Malware Analysis Report

2025-03-15 08:11

Sample ID 240530-lema7ada5x
Target 2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike
SHA256 b7cc64b4165891b6df808b011d69d1ab65addf087f7bcec6dcfb4c9fcda1635f
Tags
cobaltstrike xmrig backdoor miner trojan upx persistence 0
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b7cc64b4165891b6df808b011d69d1ab65addf087f7bcec6dcfb4c9fcda1635f

Threat Level: Known bad

The file 2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike was found to be: Known bad.

Malicious Activity Summary

cobaltstrike xmrig backdoor miner trojan upx persistence 0

Detects executables containing URLs to raw contents of a Github gist

Detects Reflective DLL injection artifacts

UPX dump on OEP (original entry point)

Cobaltstrike family

XMRig Miner payload

xmrig

Cobaltstrike

Cobalt Strike reflective loader

Xmrig family

Detects executables containing URLs to raw contents of a Github gist

Detects Reflective DLL injection artifacts

UPX dump on OEP (original entry point)

XMRig Miner payload

UPX packed file

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Drops desktop.ini file(s)

Drops file in System32 directory

Drops autorun.inf file

Drops file in Program Files directory

Unsigned PE

Modifies Internet Explorer start page

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 09:26

Signatures

Cobalt Strike reflective loader

Description Indicator Process Target
N/A N/A N/A N/A

Cobaltstrike family

cobaltstrike

Detects Reflective DLL injection artifacts

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing URLs to raw contents of a Github gist

Description Indicator Process Target
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A

Xmrig family

xmrig

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 09:26

Reported

2024-05-30 09:29

Platform

win7-20240508-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe"

Signatures

Cobalt Strike reflective loader

Description Indicator Process Target
N/A N/A N/A N/A

Cobaltstrike

trojan backdoor cobaltstrike

xmrig

miner xmrig

Detects Reflective DLL injection artifacts

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing URLs to raw contents of a Github gist

