cobaltstrike | d1d57138a9ad8b5e16609a48b3190d26029e875077d5ff9e91134200508790c0

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 11:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.2MB
MD5

52860eb26a813412bdceaa5838df2552
SHA1

a1621a8e3f7b557769c3a8641dcad71d3c72f498
SHA256

d1d57138a9ad8b5e16609a48b3190d26029e875077d5ff9e91134200508790c0
SHA512

854a65ee61a87252ed2d16b452b864046ca03ce54dacb78a1cf0b4249919e6b3972f0f7e5026ce0b1a48e98fd557f51b95a2ad4834c00f4ec0dd46f10b2d562c
SSDEEP

49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l1:RWWBibd56utgpPFotBER/mQ32lUh

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan upx

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral2/files/0x000c000000023b84-5.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b88-9.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8d-42.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8b-51.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8e-55.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8c-49.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8a-38.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b89-34.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023b87-13.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b8f-60.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b90-71.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023b85-72.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023b92-83.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b91-82.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023b94-102.dat	cobalt_reflective_dll
behavioral2/files/0x0008000000023bac-118.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023bb1-124.dat	cobalt_reflective_dll
behavioral2/files/0x0009000000023bb2-129.dat	cobalt_reflective_dll
behavioral2/files/0x000e000000023ba3-122.dat	cobalt_reflective_dll
behavioral2/files/0x000a000000023b9c-112.dat	cobalt_reflective_dll
behavioral2/files/0x000b000000023b93-95.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 46 IoCs

