Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31-10-2024 01:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe
-
Size
380KB
-
MD5
8ed7a6776d26020392895ac0bd7d02a9
-
SHA1
b45612cff48847fa870f3196e496f9bdbdea3f38
-
SHA256
ee5984b39bab28ef8cf12dfc38380998dc6ce115e5401a8788e8dcc24644acab
-
SHA512
06a6e7b11659226091edbe37eac464d0154459604feaa2e7c12beda5716278fb5d4c0361f61f7bb4a1b41fc753eccf8572e3346f43ef41ae88ba2c872bfbdff5
-
SSDEEP
3072:mEGh0ohlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGfl7Oe2MUVg3v2IneKcAEcARy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
{9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe{A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe{753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe{BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe{4597C21B-8A71-429e-8267-B0421F7CACF3}.exe{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe{A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe{6526DC57-4159-4f8a-BCB5-54A32950125F}.exe{514691DB-2C44-4363-B428-716AF7B77574}.exe2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A65F1F88-6C68-492e-B4F0-B8C8FBB33179}\stubpath = "C:\\Windows\\{A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe" {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}\stubpath = "C:\\Windows\\{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe" {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{753E09C4-5615-4483-B9B0-FDA57C5F2FCD} {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA891528-0C73-4abe-A49D-C40EB7B80F24}\stubpath = "C:\\Windows\\{BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe" {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}\stubpath = "C:\\Windows\\{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe" {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DB87317-6FFE-4520-AD62-A62ED044AAC2}\stubpath = "C:\\Windows\\{9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe" {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F21E1B45-FDEF-4ded-95DA-A2582E39B70E} {4597C21B-8A71-429e-8267-B0421F7CACF3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9DB87317-6FFE-4520-AD62-A62ED044AAC2} {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{514691DB-2C44-4363-B428-716AF7B77574}\stubpath = "C:\\Windows\\{514691DB-2C44-4363-B428-716AF7B77574}.exe" {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6526DC57-4159-4f8a-BCB5-54A32950125F} {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4597C21B-8A71-429e-8267-B0421F7CACF3} {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6526DC57-4159-4f8a-BCB5-54A32950125F}\stubpath = "C:\\Windows\\{6526DC57-4159-4f8a-BCB5-54A32950125F}.exe" {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F21E1B45-FDEF-4ded-95DA-A2582E39B70E}\stubpath = "C:\\Windows\\{F21E1B45-FDEF-4ded-95DA-A2582E39B70E}.exe" {4597C21B-8A71-429e-8267-B0421F7CACF3}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934} {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A65F1F88-6C68-492e-B4F0-B8C8FBB33179} {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A60C65C5-2B02-43b1-8E0D-0922E4A49E87} {514691DB-2C44-4363-B428-716AF7B77574}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A60C65C5-2B02-43b1-8E0D-0922E4A49E87}\stubpath = "C:\\Windows\\{A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe" {514691DB-2C44-4363-B428-716AF7B77574}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2} {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{514691DB-2C44-4363-B428-716AF7B77574} {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4597C21B-8A71-429e-8267-B0421F7CACF3}\stubpath = "C:\\Windows\\{4597C21B-8A71-429e-8267-B0421F7CACF3}.exe" {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF} 2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}\stubpath = "C:\\Windows\\{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe" 2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{753E09C4-5615-4483-B9B0-FDA57C5F2FCD}\stubpath = "C:\\Windows\\{753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe" {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BA891528-0C73-4abe-A49D-C40EB7B80F24} {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe -
Executes dropped EXE 12 IoCs
Processes:
{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe{753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe{BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe{9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe{A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe{514691DB-2C44-4363-B428-716AF7B77574}.exe{A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe{6526DC57-4159-4f8a-BCB5-54A32950125F}.exe{4597C21B-8A71-429e-8267-B0421F7CACF3}.exe{F21E1B45-FDEF-4ded-95DA-A2582E39B70E}.exepid process 3828 {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe 1060 {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe 312 {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe 3476 {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe 2080 {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe 1856 {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe 1288 {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe 4640 {514691DB-2C44-4363-B428-716AF7B77574}.exe 4844 {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe 2428 {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe 3700 {4597C21B-8A71-429e-8267-B0421F7CACF3}.exe 4652 {F21E1B45-FDEF-4ded-95DA-A2582E39B70E}.exe -
Drops file in Windows directory 12 IoCs
Processes:
{9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe{A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe{4597C21B-8A71-429e-8267-B0421F7CACF3}.exe{753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe{BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe{514691DB-2C44-4363-B428-716AF7B77574}.exe{6526DC57-4159-4f8a-BCB5-54A32950125F}.exe2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe{A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exedescription ioc process File created C:\Windows\{A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe File created C:\Windows\{6526DC57-4159-4f8a-BCB5-54A32950125F}.exe {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe File created C:\Windows\{F21E1B45-FDEF-4ded-95DA-A2582E39B70E}.exe {4597C21B-8A71-429e-8267-B0421F7CACF3}.exe File created C:\Windows\{BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe File created C:\Windows\{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe File created C:\Windows\{9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe File created C:\Windows\{514691DB-2C44-4363-B428-716AF7B77574}.exe {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe File created C:\Windows\{A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe {514691DB-2C44-4363-B428-716AF7B77574}.exe File created C:\Windows\{4597C21B-8A71-429e-8267-B0421F7CACF3}.exe {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe File created C:\Windows\{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe 2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe File created C:\Windows\{753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe File created C:\Windows\{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe -
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exe{6526DC57-4159-4f8a-BCB5-54A32950125F}.exe2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.execmd.exe{753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.execmd.exe{9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe{514691DB-2C44-4363-B428-716AF7B77574}.execmd.execmd.execmd.exe{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.execmd.exe{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.execmd.exe{BA891528-0C73-4abe-A49D-C40EB7B80F24}.execmd.execmd.exe{4597C21B-8A71-429e-8267-B0421F7CACF3}.execmd.exe{F21E1B45-FDEF-4ded-95DA-A2582E39B70E}.exe{A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe{A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {514691DB-2C44-4363-B428-716AF7B77574}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {4597C21B-8A71-429e-8267-B0421F7CACF3}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {F21E1B45-FDEF-4ded-95DA-A2582E39B70E}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe{753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe{BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe{9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe{A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe{514691DB-2C44-4363-B428-716AF7B77574}.exe{A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe{6526DC57-4159-4f8a-BCB5-54A32950125F}.exe{4597C21B-8A71-429e-8267-B0421F7CACF3}.exedescription pid process Token: SeIncBasePriorityPrivilege 2148 2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe Token: SeIncBasePriorityPrivilege 3828 {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe Token: SeIncBasePriorityPrivilege 1060 {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe Token: SeIncBasePriorityPrivilege 312 {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe Token: SeIncBasePriorityPrivilege 3476 {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe Token: SeIncBasePriorityPrivilege 2080 {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe Token: SeIncBasePriorityPrivilege 1856 {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe Token: SeIncBasePriorityPrivilege 1288 {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe Token: SeIncBasePriorityPrivilege 4640 {514691DB-2C44-4363-B428-716AF7B77574}.exe Token: SeIncBasePriorityPrivilege 4844 {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe Token: SeIncBasePriorityPrivilege 2428 {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe Token: SeIncBasePriorityPrivilege 3700 {4597C21B-8A71-429e-8267-B0421F7CACF3}.