Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 13:14
Behavioral task
behavioral1
Sample
2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe
Resource
win7-20240704-en
General
-
Target
2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe
-
Size
5.2MB
-
MD5
35c8a93dbf93fd08120576a1e897aedd
-
SHA1
2fda979e31b8c182bfb8da8600c2c10ced858bae
-
SHA256
53bde463243f5bea2a3589092f8edf6afedac375e50f432c123b7192e1020495
-
SHA512
543a2dbc2408bf75f88144c16d92387adc6de9b296119c22f374755e56186a395b7b2d968a82500db0f652b2913aedad91b9b7c015c9c47369bbd45c56922c6a
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lU9
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
resource yara_rule behavioral1/files/0x000a000000012031-3.dat cobalt_reflective_dll behavioral1/files/0x0008000000014aae-8.dat cobalt_reflective_dll behavioral1/files/0x0007000000014b33-13.dat cobalt_reflective_dll behavioral1/files/0x0007000000014bb6-22.dat cobalt_reflective_dll behavioral1/files/0x0007000000014bf6-34.dat cobalt_reflective_dll behavioral1/files/0x0007000000014b6f-23.dat cobalt_reflective_dll behavioral1/files/0x0009000000014f7d-44.dat cobalt_reflective_dll behavioral1/files/0x0034000000014729-51.dat cobalt_reflective_dll behavioral1/files/0x0008000000015d13-58.dat cobalt_reflective_dll behavioral1/files/0x0006000000016cc3-67.dat cobalt_reflective_dll behavioral1/files/0x0006000000016cf0-76.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d19-83.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d2a-91.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d32-99.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d8a-111.dat cobalt_reflective_dll behavioral1/files/0x0006000000016db3-119.dat cobalt_reflective_dll behavioral1/files/0x0006000000016dcb-134.dat cobalt_reflective_dll behavioral1/files/0x0006000000016dc7-127.dat cobalt_reflective_dll behavioral1/files/0x0006000000016ea0-137.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d9c-114.dat cobalt_reflective_dll behavioral1/files/0x0006000000016d46-109.dat cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
XMRig Miner payload 41 IoCs
resource yara_rule behavioral1/memory/2628-43-0x000000013FCF0000-0x0000000140041000-memory.dmp xmrig behavioral1/memory/2888-42-0x000000013F730000-0x000000013FA81000-memory.dmp xmrig behavioral1/memory/2636-36-0x000000013FFB0000-0x0000000140301000-memory.dmp xmrig behavioral1/memory/2712-33-0x000000013FD70000-0x00000001400C1000-memory.dmp xmrig behavioral1/memory/2872-56-0x000000013FEC0000-0x0000000140211000-memory.dmp xmrig behavioral1/memory/2564-61-0x000000013FE20000-0x0000000140171000-memory.dmp xmrig behavioral1/memory/2232-66-0x000000013FE10000-0x0000000140161000-memory.dmp xmrig behavioral1/memory/2360-65-0x000000013FA90000-0x000000013FDE1000-memory.dmp xmrig behavioral1/memory/1760-75-0x000000013F3E0000-0x000000013F731000-memory.dmp xmrig behavioral1/memory/2596-71-0x000000013F1C0000-0x000000013F511000-memory.dmp xmrig behavioral1/memory/1088-82-0x000000013FBC0000-0x000000013FF11000-memory.dmp xmrig behavioral1/memory/1980-88-0x000000013F3F0000-0x000000013F741000-memory.dmp xmrig behavioral1/memory/2808-97-0x000000013F060000-0x000000013F3B1000-memory.dmp xmrig behavioral1/memory/2872-110-0x000000013F3E0000-0x000000013F731000-memory.dmp xmrig