miner

resource	yara_rule
behavioral2/memory/4988-47-0x00007FF6A2A50000-0x00007FF6A2DA1000-memory.dmp	xmrig
behavioral2/memory/2392-22-0x00007FF6E7A10000-0x00007FF6E7D61000-memory.dmp	xmrig
behavioral2/memory/4000-59-0x00007FF6BC6F0000-0x00007FF6BCA41000-memory.dmp	xmrig
behavioral2/memory/3180-86-0x00007FF7FD8E0000-0x00007FF7FDC31000-memory.dmp	xmrig
behavioral2/memory/2088-89-0x00007FF787D90000-0x00007FF7880E1000-memory.dmp	xmrig
behavioral2/memory/4936-70-0x00007FF6D1910000-0x00007FF6D1C61000-memory.dmp	xmrig
behavioral2/memory/3532-67-0x00007FF680BA0000-0x00007FF680EF1000-memory.dmp	xmrig
behavioral2/memory/836-90-0x00007FF6BFDF0000-0x00007FF6C0141000-memory.dmp	xmrig
behavioral2/memory/3224-98-0x00007FF6B2730000-0x00007FF6B2A81000-memory.dmp	xmrig
behavioral2/memory/5020-110-0x00007FF780220000-0x00007FF780571000-memory.dmp	xmrig
behavioral2/memory/4188-116-0x00007FF7791F0000-0x00007FF779541000-memory.dmp	xmrig
behavioral2/memory/5080-107-0x00007FF66F6C0000-0x00007FF66FA11000-memory.dmp	xmrig
behavioral2/memory/4000-133-0x00007FF6BC6F0000-0x00007FF6BCA41000-memory.dmp	xmrig
behavioral2/memory/2536-134-0x00007FF67DAE0000-0x00007FF67DE31000-memory.dmp	xmrig
behavioral2/memory/2976-135-0x00007FF7DBDC0000-0x00007FF7DC111000-memory.dmp	xmrig
behavioral2/memory/1284-137-0x00007FF798DE0000-0x00007FF799131000-memory.dmp	xmrig
behavioral2/memory/5072-145-0x00007FF66A6D0000-0x00007FF66AA21000-memory.dmp	xmrig
behavioral2/memory/3556-148-0x00007FF73BA10000-0x00007FF73BD61000-memory.dmp	xmrig
behavioral2/memory/3640-149-0x00007FF674900000-0x00007FF674C51000-memory.dmp	xmrig
behavioral2/memory/3076-150-0x00007FF697E30000-0x00007FF698181000-memory.dmp	xmrig
behavioral2/memory/1952-151-0x00007FF64AC70000-0x00007FF64AFC1000-memory.dmp	xmrig
behavioral2/memory/5080-156-0x00007FF66F6C0000-0x00007FF66FA11000-memory.dmp	xmrig
behavioral2/memory/2816-158-0x00007FF6DD560000-0x00007FF6DD8B1000-memory.dmp	xmrig
behavioral2/memory/1424-160-0x00007FF7B4310000-0x00007FF7B4661000-memory.dmp	xmrig
behavioral2/memory/4000-164-0x00007FF6BC6F0000-0x00007FF6BCA41000-memory.dmp	xmrig
behavioral2/memory/3532-220-0x00007FF680BA0000-0x00007FF680EF1000-memory.dmp	xmrig
behavioral2/memory/4936-222-0x00007FF6D1910000-0x00007FF6D1C61000-memory.dmp	xmrig
behavioral2/memory/2392-224-0x00007FF6E7A10000-0x00007FF6E7D61000-memory.dmp	xmrig
behavioral2/memory/2088-226-0x00007FF787D90000-0x00007FF7880E1000-memory.dmp	xmrig
behavioral2/memory/3180-229-0x00007FF7FD8E0000-0x00007FF7FDC31000-memory.dmp	xmrig
behavioral2/memory/4988-230-0x00007FF6A2A50000-0x00007FF6A2DA1000-memory.dmp	xmrig
behavioral2/memory/836-235-0x00007FF6BFDF0000-0x00007FF6C0141000-memory.dmp	xmrig
behavioral2/memory/4188-233-0x00007FF7791F0000-0x00007FF779541000-memory.dmp	xmrig
behavioral2/memory/3224-236-0x00007FF6B2730000-0x00007FF6B2A81000-memory.dmp	xmrig
behavioral2/memory/1284-244-0x00007FF798DE0000-0x00007FF799131000-memory.dmp	xmrig
behavioral2/memory/3556-246-0x00007FF73BA10000-0x00007FF73BD61000-memory.dmp	xmrig
behavioral2/memory/3640-248-0x00007FF674900000-0x00007FF674C51000-memory.dmp	xmrig
behavioral2/memory/3076-255-0x00007FF697E30000-0x00007FF698181000-memory.dmp	xmrig
behavioral2/memory/5080-259-0x00007FF66F6C0000-0x00007FF66FA11000-memory.dmp	xmrig
behavioral2/memory/5020-257-0x00007FF780220000-0x00007FF780571000-memory.dmp	xmrig
behavioral2/memory/2976-262-0x00007FF7DBDC0000-0x00007FF7DC111000-memory.dmp	xmrig
behavioral2/memory/5072-265-0x00007FF66A6D0000-0x00007FF66AA21000-memory.dmp	xmrig
behavioral2/memory/2816-270-0x00007FF6DD560000-0x00007FF6DD8B1000-memory.dmp	xmrig
behavioral2/memory/1952-271-0x00007FF64AC70000-0x00007FF64AFC1000-memory.dmp	xmrig
behavioral2/memory/1424-268-0x00007FF7B4310000-0x00007FF7B4661000-memory.dmp	xmrig
behavioral2/memory/2536-263-0x00007FF67DAE0000-0x00007FF67DE31000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3532	KnbOfkH.exe
4936	eEVLtjQ.exe
2392	plUepaF.exe
2088	rngMgQa.exe
3180	mevbJYp.exe
836	paMRRIS.exe
3224	SBiNJfI.exe
4988	SHCrock.exe
4188	aYxmHDA.exe
1284	vRuFOFx.exe
3556	NlGSpFL.exe
3640	dDwZTGZ.exe
3076	DsclHDM.exe
1952	MuhDtCq.exe
5080	GYwcTPL.exe
5020	uvOFloe.exe
2816	sQwwutH.exe
1424	xFbufRs.exe
2536	HSzYzFS.exe
5072	gnVWVGq.exe
2976	bxyLoRU.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4000-0-0x00007FF6BC6F0000-0x00007FF6BCA41000-memory.dmp	upx
behavioral2/files/0x000c000000023b84-5.dat	upx
behavioral2/files/0x000a000000023b88-9.dat	upx
behavioral2/files/0x000a000000023b8d-42.dat	upx
behavioral2/files/0x000a000000023b8b-51.dat	upx
behavioral2/files/0x000a000000023b8e-55.dat	upx
behavioral2/memory/4188-54-0x00007FF7791F0000-0x00007FF779541000-memory.dmp	upx
behavioral2/files/0x000a000000023b8c-49.dat	upx
behavioral2/memory/4988-47-0x00007FF6A2A50000-0x00007FF6A2DA1000-memory.dmp	upx
behavioral2/memory/3224-46-0x00007FF6B2730000-0x00007FF6B2A81000-memory.dmp	upx
behavioral2/files/0x000a000000023b8a-38.dat	upx
behavioral2/memory/836-36-0x00007FF6BFDF0000-0x00007FF6C0141000-memory.dmp	upx
behavioral2/files/0x000a000000023b89-34.dat	upx
behavioral2/memory/3180-30-0x00007FF7FD8E0000-0x00007FF7FDC31000-memory.dmp	upx
behavioral2/memory/2088-28-0x00007FF787D90000-0x00007FF7880E1000-memory.dmp	upx
behavioral2/memory/2392-22-0x00007FF6E7A10000-0x00007FF6E7D61000-memory.dmp	upx
behavioral2/memory/4936-19-0x00007FF6D1910000-0x00007FF6D1C61000-memory.dmp	upx
behavioral2/files/0x000b000000023b87-13.dat	upx
behavioral2/memory/3532-6-0x00007FF680BA0000-0x00007FF680EF1000-memory.dmp	upx
behavioral2/memory/4000-59-0x00007FF6BC6F0000-0x00007FF6BCA41000-memory.dmp	upx
behavioral2/files/0x000a000000023b8f-60.dat	upx
behavioral2/files/0x000a000000023b90-71.dat	upx
behavioral2/files/0x000b000000023b85-72.dat	upx
behavioral2/files/0x000b000000023b92-83.dat	upx
behavioral2/memory/3180-86-0x00007FF7FD8E0000-0x00007FF7FDC31000-memory.dmp	upx
behavioral2/memory/1952-88-0x00007FF64AC70000-0x00007FF64AFC1000-memory.dmp	upx
behavioral2/memory/2088-89-0x00007FF787D90000-0x00007FF7880E1000-memory.dmp	upx
behavioral2/memory/3076-87-0x00007FF697E30000-0x00007FF698181000-memory.dmp	upx
behavioral2/files/0x000a000000023b91-82.dat	upx
behavioral2/memory/3640-79-0x00007FF674900000-0x00007FF674C51000-memory.dmp	upx
behavioral2/memory/3556-75-0x00007FF73BA10000-0x00007FF73BD61000-memory.dmp	upx
behavioral2/memory/4936-70-0x00007FF6D1910000-0x00007FF6D1C61000-memory.dmp	upx
behavioral2/memory/3532-67-0x00007FF680BA0000-0x00007FF680EF1000-memory.dmp	upx
behavioral2/memory/1284-63-0x00007FF798DE0000-0x00007FF799131000-memory.dmp	upx
behavioral2/memory/836-90-0x00007FF6BFDF0000-0x00007FF6C0141000-memory.dmp	upx
behavioral2/memory/3224-98-0x00007FF6B2730000-0x00007FF6B2A81000-memory.dmp	upx
behavioral2/files/0x000b000000023b94-102.dat	upx
behavioral2/memory/5020-110-0x00007FF780220000-0x00007FF780571000-memory.dmp	upx
behavioral2/files/0x0008000000023bac-118.dat	upx
behavioral2/memory/1424-119-0x00007FF7B4310000-0x00007FF7B4661000-memory.dmp	upx
behavioral2/files/0x0009000000023bb1-124.dat	upx
behavioral2/files/0x0009000000023bb2-129.dat	upx
behavioral2/files/0x000e000000023ba3-122.dat	upx
behavioral2/memory/4188-116-0x00007FF7791F0000-0x00007FF779541000-memory.dmp	upx
behavioral2/files/0x000a000000023b9c-112.dat	upx
behavioral2/memory/2816-109-0x00007FF6DD560000-0x00007FF6DD8B1000-memory.dmp	upx
behavioral2/memory/5080-107-0x00007FF66F6C0000-0x00007FF66FA11000-memory.dmp	upx
behavioral2/files/0x000b000000023b93-95.dat	upx
behavioral2/memory/4000-133-0x00007FF6BC6F0000-0x00007FF6BCA41000-memory.dmp	upx
behavioral2/memory/2536-134-0x00007FF67DAE0000-0x00007FF67DE31000-memory.dmp	upx
behavioral2/memory/2976-135-0x00007FF7DBDC0000-0x00007FF7DC111000-memory.dmp	upx
behavioral2/memory/1284-137-0x00007FF798DE0000-0x00007FF799131000-memory.dmp	upx
behavioral2/memory/5072-145-0x00007FF66A6D0000-0x00007FF66AA21000-memory.dmp	upx
behavioral2/memory/3556-148-0x00007FF73BA10000-0x00007FF73BD61000-memory.dmp	upx
behavioral2/memory/3640-149-0x00007FF674900000-0x00007FF674C51000-memory.dmp	upx
behavioral2/memory/3076-150-0x00007FF697E30000-0x00007FF698181000-memory.dmp	upx
behavioral2/memory/1952-151-0x00007FF64AC70000-0x00007FF64AFC1000-memory.dmp	upx
behavioral2/memory/5080-156-0x00007FF66F6C0000-0x00007FF66FA11000-memory.dmp	upx
behavioral2/memory/2816-158-0x00007FF6DD560000-0x00007FF6DD8B1000-memory.dmp	upx
behavioral2/memory/1424-160-0x00007FF7B4310000-0x00007FF7B4661000-memory.dmp	upx
behavioral2/memory/4000-164-0x00007FF6BC6F0000-0x00007FF6BCA41000-memory.dmp	upx
behavioral2/memory/3532-220-0x00007FF680BA0000-0x00007FF680EF1000-memory.dmp	upx
behavioral2/memory/4936-222-0x00007FF6D1910000-0x00007FF6D1C61000-memory.dmp	upx
behavioral2/memory/2392-224-0x00007FF6E7A10000-0x00007FF6E7D61000-memory.dmp	upx

