cobaltstrike | 85a7268ab71ed72ef7e78700420b4064e53ca5e3de22d42f59c270a5fe0f8bc0

Analysis

max time kernel
31s
max time network
40s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 11:56

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.2MB
MD5

86680d41caab6b4c7ab7f5280fa04cf7
SHA1

3a9aea3c7e620166520f4ca52ebebbb9ca8c372f
SHA256

85a7268ab71ed72ef7e78700420b4064e53ca5e3de22d42f59c270a5fe0f8bc0
SHA512

22b386b5f4a332be7d0cbda3da8505b933cf45eae018afad7cfe44bbc151ed4b4653edab399af09013f942dca8504834d9b85ea1d44efe9313ea17b3772fd168
SSDEEP

49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lN:RWWBibf56utgpPFotBER/mQ32lU5

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x0008000000023458-4.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002345d-9.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002345c-11.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002345e-24.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023459-29.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002345f-35.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023461-46.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023462-50.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023463-52.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023464-61.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023465-70.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023466-73.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023467-80.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023468-90.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346b-109.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346f-128.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346d-129.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346e-133.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346c-122.dat	cobalt_reflective_dll
behavioral2/files/0x000700000002346a-105.dat	cobalt_reflective_dll
behavioral2/files/0x0007000000023469-98.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral2/memory/4376-56-0x00007FF6B4110000-0x00007FF6B4461000-memory.dmp	xmrig
behavioral2/memory/2424-68-0x00007FF616080000-0x00007FF6163D1000-memory.dmp	xmrig
behavioral2/memory/4732-75-0x00007FF6AED80000-0x00007FF6AF0D1000-memory.dmp	xmrig
behavioral2/memory/4816-64-0x00007FF6B5400000-0x00007FF6B5751000-memory.dmp	xmrig
behavioral2/memory/4360-63-0x00007FF62D370000-0x00007FF62D6C1000-memory.dmp	xmrig
behavioral2/memory/1432-89-0x00007FF6F4760000-0x00007FF6F4AB1000-memory.dmp	xmrig
behavioral2/memory/2648-81-0x00007FF7FEBD0000-0x00007FF7FEF21000-memory.dmp	xmrig
behavioral2/memory/2516-117-0x00007FF77C900000-0x00007FF77CC51000-memory.dmp	xmrig
behavioral2/memory/4548-132-0x00007FF792ED0000-0x00007FF793221000-memory.dmp	xmrig
behavioral2/memory/4556-131-0x00007FF66E0C0000-0x00007FF66E411000-memory.dmp	xmrig
behavioral2/memory/908-125-0x00007FF746670000-0x00007FF7469C1000-memory.dmp	xmrig
behavioral2/memory/1916-111-0x00007FF75CF30000-0x00007FF75D281000-memory.dmp	xmrig
behavioral2/memory/2556-110-0x00007FF796B10000-0x00007FF796E61000-memory.dmp	xmrig
behavioral2/memory/3004-96-0x00007FF62D6D0000-0x00007FF62DA21000-memory.dmp	xmrig
behavioral2/memory/4376-138-0x00007FF6B4110000-0x00007FF6B4461000-memory.dmp	xmrig
behavioral2/memory/3876-148-0x00007FF6F9750000-0x00007FF6F9AA1000-memory.dmp	xmrig
behavioral2/memory/1768-149-0x00007FF7814E0000-0x00007FF781831000-memory.dmp	xmrig
behavioral2/memory/3340-150-0x00007FF7A21D0000-0x00007FF7A2521000-memory.dmp	xmrig
behavioral2/memory/1660-156-0x00007FF7C8BA0000-0x00007FF7C8EF1000-memory.dmp	xmrig
behavioral2/memory/1360-162-0x00007FF6B0110000-0x00007FF6B0461000-memory.dmp	xmrig
behavioral2/memory/1320-163-0x00007FF677380000-0x00007FF6776D1000-memory.dmp	xmrig
behavioral2/memory/4052-164-0x00007FF6ACA00000-0x00007FF6ACD51000-memory.dmp	xmrig
behavioral2/memory/908-160-0x00007FF746670000-0x00007FF7469C1000-memory.dmp	xmrig
behavioral2/memory/4304-157-0x00007FF706F00000-0x00007FF707251000-memory.dmp	xmrig
behavioral2/memory/4376-165-0x00007FF6B4110000-0x00007FF6B4461000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
4360	GtkdgYy.exe
2424	PPlhzXQ.exe
4732	LfVGTcA.exe
2648	JrERlii.exe
1432	WHithOj.exe
3004	MtulWQL.exe
2556	wxtdObD.exe
2516	tBHEgJX.exe
4556	sKQHvrT.exe
4816	dzSKviJ.exe
3876	zXItcYS.exe
1768	RCloMSm.exe
3340	FxcCrAb.exe
1660	OtpKjFe.exe
4304	AEJLGSj.exe
1916	llfWyDt.exe
4052	nseDhDY.exe
908	HzvzuWa.exe
4548	vQHwkRt.exe
1360	gkxFwgB.exe
1320	wYpAsvY.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4376-0-0x00007FF6B4110000-0x00007FF6B4461000-memory.dmp	upx