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File created C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\az.txt C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libmono_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\7-Zip\History.txt.exe C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jaas_nt.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_cloudy.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Honolulu C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\uz.txt C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\it-IT\Mahjong.exe.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradient_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOLoader.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\msadcor.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\weather.js C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di_1.4.0.v20140414-1837.jar C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\7-Zip\7z.sfx.exe C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Media Player\it-IT\wmpnetwk.exe.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-windows.xml C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89 C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Singapore C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\weather.css C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\meta\art\03_lastfm.luac C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromecast_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\18.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_cloudy.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\zip.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.WqbPNJyLce.com" C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.zRmIJNLzeX.com" C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "https://www.SEAyeyyTnf.com" C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6 C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\317A2AD07F2B335EF5A1C34E4B57E8B7D8F1FCA6\Blob = 040000000100000010000000a923759bba49366e31c2dbf2e766ba870f000000010000001400000007eeabaf80a9ef4ae1b2cb9b4b5fc70d0428e6a953000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000002e00000053007400610072006600690065006c006400200054006500630068006e006f006c006f0067006900650073000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000a848b4242fc6ea24a0d78e3cb93c5c78d79833e41d00000001000000100000005959ddbc9c7632ba0a05f06316846fe6030000000100000014000000317a2ad07f2b335ef5a1c34e4b57e8b7d8f1fca619000000010000001000000044ba5fd9039fc9b56fd8aadccd597ca62000000001000000eb020000308202e730820250020101300d06092a864886f70d01010505003081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d301e170d3939303632363030313935345a170d3139303632363030313935345a3081bb312430220603550407131b56616c69436572742056616c69646174696f6e204e6574776f726b31173015060355040a130e56616c69436572742c20496e632e31353033060355040b132c56616c694365727420436c617373203220506f6c6963792056616c69646174696f6e20417574686f726974793121301f06035504031318687474703a2f2f7777772e76616c69636572742e636f6d2f3120301e06092a864886f70d0109011611696e666f4076616c69636572742e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100ce3a71cae5abc8599255d7abd8740ef9eed9f655475965470e0555dceb98363c5c535dd330cf38ecbd4189ed254209246b0a5eb37cdd522d4ce6d4d67d5a59a965d449132d244d1c506fb5c185543bfe71e4d35c42f980e0911a0a5b393667f33f557c1b3fb45f647334e3b412bf8764f8da12ff3727c1b343bbef7b6e2e69f70203010001300d06092a864886f70d0101050500038181003b7f506f6f509499496238381f4bf8a5c83ea78281f62bc7e8c5cee83a1082cb18008e4dbda8587fa17900b5bbe98daf41d90f34ee218119a0324928f4c48e56d55233fd50d57e996c03e4c94cfccb6cab66b34a218ce5b50c323e10b2cc6ca1dc9a984c025bf3ceb99ea5720e4ab73f3ce61668f8beed744cbc5bd5621f43dd C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 040000000100000010000000324a4bbbc863699bbe749ac6dd1d46240f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 en6yogdxz5mjo.x.pipedream.net udp
US 3.233.47.96:443 en6yogdxz5mjo.x.pipedream.net tcp
US 3.233.47.96:443 en6yogdxz5mjo.x.pipedream.net tcp
US 3.233.47.96:443 en6yogdxz5mjo.x.pipedream.net tcp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 mega.nz udp
LU 31.216.144.5:443 mega.nz tcp
US 8.8.8.8:53 www.dropbox.com udp
GB 162.125.64.18:443 www.dropbox.com tcp
US 8.8.8.8:53 JOwFlA.bitbucket.com udp
GB 185.166.141.9:443 JOwFlA.bitbucket.com tcp
US 8.8.8.8:53 XPM.bitbucket.com udp
GB 185.166.141.9:443 XPM.bitbucket.com tcp
US 8.8.8.8:53 codeload.github.com udp
GB 20.26.156.216:443 codeload.github.com tcp
US 8.8.8.8:53 QYYZOZiyWT.NMXXyyILaEDrXNbcYbKC.readme.io udp
US 104.16.241.118:443 QYYZOZiyWT.NMXXyyILaEDrXNbcYbKC.readme.io tcp
US 8.8.8.8:53 jyFXQur.sCLmcLKzyAGqKhYxnquh.readme.io udp
US 104.16.242.118:443 jyFXQur.sCLmcLKzyAGqKhYxnquh.readme.io tcp
US 8.8.8.8:53 VzkngOlCiHsqr.GhGKZFzGdMeDWHhfOhKM.readme.io udp
US 104.16.241.118:443 VzkngOlCiHsqr.GhGKZFzGdMeDWHhfOhKM.readme.io tcp
US 8.8.8.8:53 utECsDnOCm.YxIqXIBzWSFuWmFkzlPL.readme.io udp
US 104.16.241.118:443 utECsDnOCm.YxIqXIBzWSFuWmFkzlPL.readme.io tcp
US 8.8.8.8:53 DjgPM.skXUZnxlQaXjKcBNlgHd.readme.io udp
US 104.16.241.118:443 DjgPM.skXUZnxlQaXjKcBNlgHd.readme.io tcp
US 8.8.8.8:53 bXJbyQVsjdZGS.zqNpulzHvyNZfdAKaoMt.readme.io udp
US 104.16.242.118:443 bXJbyQVsjdZGS.zqNpulzHvyNZfdAKaoMt.readme.io tcp
US 8.8.8.8:53 goYAOs.wmQknoMuKDdzKaGJzNez.readme.io udp
US 104.16.242.118:443 goYAOs.wmQknoMuKDdzKaGJzNez.readme.io tcp
US 8.8.8.8:53 mega.nz udp
LU 31.216.144.5:443 mega.nz tcp
US 8.8.8.8:53 KjtHN.VerDUHLWXrbvklfAxmun.readme.io udp
US 104.16.241.118:443 KjtHN.VerDUHLWXrbvklfAxmun.readme.io tcp
US 8.8.8.8:53 ZvRkLxFovyRJx.FfTjdgvJecjpLOwelequ.readme.io udp
US 104.16.242.118:443 ZvRkLxFovyRJx.FfTjdgvJecjpLOwelequ.readme.io tcp
US 8.8.8.8:53 sSRFuMarXMUFxx.MYCYUuficnYZJIfyHbXU.readme.io udp
US 104.16.242.118:443 sSRFuMarXMUFxx.MYCYUuficnYZJIfyHbXU.readme.io tcp
US 8.8.8.8:53 cyfShw.UwljZCGpPLZVqToPbTtd.readme.io udp
US 104.16.241.118:443 cyfShw.UwljZCGpPLZVqToPbTtd.readme.io tcp
US 8.8.8.8:53 tKDkKp.EkKeDRWxjeXrWXdapSGd.readme.io udp
US 104.16.242.118:443 tKDkKp.EkKeDRWxjeXrWXdapSGd.readme.io tcp
US 8.8.8.8:53 aedyuKIjDtpenQ.aqKoSIqprNcSbqEwdUaC.readme.io udp
US 104.16.241.118:443 aedyuKIjDtpenQ.aqKoSIqprNcSbqEwdUaC.readme.io tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 rIMD.bitbucket.com udp
GB 185.166.141.9:443 rIMD.bitbucket.com tcp
US 8.8.8.8:53 Ksiamz.bitbucket.com udp
GB 185.166.141.9:443 Ksiamz.bitbucket.com tcp
US 8.8.8.8:53 dBFwoJZEua.bitbucket.com udp
GB 185.166.141.7:443 dBFwoJZEua.bitbucket.com tcp
US 8.8.8.8:53 L.bitbucket.com udp
GB 185.166.141.8:443 L.bitbucket.com tcp
US 8.8.8.8:53 IfUhcrLm.bitbucket.com udp
GB 185.166.141.7:443 IfUhcrLm.bitbucket.com tcp
US 8.8.8.8:53 weMoQLhJpYM.bitbucket.com udp
GB 185.166.141.8:443 weMoQLhJpYM.bitbucket.com tcp
LU 31.216.144.5:443 mega.nz tcp
US 8.8.8.8:53 noscullsnow.com udp
US 8.8.8.8:53 FoCdgzCUoczmsN.EaKmLisSeZsvCAyytBPd.readme.io udp
US 104.16.242.118:443 FoCdgzCUoczmsN.EaKmLisSeZsvCAyytBPd.readme.io tcp
US 8.8.8.8:53 euwbt.igjIDQpReqWSqEpexFyT.readme.io udp
US 104.16.242.118:443 euwbt.igjIDQpReqWSqEpexFyT.readme.io tcp
US 8.8.8.8:53 LWenrfWDr.nXqFRLXKrwpcEPnXxVDc.readme.io udp
US 104.16.242.118:443 LWenrfWDr.nXqFRLXKrwpcEPnXxVDc.readme.io tcp
US 8.8.8.8:53 BhMvlB.VtEwstZXvJDuyrXgNIiU.readme.io udp
US 104.16.241.118:443 BhMvlB.VtEwstZXvJDuyrXgNIiU.readme.io tcp
US 8.8.8.8:53 jMcbrRCuHcLnc.nxBgyZfkVlvJuAkPuQlg.readme.io udp
US 104.16.241.118:443 jMcbrRCuHcLnc.nxBgyZfkVlvJuAkPuQlg.readme.io tcp
US 8.8.8.8:53 mWPRERNyOM.JjiKXjEaNKRaTdqgUryg.readme.io udp
US 104.16.242.118:443 mWPRERNyOM.JjiKXjEaNKRaTdqgUryg.readme.io tcp
US 8.8.8.8:53 vBeyxTfx.DFnVYTjmGEsrDdUrdHRv.readme.io udp
US 104.16.242.118:443 vBeyxTfx.DFnVYTjmGEsrDdUrdHRv.readme.io tcp
US 8.8.8.8:53 YLKkAX.bitbucket.com udp
GB 185.166.141.9:443 YLKkAX.bitbucket.com tcp