behavioral1/memory/1088-143-0x000000013FBC0000-0x000000013FF11000-memory.dmp xmrig behavioral1/memory/2872-142-0x000000013FEC0000-0x0000000140211000-memory.dmp xmrig behavioral1/memory/580-154-0x000000013FF80000-0x00000001402D1000-memory.dmp xmrig behavioral1/memory/2848-161-0x000000013FB60000-0x000000013FEB1000-memory.dmp xmrig behavioral1/memory/1800-168-0x000000013F7D0000-0x000000013FB21000-memory.dmp xmrig behavioral1/memory/1816-169-0x000000013FCD0000-0x0000000140021000-memory.dmp xmrig behavioral1/memory/2872-170-0x000000013FA70000-0x000000013FDC1000-memory.dmp xmrig behavioral1/memory/1952-167-0x000000013F360000-0x000000013F6B1000-memory.dmp xmrig behavioral1/memory/1236-166-0x000000013FB60000-0x000000013FEB1000-memory.dmp xmrig behavioral1/memory/1804-165-0x000000013F5D0000-0x000000013F921000-memory.dmp xmrig behavioral1/memory/2224-163-0x000000013FA70000-0x000000013FDC1000-memory.dmp xmrig behavioral1/memory/1304-164-0x000000013F800000-0x000000013FB51000-memory.dmp xmrig behavioral1/memory/2872-171-0x000000013FEC0000-0x0000000140211000-memory.dmp xmrig behavioral1/memory/2360-224-0x000000013FA90000-0x000000013FDE1000-memory.dmp xmrig behavioral1/memory/2712-227-0x000000013FD70000-0x00000001400C1000-memory.dmp xmrig behavioral1/memory/2596-226-0x000000013F1C0000-0x000000013F511000-memory.dmp xmrig behavioral1/memory/2636-229-0x000000013FFB0000-0x0000000140301000-memory.dmp xmrig behavioral1/memory/2888-231-0x000000013F730000-0x000000013FA81000-memory.dmp xmrig behavioral1/memory/2628-233-0x000000013FCF0000-0x0000000140041000-memory.dmp xmrig behavioral1/memory/1980-237-0x000000013F3F0000-0x000000013F741000-memory.dmp xmrig behavioral1/memory/2564-240-0x000000013FE20000-0x0000000140171000-memory.dmp xmrig behavioral1/memory/2232-243-0x000000013FE10000-0x0000000140161000-memory.dmp xmrig behavioral1/memory/1760-245-0x000000013F3E0000-0x000000013F731000-memory.dmp xmrig behavioral1/memory/1088-249-0x000000013FBC0000-0x000000013FF11000-memory.dmp xmrig behavioral1/memory/580-251-0x000000013FF80000-0x00000001402D1000-memory.dmp xmrig behavioral1/memory/2808-255-0x000000013F060000-0x000000013F3B1000-memory.dmp xmrig behavioral1/memory/2848-257-0x000000013FB60000-0x000000013FEB1000-memory.dmp xmrig -
Executes dropped EXE 21 IoCs
pid Process 2360 rcfjXId.exe 2596 EfIODUn.exe 2712 FSpPvHo.exe 2636 fvMzoMn.exe 2888 tLWgHGB.exe 2628 JGIYWDJ.exe 1980 iCzGSFp.exe 2564 FjTJFsH.exe 2232 cGTFokb.exe 1760 DIYqsft.exe 1088 CCzLpGr.exe 580 YTZEPxV.exe 2808 sjihUGg.exe 2848 JJDsGtc.exe 2224 RUfWBhe.exe 1304 ysjloQA.exe 1236 yoQBojB.exe 1804 gDZFeNx.exe 1952 PrLiFkq.exe 1800 muLumLQ.exe 1816 VhiFxjs.exe -
Loads dropped DLL 21 IoCs
pid Process 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe -
resource yara_rule behavioral1/memory/2872-0-0x000000013FEC0000-0x0000000140211000-memory.dmp upx behavioral1/files/0x000a000000012031-3.dat upx behavioral1/memory/2360-7-0x000000013FA90000-0x000000013FDE1000-memory.dmp upx behavioral1/files/0x0008000000014aae-8.dat upx behavioral1/files/0x0007000000014b33-13.dat upx behavioral1/files/0x0007000000014bb6-22.dat upx behavioral1/memory/2628-43-0x000000013FCF0000-0x0000000140041000-memory.dmp upx behavioral1/memory/2888-42-0x000000013F730000-0x000000013FA81000-memory.dmp upx