cobaltstrike | 487f4dd9bdbe94a9cf1a04a8fdec19f16f86864d05d06f0511544b3ff68c850c

Target
malware_samples.zip
Size 19.1MB
Sample250416-3dkjmsw1ds
SHA256 487f4dd9bdbe94a9cf1a04a8fdec19f16f86864d05d06f0511544b3ff68c850c
MD5 d8e816c76ab1b9bc76e73b1aa0f88f2d
SHA1 da193bad12f1b79f8c938d62e8029ba948433859
SHA512 5bd84b71cb39d1d4952255cbabc45608c972757bb63a9f70606e0d2200154374f9e61f1c526ed1fe903b166e5d0b0458540b47da9c70434ae5b31a7b7d1bd02a
SSDEEP 393216:ThCblxXJLB2mW/RxHedw0OZnq0NyWl9Hh9H2KAm4zI:ThSDZLI5xHea9Zf5XHD4zI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Extracted

Family

trickbot

Version

1000501

Botnet

ono33

5.182.210.226:443
5.182.210.120:443
185.65.202.183:443
212.80.217.243:443
85.143.218.249:443
194.5.250.178:443
198.15.119.121:443
107.175.87.142:443
185.14.31.72:443
188.165.62.2:443
194.5.250.179:443
198.15.119.71:443
185.14.29.4:443
185.99.2.202:443
192.3.193.162:443
89.191.234.89:443
195.54.32.12:443
31.131.21.30:443
5.34.177.194:443
190.214.13.2:449
181.140.173.186:449
181.129.104.139:449
181.113.28.146:449
181.112.157.42:449
170.84.78.224:449
200.21.51.38:449
46.174.235.36:449
36.89.85.103:449
181.129.134.18:449
186.71.150.23:449
131.161.253.190:449
200.127.121.99:449
114.8.133.71:449
119.252.165.75:449
121.100.19.18:449
202.29.215.114:449
180.180.216.177:449
171.100.142.238:449
186.232.91.240:449
181.196.207.202:449

Attributes

autorun
Name:pwgrab

ecc_pubkey.base64

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://sandiegohomevalues.com/engl/4de-kzsyhu-768611/
exe.dropper
https://www.wenkawang.com/data/bofze0s-7ji4-15/
exe.dropper
https://www.bruidsfotograaf-utrecht.com/wp-includes/QLvFLy/
exe.dropper
http://ma.jopedu.com/img/8z8dl-3xn-655019278/
exe.dropper
http://pay.jopedu.com/ThinkPHP/l9okcguh6-b9nnrh7-96245524/

Extracted

Family

guloader

https://eficadgdl.com/well/Omitted-Credentials_encrypted_6A17930.bin

xor.base64

Extracted

Language

xlm4.0

Source

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://diwafashions.com/wp-admin/mqau6/
exe.dropper
http://designers.hotcom-web.com/ubkskw29clek/qnpm1p/
exe.dropper
http://dixartcontractors.com/cgi-bin/nnuv/
exe.dropper
http://diaspotv.info/wordpress/G/
exe.dropper
http://easyvisaoverseas.com/cgi-bin/v/

Targets

- Target
  virusshare/1/VirusShare_0a2d1ecedf3f79754aa2c18d62e75287
- Size 5.7MB
- SHA256 e800fce6aadc7792b912abbb693aafe0905a5ab52bc92de9e2a50089de312be9
- MD5 0a2d1ecedf3f79754aa2c18d62e75287
- SHA1 4dc6c7ad46c152ee6ebf26488fd5136dd9acfa4f
- SHA512 00be04178ca0451634ce16e6b5348b768e0bc017dc8b5c6fd9fef1a7110a305b0fa6f240ca486e76f8b13c5e6aae6a416229c63750fb5a98230fd740423fee4f
- SSDEEP 98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUW:w+156utgpPF8u/7W
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  virusshare/1/VirusShare_0aee78510c46e3a200b6bc21ac1c954d
- Size 633KB
- SHA256 c7d63abc749b1f4e245bd377c11ca5857735491eddab5c176ae99a3b7bf9e0ca
- MD5 0aee78510c46e3a200b6bc21ac1c954d
- SHA1 aa82dabf571edf16022381f9795376370d4ded7c
- SHA512 ff963b0d7f3b90c5d261c101d44c6b8d595cd809ae9e8378fc85d0442d2322a6cc3899a9ec4d2d6e662de32879120a5ba07bb883a20cd2003618aa69f2806117
- SSDEEP 12288:Px/w9Fmh+HWMxs+KuwetXwuV9W0P5qUKbxqkSnY:PNAckHWCsZulAeRP5VKtqk4Y
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