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\mevbJYp.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\NlGSpFL.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\dDwZTGZ.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GYwcTPL.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\eEVLtjQ.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\paMRRIS.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SBiNJfI.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\MuhDtCq.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\xFbufRs.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HSzYzFS.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gnVWVGq.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\plUepaF.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\aYxmHDA.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\bxyLoRU.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KnbOfkH.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rngMgQa.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SHCrock.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\vRuFOFx.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\DsclHDM.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uvOFloe.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\sQwwutH.exe	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 3532	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 4000 wrote to memory of 3532	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	85
PID 4000 wrote to memory of 4936	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 4000 wrote to memory of 4936	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	86
PID 4000 wrote to memory of 2392	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 4000 wrote to memory of 2392	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	87
PID 4000 wrote to memory of 2088	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 4000 wrote to memory of 2088	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	88
PID 4000 wrote to memory of 3180	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 4000 wrote to memory of 3180	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	89
PID 4000 wrote to memory of 836	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 4000 wrote to memory of 836	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	90
PID 4000 wrote to memory of 3224	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 4000 wrote to memory of 3224	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	91
PID 4000 wrote to memory of 4988	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 4000 wrote to memory of 4988	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	92
PID 4000 wrote to memory of 4188	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 4000 wrote to memory of 4188	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	93
PID 4000 wrote to memory of 1284	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 4000 wrote to memory of 1284	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	94
PID 4000 wrote to memory of 3556	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 4000 wrote to memory of 3556	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	96
PID 4000 wrote to memory of 3640	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 4000 wrote to memory of 3640	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	97
PID 4000 wrote to memory of 3076	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 4000 wrote to memory of 3076	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	98
PID 4000 wrote to memory of 1952	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 4000 wrote to memory of 1952	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	99
PID 4000 wrote to memory of 5080	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 4000 wrote to memory of 5080	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	100
PID 4000 wrote to memory of 5020	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 4000 wrote to memory of 5020	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	101
PID 4000 wrote to memory of 2816	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 4000 wrote to memory of 2816	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	102
PID 4000 wrote to memory of 1424	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 4000 wrote to memory of 1424	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	103
PID 4000 wrote to memory of 2536	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	104
PID 4000 wrote to memory of 2536	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	104
PID 4000 wrote to memory of 5072	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	105
PID 4000 wrote to memory of 5072	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	105
PID 4000 wrote to memory of 2976	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	106
PID 4000 wrote to memory of 2976	4000	2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe	106