Files

memory/2416-1-0x00000000003E0000-0x00000000003F0000-memory.dmp

memory/2416-0-0x0000000000400000-0x00000000010B6000-memory.dmp

C:\Program Files\7-Zip\7-zip32.dll.exe

MD5 bf2c92bae190d49764f08821ba8d946e
SHA1 04138eddd4f438b641a8888cb82b906b78ee4da3
SHA256 9a80f164b230eb7899c06ca01f19f23e6cba0dfcb3a859c8eff0a4571c9d17ee
SHA512 7344257bb94a4578bf6bcedcc8770c3242e1059a68378e415457f5ec8d60e2c0881e1c32c647c8747c868fa454a795ab953f9b7991daec752defcdcc170221a3

C:\Users\Admin\AppData\Local\Temp\Cab1576.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

C:\Users\Admin\AppData\Local\Temp\Tar1598.tmp

MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar16A7.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 78b897df05172d4834394b7e0eebf99b
SHA1 c41d6efe3828f7453d029837f0a249c8274a7355
SHA256 b9420169f6fd5c753a181d9cc3865ababf10f6134bc011aa79ca560d8daedb5d
SHA512 5eec658d22c9f0ebe78a65a678439d692cb38479a285bff05fa3407854a9f259f3a820851f75b677c206dc63a57db89e6432c47f8822b5b7b1fcaba3c48c06e7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 5a5a95cf7e024cd4ca50899c87fca547
SHA1 78da64f5ffd9a9c60e62f8ee7ec7bf7415404b50
SHA256 50262f7070e8b300bb8af8df9749c879c1b91978c2f48651634cbe284eb4bc61
SHA512 8c4c41895b2f1c98ec8538fec806ce3552f0506244f367a589e99786aaf080231b20b7b856e37bbbd5e5d9a23d8e91df2b99146645e70530ceaad17c5cb03065