behavioral1/memory/2636-36-0x000000013FFB0000-0x0000000140301000-memory.dmp upx behavioral1/files/0x0007000000014bf6-34.dat upx behavioral1/files/0x0007000000014b6f-23.dat upx behavioral1/memory/2712-33-0x000000013FD70000-0x00000001400C1000-memory.dmp upx behavioral1/memory/2596-21-0x000000013F1C0000-0x000000013F511000-memory.dmp upx behavioral1/files/0x0009000000014f7d-44.dat upx behavioral1/files/0x0034000000014729-51.dat upx behavioral1/memory/1980-49-0x000000013F3F0000-0x000000013F741000-memory.dmp upx behavioral1/memory/2872-56-0x000000013FEC0000-0x0000000140211000-memory.dmp upx behavioral1/files/0x0008000000015d13-58.dat upx behavioral1/memory/2564-61-0x000000013FE20000-0x0000000140171000-memory.dmp upx behavioral1/memory/2232-66-0x000000013FE10000-0x0000000140161000-memory.dmp upx behavioral1/memory/2360-65-0x000000013FA90000-0x000000013FDE1000-memory.dmp upx behavioral1/files/0x0006000000016cc3-67.dat upx behavioral1/memory/1760-75-0x000000013F3E0000-0x000000013F731000-memory.dmp upx behavioral1/memory/2596-71-0x000000013F1C0000-0x000000013F511000-memory.dmp upx behavioral1/files/0x0006000000016cf0-76.dat upx behavioral1/memory/1088-82-0x000000013FBC0000-0x000000013FF11000-memory.dmp upx behavioral1/files/0x0006000000016d19-83.dat upx behavioral1/memory/580-90-0x000000013FF80000-0x00000001402D1000-memory.dmp upx behavioral1/memory/1980-88-0x000000013F3F0000-0x000000013F741000-memory.dmp upx behavioral1/files/0x0006000000016d2a-91.dat upx behavioral1/memory/2808-97-0x000000013F060000-0x000000013F3B1000-memory.dmp upx behavioral1/files/0x0006000000016d32-99.dat upx behavioral1/memory/2848-105-0x000000013FB60000-0x000000013FEB1000-memory.dmp upx behavioral1/files/0x0006000000016d8a-111.dat upx behavioral1/files/0x0006000000016db3-119.dat upx behavioral1/files/0x0006000000016dcb-134.dat upx behavioral1/files/0x0006000000016dc7-127.dat upx behavioral1/files/0x0006000000016ea0-137.dat upx behavioral1/files/0x0006000000016d9c-114.dat upx behavioral1/files/0x0006000000016d46-109.dat upx behavioral1/memory/1088-143-0x000000013FBC0000-0x000000013FF11000-memory.dmp upx behavioral1/memory/2872-142-0x000000013FEC0000-0x0000000140211000-memory.dmp upx behavioral1/memory/580-154-0x000000013FF80000-0x00000001402D1000-memory.dmp upx behavioral1/memory/2848-161-0x000000013FB60000-0x000000013FEB1000-memory.dmp upx behavioral1/memory/1800-168-0x000000013F7D0000-0x000000013FB21000-memory.dmp upx behavioral1/memory/1816-169-0x000000013FCD0000-0x0000000140021000-memory.dmp upx behavioral1/memory/1952-167-0x000000013F360000-0x000000013F6B1000-memory.dmp upx behavioral1/memory/1236-166-0x000000013FB60000-0x000000013FEB1000-memory.dmp upx behavioral1/memory/1804-165-0x000000013F5D0000-0x000000013F921000-memory.dmp upx behavioral1/memory/2224-163-0x000000013FA70000-0x000000013FDC1000-memory.dmp upx behavioral1/memory/1304-164-0x000000013F800000-0x000000013FB51000-memory.dmp upx behavioral1/memory/2872-171-0x000000013FEC0000-0x0000000140211000-memory.dmp upx behavioral1/memory/2360-224-0x000000013FA90000-0x000000013FDE1000-memory.dmp upx behavioral1/memory/2712-227-0x000000013FD70000-0x00000001400C1000-memory.dmp upx behavioral1/memory/2596-226-0x000000013F1C0000-0x000000013F511000-memory.dmp upx behavioral1/memory/2636-229-0x000000013FFB0000-0x0000000140301000-memory.dmp