C:\Users\Admin\AppData\Local\Temp\2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-14_52860eb26a813412bdceaa5838df2552_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\System\KnbOfkH.exe
  C:\Windows\System\KnbOfkH.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\eEVLtjQ.exe
  C:\Windows\System\eEVLtjQ.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\plUepaF.exe
  C:\Windows\System\plUepaF.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\rngMgQa.exe
  C:\Windows\System\rngMgQa.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\mevbJYp.exe
  C:\Windows\System\mevbJYp.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\paMRRIS.exe
  C:\Windows\System\paMRRIS.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\SBiNJfI.exe
  C:\Windows\System\SBiNJfI.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\SHCrock.exe
  C:\Windows\System\SHCrock.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\aYxmHDA.exe
  C:\Windows\System\aYxmHDA.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\vRuFOFx.exe
  C:\Windows\System\vRuFOFx.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\NlGSpFL.exe
  C:\Windows\System\NlGSpFL.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\dDwZTGZ.exe
  C:\Windows\System\dDwZTGZ.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\DsclHDM.exe
  C:\Windows\System\DsclHDM.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\MuhDtCq.exe
  C:\Windows\System\MuhDtCq.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\GYwcTPL.exe
  C:\Windows\System\GYwcTPL.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\uvOFloe.exe
  C:\Windows\System\uvOFloe.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\sQwwutH.exe
  C:\Windows\System\sQwwutH.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\xFbufRs.exe
  C:\Windows\System\xFbufRs.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\HSzYzFS.exe
  C:\Windows\System\HSzYzFS.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\gnVWVGq.exe
  C:\Windows\System\gnVWVGq.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\bxyLoRU.exe
  C:\Windows\System\bxyLoRU.exe
  2⤵
  - Executes dropped EXE
  PID:2976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DsclHDM.exe

Filesize
5.2MB

MD5
0f95554e27f4584153479646c65e6258

SHA1
08d54410db7a77184ddfcaa3e424185703418ce2

SHA256
7bb0b16da1015a3b9c7771bb407021b8919634fdb4517bac13cbf340e9b5881a

SHA512
e52b5496316e33503caf70f389e5eb820b043b94648c215af68c4c052609788ff5b13410d79af0e4e27a59937173750266118dd04b807ff165712127cf69709b

