cobaltstrike | 94fcc9fd6147ce193da373c8c596834c76a433d3a1113886e87f30cf047baca3

Analysis

max time kernel
140s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.2MB
MD5

9c5c9f78c181fbc34d077734d6c79e5f
SHA1

0c063299f75e9d6401293a938af95f220ab3283d
SHA256

94fcc9fd6147ce193da373c8c596834c76a433d3a1113886e87f30cf047baca3
SHA512

da57e1af529891d06b90da7da6e912be6f318346a3c9e4ba95a8e06ee126d1d029b6a01b01bfe1a372d8b66b43bedd25b0a8a6486bd711526f02da69ba576781
SSDEEP

49152:ROdWCCi7/raA56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lz:RWWBibj56utgpPFotBER/mQ32lUf

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000900000002344b-6.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a7-9.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a8-32.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234ab-37.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234ad-41.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234b1-71.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234b2-106.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234b7-117.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234b8-119.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234b6-111.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234b4-100.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234b3-99.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234b5-104.dat	cobalt_reflective_dll
behavioral2/files/0x00080000000234a3-94.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234b0-83.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234af-78.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234ae-62.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234ac-54.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a9-43.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234aa-36.dat	cobalt_reflective_dll
behavioral2/files/0x00070000000234a6-14.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 45 IoCs