behavioral2/files/0x0008000000023458-4.dat	upx
behavioral2/memory/4360-7-0x00007FF62D370000-0x00007FF62D6C1000-memory.dmp	upx
behavioral2/files/0x000700000002345d-9.dat	upx
behavioral2/files/0x000700000002345c-11.dat	upx
behavioral2/memory/2424-12-0x00007FF616080000-0x00007FF6163D1000-memory.dmp	upx
behavioral2/memory/4732-18-0x00007FF6AED80000-0x00007FF6AF0D1000-memory.dmp	upx
behavioral2/files/0x000700000002345e-24.dat	upx
behavioral2/memory/2648-26-0x00007FF7FEBD0000-0x00007FF7FEF21000-memory.dmp	upx
behavioral2/files/0x0008000000023459-29.dat	upx
behavioral2/memory/1432-30-0x00007FF6F4760000-0x00007FF6F4AB1000-memory.dmp	upx
behavioral2/files/0x000700000002345f-35.dat	upx
behavioral2/memory/3004-36-0x00007FF62D6D0000-0x00007FF62DA21000-memory.dmp	upx
behavioral2/files/0x0007000000023461-46.dat	upx
behavioral2/files/0x0007000000023462-50.dat	upx
behavioral2/files/0x0007000000023463-52.dat	upx
behavioral2/memory/4556-53-0x00007FF66E0C0000-0x00007FF66E411000-memory.dmp	upx
behavioral2/memory/2516-49-0x00007FF77C900000-0x00007FF77CC51000-memory.dmp	upx
behavioral2/memory/2556-41-0x00007FF796B10000-0x00007FF796E61000-memory.dmp	upx
behavioral2/memory/4376-56-0x00007FF6B4110000-0x00007FF6B4461000-memory.dmp	upx
behavioral2/files/0x0007000000023464-61.dat	upx
behavioral2/memory/2424-68-0x00007FF616080000-0x00007FF6163D1000-memory.dmp	upx
behavioral2/files/0x0007000000023465-70.dat	upx
behavioral2/files/0x0007000000023466-73.dat	upx
behavioral2/memory/1768-76-0x00007FF7814E0000-0x00007FF781831000-memory.dmp	upx
behavioral2/memory/4732-75-0x00007FF6AED80000-0x00007FF6AF0D1000-memory.dmp	upx
behavioral2/memory/3876-69-0x00007FF6F9750000-0x00007FF6F9AA1000-memory.dmp	upx
behavioral2/memory/4816-64-0x00007FF6B5400000-0x00007FF6B5751000-memory.dmp	upx
behavioral2/memory/4360-63-0x00007FF62D370000-0x00007FF62D6C1000-memory.dmp	upx
behavioral2/files/0x0007000000023467-80.dat	upx
behavioral2/memory/1432-89-0x00007FF6F4760000-0x00007FF6F4AB1000-memory.dmp	upx
behavioral2/files/0x0007000000023468-90.dat	upx
behavioral2/memory/3340-87-0x00007FF7A21D0000-0x00007FF7A2521000-memory.dmp	upx
behavioral2/memory/2648-81-0x00007FF7FEBD0000-0x00007FF7FEF21000-memory.dmp	upx
behavioral2/memory/1660-92-0x00007FF7C8BA0000-0x00007FF7C8EF1000-memory.dmp	upx
behavioral2/files/0x000700000002346b-109.dat	upx
behavioral2/memory/4052-115-0x00007FF6ACA00000-0x00007FF6ACD51000-memory.dmp	upx
behavioral2/memory/2516-117-0x00007FF77C900000-0x00007FF77CC51000-memory.dmp	upx
behavioral2/files/0x000700000002346f-128.dat	upx
behavioral2/files/0x000700000002346d-129.dat	upx
behavioral2/memory/1320-135-0x00007FF677380000-0x00007FF6776D1000-memory.dmp	upx
behavioral2/files/0x000700000002346e-133.dat	upx
behavioral2/memory/4548-132-0x00007FF792ED0000-0x00007FF793221000-memory.dmp	upx
behavioral2/memory/4556-131-0x00007FF66E0C0000-0x00007FF66E411000-memory.dmp	upx
behavioral2/memory/1360-126-0x00007FF6B0110000-0x00007FF6B0461000-memory.dmp	upx
behavioral2/memory/908-125-0x00007FF746670000-0x00007FF7469C1000-memory.dmp	upx
behavioral2/files/0x000700000002346c-122.dat	upx
behavioral2/memory/1916-111-0x00007FF75CF30000-0x00007FF75D281000-memory.dmp	upx
behavioral2/memory/2556-110-0x00007FF796B10000-0x00007FF796E61000-memory.dmp	upx
behavioral2/files/0x000700000002346a-105.dat	upx
behavioral2/files/0x0007000000023469-98.dat	upx
behavioral2/memory/4304-97-0x00007FF706F00000-0x00007FF707251000-memory.dmp	upx
behavioral2/memory/3004-96-0x00007FF62D6D0000-0x00007FF62DA21000-memory.dmp	upx
behavioral2/memory/4376-138-0x00007FF6B4110000-0x00007FF6B4461000-memory.dmp	upx
behavioral2/memory/3876-148-0x00007FF6F9750000-0x00007FF6F9AA1000-memory.dmp	upx
behavioral2/memory/1768-149-0x00007FF7814E0000-0x00007FF781831000-memory.dmp	upx
behavioral2/memory/3340-150-0x00007FF7A21D0000-0x00007FF7A2521000-memory.dmp	upx
behavioral2/memory/1660-156-0x00007FF7C8BA0000-0x00007FF7C8EF1000-memory.dmp	upx
behavioral2/memory/1360-162-0x00007FF6B0110000-0x00007FF6B0461000-memory.dmp	upx
behavioral2/memory/1320-163-0x00007FF677380000-0x00007FF6776D1000-memory.dmp	upx
behavioral2/memory/4052-164-0x00007FF6ACA00000-0x00007FF6ACD51000-memory.dmp	upx
behavioral2/memory/908-160-0x00007FF746670000-0x00007FF7469C1000-memory.dmp	upx
behavioral2/memory/4304-157-0x00007FF706F00000-0x00007FF707251000-memory.dmp	upx