Download Submit
C:\Windows\System\GYwcTPL.exe

Filesize
5.2MB

MD5
981b73c9da54870a23d3e546387be0ac

SHA1
cd379feb4d5b564e8fe41fbe564b624051264e9c

SHA256
6474b0722f83dfb19eaf074c073fe8ab5e054f3162a157e7d2eda3dcc151886b

SHA512
d0ee0c382df720114325c1eaf26cbb21dfb762ea0222a1d59620d7985e7febcadfc973d0500e0f7a42c48290ae35672123cd59bcc2577f53cf34cedc1353cee1

Download Submit
C:\Windows\System\HSzYzFS.exe

Filesize
5.2MB

MD5
850b4a0b0f94a4d1a4017ae92273af3a

SHA1
a318980d45676c5a00e6dee2138742d837dd81a6

SHA256
936d9007391c10ed7e249b78c90f99cfffde62a9b93ed4c3262114d7cdff5ed4

SHA512
db06bb730dffbf62d561aeadd623ca0440f6f5f20a7934139f74dfa726906247e1ef7738a1708b3f1e4ee3745c0ecb399b53c80a4b567fa19101cac8ab08214e

Download Submit
C:\Windows\System\KnbOfkH.exe

Filesize
5.2MB

MD5
01c9de58cf11b532863f4bc24b0103e1

SHA1
e23fcb248943913098550a1fa9affcdec5d882f0

SHA256
4f6c5295f4f4ae2274065300f5159d69b64eb771c071634cbd11c4496cdda5cf

SHA512
58576665a296bc6fe640946450a5c34c53605502bcee486e01c213a432ce9db8401d11264495d1f4c52a3506f2c2ed8cae5b655551004dcfce835686bbcb432d

Download Submit
C:\Windows\System\MuhDtCq.exe

Filesize
5.2MB

MD5
c223f3a7439db0d6ae3473c8818fc9a3

SHA1
a80607042a1a6ef49720acafc4a2f3c5f2cee535

SHA256
5bfe523ae23fd72c68b73a08d6f8debb42730f66147f68155c506958b38005b3

SHA512
1a50bd38f7b6576463be34df0b9fcbe8c0bbe51ef2f7c9fab4a542a9195f090679f095891265901c8b818c8a1263c96d50ea3146ab0c400499b835f23f56ad31

Download Submit
C:\Windows\System\NlGSpFL.exe

Filesize
5.2MB

MD5
35219789926f6bfbd0b601bc58674bf5

SHA1
71cb5eb5e96e074307b69c3dd31df50ca0e43190

SHA256
0485f0e1020e539b119fab25c5db1cf458c3a3fa5accb6067a74734f3a1ff9e5

SHA512
77dfac2f0b143db5ad81472eb4daa06e57067baed6bf8794a2bae3f2b1e09a4bd3cac6ecf7ff512f37db1e87cf024774530dded34a7b08252889fd009c6def8c

Download Submit
C:\Windows\System\SBiNJfI.exe

Filesize
5.2MB

MD5
0007c1147de2a890f6138123c8bb7b8a

SHA1
5825468e2d6e78ca65ba4a3319b70be0761dfd95

SHA256
9f9a4309796db3e5b1caa70213963205b026373b04ba2c129455f6b5de7e53cc

SHA512
ecfb4154c2427f58d0033376cb8c900f965dbbd16a09650b3586db3da729110907414cdce0372078fc8f7495546774a2765bf5b0023173e4ab8d24ec27b2032f

Download Submit
C:\Windows\System\SHCrock.exe

Filesize
5.2MB

MD5
8ec3ed11830a931428080b4b2aa03b4e

SHA1
8bf06802c3593245d6400a47af4487e02f3dff3c

SHA256
44aa94172568dc5c3d33f03534a5b0696a42cbec19f47675b3c69c219473b7ff

SHA512
5903f3f333bfe2a067ddc7d3b3ed356ed9b0fba6f856f4555f63b0a854d1032d21a2d52c23f478ce72d0451be4c9441356f3b12ef5a13c14a39984ed4ee44d50

Download Submit
C:\Windows\System\aYxmHDA.exe

Filesize
5.2MB

MD5
5f3de9423677bfcb97d9ccf2b841f496

SHA1
d28fd4e57441ff2fa63be3fe5b491b555f387f17

SHA256
6d449deba76ad63d73c0ff9c540ef5ff69779f49004bf92c607bf73a6efc933c

SHA512
9e839837c6e024480414eb3fd274edbb9566922a8d5a241e7382fe6833f4597a1b3546acd9bb5c6d3663e05b92c6130f0100a988507b24ae8caa936eb40b5401

Download Submit
C:\Windows\System\bxyLoRU.exe

Filesize
5.2MB

MD5
9ee4712aa757d0731dadb797ec4cdb04

SHA1
8f87bd8ddbd7b2f66a0c9e39ec8e3b2bd6028ad3

SHA256
1bd89afdfd6f358992754ba43c38d1373e28cf4ea0cadd678a165c3b65717b73

SHA512
2ae31df157de35e12e51b5c2961cfde9449eed1120c4ba4d8563543b2f708998c2de114093b0379fa9f20016f0682936a5e1dc0398da6ad0526ba1b98213ee64