upx behavioral1/memory/2888-231-0x000000013F730000-0x000000013FA81000-memory.dmp upx behavioral1/memory/2628-233-0x000000013FCF0000-0x0000000140041000-memory.dmp upx behavioral1/memory/1980-237-0x000000013F3F0000-0x000000013F741000-memory.dmp upx behavioral1/memory/2564-240-0x000000013FE20000-0x0000000140171000-memory.dmp upx behavioral1/memory/2232-243-0x000000013FE10000-0x0000000140161000-memory.dmp upx behavioral1/memory/1760-245-0x000000013F3E0000-0x000000013F731000-memory.dmp upx behavioral1/memory/1088-249-0x000000013FBC0000-0x000000013FF11000-memory.dmp upx behavioral1/memory/580-251-0x000000013FF80000-0x00000001402D1000-memory.dmp upx -
Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\System\yoQBojB.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\VhiFxjs.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\FSpPvHo.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\tLWgHGB.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\iCzGSFp.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\CCzLpGr.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\YTZEPxV.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\RUfWBhe.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\ysjloQA.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\gDZFeNx.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\EfIODUn.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\fvMzoMn.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\FjTJFsH.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\muLumLQ.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\rcfjXId.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\JGIYWDJ.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\PrLiFkq.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\JJDsGtc.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\cGTFokb.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\DIYqsft.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe File created C:\Windows\System\sjihUGg.exe 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe Token: SeLockMemoryPrivilege 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2360 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 29 PID 2872 wrote to memory of 2360 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 29 PID 2872 wrote to memory of 2360 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 29 PID 2872 wrote to memory of 2596 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 30 PID 2872 wrote to memory of 2596 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 30 PID 2872 wrote to memory of 2596 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 30 PID 2872 wrote to memory of 2636 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 31 PID 2872 wrote to memory of 2636 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 31 PID 2872 wrote to memory of 2636 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 31 PID 2872 wrote to memory of 2712 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 32 PID 2872 wrote to memory of 2712 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 32 PID 2872 wrote to memory of 2712 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 32 PID 2872 wrote to memory of 2628 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 