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 02ab47b58ec071b1228d6e0ca79ba0a9
SHA1 45457829ad6f212cf71fa77ae9a6a6d6715c2274
SHA256 c6673d9a04ba646924f5af1021323416aed79674949316e8917da2a20ab9e913
SHA512 eed6a8cfea7a0a886fca1889735f0fa2c42870be660e005072dfca36175396e95960881e1993791c43db996374987fc0c591774867a998a40c841b67dd63b449

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 cbcd375e1edddd1ed1892eecff6610e1
SHA1 e60de86fb488006c9620d742dd7a37f58e838184
SHA256 0e958a5ef2372acb617bb41513ecd36db0ad0f260e7470e815b77b20007ff96b
SHA512 6d9adb6079a90bcce97f798fad40aa51073b2e20c563754115b019da5df317bdf3e834994d14b20880a4f46a1925b123817fe899bb26d8b69a746dbdef8ba7cb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 ef1dc5dba01a28d060066e1f2caac617
SHA1 0de88de7f472d8cc1dccca7f597f593e4ce069ec
SHA256 edc6d46e0c8263d9cf78f49e5ffbb762962d772ba819642fb15ca2c8e07eb8bc
SHA512 0c15e83e99002660fa43dcad530485c829379a6eec887a4c959c0ff7c9d5066d24daa1ed5be9d801cf4d6a64e1826f233b028aebecc326f1650fac36ae351335

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 348b4d9fc5ec7af75f2ec524437f0835
SHA1 8fe2cc22d43052355d1f9352a90752376791743a
SHA256 c444aaf8656ce8cbb5a844bf4cb04b0a85596beef050fbe1704d9335984ae8ba
SHA512 013242e6cf51361b4d333a407b006007f98637b8ea704ad11a973fb0579469252624ac85ca440d0c6a6a8c0edcd82fe7c2e45e370e40b350de464ab45426622f

memory/2416-1207-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2416-1213-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2416-2239-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2416-3458-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2416-4157-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2416-4478-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2416-4481-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2416-4483-0x00000000003C0000-0x00000000003C1000-memory.dmp

memory/2416-4484-0x00000000003D0000-0x00000000003D1000-memory.dmp

memory/2416-4485-0x00000000003F0000-0x0000000000400000-memory.dmp

memory/2416-4486-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2416-4487-0x0000000000401000-0x00000000010B5000-memory.dmp

memory/2416-4498-0x0000000004530000-0x0000000004531000-memory.dmp

memory/2416-4501-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2416-4502-0x0000000000401000-0x00000000010B5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 09:26

Reported

2024-05-30 09:29

Platform

win10v2004-20240508-en

Max time kernel

131s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe"

Signatures

Cobalt Strike reflective loader

Description Indicator Process Target
N/A N/A N/A N/A

Cobaltstrike

trojan backdoor cobaltstrike

xmrig

miner xmrig

Detects Reflective DLL injection artifacts

Description Indicator Process Target
N/A N/A N/A N/A

Detects executables containing URLs to raw contents of a Github gist

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HdkymbLvGX = "c:\\Windows\\System32\\HdkymbLvGX.exe" C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created \??\c:\Windows\System32\HdkymbLvGX.exe C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.AnalysisServices.Excel.BackEnd.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\155.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessLetter.dotx C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUECALM\BLUECALM.ELM C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\EssentialLetter.dotx C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp32.msi C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MUAUTH.CAB C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\TestApprove.dib C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp5.scale-125.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\IFDPINTL.DLL C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-BOLD.TTF C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\libskins2_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\api-ms-win-core-processthreads-l1-1-1.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\GetTest.xltx C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\concrt140.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libkate_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libmpg123_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nn.txt C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Media Player\uk-UA\wmpnscfg.exe.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.scale-200.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\en-us\oregres.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\visualization\libvisual_plugin.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-core-localization-l1-2-0.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\28.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ADALPREVIOUS.DLL C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-process-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ALRTINTL.DLL C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ar.txt C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Modifies Internet Explorer start page