Download Submit
C:\Windows\System\dDwZTGZ.exe

Filesize
5.2MB

MD5
7d8b654435ab97484144185679c018d7

SHA1
5c46e343ff7a4f52eb85549269caf9a1325b6f75

SHA256
dd39e6307b86c6e93ac797722b12f19c5e1ffa59eefa232ed763a1dc9764f90e

SHA512
91e2939730ba8b9a1f97e98f821111fffe739538ccbdac9a3e3c167ff973fbae32944a9ca1da87334dd2806bb272baaab5e9062e79be709197fb67fab9190f90

Download Submit
C:\Windows\System\eEVLtjQ.exe

Filesize
5.2MB

MD5
4e748113649a281797c01fd4f269be43

SHA1
6fa71b5de5e7c8a02b4d8fd2457be33ca310d940

SHA256
b4ecf945a22e6be284943e2117ba6647958c6175369589b5d3a890a81bea929c

SHA512
00adf7280b8837ba8081073714d73f590a5845902267fc16d9fc5498a481d484bee6e66e791fe79cf4c6cc9627e17810a544cb7f0c1882b6099b6493a5d43dfb

Download Submit
C:\Windows\System\gnVWVGq.exe

Filesize
5.2MB

MD5
a7308bc7f765095e6564ea8bc74ce12e

SHA1
44f14310dc8804e4b1e0d595f2b86bdd3be2ee7c

SHA256
1d1493e4421e147385d2611421af7ac63c65e39c095efec4c0d56b767d493190

SHA512
af7638a01352a0b2941a06da9063e98ce745a8dc34b8ac27f2a4f810ea35a0136353d512ee7acca9c649ce459e5544ee823052fd105a32d412e8936bc04a2317

Download Submit
C:\Windows\System\mevbJYp.exe

Filesize
5.2MB

MD5
a270b2a45acca1aa62a1860c56ffe2af

SHA1
5d8ef04824273f0e661ceff463204127132e6c81

SHA256
e7a8ad5c9cd475e934fab359f79d5d56090ccdfca1022bc555bdd54bb2120d7c

SHA512
6743ee1f673fcbe2f8a7b57176dde9ad688504f8e0e5160668829b1ab03e3cb0daae1a5c08bbd756398c424037a70e008508f31aaafb96a825d67ab0737ddfd8

Download Submit
C:\Windows\System\paMRRIS.exe

Filesize
5.2MB

MD5
36db281e9bc66739f5748a8b26d31446

SHA1
38e3fcf0e4c83c41633088bef8ddbc42413d24f5

SHA256
441fcf5887a1cea31de3b44089ee2f18cc1a70c9ec4ae45c726ad4ba38ceeb5a

SHA512
100172ba01ff7db9c709ec98b943e54c69f232313a095ad057884e1e20d17a1db5896c9383efb8239f565f96e671da47994fc91d69873d0895806bfc26ca72b6

Download Submit
C:\Windows\System\plUepaF.exe

Filesize
5.2MB

MD5
c7da9f83ae85e766d242ebc1385b0458

SHA1
71239fdd8b1b4c4894e8b1c80eb0bcfb2e174ffc

SHA256
5ced2ecf165a5b8c5e45754fe1a83deb449165e1450b289ae298a81fa0a787ab

SHA512
0201be665296e57e9d5a91465de810cbbd79f8911c6ecadfecf0cd4b592024e3a000ff50437e833d536b50d988b4c3cbdd004368a6869b383187eae07e8cdbbf

Download Submit
C:\Windows\System\rngMgQa.exe

Filesize
5.2MB

MD5
de6da1e8a81d430f04fcc5fbe4d14dff

SHA1
3ac07b36e3ad7079c07337f1d1ba453d1dbdce1f

SHA256
c3dc0e76316e24e7b3608d022b0b7e1d2f087f706569485b08b072c87b96238b

SHA512
09588524b82ea5e2ea140a5e962f50b423c2104c8938d7c5efa6640fd87c8c27493b23d14da5c84d6c72bec68fb999230e393d67ce43213a465f278811e32dec

Download Submit
C:\Windows\System\sQwwutH.exe

Filesize
5.2MB

MD5
7fc887428f7bb8adcec0ab94b44b4fb5

SHA1
829c9762a814d93b2504e9798115c2852728edcc

SHA256
3ec81b6282efadbd7e9d6e6f98c5549274f6dca8378fb9225fe9c933ed141205

SHA512
972421665210dc41b3bf4dd6a57a339249e247c4b3519b68e3c481e9eaf311dc1e131edc77c0298122fcc6ab0e1ea302d1c8e79c5b2444153ee0046b2c413606