discovery upx
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  virusshare/1/VirusShare_0fea640a7da27f365b3675f73626b9c9
- Size 937KB
- SHA256 64af94592f6707505fa6f42b58776c3635706a414e6362a92f707df84627679c
- MD5 0fea640a7da27f365b3675f73626b9c9
- SHA1 fd4825f244e9c145486cb6930ad05695b9972668
- SHA512 c9a10288762f3f5a3fdff17f8dd8560e7a884f1b83f405c2e85c6c86e42f69a30841c13aa0f2ecfc55aed42995d7aeb8fe40415e423ed0a306d2e7d00883dfbf
- SSDEEP 24576:h3zS0aqbCrxgFhFSQVB5DjDLG6/8otVBTN9s:K9Fo5VLDLGwTBT
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ta505
- TA505
  Cybercrime group active since 2015, responsible for families like Dridex and Locky.
  ta505
- Ta505 family
  ta505
- Loads dropped DLL
behavioral5 behavioral6
- Target
  virusshare/1/VirusShare_1ba8249d8503c0cf7bc125588c43bef9
- Size 182KB
- SHA256 a44031feb2a71980a0980377c8f7b6f3b5b9dfa0f708556dd420be323c7e1a38
- MD5 1ba8249d8503c0cf7bc125588c43bef9
- SHA1 eb473c845c7474010ff35a3e8a169a9b6b9e5ebe
- SHA512 b5421ca474e8ccd30683b90a83e98c6ba74c8418201aaa923ba6c7805ef724b37dfabb74cfedccbb69e3fcf923635f64faa406f280057404f78957df3d840c8c
- SSDEEP 3072:9NO2y/GdywFyktGDWLS0HZWD5w8K7Nk9rD7IBU9asiv8Oc7V:9NO2k4PF7tGiL3HJk9rD7b9asiv8dZ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

execution
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral7 behavioral8
- Target
  virusshare/1/VirusShare_3cd9a967b67fe69351e390195ca7a430
- Size 32KB
- SHA256 e96e3b90d9483a2e463fdda0edf27310ed10fbdb8a8b920c6480ca93bb2e1077
- MD5 3cd9a967b67fe69351e390195ca7a430
- SHA1 4e7f309d283182d76377ad02616a6a5933cac649
- SHA512 ffe9ffe8555ef0b914bdcaea5b50eb501c4b0d03726ab6f2baa0e5cf6875d9b0ac735679dbd03810d3f03905402f382bf32e3227bd2a11c0eef173082cb02273
- SSDEEP 768:XDNivfrO+Av3qpOCy71ShZ2/p1oaVBV2iKL2GmqBmmSE5fXuMZmwgCLWar8v:XB6zrAv3qpOCy71ShZ2R1osBV2iKL25p
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  virusshare/1/malware
- Size 5.7MB
- SHA256 e800fce6aadc7792b912abbb693aafe0905a5ab52bc92de9e2a50089de312be9
- MD5 0a2d1ecedf3f79754aa2c18d62e75287
- SHA1 4dc6c7ad46c152ee6ebf26488fd5136dd9acfa4f
- SHA512 00be04178ca0451634ce16e6b5348b768e0bc017dc8b5c6fd9fef1a7110a305b0fa6f240ca486e76f8b13c5e6aae6a416229c63750fb5a98230fd740423fee4f
- SSDEEP 98304:hemTLkNdfE0pZaN56utgpPFotBER/mQ32lUW:w+156utgpPF8u/7W
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  virusshare/2/VirusShare_01b55404de50bd1a56343b2f316ff88d
- Size 121KB
- SHA256 69bd652ace6469311a49a12f66bbbc691bdfc69aba958dd02d928464cbb46609
- MD5 01b55404de50bd1a56343b2f316ff88d
- SHA1 8a6b9599d3e71c83eaef7f5a23df21b4f41370b1
- SHA512 f1ec4bf6768dea2edc53c72dd7c884641a464f4268d21480bb55fbdb1079b8c5c9fb50eab4b29d13acb4a8682ca6ae291341e01b748e228b185676e48df2e598
- SSDEEP 3072:JrhJGtDfYtWAh3A8lKl+/63VBwxkbwQXz8lFTnc:JrhJoDfY13KE/qVlNYvnc
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  virusshare/2/VirusShare_1ad9a67240d5775395c45b64dd6529fa
- Size 2.9MB
- SHA256 3751298058a2a5d0912caa35bfdbafa48ae788647b536e69ad383c7c1990dd9d
- MD5 1ad9a67240d5775395c45b64dd6529fa
- SHA1 c653d2c475f639ad68c210e0f9d829344c5663c7
- SHA512 721b1c577db1cfe5465eaceadf2a7cc9d3f68d341f98d7dcc4bde2ff606f359b6bc917e993f5f05e9897b7957ca2617fa03937c2aea6a8462b86f2e750397c23
- SSDEEP 49152:4obi85jFGg0IZHVA/pfa8u0Ikjhd6kss8CYxB52ibDIJZKpYg0Kg9e+KgFTRFO:Vzh6/I8u0IktgkOvxBUibs2Z0ggFdE
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  virusshare/2/VirusShare_2fe5b00079aec2d8369a798230313ec8
- Size 125KB
- SHA256 8eb6805a0852b220695175ce81a5b139f1438dc06ea3fc1347b047702880374c
- MD5 2fe5b00079aec2d8369a798230313ec8
- SHA1 e233595a2ee62f6197fcc7d9088fce3505c38ec0
- SHA512 d9b4173274b49d7f041aea1a6866d5cc79530360668299385a10f25597b608308a5cb6502363709a7e09e43d30a1df95e1ab72fcc71852c78b51da016c2bbed7
- SSDEEP 3072:beKgdzSrG8KyIwLx3phgC1s0rPOWfKNR/:beKUzSLnLx3X3O0r2WfKNJ
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