stealer
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.djxfBWyybq.com" C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.AKyioesHda.com" C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://www.JcErHKcKjP.com" C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-30_143dbade3ccf35e91b1c815b6e7c4b48_cobalt-strike_cobaltstrike.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 en6yogdxz5mjo.x.pipedream.net udp
US 54.85.81.111:443 en6yogdxz5mjo.x.pipedream.net tcp
US 54.85.81.111:443 en6yogdxz5mjo.x.pipedream.net tcp
US 54.85.81.111:443 en6yogdxz5mjo.x.pipedream.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 111.81.85.54.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 38.201.222.52.in-addr.arpa udp
US 8.8.8.8:53 98.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 abrakadabra.host udp
NL 23.62.61.75:443 www.bing.com tcp
US 8.8.8.8:53 75.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 zPiogsHxUC.tPjugcBicgkXGoXZPyki.readme.io udp
US 104.16.241.118:443 zPiogsHxUC.tPjugcBicgkXGoXZPyki.readme.io tcp
US 8.8.8.8:53 jnMwaUGaZCw.pajGFTqKCGYqqvDKgJhb.readme.io udp
US 104.16.242.118:443 jnMwaUGaZCw.pajGFTqKCGYqqvDKgJhb.readme.io tcp
US 8.8.8.8:53 xOZBtXMHhBp.QQtfnbqsVNqgudkPeHTz.readme.io udp
US 104.16.242.118:443 xOZBtXMHhBp.QQtfnbqsVNqgudkPeHTz.readme.io tcp
US 8.8.8.8:53 HCpfZ.VpbVXjKYNSNHbdpgNDde.readme.io udp
US 104.16.242.118:443 HCpfZ.VpbVXjKYNSNHbdpgNDde.readme.io tcp
US 8.8.8.8:53 ZlLnlxXNuu.tJoExyQaJLdpZfpeUiDH.readme.io udp
US 104.16.242.118:443 ZlLnlxXNuu.tJoExyQaJLdpZfpeUiDH.readme.io tcp
US 8.8.8.8:53 WFUFFKX.FebQOflWMElJbEyGzPuF.readme.io udp
US 104.16.241.118:443 WFUFFKX.FebQOflWMElJbEyGzPuF.readme.io tcp
US 8.8.8.8:53 DHwjHrEyyV.PxWAsSzRkvKHAhTHEwBo.readme.io udp
US 104.16.242.118:443 DHwjHrEyyV.PxWAsSzRkvKHAhTHEwBo.readme.io tcp
US 8.8.8.8:53 X.jxAIMRDkTMRpYpGGgvzW.readme.io udp
US 104.16.242.118:443 X.jxAIMRDkTMRpYpGGgvzW.readme.io tcp
US 8.8.8.8:53 GaFYeVNnGk.oAmfZkwAunMYzlZumsvD.readme.io udp
US 104.16.241.118:443 GaFYeVNnGk.oAmfZkwAunMYzlZumsvD.readme.io tcp
US 8.8.8.8:53 118.241.16.104.in-addr.arpa udp
US 8.8.8.8:53 118.242.16.104.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 noscullsnow.com udp
US 8.8.8.8:53 xwchn.net udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 jmbvmwp.mxp4037.com udp
US 8.8.8.8:53 noscullsnow.com udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 www.bates.edu udp
US 134.181.132.45:443 www.bates.edu tcp
US 8.8.8.8:53 45.132.181.134.in-addr.arpa udp
US 8.8.8.8:53 www.dropbox.com udp
GB 162.125.64.18:443 www.dropbox.com tcp
US 8.8.8.8:53 18.64.125.162.in-addr.arpa udp
US 8.8.8.8:53 mega.nz udp
LU 31.216.144.5:443 mega.nz tcp
US 8.8.8.8:53 5.144.216.31.in-addr.arpa udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 zOPHuwRaD.kVXlLMsRKUDsobXosOiW.readme.io udp
US 104.16.241.118:443 zOPHuwRaD.kVXlLMsRKUDsobXosOiW.readme.io tcp
US 8.8.8.8:53 www.jmxyc.com udp
LU 31.216.144.5:443 mega.nz tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 jmbvmwp.mxp4037.com udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 NFCXpPiJxqubLP.iDmkJwrcrqgmncCmhkXO.readme.io udp
US 104.16.242.118:443 NFCXpPiJxqubLP.iDmkJwrcrqgmncCmhkXO.readme.io tcp
US 8.8.8.8:53 fUALkxR.fkMdIlOspjAJSIQLRgMs.readme.io udp
US 104.16.242.118:443 fUALkxR.fkMdIlOspjAJSIQLRgMs.readme.io tcp
US 8.8.8.8:53 El.ueQFfVrirbgdLOqgcQgi.readme.io udp
US 104.16.242.118:443 El.ueQFfVrirbgdLOqgcQgi.readme.io tcp
US 8.8.8.8:53 QGYYLBRTCBcql.ZDrWsXuNtTulUPHXnxHn.readme.io udp
US 104.16.242.118:443 QGYYLBRTCBcql.ZDrWsXuNtTulUPHXnxHn.readme.io tcp
US 8.8.8.8:53 CBodEWQ.GdCgrUimdIPnqhdMLmnT.readme.io udp
US 104.16.242.118:443 CBodEWQ.GdCgrUimdIPnqhdMLmnT.readme.io tcp
US 8.8.8.8:53 NUPlrUIQcHY.cxphjkPoXrwCsKOzpZvJ.readme.io udp
US 104.16.242.118:443 NUPlrUIQcHY.cxphjkPoXrwCsKOzpZvJ.readme.io tcp
US 8.8.8.8:53 EYioWtO.eBVUrgMlfCruDJBckIri.readme.io udp
US 104.16.242.118:443 EYioWtO.eBVUrgMlfCruDJBckIri.readme.io tcp
US 8.8.8.8:53 abrakadabra.host udp
LU 31.216.144.5:443 mega.nz tcp
US 8.8.8.8:53 abrakadabra.host udp
US 8.8.8.8:53 yoKBAVsaO.ZUaNdKxfjuNFTeapMClC.readme.io udp
US 104.16.242.118:443 yoKBAVsaO.ZUaNdKxfjuNFTeapMClC.readme.io tcp
US 8.8.8.8:53 diVkoDMvfhnTMf.azsjfNbNaQJoRfOvJLrw.readme.io udp
US 104.16.242.118:443 diVkoDMvfhnTMf.azsjfNbNaQJoRfOvJLrw.readme.io tcp
US 8.8.8.8:53 vLCBqOn.JTLxGDxfFgcRPugFaige.readme.io udp
US 104.16.241.118:443 vLCBqOn.JTLxGDxfFgcRPugFaige.readme.io tcp
US 8.8.8.8:53 oOqFiWjqOEQnc.jxTPWBUrucaEKPNqprYR.readme.io udp
US 104.16.242.118:443 oOqFiWjqOEQnc.jxTPWBUrucaEKPNqprYR.readme.io tcp
US 8.8.8.8:53 216.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