behavioral2/memory/4376-165-0x00007FF6B4110000-0x00007FF6B4461000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\wYpAsvY.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GtkdgYy.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\tBHEgJX.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\FxcCrAb.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\AEJLGSj.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\llfWyDt.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gkxFwgB.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\LfVGTcA.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WHithOj.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wxtdObD.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OtpKjFe.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\vQHwkRt.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PPlhzXQ.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JrERlii.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\dzSKviJ.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\zXItcYS.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RCloMSm.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HzvzuWa.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\MtulWQL.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\sKQHvrT.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nseDhDY.exe	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4360	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	83
PID 4376 wrote to memory of 4360	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	83
PID 4376 wrote to memory of 2424	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 4376 wrote to memory of 2424	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 4376 wrote to memory of 4732	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 4376 wrote to memory of 4732	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 4376 wrote to memory of 2648	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 4376 wrote to memory of 2648	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 4376 wrote to memory of 1432	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 4376 wrote to memory of 1432	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 4376 wrote to memory of 3004	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 4376 wrote to memory of 3004	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 4376 wrote to memory of 2556	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 4376 wrote to memory of 2556	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 4376 wrote to memory of 2516	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 4376 wrote to memory of 2516	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 4376 wrote to memory of 4556	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 4376 wrote to memory of 4556	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 4376 wrote to memory of 4816	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 4376 wrote to memory of 4816	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 4376 wrote to memory of 3876	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 4376 wrote to memory of 3876	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 4376 wrote to memory of 1768	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 4376 wrote to memory of 1768	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 4376 wrote to memory of 3340	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 4376 wrote to memory of 3340	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 4376 wrote to memory of 1660	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 4376 wrote to memory of 1660	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 4376 wrote to memory of 4304	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 4376 wrote to memory of 4304	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 4376 wrote to memory of 1916	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 4376 wrote to memory of 1916	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 4376 wrote to memory of 4052	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 4376 wrote to memory of 4052	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 4376 wrote to memory of 908	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 4376 wrote to memory of 908	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 4376 wrote to memory of 4548	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 4376 wrote to memory of 4548	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 4376 wrote to memory of 1360	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 4376 wrote to memory of 1360	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 4376 wrote to memory of 1320	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 4376 wrote to memory of 1320	4376	2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe	103