miner

resource	yara_rule
behavioral2/memory/1528-81-0x00007FF6E1690000-0x00007FF6E19E1000-memory.dmp	xmrig
behavioral2/memory/4304-92-0x00007FF7FA1A0000-0x00007FF7FA4F1000-memory.dmp	xmrig
behavioral2/memory/4940-91-0x00007FF6BBF40000-0x00007FF6BC291000-memory.dmp	xmrig
behavioral2/memory/948-65-0x00007FF70F4A0000-0x00007FF70F7F1000-memory.dmp	xmrig
behavioral2/memory/3112-63-0x00007FF607770000-0x00007FF607AC1000-memory.dmp	xmrig
behavioral2/memory/2972-58-0x00007FF7481E0000-0x00007FF748531000-memory.dmp	xmrig
behavioral2/memory/3720-46-0x00007FF703490000-0x00007FF7037E1000-memory.dmp	xmrig
behavioral2/memory/3292-123-0x00007FF6A9520000-0x00007FF6A9871000-memory.dmp	xmrig
behavioral2/memory/3296-124-0x00007FF630890000-0x00007FF630BE1000-memory.dmp	xmrig
behavioral2/memory/1408-126-0x00007FF726A80000-0x00007FF726DD1000-memory.dmp	xmrig
behavioral2/memory/4596-125-0x00007FF6342D0000-0x00007FF634621000-memory.dmp	xmrig
behavioral2/memory/4196-127-0x00007FF781470000-0x00007FF7817C1000-memory.dmp	xmrig
behavioral2/memory/400-122-0x00007FF7672E0000-0x00007FF767631000-memory.dmp	xmrig
behavioral2/memory/4520-121-0x00007FF677830000-0x00007FF677B81000-memory.dmp	xmrig
behavioral2/memory/1752-130-0x00007FF782A70000-0x00007FF782DC1000-memory.dmp	xmrig
behavioral2/memory/1644-129-0x00007FF608B50000-0x00007FF608EA1000-memory.dmp	xmrig
behavioral2/memory/4004-136-0x00007FF77A450000-0x00007FF77A7A1000-memory.dmp	xmrig
behavioral2/memory/716-128-0x00007FF778D60000-0x00007FF7790B1000-memory.dmp	xmrig
behavioral2/memory/4636-132-0x00007FF67A630000-0x00007FF67A981000-memory.dmp	xmrig
behavioral2/memory/916-142-0x00007FF6A6D10000-0x00007FF6A7061000-memory.dmp	xmrig
behavioral2/memory/4464-145-0x00007FF7C61B0000-0x00007FF7C6501000-memory.dmp	xmrig
behavioral2/memory/540-143-0x00007FF7B43E0000-0x00007FF7B4731000-memory.dmp	xmrig
behavioral2/memory/716-150-0x00007FF778D60000-0x00007FF7790B1000-memory.dmp	xmrig
behavioral2/memory/716-151-0x00007FF778D60000-0x00007FF7790B1000-memory.dmp	xmrig
behavioral2/memory/1644-202-0x00007FF608B50000-0x00007FF608EA1000-memory.dmp	xmrig
behavioral2/memory/1752-218-0x00007FF782A70000-0x00007FF782DC1000-memory.dmp	xmrig
behavioral2/memory/3112-220-0x00007FF607770000-0x00007FF607AC1000-memory.dmp	xmrig
behavioral2/memory/4636-222-0x00007FF67A630000-0x00007FF67A981000-memory.dmp	xmrig
behavioral2/memory/3720-224-0x00007FF703490000-0x00007FF7037E1000-memory.dmp	xmrig
behavioral2/memory/948-226-0x00007FF70F4A0000-0x00007FF70F7F1000-memory.dmp	xmrig
behavioral2/memory/1528-228-0x00007FF6E1690000-0x00007FF6E19E1000-memory.dmp	xmrig
behavioral2/memory/2972-230-0x00007FF7481E0000-0x00007FF748531000-memory.dmp	xmrig
behavioral2/memory/4004-232-0x00007FF77A450000-0x00007FF77A7A1000-memory.dmp	xmrig
behavioral2/memory/4940-234-0x00007FF6BBF40000-0x00007FF6BC291000-memory.dmp	xmrig
behavioral2/memory/4520-236-0x00007FF677830000-0x00007FF677B81000-memory.dmp	xmrig
behavioral2/memory/400-238-0x00007FF7672E0000-0x00007FF767631000-memory.dmp	xmrig
behavioral2/memory/4304-240-0x00007FF7FA1A0000-0x00007FF7FA4F1000-memory.dmp	xmrig
behavioral2/memory/916-246-0x00007FF6A6D10000-0x00007FF6A7061000-memory.dmp	xmrig
behavioral2/memory/3296-245-0x00007FF630890000-0x00007FF630BE1000-memory.dmp	xmrig
behavioral2/memory/3292-249-0x00007FF6A9520000-0x00007FF6A9871000-memory.dmp	xmrig
behavioral2/memory/4464-250-0x00007FF7C61B0000-0x00007FF7C6501000-memory.dmp	xmrig
behavioral2/memory/1408-255-0x00007FF726A80000-0x00007FF726DD1000-memory.dmp	xmrig
behavioral2/memory/540-257-0x00007FF7B43E0000-0x00007FF7B4731000-memory.dmp	xmrig
behavioral2/memory/4596-258-0x00007FF6342D0000-0x00007FF634621000-memory.dmp	xmrig
behavioral2/memory/4196-252-0x00007FF781470000-0x00007FF7817C1000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
1644	blyGwAx.exe
1752	riwkUMW.exe
3112	pIpKuOL.exe
4636	mqEjsCz.exe
948	PsPAikb.exe
3720	MOHKnpQ.exe
1528	ZbrQPcn.exe
4004	KheFuVP.exe
2972	CdHUhgj.exe
4940	GLyNgqs.exe
4520	QEtqcWD.exe
400	COmKUiV.exe
4304	wIvpoHt.exe
916	tKZrmlt.exe
540	OrpEUtB.exe
3292	wFAUjVP.exe
4464	bDAmdUW.exe
3296	XckbqOH.exe
4596	ngzKgLf.exe
1408	wmPdJQf.exe
4196	uyzRmKs.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/716-0-0x00007FF778D60000-0x00007FF7790B1000-memory.dmp	upx
behavioral2/files/0x000900000002344b-6.dat	upx
behavioral2/files/0x00070000000234a7-9.dat	upx
behavioral2/files/0x00070000000234a8-32.dat	upx
behavioral2/files/0x00070000000234ab-37.dat	upx
behavioral2/files/0x00070000000234ad-41.dat	upx
behavioral2/files/0x00070000000234b1-71.dat	upx
behavioral2/memory/1528-81-0x00007FF6E1690000-0x00007FF6E19E1000-memory.dmp	upx
behavioral2/memory/4304-92-0x00007FF7FA1A0000-0x00007FF7FA4F1000-memory.dmp	upx
behavioral2/memory/916-97-0x00007FF6A6D10000-0x00007FF6A7061000-memory.dmp	upx
behavioral2/files/0x00070000000234b2-106.dat	upx
behavioral2/files/0x00070000000234b7-117.dat	upx
behavioral2/files/0x00070000000234b8-119.dat	upx
behavioral2/memory/4464-115-0x00007FF7C61B0000-0x00007FF7C6501000-memory.dmp	upx
behavioral2/files/0x00070000000234b6-111.dat	upx
behavioral2/memory/540-103-0x00007FF7B43E0000-0x00007FF7B4731000-memory.dmp	upx
behavioral2/files/0x00070000000234b4-100.dat	upx
behavioral2/files/0x00070000000234b3-99.dat	upx
behavioral2/files/0x00070000000234b5-104.dat	upx
behavioral2/files/0x00080000000234a3-94.dat	upx
behavioral2/memory/4940-91-0x00007FF6BBF40000-0x00007FF6BC291000-memory.dmp	upx
behavioral2/files/0x00070000000234b0-83.dat	upx
behavioral2/files/0x00070000000234af-78.dat	upx
behavioral2/memory/948-65-0x00007FF70F4A0000-0x00007FF70F7F1000-memory.dmp	upx
behavioral2/memory/3112-63-0x00007FF607770000-0x00007FF607AC1000-memory.dmp	upx
behavioral2/files/0x00070000000234ae-62.dat	upx
behavioral2/memory/2972-58-0x00007FF7481E0000-0x00007FF748531000-memory.dmp	upx
behavioral2/files/0x00070000000234ac-54.dat	upx
behavioral2/memory/4004-53-0x00007FF77A450000-0x00007FF77A7A1000-memory.dmp	upx
behavioral2/memory/3720-46-0x00007FF703490000-0x00007FF7037E1000-memory.dmp	upx
behavioral2/files/0x00070000000234a9-43.dat	upx
behavioral2/files/0x00070000000234aa-36.dat	upx
behavioral2/memory/4636-31-0x00007FF67A630000-0x00007FF67A981000-memory.dmp	upx
behavioral2/memory/1752-22-0x00007FF782A70000-0x00007FF782DC1000-memory.dmp	upx
behavioral2/files/0x00070000000234a6-14.dat	upx
behavioral2/memory/1644-10-0x00007FF608B50000-0x00007FF608EA1000-memory.dmp	upx
behavioral2/memory/3292-123-0x00007FF6A9520000-0x00007FF6A9871000-memory.dmp	upx
behavioral2/memory/3296-124-0x00007FF630890000-0x00007FF630BE1000-memory.dmp	upx
behavioral2/memory/1408-126-0x00007FF726A80000-0x00007FF726DD1000-memory.dmp	upx
behavioral2/memory/4596-125-0x00007FF6342D0000-0x00007FF634621000-memory.dmp	upx