Download Submit
C:\Windows\System\uvOFloe.exe

Filesize
5.2MB

MD5
314eed1c15e886cc080d9eb3e0ce1215

SHA1
499e683b98a2c1161371eddafa6a2f99fc5de164

SHA256
48e6386c458df223bbcd24f0ca78217e85436bede157de51acf110d015021883

SHA512
09e4b3c1597862ca9b8b796008227c846b0036a700b2c862e303db000fdd87b1c9d941ea3b935d8ef70f93b55e6bb39171d9ea174673c455103c329b44c9bebe

Download Submit
C:\Windows\System\vRuFOFx.exe

Filesize
5.2MB

MD5
83ea11772ddaa401c090859e1daee220

SHA1
f94afc308ebbcffd88609dc8b77464c0a6db007b

SHA256
6d56436b2a076778b2624b63088c03bd6aebe9bfc1262e3b72a477f274a5a5eb

SHA512
e469d269a31f39c5fda1b0d90dfc56c0f77b0aa7dc84608e28d140f922ba6db5ab2fd874ecf7df39b6aa013c99222bc876af79bef3b349436e741621e96e7d3f

Download Submit
C:\Windows\System\xFbufRs.exe

Filesize
5.2MB

MD5
2d3c631cdb1257b5e088410d9fbf110e

SHA1
92416d223ccf614d920c9933de185f43a64d6404

SHA256
25f645719b4e153205d43e35ad903ab3a6706d1071ccb4525cee1547a6eb51c5

SHA512
88233d271779501cbd4cccbab6d5ce8568a5474f8b92a81aa409688e632adde2dd180ff35539dad92bd2767fd8b77c8c877a1e56e5d2d60e2494c50ce9ab379b