C:\Users\Admin\AppData\Local\Temp\2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-20_86680d41caab6b4c7ab7f5280fa04cf7_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\System\GtkdgYy.exe
  C:\Windows\System\GtkdgYy.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\PPlhzXQ.exe
  C:\Windows\System\PPlhzXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\LfVGTcA.exe
  C:\Windows\System\LfVGTcA.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\JrERlii.exe
  C:\Windows\System\JrERlii.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\WHithOj.exe
  C:\Windows\System\WHithOj.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\MtulWQL.exe
  C:\Windows\System\MtulWQL.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\wxtdObD.exe
  C:\Windows\System\wxtdObD.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\tBHEgJX.exe
  C:\Windows\System\tBHEgJX.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\sKQHvrT.exe
  C:\Windows\System\sKQHvrT.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\dzSKviJ.exe
  C:\Windows\System\dzSKviJ.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\zXItcYS.exe
  C:\Windows\System\zXItcYS.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\RCloMSm.exe
  C:\Windows\System\RCloMSm.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\FxcCrAb.exe
  C:\Windows\System\FxcCrAb.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\OtpKjFe.exe
  C:\Windows\System\OtpKjFe.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\AEJLGSj.exe
  C:\Windows\System\AEJLGSj.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\llfWyDt.exe
  C:\Windows\System\llfWyDt.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\nseDhDY.exe
  C:\Windows\System\nseDhDY.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\HzvzuWa.exe
  C:\Windows\System\HzvzuWa.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\vQHwkRt.exe
  C:\Windows\System\vQHwkRt.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\gkxFwgB.exe
  C:\Windows\System\gkxFwgB.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\wYpAsvY.exe
  C:\Windows\System\wYpAsvY.exe
  2⤵
  - Executes dropped EXE
  PID:1320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AEJLGSj.exe