behavioral2/memory/4196-127-0x00007FF781470000-0x00007FF7817C1000-memory.dmp	upx
behavioral2/memory/400-122-0x00007FF7672E0000-0x00007FF767631000-memory.dmp	upx
behavioral2/memory/4520-121-0x00007FF677830000-0x00007FF677B81000-memory.dmp	upx
behavioral2/memory/1752-130-0x00007FF782A70000-0x00007FF782DC1000-memory.dmp	upx
behavioral2/memory/1644-129-0x00007FF608B50000-0x00007FF608EA1000-memory.dmp	upx
behavioral2/memory/4004-136-0x00007FF77A450000-0x00007FF77A7A1000-memory.dmp	upx
behavioral2/memory/716-128-0x00007FF778D60000-0x00007FF7790B1000-memory.dmp	upx
behavioral2/memory/4636-132-0x00007FF67A630000-0x00007FF67A981000-memory.dmp	upx
behavioral2/memory/916-142-0x00007FF6A6D10000-0x00007FF6A7061000-memory.dmp	upx
behavioral2/memory/4464-145-0x00007FF7C61B0000-0x00007FF7C6501000-memory.dmp	upx
behavioral2/memory/540-143-0x00007FF7B43E0000-0x00007FF7B4731000-memory.dmp	upx
behavioral2/memory/716-150-0x00007FF778D60000-0x00007FF7790B1000-memory.dmp	upx
behavioral2/memory/716-151-0x00007FF778D60000-0x00007FF7790B1000-memory.dmp	upx
behavioral2/memory/1644-202-0x00007FF608B50000-0x00007FF608EA1000-memory.dmp	upx
behavioral2/memory/1752-218-0x00007FF782A70000-0x00007FF782DC1000-memory.dmp	upx
behavioral2/memory/3112-220-0x00007FF607770000-0x00007FF607AC1000-memory.dmp	upx
behavioral2/memory/4636-222-0x00007FF67A630000-0x00007FF67A981000-memory.dmp	upx
behavioral2/memory/3720-224-0x00007FF703490000-0x00007FF7037E1000-memory.dmp	upx
behavioral2/memory/948-226-0x00007FF70F4A0000-0x00007FF70F7F1000-memory.dmp	upx
behavioral2/memory/1528-228-0x00007FF6E1690000-0x00007FF6E19E1000-memory.dmp	upx
behavioral2/memory/2972-230-0x00007FF7481E0000-0x00007FF748531000-memory.dmp	upx
behavioral2/memory/4004-232-0x00007FF77A450000-0x00007FF77A7A1000-memory.dmp	upx
behavioral2/memory/4940-234-0x00007FF6BBF40000-0x00007FF6BC291000-memory.dmp	upx
behavioral2/memory/4520-236-0x00007FF677830000-0x00007FF677B81000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\pIpKuOL.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PsPAikb.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZbrQPcn.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\CdHUhgj.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GLyNgqs.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\QEtqcWD.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\tKZrmlt.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OrpEUtB.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wFAUjVP.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\riwkUMW.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KheFuVP.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\bDAmdUW.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\XckbqOH.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ngzKgLf.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uyzRmKs.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\blyGwAx.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\COmKUiV.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mqEjsCz.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\MOHKnpQ.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wIvpoHt.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wmPdJQf.exe	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 1644	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	83
PID 716 wrote to memory of 1644	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	83
PID 716 wrote to memory of 1752	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 716 wrote to memory of 1752	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	84
PID 716 wrote to memory of 3112	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 716 wrote to memory of 3112	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 716 wrote to memory of 4636	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 716 wrote to memory of 4636	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 716 wrote to memory of 948	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 716 wrote to memory of 948	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 716 wrote to memory of 3720	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 716 wrote to memory of 3720	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 716 wrote to memory of 1528	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 716 wrote to memory of 1528	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 716 wrote to memory of 4004	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 716 wrote to memory of 4004	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 716 wrote to memory of 2972	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 716 wrote to memory of 2972	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 716 wrote to memory of 4940	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 716 wrote to memory of 4940	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 716 wrote to memory of 4520	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 716 wrote to memory of 4520	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 716 wrote to memory of 400	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 716 wrote to memory of 400	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 716 wrote to memory of 4304	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 716 wrote to memory of 4304	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	95
PID 716 wrote to memory of 916	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 716 wrote to memory of 916	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 716 wrote to memory of 540	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 716 wrote to memory of 540	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 716 wrote to memory of 3292	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 716 wrote to memory of 3292	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 716 wrote to memory of 4464	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 716 wrote to memory of 4464	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 716 wrote to memory of 3296	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 716 wrote to memory of 3296	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 716 wrote to memory of 4596	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 716 wrote to memory of 4596	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 716 wrote to memory of 1408	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 716 wrote to memory of 1408	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 716 wrote to memory of 4196	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 716 wrote to memory of 4196	716	2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe	103