memory/2020-0-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2020-1-0x00000000001F0000-0x0000000000200000-memory.dmp

C:\Program Files\7-Zip\7-zip.dll.exe

MD5 84e02c645ccc386b07e6e371bddfcba9
SHA1 3d2250c365a70ac521be6c627445adca8908bb42
SHA256 4ffb345ebdf1421897fd46875d5604bfb7c7d7a1068370a10158af1c4e96c98a
SHA512 17fa3cd38188f2759abfc22764938fd897f7b0d44205168f8ecdd405730f9ede2ee2c07abc773c39e166a56fd037fca88513c8fa3d500ef1c0eb2cfc9aec4c8d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

MD5 55540a230bdab55187a841cfe1aa1545
SHA1 363e4734f757bdeb89868efe94907774a327695e
SHA256 d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512 c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

MD5 4b1398e4030e7dbb246a0da4fadf2db7
SHA1 44d3f19128101be2553fbdf1b51aff0bdfcffad9
SHA256 a18713b469ee0b39d7fda93710ad7c15a2bf3d3263b7a3ba05e0e73f523bc377
SHA512 d6015f3758e28a9807b0bbdc4aac766bfdbcff487f86716e3f84bd139b9cd407cf131f5a3a35f11efcce03e068595ad2df2818a2d1709735a568bac9d1fe9424

memory/2020-727-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2020-1840-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2020-2430-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2020-2929-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2020-4239-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2020-4987-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2020-4990-0x0000000000060000-0x0000000000062000-memory.dmp

memory/2020-4993-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2020-4994-0x0000000000401000-0x00000000010B5000-memory.dmp

memory/2020-4995-0x0000000000400000-0x00000000010B6000-memory.dmp

memory/2020-4996-0x0000000000401000-0x00000000010B5000-memory.dmp