33 PID 2872 wrote to memory of 2628 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 33 PID 2872 wrote to memory of 2628 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 33 PID 2872 wrote to memory of 2888 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 34 PID 2872 wrote to memory of 2888 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 34 PID 2872 wrote to memory of 2888 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 34 PID 2872 wrote to memory of 1980 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 35 PID 2872 wrote to memory of 1980 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 35 PID 2872 wrote to memory of 1980 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 35 PID 2872 wrote to memory of 2564 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 36 PID 2872 wrote to memory of 2564 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 36 PID 2872 wrote to memory of 2564 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 36 PID 2872 wrote to memory of 2232 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 37 PID 2872 wrote to memory of 2232 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 37 PID 2872 wrote to memory of 2232 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 37 PID 2872 wrote to memory of 1760 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 38 PID 2872 wrote to memory of 1760 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 38 PID 2872 wrote to memory of 1760 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 38 PID 2872 wrote to memory of 1088 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 39 PID 2872 wrote to memory of 1088 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 39 PID 2872 wrote to memory of 1088 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 39 PID 2872 wrote to memory of 580 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 40 PID 2872 wrote to memory of 580 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 40 PID 2872 wrote to memory of 580 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 40 PID 2872 wrote to memory of 2808 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 41 PID 2872 wrote to memory of 2808 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 41 PID 2872 wrote to memory of 2808 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 41 PID 2872 wrote to memory of 2848 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 42 PID 2872 wrote to memory of 2848 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 42 PID 2872 wrote to memory of 2848 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 42 PID 2872 wrote to memory of 2224 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 43 PID 2872 wrote to memory of 2224 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 43 PID 2872 wrote to memory of 2224 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 43 PID 2872 wrote to memory of 1304 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 44 PID 2872 wrote to memory of 1304 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 44 PID 2872 wrote to memory of 1304 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 44 PID 2872 wrote to memory of 1804 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 45 PID 2872 wrote to memory