C:\Users\Admin\AppData\Local\Temp\2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-25_9c5c9f78c181fbc34d077734d6c79e5f_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:716
- C:\Windows\System\blyGwAx.exe
  C:\Windows\System\blyGwAx.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\riwkUMW.exe
  C:\Windows\System\riwkUMW.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\pIpKuOL.exe
  C:\Windows\System\pIpKuOL.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\mqEjsCz.exe
  C:\Windows\System\mqEjsCz.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\PsPAikb.exe
  C:\Windows\System\PsPAikb.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\MOHKnpQ.exe
  C:\Windows\System\MOHKnpQ.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\ZbrQPcn.exe
  C:\Windows\System\ZbrQPcn.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\KheFuVP.exe
  C:\Windows\System\KheFuVP.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\CdHUhgj.exe
  C:\Windows\System\CdHUhgj.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\GLyNgqs.exe
  C:\Windows\System\GLyNgqs.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\QEtqcWD.exe
  C:\Windows\System\QEtqcWD.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\COmKUiV.exe
  C:\Windows\System\COmKUiV.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\wIvpoHt.exe
  C:\Windows\System\wIvpoHt.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\tKZrmlt.exe
  C:\Windows\System\tKZrmlt.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\OrpEUtB.exe
  C:\Windows\System\OrpEUtB.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\wFAUjVP.exe
  C:\Windows\System\wFAUjVP.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\bDAmdUW.exe
  C:\Windows\System\bDAmdUW.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\XckbqOH.exe
  C:\Windows\System\XckbqOH.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\ngzKgLf.exe
  C:\Windows\System\ngzKgLf.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\wmPdJQf.exe
  C:\Windows\System\wmPdJQf.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\uyzRmKs.exe
  C:\Windows\System\uyzRmKs.exe
  2⤵
  - Executes dropped EXE
  PID:4196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\COmKUiV.exe