execution
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral17 behavioral18
- Target
  virusshare/2/VirusShare_3f0b1eed4b7b9ae05fab4d949843f103
- Size 35KB
- SHA256 ce21d34bafe338effb8f619936f057084cb45743fce884a1465966d8523a00a8
- MD5 3f0b1eed4b7b9ae05fab4d949843f103
- SHA1 e5b9fa0a23f337adae93ed4e8fcd1e9d9db4acba
- SHA512 292183a9d0b3e5759453a43bcf34b8b1d09d09523687bfab090dd740a5c70169938904949b1c5a025b40082898dc3ec240ad2ec788b66f256efe5a041f774740
- SSDEEP 384:3+WbqwPv/ETzbVwNY/+TU5lHizK+BS3DzxW8M2GzraAzVCIXh3aM:OWbqm/EvZwO2TUrEQDtI2G31lX5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral19 behavioral20
- Target
  virusshare/2/VirusShare_480ef02bb062a57724e1b3e14532a140
- Size 32KB
- SHA256 b2e302356d613a814a41d356a61cee24fc133dd032e4b02d8e29436aedd8d742
- MD5 480ef02bb062a57724e1b3e14532a140
- SHA1 5ea2c3fdeb0b399e1805a94d8e6af4ce0de2c63e
- SHA512 82587a541bdc570b15402ef33beb14d9681160dc6e520f0c34b3c040658d17a9ced58feaa350f3a6c56eb7236ceb4bd09ba6ece56d13113780a6fe1a5044a99f
- SSDEEP 768:9EKOUP0/RXtY+E1dhX2e1kaVsVri7sF9/I70u5M/E5vXuMZmwgCLWarCC:ROc0JTE1dhX2e1kssVri7sng0u5MyXFh
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  virusshare/2/wedding.apk
- Size 5.3MB
- SHA256 7a42d7809fdef76fe0580d09ef6780a96c000d97712236e6550d7fff061e122a
- MD5 7a78191dad2e8baf6b372a4dc864430c
- SHA1 92f7a09036d7fc1c4ada288fdb114e5e5dcb09c1
- SHA512 28ed1d04180dbf9fa7ea9561ddc112377c7d81f6ee1078ceb2fb93782cb29ff875bafc03f5906379f87060132d048ff1802748a97eb7cde9647893e5550c2c8d
- SSDEEP 98304:dTUWQ8/rUKDzU87SWbFnVNyYdOYmwKOQarbcDSaBd2ZrYub+4XD:dTLHPSw7Nd8v0rr3aX4XD
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral23 behavioral24 behavioral25
- Target
  virusshare/3/VirusShare_3fb34964fa7b8c6bfad8d960380ff04e
- Size 34KB
- SHA256 26026b1b3d0cb660c6be6c536df679acca0b5562a3adbb507d001474d23f5650
- MD5 3fb34964fa7b8c6bfad8d960380ff04e
- SHA1 9a3aec40056ce74bac833989ed71dfb6c2626f4c
- SHA512 a82b522dfd7eac30292a9e9ab19ddac94563804e77a1090e5f44de7e794ef4e5ebe0e7fb36e5177479417c8176ae0475613700755ca015c7ce941a4740215faa
- SSDEEP 384:bzIPMepSbSsG/CdPvunCpeJzKoSS3D6JO5LfBqtjbjk4Eohubn3ezta:nIPMecWsGKVunFFRDE6pqjhust
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral26 behavioral27
- Target
  virusshare/3/VirusShare_4675e87be15585e66b0c88b833dd9ecd
- Size 32KB
- SHA256 77e2bcef8ff0e68646b27591faea3e15b4a09154d0611a5004ec028df5f36256
- MD5 4675e87be15585e66b0c88b833dd9ecd
- SHA1 b2c62b3cdc97ca86df9f06ea78bc4c59439d7a9b
- SHA512 433f88857e55d57f01230dabb3ca5c618311c45e93c82786ab2677a7d2522e91343bcb7f8df02c83abcc9d431e0bd553022b05ab1f7c2c7f05d621f07a7e19a1
- SSDEEP 768:YJ7cDLXeFL/i6XV7JCzYLggXw2E0Ua20dZU57DsM1uBsYJyWOOX8ohjaSD2stCQB:0c/XcLF8E5Z
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral28 behavioral29
- Target
  virusshare/3/VirusShare_4aa5734fe9c86184f931f4ddaf2d4d7b
- Size 64KB
- SHA256 2e18ad3e470b97415beb2cdb8e3ef7510bad21f0a5add020a7f9343dd959eeaa
- MD5 4aa5734fe9c86184f931f4ddaf2d4d7b
- SHA1 a066ccad76f3c63d053cd68ac8692d4f4acf82ac
- SHA512 7355ffd3fc59af49af1d57f5327c7442a12c8e5ddc6ec9e176cc27fd4986cd6182f5f6ce91f892c07029efcac37f90d4dd077b6bb226b54c40621b94987a044c
- SSDEEP 384:rdP9JIA7uJ1wK2xBpHbVbl+NGYD90pSCfZziEKffhaekBfdReVwoGHdRsArr2rOR:R9JIqNl/SSrrpBfiIdRsorZucnjtsq
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