Filesize
5.2MB

MD5
b280c71cc7559eaf05a8a312f3e77c58

SHA1
b33422eb97e106983f7d467abe412f917689c482

SHA256
680dba4cca4ba2066beaed4e85c67c58bc2db6281437e5666e07049b55ab8422

SHA512
cfdfb8a5d4bdea17a355673350f5b8c94e044cd01d656c14ae3e4398415b23903390bbe393890a515f483e61fea1c7fbdf1c147c26188b81f1589bd5806e5302

Download Submit
C:\Windows\System\FxcCrAb.exe

Filesize
5.2MB

MD5
913a1ee874aae19080863cc22399a29d

SHA1
cec737ae9316b00c9a41eabde233fea891904f31

SHA256
b37921a71c6a2810cdad7ad0def497ab67038635ce9e1505e36dd5456a592900

SHA512
5e17a40e2662a23630247f83e334eb722fb933433e7fee180dce41b035f87b229c82d972af6057c37b6c38d4c6dde1f58f3c30eb2012559b3705c16dc2dc73d7

Download Submit
C:\Windows\System\GtkdgYy.exe

Filesize
5.2MB

MD5
0366d3719e06d16198ae563a11b058c8

SHA1
c900b33456a48661236fd97b3e1a2f2ee1e16460

SHA256
3bac880d59dfd8afd890157ad67f3303ae4d05a1dbc9357fc0d1f262aefce8a6

SHA512
3d9975ea178d71db2f9d4383d9b33fb8cbb99ee9beb2d6fffb469d846d70822e49654d4399769ca235a35e6dd5f0abe45526da33a5b41f786ae2e4ce487dd382

Download Submit
C:\Windows\System\HzvzuWa.exe

Filesize
5.2MB

MD5
47cf9f2485c889859d11e78a1d33b9c1

SHA1
e2c076185d6dfb74213825ce707fa835b89fe2aa

SHA256
29dc2f732e3997f292323b77f55b30c2e2933dab1ddacfdf595be6312074ecfd

SHA512
7050613b3f15e3bc356cbfcce5c507f721868d078a9269eaccb8fe2e8d3de9a67056232ec8fb9d378dd6224a6480bdc5420ebd8e263efd597458d4549905e257

Download Submit
C:\Windows\System\JrERlii.exe

Filesize
5.2MB

MD5
885911a136cbcc769df1928978b6234d

SHA1
921e93cd093d1f200c227ea6bfd7b06faa2702d2

SHA256
4fbec17f4910793e411f79d5d31a876cf3883f8a9c9c6b738834022fa56a5bf7

SHA512
2bf6c33a8545ab39ca49ecf8777062166a2f761bc3bb77bde14f76b5c20ea0b56c6837b8bfef76f9cdeed421eb1db1bbe3ea0353abf441b637c6dda53bf0c6e3

Download Submit
C:\Windows\System\LfVGTcA.exe

Filesize
5.2MB

MD5
30ec5189258bf17d6bf39d813c10ed3d

SHA1
1b66b78a2795d0958ba783c32d25fa7536c7ca1c

SHA256
0a9ae31453a84deb59495281f2cb8243d7137471b6b4e11abfed9f8b91c745a5

SHA512
4bda0044600b232097ab489b499b078bfcb54c053b9af206149c7ffc948742ae4a7bd8fbd410f36f2baec18b64148a3ca4316a6f32af99d48fa77fdf83dc4355

Download Submit
C:\Windows\System\MtulWQL.exe

Filesize
5.2MB

MD5
49ee9619c919a4f22fa8172a6000c950

SHA1
13efc91f283514992589dbe704e5fad5d93e3a80

SHA256
742a31bc2ba2f8daae282393570bdf231bbc13fa08ae047646b0b3afbcff21c1

SHA512
d4a554caa2d1c06080da01ef601229c5b50695199f17e5aa4580cc393b8d36cc780f0c6905b0570dae05db50e78eb2f149ea34d2d6adda823b7eb216a7db88c4

Download Submit
C:\Windows\System\OtpKjFe.exe

Filesize
5.2MB

MD5
59317e2b02bcbd6eb5f01e4f14184d80

SHA1
a4e156317f2800cc51ad44c6db69dda654ed5621

SHA256
9dfdfb0648058037ce465efd1edd54c75f0534afce4cd80e20cc75e72347ec7b

SHA512
633bf1f64fe20e4b9a2a4dd25448ed7dba4e2fff1571efd7e6718339f28bcb36514ef953f60beeb98f5eb8cf3375ee9c37e7faf7b38a2a93372407327bb665d6

Download Submit
C:\Windows\System\PPlhzXQ.exe

Filesize
5.2MB

MD5
d55a6d8675dfa604f77d0a5ce348d3b8

SHA1
c259b220da5801fdfb10a825ab3609094e113eac

SHA256
168ca26f3881e12d4b2c2d1e2baead93ec30484422cb977926bc90909ea109ab

SHA512
0c5b84a936f615e103aa4ec6c153c288e629b63b38cbc2dadacef522073884c9012d8d49cf293e36aee70eb1381c4a43ec75ed463e2bb8b06ada38ce9a4de3ec

Download Submit
C:\Windows\System\RCloMSm.exe

Filesize
5.2MB

MD5
d9cb2c7035a93dadbd545272dc3674cb

SHA1
c0fbbb708aa0e7d31a614595e6fcfb8716ff6d45

SHA256
6280f4a3e04059b0dbd3947a73e8400fa0be41f21ab43a75b5c5659b3ad07438

SHA512
2bd39fd28e31638d2f3db3e59b2f2f752b277f8e2c83e766f274a3489dcf40f2ac852cbb1fa4915ed3fd6118411a20a21ee66039680b1f27fdaca8fc3c4c31b5