Filesize
5.2MB

MD5
82bf02eeadb824f7b2eb8832db405814

SHA1
31f64f181e135ab92779e1f93067ed7045c66665

SHA256
820cb758bf4d9ac798c6b35157aa8f58e1adce8074b238be7e9de0213a7f9300

SHA512
6359ac267778a1bc762fe565fda646be9aa7f9d4728c2e7ae7447f52f1c81dbd8791ef96ed2fca2a4c0ff5080f63e182a3dff3fbdf5a5a44bf5a8443705ac945

Download Submit
C:\Windows\System\CdHUhgj.exe

Filesize
5.2MB

MD5
f48949f9a69d6722fd6b80229b8bd82e

SHA1
39425934e85103da70142bcb5e2608b44ae39e05

SHA256
e4f253ac16abff954e74f9e2f78b46115bf5a6d0abfbd191d58b715ce99fda74

SHA512
280d660a46d503b65afc34d03f2af0087e1dc578c4fe2d7381d9f09e5a38d12fc0ed4877bb95df51e4717657adab21813c1e36a47921ac48b6ec79778cde02a2

Download Submit
C:\Windows\System\GLyNgqs.exe

Filesize
5.2MB

MD5
0dc00a77c4e767d289f5b713c9f8c8ca

SHA1
f7b29bdbcc404322fcc0d3ad1a96e40dedba38f5

SHA256
e708133389835329206b06749aab284dc34810d5afc56b8b6e0a49da89513400

SHA512
bffbe631d02c98e71d419e510b413c79a6252bf591e7a49408d9943b63054f896ae385013c32a6bd9242273fc899bf8131e2ccb5f978e0a451e0d972b9212162

Download Submit
C:\Windows\System\KheFuVP.exe

Filesize
5.2MB

MD5
02fad570506e7eff2a314dc38a1c634d

SHA1
a8e70f4a8515e355e3c00911d96bd3c11a356026

SHA256
cbe1db5ed885ce49621086a51b5c5dbdf794c24d35d7af24690e05a5c88066b6

SHA512
770f501a330a2df2c2c17dc8b40ac20f5bae79be3c3e48bf2bd69a0c5a8810474d50190f137c67e41deab6632c151bf17b8ebcf7d5df6132e1c96e39edc44819

Download Submit
C:\Windows\System\MOHKnpQ.exe

Filesize
5.2MB

MD5
c5e27a80cde68e8b829267ef1ea040a0

SHA1
308f7a245d0f62deee3cf1321630f8d037d29e85

SHA256
3a2f6b100f0e84feb467e9f009e72fc3906991785d561c8709c88361b54d66de

SHA512
0a46d4c90a4ac8db48a4a9bf07679ef9e5a21dc0776e1694b8702f2b4d85a2dea223d74b3bf183b6d8794b472933fda4b0ea5d70ef039278fb90454b349c63b3

Download Submit
C:\Windows\System\OrpEUtB.exe

Filesize
5.2MB

MD5
87675d70a3efb238427d8e99065e3198

SHA1
a6138230a75e5ffd727898cff853844aa90d4e46

SHA256
bc76cdcca11ba798e81d45d76137d809b2c39accf78e0d40502c9febf8ef558f

SHA512
f457f135d2a1e2052ec612d9604d29ed8a8346e67423d54e2509fce1943eaed9855b46b4c3583d17307e4f39bf4629f9e07cc03f555499729e2a30ce6e9f2739

Download Submit
C:\Windows\System\PsPAikb.exe

Filesize
5.2MB

MD5
ee0c31d5689c4657ec3e116553117725

SHA1
6ab159fa747cd43169e8721faf4e6e4aa08f0e64

SHA256
b2ed17e48e90c0b890839476313e77a00d5693e104354f0eb11672873bc78720

SHA512
5ec3f11482e8346c0aacfaab9379738944212f21a70b15b5b419f155c347e4809f799df472d1cba3d238a272254d392a12816644f1392016e12a9014949b623a

Download Submit
C:\Windows\System\QEtqcWD.exe

Filesize
5.2MB

MD5
07fb4ce85d2c29990b241380bd0909e3

SHA1
fbf891eb564489b66dbe5d73f034d5a87f5f16f9

SHA256
de287d5829fec2e0cc8282086dff6d6f61219f7b0d03da447c10624a86b93193

SHA512
2c7d67b413ddfe9fbe4afdc8243ab2c782cd58e8599b604694207559dac7a667bbc5fca5e2b6f5322bfbc9c804bd7c76a9452ade04b1ada8691ac003bd28b74f

Download Submit
C:\Windows\System\XckbqOH.exe

Filesize
5.2MB

MD5
dab40264a5ec4ca4cb49d6ba58e76e38

SHA1
747d5be4ca7ae569b40c3f14f20a145e80d9961a

SHA256
a1448ff7049e8848f3982d1d7b2b1d6dd3ba9cd2ed44216e53b1fddf88067fe2

SHA512
7356a1315c05d75fa4f657e4f71d0b7d33a1aa8c1a8efba7b27192dd9ea9f91a5faabc0e6fc128318571c0281a83b441b8793835498dc92571fdafbf85f8daf4