of 1804 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 45 PID 2872 wrote to memory of 1804 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 45 PID 2872 wrote to memory of 1236 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 46 PID 2872 wrote to memory of 1236 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 46 PID 2872 wrote to memory of 1236 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 46 PID 2872 wrote to memory of 1952 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 47 PID 2872 wrote to memory of 1952 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 47 PID 2872 wrote to memory of 1952 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 47 PID 2872 wrote to memory of 1800 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 48 PID 2872 wrote to memory of 1800 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 48 PID 2872 wrote to memory of 1800 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 48 PID 2872 wrote to memory of 1816 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 49 PID 2872 wrote to memory of 1816 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 49 PID 2872 wrote to memory of 1816 2872 2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe"C:\Users\Admin\AppData\Local\Temp\2024082535c8a93dbf93fd08120576a1e897aeddcobaltstrikecobaltstrikepoetrat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\System\rcfjXId.exeC:\Windows\System\rcfjXId.exe2⤵
- Executes dropped EXE
PID:2360
-
-
C:\Windows\System\EfIODUn.exeC:\Windows\System\EfIODUn.exe2⤵
- Executes dropped EXE
PID:2596
-
-
C:\Windows\System\fvMzoMn.exeC:\Windows\System\fvMzoMn.exe2⤵
- Executes dropped EXE
PID:2636
-
-
C:\Windows\System\FSpPvHo.exeC:\Windows\System\FSpPvHo.exe2⤵
- Executes dropped EXE
PID:2712
-
-
C:\Windows\System\JGIYWDJ.exeC:\Windows\System\JGIYWDJ.exe2⤵
- Executes dropped EXE
PID:2628
-
-
C:\Windows\System\tLWgHGB.exeC:\Windows\System\tLWgHGB.exe2⤵
- Executes dropped EXE
PID:2888
-
-
C:\Windows\System\iCzGSFp.exeC:\Windows\System\iCzGSFp.exe2⤵
- Executes dropped EXE
PID:1980
-
-
C:\Windows\System\FjTJFsH.exeC:\Windows\System\FjTJFsH.exe2⤵
- Executes dropped EXE
PID:2564
-
-
C:\Windows\System\cGTFokb.exeC:\Windows\System\cGTFokb.exe2⤵
- Executes dropped EXE
PID:2232
-
-
C:\Windows\System\DIYqsft.exeC:\Windows\System\DIYqsft.exe2⤵
- Executes dropped EXE
PID:1760
-
-
C:\Windows\System\CCzLpGr.exeC:\Windows\System\CCzLpGr.exe2⤵
- Executes dropped EXE
PID:1088
-
-
C:\Windows\System\YTZEPxV.exeC:\Windows\System\YTZEPxV.exe2⤵
- Executes dropped EXE
PID:580
-
-
C:\Windows\System\sjihUGg.exeC:\Windows\System\sjihUGg.exe2⤵
- Executes dropped EXE
PID:2808
-
-
C:\Windows\System\JJDsGtc.exeC:\Windows\System\JJDsGtc.exe2⤵
- Executes dropped EXE
PID:2848
-
-
C:\Windows\System\RUfWBhe.exeC:\Windows\System\RUfWBhe.exe2⤵
- Executes dropped EXE
PID:2224
-
-
C:\Windows\System\ysjloQA.exeC:\Windows\System\ysjloQA.exe2⤵
- Executes dropped EXE
PID:1304
-
-
C:\Windows\System\gDZFeNx.exeC:\Windows\System\gDZFeNx.exe2⤵
- Executes dropped EXE
PID:1804
-
-
C:\Windows\System\yoQBojB.exeC:\Windows\System\yoQBojB.exe2⤵
- Executes dropped EXE
PID:1236
-
-
C:\Windows\System\PrLiFkq.exeC:\Windows\System\PrLiFkq.exe2⤵
- Executes dropped EXE
PID:1952
-
-
C:\Windows\System\muLumLQ.exeC:\Windows\System\muLumLQ.exe2⤵