Download Submit
C:\Windows\System\WHithOj.exe

Filesize
5.2MB

MD5
9dacf58f4b4ea566c0de787d3e8dbe2e

SHA1
649dbe9cf2bd8d9d125fca018c1a32133be588a1

SHA256
09bbd24e49a2c100977f975a618be29ea9d0e5e11d6338c4ed8fe1e3637d3966

SHA512
78c30f999c09f4d0cbd47da73f5ec847e8ab76041dd87ebc8a8b74091d6a0490adeb661bfc05563b3413008bb0e6d794bbbef06f3c6a3c87ded7827b800f59af

Download Submit
C:\Windows\System\dzSKviJ.exe

Filesize
5.2MB

MD5
315d57c5ce230331dc588725362a0a4a

SHA1
5c47368951b8fd3aad36cc5f8b3d9223676f7547

SHA256
32d8af26bc78fd88796955188b5310f9863f9c6e514783077838900a7b09e4a1

SHA512
f893adc92dccbf4ad1c2cf6e44488b70bcd020887e5443125295b48b5a38e9cc6d0eab4f733f5b78cc5f42e3a0947b25318683d2a8c3dd32331b30470b9c411d

Download Submit
C:\Windows\System\gkxFwgB.exe

Filesize
5.2MB

MD5
25f41c7bce6d53e5afdc11bddd3c6e65

SHA1
285ac2a35c1812b1f4f7cb536727bb2e5fe9bc0e

SHA256
df57c97de3b2baa54cd6e0425dc6eb2f5276756daeb6bb749eac7b31756c775a

SHA512
2b2bea555100bc48a6a0121cf18386c77d6fa28c0e5369c68737ac4773e2e20f8bdfda7914cccf1c2b1c4bc256349c97fe87704458c5c667a1e75f6e3f3cab46

Download Submit
C:\Windows\System\llfWyDt.exe

Filesize
5.2MB

MD5
73110aeb044d7af1dfdb2cb88409bba8

SHA1
4eaf60f57e9f21bf759e56a3c0bdc7f5b9fb40bc

SHA256
5fb1afeb843f7ca75e84144417695edb55d690b390099fefd2a3a0f098e2a15c

SHA512
fb9ea195b240bc604e390f98579a8561e4936a54678d034382ac6d8b81da85c40d0630f3185ed1f0090c4ccd9b4a9e7b94746c9b88f10d3350bd3daec1884e38

Download Submit
C:\Windows\System\nseDhDY.exe

Filesize
5.2MB

MD5
fe04a6cb415e8eb30e6b7b698b5c4f39

SHA1
8862d85ffbdb50ee4ef0913c09040ff3d253eb8f

SHA256
f9a904632703326666fd60b2357058904a9dab28126c46727e3d0ff0d3e11541

SHA512
70cea0ccad13abbdf6d501751ac3e43f2131e0feb1669a4a7a91d9243ebf760f3050efdfa3cf28e567d7833ae189b2b9f5e7360522657a86254744be9773a0a3

Download Submit
C:\Windows\System\sKQHvrT.exe

Filesize
5.2MB

MD5
d41b174bfcaea134069e0354d4e20ccd

SHA1
c3320743cd2d23dca265d763f3aaffbd51e20d53

SHA256
0af6cecd353e8afa6db91e811de444d0fe465a800b285ebc53e463350440bac9

SHA512
d1efd8a4a95a40721c47e7069f695175cdd8b3e5358cf10222927cf10bef289eb027cf57dbb853884629294fd3b69b972851e8b31c7e34606fac56c3ec66f4a6

Download Submit
C:\Windows\System\tBHEgJX.exe

Filesize
5.2MB

MD5
051e24a898ec977400264cc4f461bf2d

SHA1
49c8fc1b0da88b40da2e7644a6e0cedba8e92929

SHA256
13cbf6c2edee3a4f36715867cb141709577656efe17cc899ec3f5618f4c78e9d

SHA512
03a132d03d2b9bd40c23f49f5bec6cf79ac31dfa668d56ccc08a65a686d73295676a0d2d54f0e1f5c5dc1a847c2d604eedbdec52556dc3437b6fe171fb72ba3c