Download Submit
C:\Windows\System\ZbrQPcn.exe

Filesize
5.2MB

MD5
85722a42292567df48e3b6697f3ba923

SHA1
0b7f3f12c316d7cda65368827d3ec95c71384c33

SHA256
ffd63de2eca1966b3d5639a118f6188ed105fe85017bd8f4ef852152600d1d35

SHA512
46cfb6ab1b014b39e753c85b595720dcd7e95dc48d855428c1f67bdc1244a8aff858b6c19ab7d40fae929dd6389d8c6d45734780d1e73f42d432cf9fdd795149

Download Submit
C:\Windows\System\bDAmdUW.exe

Filesize
5.2MB

MD5
54a4ff179a19ba3fa36e967121a820c3

SHA1
a73d067dbce8d096fffc9548d9d2ced85c221194

SHA256
ad76df273e7194d39bbfe2fd7a0a4e8caecd6286aa04a64978ac67dd17c269b9

SHA512
0000cdc73bc6d6a47016ea451588bc7523700995049edd8424bc3ffab920dbbc241765a4f35aa7c71af626dbb7c4a16ecde3898bf519994d1689a3eadb7f0c8a

Download Submit
C:\Windows\System\blyGwAx.exe

Filesize
5.2MB

MD5
e7467e2f9e626e57eff105718abcdfbd

SHA1
0bae85183c2cee6670288922eea1da3846916eeb

SHA256
b1025bab074812d271433f588e369fd3832e935f7510ea1b2ea7cee446d9ee73

SHA512
b543c3ea36ed2e7856091c41246e1fcb55063f29d8b204e66d5e0c69c09aaca6e3986415c9df93477ee4edcca6a6d440fd21afc2af9516ad506d4293ac3cd47a

Download Submit
C:\Windows\System\mqEjsCz.exe

Filesize
5.2MB

MD5
f09bce5bbc248579d1c238dbe27bda8c

SHA1
fe2d28429c615f9a8ab791c07f1dc619f40228f6

SHA256
25890de9c52318343653101819fc0aa23ce9e2ba54b85ed8762f9ab4af5f30d3

SHA512
c1ce555f8f5beb7a77ef1ebdac4af8eac40350450c02f04286723a0233a20135c201e2e95b129adfdbe3fe1089bdc5b15dc4d4df7e07568b51303ee37d1bade7

Download Submit
C:\Windows\System\ngzKgLf.exe

Filesize
5.2MB

MD5
c83ae3c46bbfc649b24e8d54b6cf6527

SHA1
ab49db7465a25b51c8febf2b635f1e801a0f487e

SHA256
ffe441b12dcb5680405931f899f0d3e9833ef096cfbef595b5ab79dde7da08c8

SHA512
dcf22757eb94ea37a22f40f4658a0dc41f11e65298ddb151794d1ef749f43f21cbb029c9543ee1e9f1bd1b04fc7558c29185c672ba92eadd901fe02990b0206b

Download Submit
C:\Windows\System\pIpKuOL.exe

Filesize
5.2MB

MD5
37f2d3655bfa5b323da7f42d07447ecf

SHA1
8b1b4ba968ffdd5602ad928d508bbaeaae6ef6f2

SHA256
aac141bf2127596a650b46e8a1b5ffa6cd0c88d948d50e49890e61c612c40bab

SHA512
3eafc6c0e833959d3700ccaaddb2b5c6203e91d5c76f041d8c0add527e32e23a9871e7513fb35d69fc928417f95da55f8db6a036190d46ef1c922baa6a6f5bae

Download Submit
C:\Windows\System\riwkUMW.exe

Filesize
5.2MB

MD5
a59bb8f137046a9b13a3d5e0f2ab427c

SHA1
37bb5c80ba81e2b931e71e54a5f17e884aa0ec19

SHA256
1448b42668116a08b60869eb60be6c2be410320da6d7dbad180dda8bdcec0c7b

SHA512
382c8edf20d97cad00e1c867468cb841775009c969987fe0d9e40ef910c8bdd82032a11a1f51fe1c8f20e19a2e2c872aeedee0a7625b16d09045d1a4cd86f7b5

Download Submit
C:\Windows\System\tKZrmlt.exe

Filesize
5.2MB

MD5
57d63563a7f347d62b405913c4c7ef5e

SHA1
bfac7b8689e925ffb517b9ad099c44357b87ebab

SHA256
200ebd9a74aae7bcc59cf6f0156ab018cb91c0a9feded3384498017007b09f8b

SHA512
dc83e281d9a1500cd99040d0b5ae1f5d4c09c4c0f4005697f98c413e279f23161b6e11bfd005643b8f0761e794ec240d01346ed4176e4c2d829f4f988ef9f4df