- Executes dropped EXE
PID:1800
-
-
C:\Windows\System\VhiFxjs.exeC:\Windows\System\VhiFxjs.exe2⤵
- Executes dropped EXE
PID:1816
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD59728777462fd32a871690fb4ccb8fd41
SHA14f81e1c003d8c41fecf9ef7934e63e9ce6e0cc20
SHA2560d38ae6a9c9cace12c133e8872e6d39ef86dc529bb3f2b0df909bbf305a6fb2c
SHA512ad4028b9f432baf1b5a59a5b5c202689a321614711f594636d1759c0d878ead537e615e5d727ca850cd72f90396b7b73df00bb8c3d7d105f90b45d7028782ba0
-
Filesize
5.2MB
MD5ee774a4dd9f9e63caf8b6231e891fa8c
SHA15dee4130eb9168be804ea21986e0abd352e06a35
SHA2562cc8c666aa03d6961ad9da5f2f2d11cd3fb865f62838a60d9892d3aa5eaf160b
SHA51235a6ac17c1b2c3189c87cb9921a8c99f5bce1ca31d7bab87389ab7b42d48f9d51a40e48a92d0659293d0bfcc3c3738a0995b3d6ee8c4d99c746da4afbdecb247
-
Filesize
5.2MB
MD5042479d1e5fe2787640d7e5b35647f1c
SHA1ca44823fa9d16ac1ef69e1a6ad2a6df7747b07e3
SHA2569a2ec6e23b96b4f86d8c8eb6d53778a7269e0e83d1b4cbfb40441cf9b5c3c14a
SHA5126c5fff2bb09b019740ab07c824b433996f246094a5442060885e200d524dc73d913c582bc08098bbf5db32cdc92a25910cf8f6b21ae3b39e07c07388f0178324
-
Filesize
5.2MB
MD5b35e9d946bd74b3ebf46f847f7cce367
SHA1c44c0a8f6f5f6a9b8a14b5face1437f383f5cbb9
SHA2566d740d6ffaefb5038bf511eb6391a702550b5c43cc091bdc3d93e3182972b902
SHA5123658c0f6cae72855d023a6a925565b762fab3e85399c6e368edb5e46868264881a2cc65ccff969660b030a467e68b289ba66f2b26525223e8858e3cb746ff30c
-
Filesize
5.2MB
MD5fd245269587241b455bf37a0a9e78d0c
SHA1ae4220fcbbdaa3edb4ddf00dea42771bb66915dd
SHA256b65fa6be41836d8d506ed3884793963e1952966d6926951cfccd7b23efbfb1d7
SHA512d152e3ab6989732e3c2d63054879ab1c756b8aa4b855351a055f7348f67b366722ae1fa34a97fdba97f7f1f8e013230879c471e1f976b67265273153ac12affa
-
Filesize
5.2MB
MD5c615714b8329b098957a4e6f2cd1ea43
SHA1b678bcb7c4a9c40e05108afba8a55418b8ed59aa
SHA256c624829d616b50c7a1ed34430ef2608c025fad589f8085d129a1b37ea0c587e2
SHA512dd4276597efa723eed514b1e75ef6e0d16a53126a5ca2e6f321c4d688283bae442a18b517c00feafa3300d363e9e7b96a21b6eccf7a93ef8623febbd4e5275a4
-
Filesize
5.2MB
MD5528d956735cf3bc589dadbcb2122f9b2
SHA1b4fdab95c1368891605d1caa49d9ddb20d8c2cbe
SHA2565a683d1c6fece152c21735d03c9d4cc572be207195a6c4c04f0080adc0c6e0c5
SHA512f742ebbabefe71f81893cfb068a6b29f2b4018e32e8486b365671f5faed0a6c59fcfaa88bd3e893745a9db460d6fe77c69ef9a6677b356956d41b3484986599b
-
Filesize
5.2MB
MD514d4bbff3dfcc8085e7e7c97ab03aab6
SHA14c2786172c3a534d8ab4bb5951d1d7b5b1c31e2c
SHA2563c74c400c4b4265a60f3e65fcc4646b583cdff3e15c9b40e8361666fccf71dde
SHA512671df4afc158620892fbff69754b60c60f8852b962496d5a731a1092d8bba2f3e00c05b57feea18338f30be2fe86ba836a72fdc120e6a171e7717b04a642ba6a
-
Filesize
5.2MB
MD58c95dd6775ffa3fce4bc6527ff1bd131
SHA1f4630bf3aa2672773e6d2a4bc31cb38c6e450604
SHA2569225a6413780d17182e34cf46c054b7d7c595e5f73c2c7da401fcafd9ec1da80
SHA51200499b4eb0b5b580fd3b4078f7191b2523ea39988696dac51f0d364b670c7e87fa0b89f5c91e26806d95a8bfbcf8edbeb33a3af8bfc301f622f8caf1debf4357
-
Filesize
5.2MB
MD5f8b2232583a379e10b1e6fd3fd1db218
SHA1cc46c70f26e3050594ab8c72c5e97d3a2e67cc7c
SHA25660efd95f8eb115670b49ced2f88532c48cc48913e14f88f2553b3c4aa1c163e5
SHA5121c9073e175695c5fad4a1d3d62dbd6247c96a15fdc706b1ea5905bebe04bbfd9558d87ee4e6ce9c910c6fa97da2d2d56fce6a9d4ef33be182b574623057085a9
-
Filesize
5.2MB
MD55518da03d5460a303e9c4f1d8325e2aa