Download Submit
C:\Windows\System\vQHwkRt.exe

Filesize
5.2MB

MD5
c374e51a60f307945839ca2598160ad0

SHA1
9e9c4913a736a8912ad2f01f65d09f97b79b7eeb

SHA256
c964b31aeaca72aa118c3c74060250929c5ae4927b03839f2186dd9596e821b3

SHA512
7360de0be5a82a6c7ecd497aa5460e32e965c41d231a17069814525d6e0cf21e29680dc141336cec896c16f4de361975f0fe83bcc74291ab3f86341758ff5ea3

Download Submit
C:\Windows\System\wYpAsvY.exe

Filesize
5.2MB

MD5
ae5cc581e5bc2cd64320380d49a72af9

SHA1
36c0a6d16eb00d34070aa7138f771cba4122846b

SHA256
ccabd4871d064d3b55ed9f6913c915bf37130beca72a8803032602d5a658bc4d

SHA512
060ca773ad1fc0305539fe6a4133dfd4cf2ced14b1cdf3738e5f03c7c28fe63178926a86370e381b77d053512e98ba2ff4147741ccd97f0cdc91693e5780b97f

Download Submit
C:\Windows\System\wxtdObD.exe

Filesize
5.2MB

MD5
614c658bd0a9f47f40ba55149926c540

SHA1
5bb4c0cceca3a2525cd9f81f80c0c03ee8edf912

SHA256
2f46759690979aa70ae681c20d1c757b212fa3f8ff48541218e08967eaf74205

SHA512
c0f59958dcbbad7df2f109a69cbe574705eaa1e9ade5b5b617e0320031bc2344c727b9c5f984a80d4a0c21b372076b6f81e297056ca02bcb2e1b531d7c77aa74

Download Submit
C:\Windows\System\zXItcYS.exe

Filesize
5.2MB

MD5
4de2f8c5c2cd50ea6d1ab37f26834a5e

SHA1
22a1980c7a1a8ca912635034d75d2f3aef9076d0

SHA256
2bca4e05ae1de760cacc8233d4f4c774b0d1d2eafd085a3e15354663a9fcb345

SHA512
d21ce09b0921471e976341d5c7c65608d4b71558e465e3ba42ad7d953db688ac3cdb48a454e132860df50bff03dff2c2cafebde6835feeda230cfe65d7996afd