Download Submit
C:\Windows\System\uyzRmKs.exe

Filesize
5.2MB

MD5
1c54473c7afa1875b661a10e53f32e30

SHA1
acd43c9e22a5e297b309deaf48aba3a68074f786

SHA256
b7e3064a387a11832128f29efd3a067a828ef474110523495752c401f7ecf7e8

SHA512
382f18d02018e94a61f17b435cade2d0206becf68ce7a1e5b43a0502bacf24cbb33bdb24c0cea9ff608f60e8478ca031d30df747136f36d23e72a913311f5df9

Download Submit
C:\Windows\System\wFAUjVP.exe

Filesize
5.2MB

MD5
a2e9eb6c5f2c3c31f9befa5c342b47c5

SHA1
66c076419f8b3eff2cd2292950dd13c0380d40ea

SHA256
8518d7aa9f06d0d975ff92245e411c5c40c067ddea343342f9298c8bf9a86bd6

SHA512
894efd7c749a4c5187757d80fc465dc080fae7d6beaec084ae27de1f9c93ecde740d2d275d6a4598090c02f72571596093d2b4862ad37acb6b8184c7f23b9eeb

Download Submit
C:\Windows\System\wIvpoHt.exe

Filesize
5.2MB

MD5
aa44b5be86f5dcc38a5d16dad9466e84

SHA1
e0a5fda335cee6cb5bcb0b81909951777e00d663

SHA256
0032aa999d2f9d1d5a1dbd211d02f8a037e2e91573470a318c749f972eb0c83b

SHA512
af50e2910a10584341f8248fc8abcd20cecb8bd87f4f70aaa562ee9042eab0aff4c3b72d8e92f1daa562775d5a144c5b0633d48ace1475b587db2b2daa6e0efa

Download Submit
C:\Windows\System\wmPdJQf.exe

Filesize
5.2MB

MD5
4e2e96ad7108782a2969a609b9d0fa67

SHA1
a72e8643e2138fe9974395e73570bbd7902db160

SHA256
657a620de89296b2119e6446abf0a3c7cab194d2158d269c7be4277bba4cf330

SHA512
86497b7934bb3b2634fbbb2cd65b85927d0b035a60e957eb377ad5fbb47e1fe8be843c2a991d51b32731d343b76ae541d7e4f4e7967b2ecee4d314e009c8c034