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe{753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe{BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe{9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe{A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe{514691DB-2C44-4363-B428-716AF7B77574}.exe{A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe{6526DC57-4159-4f8a-BCB5-54A32950125F}.exedescription pid process target process PID 2148 wrote to memory of 3828 2148 2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe PID 2148 wrote to memory of 3828 2148 2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe PID 2148 wrote to memory of 3828 2148 2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe PID 2148 wrote to memory of 3492 2148 2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe cmd.exe PID 2148 wrote to memory of 3492 2148 2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe cmd.exe PID 2148 wrote to memory of 3492 2148 2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe cmd.exe PID 3828 wrote to memory of 1060 3828 {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe PID 3828 wrote to memory of 1060 3828 {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe PID 3828 wrote to memory of 1060 3828 {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe PID 3828 wrote to memory of 3752 3828 {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe cmd.exe PID 3828 wrote to memory of 3752 3828 {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe cmd.exe PID 3828 wrote to memory of 3752 3828 {5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe cmd.exe PID 1060 wrote to memory of 312 1060 {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe PID 1060 wrote to memory of 312 1060 {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe PID 1060 wrote to memory of 312 1060 {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe PID 1060 wrote to memory of 112 1060 {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe cmd.exe PID 1060 wrote to memory of 112 1060 {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe cmd.exe PID 1060 wrote to memory of 112 1060 {753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe cmd.exe PID 312 wrote to memory of 3476 312 {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe PID 312 wrote to memory of 3476 312 {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe PID 312 wrote to memory of 3476 312 {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe PID 312 wrote to memory of 3208 312 {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe cmd.exe PID 312 wrote to memory of 3208 312 {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe cmd.exe PID 312 wrote to memory of 3208 312 {BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe cmd.exe PID 3476 wrote to memory of 2080 3476 {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe PID 3476 wrote to memory of 2080 3476 {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe PID 3476 wrote to memory of 2080 3476 {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe PID 3476 wrote to memory of 3092 3476 {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe cmd.exe PID 3476 wrote to memory of 3092 3476 {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe cmd.exe PID 3476 wrote to memory of 3092 3476 {EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe cmd.exe PID 2080 wrote to memory of 1856 2080 {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe PID 2080 wrote to memory of 1856 2080 {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe PID 2080 wrote to memory of 1856 2080 {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe PID 2080 wrote to memory of 1792 2080 {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe cmd.exe PID 2080 wrote to memory of 1792 2080 {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe cmd.exe PID 2080 wrote to memory of 1792 2080 {9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe cmd.exe PID 1856 wrote to memory of 1288 1856 {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe PID 1856 wrote to memory of 1288 1856 {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe PID 1856 wrote to memory of 1288 1856 {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe PID 1856 wrote to memory of 3164 1856 {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe cmd.exe PID 1856 wrote to memory of 3164 1856 {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe cmd.exe PID 1856 wrote to memory of 3164 1856 {A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe cmd.exe PID 1288 wrote to memory of 4640 1288 {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe {514691DB-2C44-4363-B428-716AF7B77574}.exe PID 1288 wrote to memory of 4640 1288 {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe {514691DB-2C44-4363-B428-716AF7B77574}.exe PID 1288 wrote to memory of 4640 1288 {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe {514691DB-2C44-4363-B428-716AF7B77574}.exe PID 1288 wrote to memory of 4284 1288 {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe cmd.exe PID 1288 wrote to memory of 4284 1288 {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe cmd.exe PID 1288 wrote to memory of 4284 1288 {C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe cmd.exe PID 4640 wrote to memory of 4844 4640 {514691DB-2C44-4363-B428-716AF7B77574}.exe {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe PID 4640 wrote to memory of 4844 4640 {514691DB-2C44-4363-B428-716AF7B77574}.exe {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe PID 4640 wrote to memory of 4844 4640 {514691DB-2C44-4363-B428-716AF7B77574}.exe {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe PID 4640 wrote to memory of 4484 4640 {514691DB-2C44-4363-B428-716AF7B77574}.exe cmd.exe PID 4640 wrote to memory of 4484 4640 {514691DB-2C44-4363-B428-716AF7B77574}.exe cmd.exe PID 4640 wrote to memory of 4484 4640 {514691DB-2C44-4363-B428-716AF7B77574}.exe cmd.exe PID 4844 wrote to memory of 2428 4844 {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe PID 4844 wrote to memory of 2428 4844 {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe PID 4844 wrote to memory of 2428 4844 {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe PID 4844 wrote to memory of 3428 4844 {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe cmd.exe PID 4844 wrote to memory of 3428 4844 {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe cmd.exe PID 4844 wrote to memory of 3428 4844 {A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe cmd.exe PID 2428 wrote to memory of 3700 2428 {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe {4597C21B-8A71-429e-8267-B0421F7CACF3}.exe PID 2428 wrote to memory of 3700 2428 {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe {4597C21B-8A71-429e-8267-B0421F7CACF3}.exe PID 2428 wrote to memory of 3700 2428 {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe {4597C21B-8A71-429e-8267-B0421F7CACF3}.exe PID 2428 wrote to memory of 4636 2428 {6526DC57-4159-4f8a-BCB5-54A32950125F}.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-31_8ed7a6776d26020392895ac0bd7d02a9_goldeneye.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exeC:\Windows\{5BAD4D0E-B119-40d0-B380-C753FEEE2CBF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\{753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exeC:\Windows\{753E09C4-5615-4483-B9B0-FDA57C5F2FCD}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\{BA891528-0C73-4abe-A49D-C40EB7B80F24}.exeC:\Windows\{BA891528-0C73-4abe-A49D-C40EB7B80F24}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Windows\{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exeC:\Windows\{EFD2EE81-B4FB-4a4e-AB5F-65C3DB547934}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\{9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exeC:\Windows\{9DB87317-6FFE-4520-AD62-A62ED044AAC2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\{A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exeC:\Windows\{A65F1F88-6C68-492e-B4F0-B8C8FBB33179}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exeC:\Windows\{C7D28E88-1A54-45e5-ADAB-75351EFCB0A2}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\{514691DB-2C44-4363-B428-716AF7B77574}.exeC:\Windows\{514691DB-2C44-4363-B428-716AF7B77574}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\{A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exeC:\Windows\{A60C65C5-2B02-43b1-8E0D-0922E4A49E87}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\{6526DC57-4159-4f8a-BCB5-54A32950125F}.exeC:\Windows\{6526DC57-4159-4f8a-BCB5-54A32950125F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\{4597C21B-8A71-429e-8267-B0421F7CACF3}.exeC:\Windows\{4597C21B-8A71-429e-8267-B0421F7CACF3}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3700 -
C:\Windows\{F21E1B45-FDEF-4ded-95DA-A2582E39B70E}.exeC:\Windows\{F21E1B45-FDEF-4ded-95DA-A2582E39B70E}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4597C~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6526D~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