Download Submit
memory/908-125-0x00007FF746670000-0x00007FF7469C1000-memory.dmp

Filesize
3.3MB

Download
memory/908-160-0x00007FF746670000-0x00007FF7469C1000-memory.dmp

Filesize
3.3MB

Download
memory/1320-135-0x00007FF677380000-0x00007FF6776D1000-memory.dmp

Filesize
3.3MB

Download
memory/1320-163-0x00007FF677380000-0x00007FF6776D1000-memory.dmp

Filesize
3.3MB

Download
memory/1360-126-0x00007FF6B0110000-0x00007FF6B0461000-memory.dmp

Filesize
3.3MB

Download
memory/1360-162-0x00007FF6B0110000-0x00007FF6B0461000-memory.dmp

Filesize
3.3MB

Download
memory/1432-89-0x00007FF6F4760000-0x00007FF6F4AB1000-memory.dmp

Filesize
3.3MB

Download
memory/1432-30-0x00007FF6F4760000-0x00007FF6F4AB1000-memory.dmp

Filesize
3.3MB

Download
memory/1660-92-0x00007FF7C8BA0000-0x00007FF7C8EF1000-memory.dmp

Filesize
3.3MB

Download
memory/1660-156-0x00007FF7C8BA0000-0x00007FF7C8EF1000-memory.dmp

Filesize
3.3MB

Download
memory/1768-76-0x00007FF7814E0000-0x00007FF781831000-memory.dmp

Filesize
3.3MB

Download
memory/1768-149-0x00007FF7814E0000-0x00007FF781831000-memory.dmp

Filesize
3.3MB

Download
memory/1916-111-0x00007FF75CF30000-0x00007FF75D281000-memory.dmp

Filesize
3.3MB

Download
memory/2424-12-0x00007FF616080000-0x00007FF6163D1000-memory.dmp

Filesize
3.3MB

Download
memory/2424-68-0x00007FF616080000-0x00007FF6163D1000-memory.dmp

Filesize
3.3MB

Download
memory/2516-117-0x00007FF77C900000-0x00007FF77CC51000-memory.dmp

Filesize
3.3MB

Download
memory/2516-49-0x00007FF77C900000-0x00007FF77CC51000-memory.dmp

Filesize
3.3MB

Download
memory/2556-41-0x00007FF796B10000-0x00007FF796E61000-memory.dmp

Filesize
3.3MB

Download
memory/2556-110-0x00007FF796B10000-0x00007FF796E61000-memory.dmp

Filesize
3.3MB

Download
memory/2648-26-0x00007FF7FEBD0000-0x00007FF7FEF21000-memory.dmp

Filesize
3.3MB

Download
memory/2648-81-0x00007FF7FEBD0000-0x00007FF7FEF21000-memory.dmp

Filesize
3.3MB

Download
memory/3004-96-0x00007FF62D6D0000-0x00007FF62DA21000-memory.dmp

Filesize
3.3MB

Download
memory/3004-36-0x00007FF62D6D0000-0x00007FF62DA21000-memory.dmp

Filesize
3.3MB

Download
memory/3340-150-0x00007FF7A21D0000-0x00007FF7A2521000-memory.dmp

Filesize
3.3MB

Download
memory/3340-87-0x00007FF7A21D0000-0x00007FF7A2521000-memory.dmp

Filesize
3.3MB

Download
memory/3876-148-0x00007FF6F9750000-0x00007FF6F9AA1000-memory.dmp

Filesize
3.3MB

Download
memory/3876-69-0x00007FF6F9750000-0x00007FF6F9AA1000-memory.dmp

Filesize
3.3MB

Download
memory/4052-115-0x00007FF6ACA00000-0x00007FF6ACD51000-memory.dmp

Filesize
3.3MB

Download
memory/4052-164-0x00007FF6ACA00000-0x00007FF6ACD51000-memory.dmp

Filesize
3.3MB

Download
memory/4304-157-0x00007FF706F00000-0x00007FF707251000-memory.dmp

Filesize
3.3MB

Download
memory/4304-97-0x00007FF706F00000-0x00007FF707251000-memory.dmp

Filesize
3.3MB

Download
memory/4360-63-0x00007FF62D370000-0x00007FF62D6C1000-memory.dmp

Filesize
3.3MB

Download
memory/4360-7-0x00007FF62D370000-0x00007FF62D6C1000-memory.dmp

Filesize
3.3MB

Download
memory/4376-56-0x00007FF6B4110000-0x00007FF6B4461000-memory.dmp

Filesize
3.3MB

Download
memory/4376-138-0x00007FF6B4110000-0x00007FF6B4461000-memory.dmp

Filesize
3.3MB

Download
memory/4376-165-0x00007FF6B4110000-0x00007FF6B4461000-memory.dmp

Filesize
3.3MB

Download
memory/4376-1-0x0000021CC97F0000-0x0000021CC9800000-memory.dmp

Filesize
64KB

Download
memory/4376-0-0x00007FF6B4110000-0x00007FF6B4461000-memory.dmp

Filesize
3.3MB

Download
memory/4548-132-0x00007FF792ED0000-0x00007FF793221000-memory.dmp

Filesize
3.3MB

Download
memory/4556-53-0x00007FF66E0C0000-0x00007FF66E411000-memory.dmp

Filesize
3.3MB

Download
memory/4556-131-0x00007FF66E0C0000-0x00007FF66E411000-memory.dmp

Filesize
3.3MB

Download
memory/4732-18-0x00007FF6AED80000-0x00007FF6AF0D1000-memory.dmp

Filesize
3.3MB

Download
memory/4732-75-0x00007FF6AED80000-0x00007FF6AF0D1000-memory.dmp

Filesize
3.3MB

Download
memory/4816-64-0x00007FF6B5400000-0x00007FF6B5751000-memory.dmp

Filesize
3.3MB

Download