Download Submit
memory/400-122-0x00007FF7672E0000-0x00007FF767631000-memory.dmp

Filesize
3.3MB

Download
memory/400-238-0x00007FF7672E0000-0x00007FF767631000-memory.dmp

Filesize
3.3MB

Download
memory/540-103-0x00007FF7B43E0000-0x00007FF7B4731000-memory.dmp

Filesize
3.3MB

Download
memory/540-257-0x00007FF7B43E0000-0x00007FF7B4731000-memory.dmp

Filesize
3.3MB

Download
memory/540-143-0x00007FF7B43E0000-0x00007FF7B4731000-memory.dmp

Filesize
3.3MB

Download
memory/716-151-0x00007FF778D60000-0x00007FF7790B1000-memory.dmp

Filesize
3.3MB

Download
memory/716-0-0x00007FF778D60000-0x00007FF7790B1000-memory.dmp

Filesize
3.3MB

Download
memory/716-128-0x00007FF778D60000-0x00007FF7790B1000-memory.dmp

Filesize
3.3MB

Download
memory/716-1-0x0000022081FB0000-0x0000022081FC0000-memory.dmp

Filesize
64KB

Download
memory/716-150-0x00007FF778D60000-0x00007FF7790B1000-memory.dmp

Filesize
3.3MB

Download
memory/916-97-0x00007FF6A6D10000-0x00007FF6A7061000-memory.dmp

Filesize
3.3MB

Download
memory/916-246-0x00007FF6A6D10000-0x00007FF6A7061000-memory.dmp

Filesize
3.3MB

Download
memory/916-142-0x00007FF6A6D10000-0x00007FF6A7061000-memory.dmp

Filesize
3.3MB

Download
memory/948-226-0x00007FF70F4A0000-0x00007FF70F7F1000-memory.dmp

Filesize
3.3MB

Download
memory/948-65-0x00007FF70F4A0000-0x00007FF70F7F1000-memory.dmp

Filesize
3.3MB

Download
memory/1408-255-0x00007FF726A80000-0x00007FF726DD1000-memory.dmp

Filesize
3.3MB

Download
memory/1408-126-0x00007FF726A80000-0x00007FF726DD1000-memory.dmp

Filesize
3.3MB

Download
memory/1528-81-0x00007FF6E1690000-0x00007FF6E19E1000-memory.dmp

Filesize
3.3MB

Download
memory/1528-228-0x00007FF6E1690000-0x00007FF6E19E1000-memory.dmp

Filesize
3.3MB

Download
memory/1644-10-0x00007FF608B50000-0x00007FF608EA1000-memory.dmp

Filesize
3.3MB

Download
memory/1644-129-0x00007FF608B50000-0x00007FF608EA1000-memory.dmp

Filesize
3.3MB

Download
memory/1644-202-0x00007FF608B50000-0x00007FF608EA1000-memory.dmp

Filesize
3.3MB

Download
memory/1752-22-0x00007FF782A70000-0x00007FF782DC1000-memory.dmp

Filesize
3.3MB

Download
memory/1752-130-0x00007FF782A70000-0x00007FF782DC1000-memory.dmp

Filesize
3.3MB

Download
memory/1752-218-0x00007FF782A70000-0x00007FF782DC1000-memory.dmp

Filesize
3.3MB

Download
memory/2972-230-0x00007FF7481E0000-0x00007FF748531000-memory.dmp

Filesize
3.3MB

Download
memory/2972-58-0x00007FF7481E0000-0x00007FF748531000-memory.dmp

Filesize
3.3MB

Download
memory/3112-63-0x00007FF607770000-0x00007FF607AC1000-memory.dmp

Filesize
3.3MB

Download
memory/3112-220-0x00007FF607770000-0x00007FF607AC1000-memory.dmp

Filesize
3.3MB

Download
memory/3292-123-0x00007FF6A9520000-0x00007FF6A9871000-memory.dmp

Filesize
3.3MB

Download
memory/3292-249-0x00007FF6A9520000-0x00007FF6A9871000-memory.dmp

Filesize
3.3MB

Download
memory/3296-124-0x00007FF630890000-0x00007FF630BE1000-memory.dmp

Filesize
3.3MB

Download
memory/3296-245-0x00007FF630890000-0x00007FF630BE1000-memory.dmp

Filesize
3.3MB

Download
memory/3720-46-0x00007FF703490000-0x00007FF7037E1000-memory.dmp

Filesize
3.3MB

Download
memory/3720-224-0x00007FF703490000-0x00007FF7037E1000-memory.dmp

Filesize
3.3MB

Download
memory/4004-232-0x00007FF77A450000-0x00007FF77A7A1000-memory.dmp

Filesize
3.3MB

Download
memory/4004-53-0x00007FF77A450000-0x00007FF77A7A1000-memory.dmp

Filesize
3.3MB

Download
memory/4004-136-0x00007FF77A450000-0x00007FF77A7A1000-memory.dmp

Filesize
3.3MB

Download
memory/4196-252-0x00007FF781470000-0x00007FF7817C1000-memory.dmp

Filesize
3.3MB

Download
memory/4196-127-0x00007FF781470000-0x00007FF7817C1000-memory.dmp

Filesize
3.3MB

Download
memory/4304-92-0x00007FF7FA1A0000-0x00007FF7FA4F1000-memory.dmp

Filesize
3.3MB

Download
memory/4304-240-0x00007FF7FA1A0000-0x00007FF7FA4F1000-memory.dmp

Filesize
3.3MB

Download
memory/4464-250-0x00007FF7C61B0000-0x00007FF7C6501000-memory.dmp

Filesize
3.3MB

Download
memory/4464-115-0x00007FF7C61B0000-0x00007FF7C6501000-memory.dmp

Filesize
3.3MB

Download
memory/4464-145-0x00007FF7C61B0000-0x00007FF7C6501000-memory.dmp

Filesize
3.3MB

Download
memory/4520-121-0x00007FF677830000-0x00007FF677B81000-memory.dmp

Filesize
3.3MB

Download
memory/4520-236-0x00007FF677830000-0x00007FF677B81000-memory.dmp

Filesize
3.3MB

Download
memory/4596-125-0x00007FF6342D0000-0x00007FF634621000-memory.dmp

Filesize
3.3MB

Download
memory/4596-258-0x00007FF6342D0000-0x00007FF634621000-memory.dmp

Filesize
3.3MB

Download
memory/4636-222-0x00007FF67A630000-0x00007FF67A981000-memory.dmp

Filesize
3.3MB

Download
memory/4636-132-0x00007FF67A630000-0x00007FF67A981000-memory.dmp

Filesize
3.3MB

Download
memory/4636-31-0x00007FF67A630000-0x00007FF67A981000-memory.dmp

Filesize
3.3MB

Download
memory/4940-91-0x00007FF6BBF40000-0x00007FF6BC291000-memory.dmp

Filesize
3.3MB

Download
memory/4940-234-0x00007FF6BBF40000-0x00007FF6BC291000-memory.dmp

Filesize
3.3MB

Download