SHA1abe4ffdee7b56f9c55c7a0699f22fad2d09ad806
SHA2567dc1a69959021ea5969486b48a1abf9fb3a46c9ec4d97702c0e95ccfba6aabde
SHA51288a3e3f9af49511ca32b021f3db0716487541d642850f6d0f49a6b130152057bda55467c134975698c934d798a53187b7a101fed0f7e7b0f3073c82e24f8fdea
-
Filesize
5.2MB
MD58b09204bbfca0fa4db89ebed969168bf
SHA15c8163306e28182a94b5989ef463916185deaf0c
SHA2564b37b566016c967703ed0f78687da7a7fb8dabf1c4afb9239dafd954d5bb3f07
SHA512b7e69aaf2caa44eabe73135812a82809f35a3b6be4f174562fba071973708c409faef8caceef5611fc3a29f2099f9f9219d735f1933600497a0dde254a04b417
-
Filesize
5.2MB
MD5e165e9dfaa01936273a0cf4e77adbdac
SHA12383d74a20c918c9e99f2d298fa39834ab0d5453
SHA25669ca104e0efa6d7a69be93d42adf858fdbd2b0c5a0dc23fda2106e0ed484463f
SHA512a54d22e410b20708e3b54dac2cc044a9ba5c8a1286b29c5bbd559bae5635a91093da365262126cc4919d883ebf881006ded54c65b5d76cb5697848b2adbf1a6a
-
Filesize
5.2MB
MD525b55ac7f8404e94b2d0af42da3a6606
SHA10e04bd2ad1e0178e2259f8f18ed02c7ff5dd9876
SHA256d6396eafdda946c178a23f5fc987fcfe2a77555c0d682f3cf616e62a804c4eca
SHA5121a3c66a3566e4be74ca5178632edd92dec64ac39b76921a206306f5992e2764e159b20d3398a6f62e1b1358b320bffd92c7f66c0894bf1ace60ea89ea198de98
-
Filesize
5.2MB
MD568ffb28968ac1e450cc7f5afe48d87af
SHA100c8d255cc17b913fde5a649ea73d51c9ba42dcc
SHA25603a4bdfe02d58181c9117c0d78f7677548519174b0105c936dfe4565ede97b68
SHA5120f29fe2a870b26aed6041537e8be85fd04f5db9bb6af783eaf0c5c71e6883b55b8835f4e620d0c2babec90397328b0d33749a84038c6f4086e394c4c3a0f56a8
-
Filesize
5.2MB
MD5e0ccc49184f3873061367fd88bb9f61e
SHA159ce193512b2567f1cac079d007d0d536129276f
SHA256bc7df9aa7f04b8a1613f1c9a52c97914633b82dd78389df61625583a3ee0d853
SHA512913cb1f110b733e875fac76d0f7aa1d62d2985d30d62523296761cfe7f24124a18ee87a186886aeb9eaf83b3c4bcd210197d3c75c4cd3453e786fe4fee2df577
-
Filesize
5.2MB
MD5944a889d511ed125c7799f83eecca9b0
SHA101bd123bd93c1853008270ad16ed38e940bb9e39
SHA25623da0f1af045aca05d0246d88e55cd5b9310fc1eb485f68decee6425f16a58e5
SHA512ed1eacd0b34532501550ad607ed9bd36d12183f2d9b91fd39f7891ca0b0e9b9861aaf889d9598374c43f3bcf57dff82731dc30a4c7173444d78f31369d056986
-
Filesize
5.2MB
MD5581257cbd109567d06473e6d0cafbca8
SHA1953364a679905964c05a8c76a72a7b3823e9de4a
SHA256e0b4fb6099e95acbe65e21aff526f9540a71d22687cf948a769cbd2b59571bc0
SHA5129897505a90735f3fff14a3177ecddbfc41f28e66e21a8a2f195bb1e75a8142bc296c77ad092f62c29c2903d6118156d59fa43a57e5f50d4991e63a3f2ed72be4
-
Filesize
5.2MB
MD53a5ce84ad086693336c2e00538ddcd1c
SHA12775c443093302e3772fc5fa49245376509de99b
SHA256f3ebd457b1f5a8515b0ae2894171914d235bf18e213b532333500f88d9e94ca9
SHA512d17eb9552ee88dc6dca070e7a1431ec8aa7727c7b79ad735af4c1b0020dcbe794ca6ddfa21a8f1e8b2d2277788d59b7a31dafc00dea5c0d2a5f546c201d57993
-
Filesize
5.2MB
MD59f99dd7d2c9def1f39d251d08eb1ff10
SHA10994aa348ba600881fb425539d1f575dec227572
SHA2565d534d17629ba07468fa3f53c77913448213a1692acc983cf16d395a72ec512e
SHA5123313ce100f5e62f6f8250ea42ea1e29dadcc70634e00e3930c5f30f8856e88ca610714b5faaebb5f38efd58ada7c7a95d40ae6760c9471d1981c90c2071d1369
-
Filesize
5.2MB
MD55b419d9630da0887df02e7320dcfa508
SHA1090e5fce2410b11cb53474fa9c352163c3704bfe
SHA256b120880371040877962e26064edba6ac4a44d8c00a11eabcc2736cf399bba165
SHA5127c4e011faa9ecbebbb02d3881d3c4c9f0b96c755053f88b1978ed7da84019e76801597a27d08522bd1030b05a1f28e5dd5a7b9145242ef7ebd8067d0d2f722d0