guloader discovery downloader persistence
- Guloader family
  guloader
- Guloader,Cloudeye
  A shellcode based downloader first seen in 2020.
  downloader guloader
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral30 behavioral31
- Target
  virusshare/3/VirusShare_5c8b670c503455baafbff400a446cf82
- Size 208KB
- SHA256 22564368a2143231eb51f0ecb501d9777060fd9dd832dcc88a799520884da40c
- MD5 5c8b670c503455baafbff400a446cf82
- SHA1 a3eebbc14b852f77318d9bd09117b1ef56f35ede
- SHA512 6f9bf4e52523c32d980ab29c63e21d29aafd358c7c2cabcca6455685e1a683f96a718efe230d76687b72ce60b24c36c541e720a2d86d490835d481cf93c12d64
- SSDEEP 6144:jG3XIHrH91T+dG8tlj+ur37VW7SrBLl2mr/ruei+QE4lIVnAEsnnnnnn:jG3XorH3YGeljtr37s7SrBLrTaei+Qtz
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

UPX packed file

TA505

Ta505 family

Loads dropped DLL

Process spawned unexpected child process

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Process spawned unexpected child process

Blocklisted process makes network request

Command and Scripting Interpreter: PowerShell

Guloader family

Guloader,Cloudeye

Executes dropped EXE

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32