Download Submit
memory/836-36-0x00007FF6BFDF0000-0x00007FF6C0141000-memory.dmp

Filesize
3.3MB

Download
memory/836-90-0x00007FF6BFDF0000-0x00007FF6C0141000-memory.dmp

Filesize
3.3MB

Download
memory/836-235-0x00007FF6BFDF0000-0x00007FF6C0141000-memory.dmp

Filesize
3.3MB

Download
memory/1284-244-0x00007FF798DE0000-0x00007FF799131000-memory.dmp

Filesize
3.3MB

Download
memory/1284-137-0x00007FF798DE0000-0x00007FF799131000-memory.dmp

Filesize
3.3MB

Download
memory/1284-63-0x00007FF798DE0000-0x00007FF799131000-memory.dmp

Filesize
3.3MB

Download
memory/1424-160-0x00007FF7B4310000-0x00007FF7B4661000-memory.dmp

Filesize
3.3MB

Download
memory/1424-119-0x00007FF7B4310000-0x00007FF7B4661000-memory.dmp

Filesize
3.3MB

Download
memory/1424-268-0x00007FF7B4310000-0x00007FF7B4661000-memory.dmp

Filesize
3.3MB

Download
memory/1952-88-0x00007FF64AC70000-0x00007FF64AFC1000-memory.dmp

Filesize
3.3MB

Download
memory/1952-151-0x00007FF64AC70000-0x00007FF64AFC1000-memory.dmp

Filesize
3.3MB

Download
memory/1952-271-0x00007FF64AC70000-0x00007FF64AFC1000-memory.dmp

Filesize
3.3MB

Download
memory/2088-89-0x00007FF787D90000-0x00007FF7880E1000-memory.dmp

Filesize
3.3MB

Download
memory/2088-226-0x00007FF787D90000-0x00007FF7880E1000-memory.dmp

Filesize
3.3MB

Download
memory/2088-28-0x00007FF787D90000-0x00007FF7880E1000-memory.dmp

Filesize
3.3MB

Download
memory/2392-224-0x00007FF6E7A10000-0x00007FF6E7D61000-memory.dmp

Filesize
3.3MB

Download
memory/2392-22-0x00007FF6E7A10000-0x00007FF6E7D61000-memory.dmp

Filesize
3.3MB

Download
memory/2536-134-0x00007FF67DAE0000-0x00007FF67DE31000-memory.dmp

Filesize
3.3MB

Download
memory/2536-263-0x00007FF67DAE0000-0x00007FF67DE31000-memory.dmp

Filesize
3.3MB

Download
memory/2816-158-0x00007FF6DD560000-0x00007FF6DD8B1000-memory.dmp

Filesize
3.3MB

Download
memory/2816-270-0x00007FF6DD560000-0x00007FF6DD8B1000-memory.dmp

Filesize
3.3MB

Download
memory/2816-109-0x00007FF6DD560000-0x00007FF6DD8B1000-memory.dmp

Filesize
3.3MB

Download
memory/2976-135-0x00007FF7DBDC0000-0x00007FF7DC111000-memory.dmp

Filesize
3.3MB

Download
memory/2976-262-0x00007FF7DBDC0000-0x00007FF7DC111000-memory.dmp

Filesize
3.3MB

Download
memory/3076-255-0x00007FF697E30000-0x00007FF698181000-memory.dmp

Filesize
3.3MB

Download
memory/3076-150-0x00007FF697E30000-0x00007FF698181000-memory.dmp

Filesize
3.3MB

Download
memory/3076-87-0x00007FF697E30000-0x00007FF698181000-memory.dmp

Filesize
3.3MB

Download
memory/3180-30-0x00007FF7FD8E0000-0x00007FF7FDC31000-memory.dmp

Filesize
3.3MB

Download
memory/3180-229-0x00007FF7FD8E0000-0x00007FF7FDC31000-memory.dmp

Filesize
3.3MB

Download
memory/3180-86-0x00007FF7FD8E0000-0x00007FF7FDC31000-memory.dmp

Filesize
3.3MB

Download
memory/3224-46-0x00007FF6B2730000-0x00007FF6B2A81000-memory.dmp

Filesize
3.3MB

Download
memory/3224-98-0x00007FF6B2730000-0x00007FF6B2A81000-memory.dmp

Filesize
3.3MB

Download
memory/3224-236-0x00007FF6B2730000-0x00007FF6B2A81000-memory.dmp

Filesize
3.3MB

Download
memory/3532-6-0x00007FF680BA0000-0x00007FF680EF1000-memory.dmp

Filesize
3.3MB

Download
memory/3532-67-0x00007FF680BA0000-0x00007FF680EF1000-memory.dmp

Filesize
3.3MB

Download
memory/3532-220-0x00007FF680BA0000-0x00007FF680EF1000-memory.dmp

Filesize
3.3MB

Download
memory/3556-148-0x00007FF73BA10000-0x00007FF73BD61000-memory.dmp

Filesize
3.3MB

Download
memory/3556-75-0x00007FF73BA10000-0x00007FF73BD61000-memory.dmp

Filesize
3.3MB

Download
memory/3556-246-0x00007FF73BA10000-0x00007FF73BD61000-memory.dmp

Filesize
3.3MB

Download
memory/3640-149-0x00007FF674900000-0x00007FF674C51000-memory.dmp

Filesize
3.3MB

Download
memory/3640-248-0x00007FF674900000-0x00007FF674C51000-memory.dmp

Filesize
3.3MB

Download
memory/3640-79-0x00007FF674900000-0x00007FF674C51000-memory.dmp

Filesize
3.3MB

Download
memory/4000-0-0x00007FF6BC6F0000-0x00007FF6BCA41000-memory.dmp

Filesize
3.3MB

Download
memory/4000-59-0x00007FF6BC6F0000-0x00007FF6BCA41000-memory.dmp

Filesize
3.3MB

Download
memory/4000-1-0x000001C931130000-0x000001C931140000-memory.dmp

Filesize
64KB

Download
memory/4000-133-0x00007FF6BC6F0000-0x00007FF6BCA41000-memory.dmp

Filesize
3.3MB

Download
memory/4000-164-0x00007FF6BC6F0000-0x00007FF6BCA41000-memory.dmp

Filesize
3.3MB

Download
memory/4188-54-0x00007FF7791F0000-0x00007FF779541000-memory.dmp

Filesize
3.3MB

Download
memory/4188-116-0x00007FF7791F0000-0x00007FF779541000-memory.dmp

Filesize
3.3MB

Download
memory/4188-233-0x00007FF7791F0000-0x00007FF779541000-memory.dmp

Filesize
3.3MB

Download
memory/4936-70-0x00007FF6D1910000-0x00007FF6D1C61000-memory.dmp

Filesize
3.3MB

Download
memory/4936-222-0x00007FF6D1910000-0x00007FF6D1C61000-memory.dmp

Filesize
3.3MB

Download
memory/4936-19-0x00007FF6D1910000-0x00007FF6D1C61000-memory.dmp

Filesize
3.3MB

Download
memory/4988-230-0x00007FF6A2A50000-0x00007FF6A2DA1000-memory.dmp

Filesize
3.3MB

Download
memory/4988-47-0x00007FF6A2A50000-0x00007FF6A2DA1000-memory.dmp

Filesize
3.3MB

Download
memory/5020-110-0x00007FF780220000-0x00007FF780571000-memory.dmp

Filesize
3.3MB

Download
memory/5020-257-0x00007FF780220000-0x00007FF780571000-memory.dmp

Filesize
3.3MB

Download
memory/5072-265-0x00007FF66A6D0000-0x00007FF66AA21000-memory.dmp

Filesize
3.3MB

Download
memory/5072-145-0x00007FF66A6D0000-0x00007FF66AA21000-memory.dmp

Filesize
3.3MB

Download
memory/5080-156-0x00007FF66F6C0000-0x00007FF66FA11000-memory.dmp

Filesize
3.3MB

Download
memory/5080-259-0x00007FF66F6C0000-0x00007FF66FA11000-memory.dmp

Filesize
3.3MB

Download
memory/5080-107-0x00007FF66F6C0000-0x00007FF66FA11000-memory.dmp

Filesize
3.3MB

Download