PID:4636 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A60C6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
PID:3428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51469~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7D28~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
PID:4284 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A65F1~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
PID:3164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9DB87~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
PID:1792 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EFD2E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
PID:3092 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA891~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
PID:3208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{753E0~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
PID:112 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5BAD4~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
PID:3752 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:3492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD5ccf79cc7b12c4fd81adc3974167b3a61
SHA1a007dad5918fcee42cde02a24eeb837460fddb49
SHA25657075c77b1b5560b051db1b86d8ac6c9f50beb2dffe4ed1da50eeee3495bbee4
SHA512a428b1fe8748502dc3fce563bc3adc765872ec9bee5620a6c2b8e4713e9409b0474ed599c76edc6bd8c47a7bc43bd0f6a8c27b57169805cf863cbd98ba83cf40
-
Filesize
380KB
MD51812123216fe071cf416b5c880983fec
SHA1432de220a96daa636314b24d0c781cdec116fd0a
SHA256a71d41b3327bbe432428485899a68f05cc99cec1bd42732036e5dee574a2eb9d
SHA512295539135647521b0910dea6b7b13799e78fe9050e9bed25e90179eb0ce811c9251f5cc35f0a9edf3e287f756b20e88ae50f942d9d579c7e282a5702b908698e
-
Filesize
380KB
MD5ceec3a3766f4569c7eeab1a8fec12f34
SHA185197592bc5fe2c1ae832a5d2fbdf6c62afe2c7b
SHA256d7df83ef2cdbf66a5ad049212782c74be69fcb8eb56e91ab27042316890d69d2
SHA512262ef85ce685952fbc7303e262972e8ddfb9d35fcf804a55027602e4672d8e70bc38f7e52b91b8d48da180b21f2861b0d962c864cd446f49702daa9a59f899d8
-
Filesize
380KB
MD55e2c6880e087334ca81bd0f899efd7d7
SHA136c7344709d7fb4e5cb04c322e042d1fc6468545
SHA2561103a85519835139ed81d43ea94e68e84d1f34fecf54cf23e46a486884ac0567
SHA51259533ce78fe50da56bf04ffe4a91c2e4a8ad6ce62ce0f7f6ed8fa662df315fbe3ee278aa1f64786d8023c50d11e2c11aef721fd872e89a4da6b2c86dcca5fcec
-
Filesize
380KB
MD5b992e3b989ba9273afd09c61a1e2c5f1
SHA1c4f8311b7b016697adda967469c846b754c2f768
SHA2564ece762c2bd8709f19252393d6028697422364ab059cc71cbee5182eff370d65
SHA512e00c18f7d9dfb64500ff49cdd2dc9643c7643512c3188009af72b42ee1755c321009a4aa8dbb9c2b0f01a4d9252343c33305f05b6aaf15bf6004a4ff538ce5e7
-
Filesize
380KB
MD54435b10779b6735d87d0445c41128473
SHA110871caab93d99668dd576bd346db53df1dbf904
SHA256686c3a78cf336903d72e54d2d1b34c32e825ad072385cf94c3067a98dbeb605f
SHA51235bde3b773c25f898785cfb98d1e79612bab0d515a4d2cc1fd220540922996ff38bd805d1eae98bb1b8677c658a1175821fb37805ddc49d83bfe0987532c0c38
-
Filesize
380KB
MD50ef2c8f53172a56044f662bf82874cf5
SHA185292ca9c26c045d758e28e53bc24cd1db0f45b2
SHA256922ba02034f25563870849d838ad979ff3d400ad10fd91ef093582126395e431
SHA512476c5c705797df8737c28c33d19f758d7de17aec951b1c622d11684da4865a1436472d02ef91029f1631ed1219860fabff1f955ca3f4a8e8ac38ab4c7c4d3d6f
-
Filesize
380KB
MD51c2e05b197f09ed5d04a4f123f341aa1
SHA12767e433b065728ecbde2e21ce8371c28bae8d1f
SHA256e9847d5736879abf98fe4ebd4dec03d4c087a560e61a4105ea30e716d20efc79
SHA512a598d77c12ae1b87231bd92a7e94bbc03e113265c67c655a7f650a0b5bd1b2dcf06779984784c3abc85c43d7b03db1da0d92ca5966f0c2ebc4ebc45277169bd0
-
Filesize
380KB
MD5e22554624ac6f7ac7878de0fa07b7664
SHA185ee9f8c11f1ee4dbd18a05f4f83775ff910ce13
SHA256dc3014433ec0fc975b29c23069ed8ecae60ef813e6eec2353c65087e45f8e0ca
SHA512923c524d002515662fe5b537e05c432aa37fbcffda3fb5055a257b0873bc5704e9a9f4f764153e5df51f4facbe97d703c366c38966f2d718a6463d46047bc45c
-
Filesize
380KB
MD54a124c87dc044db5484baf9696233af0
SHA187d50305d474939ee66118d2707e93001b53e977
SHA2566f521f57d4c77e4af6dbb31092e223f23f099b2c553a88a7786b381ea2cc77e1
SHA5127cba6deac32f9746968ba499b07b8c28ccbf8d796de64685d22a83329e2f1100894ce98e249598e52d0858692ba3776ddc0146ea5e8da37033da27d22dc7497a
-
Filesize
380KB
MD5f2085934ee0203261daec4e010179d60
SHA1693d672293412c4846c75fdd4bc8a0bdd2a1c326
SHA256975e0dffab74a231c5a5d77bd809aad36f5fc5b73e2e9cd8b5520bc8aeee933b
SHA512c9c8d2bc180c4d29e56deeb181c6dd930150a67fc78a166374ba9ff0412e1a3e4df56cba38ab80a36c9f14b64a09de430646e44f82c5bebcdaab35148b0785de
-
Filesize
380KB
MD5dadb6d5db25090f41ba161e50494b199
SHA198fde31da5f78ae764113ef6de0483cb96f951f9
SHA2569c09b0cc6ec2b642b0b2d3c62743cd15009419c5c0f00c118d6f647dfbe5f854
SHA5121fa796a7ab480877e853ff87c7baf07a23a00ac721e3b18cbdd5d118c7610364dfec615adb7ff08662e47620c967555e2bd8ff26c5c1915163ac7dadf0adec38