cobaltstrike | ddacdacb80119c581bdd9d0f292e9922c9e8eaf2b654437e7f249bca8376a2e9

Analysis

max time kernel
140s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-01-2025 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

6025176a0461d6c7c120be1197b35c54
SHA1

85c6787f072c8d7c47440fa4c37586ddfbe5c574
SHA256

ddacdacb80119c581bdd9d0f292e9922c9e8eaf2b654437e7f249bca8376a2e9
SHA512

b907a0273dc2e8f1a18d9035b3880d331c2971ccf138270e86326c95eebc7d4a97f118e89a3950becb23cc11e275989db9000da318411fb20dcc3bbf93aa0f87
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUs:j+R56utgpPF8u/7s

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0007000000012117-3.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016d31-9.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016d3a-12.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016d4a-23.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016d68-32.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019350-107.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000193e1-123.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000193c2-119.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000193b4-113.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019334-101.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019282-95.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019261-89.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001925e-83.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000019023-77.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000187a5-71.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001878f-65.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016fdf-53.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000018784-59.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016d89-48.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016d6d-42.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000016d18-27.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral1/memory/2464-0-0x000000013F540000-0x000000013F88D000-memory.dmp	xmrig
behavioral1/files/0x0007000000012117-3.dat	xmrig
behavioral1/memory/2320-7-0x000000013FD50000-0x000000014009D000-memory.dmp	xmrig
behavioral1/files/0x0008000000016d31-9.dat	xmrig
behavioral1/files/0x0008000000016d3a-12.dat	xmrig
behavioral1/memory/1608-13-0x000000013FB50000-0x000000013FE9D000-memory.dmp	xmrig
behavioral1/files/0x0008000000016d4a-23.dat	xmrig
behavioral1/memory/2272-28-0x000000013F310000-0x000000013F65D000-memory.dmp	xmrig
behavioral1/files/0x0007000000016d68-32.dat	xmrig
behavioral1/memory/2780-34-0x000000013F4D0000-0x000000013F81D000-memory.dmp	xmrig
behavioral1/memory/2864-35-0x000000013FD60000-0x00000001400AD000-memory.dmp	xmrig
behavioral1/memory/1896-19-0x000000013F9B0000-0x000000013FCFD000-memory.dmp	xmrig
behavioral1/memory/2012-43-0x000000013FEC0000-0x000000014020D000-memory.dmp	xmrig
behavioral1/memory/2704-55-0x000000013FEB0000-0x00000001401FD000-memory.dmp	xmrig
behavioral1/memory/2644-61-0x000000013F270000-0x000000013F5BD000-memory.dmp	xmrig
behavioral1/memory/3016-73-0x000000013F020000-0x000000013F36D000-memory.dmp	xmrig
behavioral1/memory/2404-79-0x000000013FAA0000-0x000000013FDED000-memory.dmp	xmrig
behavioral1/memory/1384-85-0x000000013F460000-0x000000013F7AD000-memory.dmp	xmrig
behavioral1/memory/1156-91-0x000000013F0B0000-0x000000013F3FD000-memory.dmp	xmrig
behavioral1/memory/2800-97-0x000000013FEF0000-0x000000014023D000-memory.dmp	xmrig
behavioral1/files/0x0005000000019350-107.dat	xmrig
behavioral1/memory/776-115-0x000000013FC70000-0x000000013FFBD000-memory.dmp	xmrig
behavioral1/memory/1988-126-0x000000013FBB0000-0x000000013FEFD000-memory.dmp	xmrig
behavioral1/files/0x00050000000193e1-123.dat	xmrig
behavioral1/memory/2288-121-0x000000013FD70000-0x00000001400BD000-memory.dmp	xmrig
behavioral1/files/0x00050000000193c2-119.dat	xmrig
behavioral1/files/0x00050000000193b4-113.dat	xmrig
behavioral1/memory/1960-109-0x000000013F880000-0x000000013FBCD000-memory.dmp	xmrig
behavioral1/memory/2004-103-0x000000013F190000-0x000000013F4DD000-memory.dmp	xmrig
behavioral1/files/0x0005000000019334-101.dat	xmrig
behavioral1/files/0x0005000000019282-95.dat	xmrig
behavioral1/files/0x0005000000019261-89.dat	xmrig
behavioral1/files/0x000500000001925e-83.dat	xmrig
behavioral1/files/0x0006000000019023-77.dat	xmrig
behavioral1/memory/2552-67-0x000000013FF90000-0x00000001402DD000-memory.dmp	xmrig
behavioral1/files/0x00050000000187a5-71.dat	xmrig
behavioral1/files/0x000500000001878f-65.dat	xmrig
behavioral1/files/0x0008000000016fdf-53.dat	xmrig
behavioral1/files/0x0005000000018784-59.dat	xmrig
behavioral1/memory/2568-49-0x000000013FBE0000-0x000000013FF2D000-memory.dmp	xmrig
behavioral1/files/0x0008000000016d89-48.dat	xmrig
behavioral1/files/0x0007000000016d6d-42.dat	xmrig
behavioral1/files/0x0008000000016d18-27.dat	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2320	sRPiJyI.exe
1608	YBdfRVs.exe
1896	FGjqedz.exe
2864	tVyhPDr.exe
2272	FiXlWFT.exe
2780	XPhzUgX.exe
2012	NrBiuJf.exe
2568	WoPzsxj.exe
2704	JumgcXT.exe
2644	gLXiNka.exe
2552	eUbgkEc.exe
3016	ZhJeihW.exe
2404	GovsRpW.exe
1384	UMoGZAA.exe
1156	OswDzOb.exe
2800	mwaNABr.exe
2004	dpCVTaN.exe
1960	FWjpCKw.exe
776	euXrlNc.exe
2288	NiJAKPa.exe
1988	RARBPeC.exe

Loads dropped DLL 21 IoCs

pid	Process
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\YBdfRVs.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\FiXlWFT.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\FGjqedz.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gLXiNka.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GovsRpW.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OswDzOb.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mwaNABr.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\FWjpCKw.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\NiJAKPa.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\sRPiJyI.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\tVyhPDr.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\XPhzUgX.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WoPzsxj.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZhJeihW.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\dpCVTaN.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\euXrlNc.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\NrBiuJf.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JumgcXT.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\eUbgkEc.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\UMoGZAA.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RARBPeC.exe	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2320	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2464 wrote to memory of 2320	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2464 wrote to memory of 2320	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2464 wrote to memory of 1608	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2464 wrote to memory of 1608	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2464 wrote to memory of 1608	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2464 wrote to memory of 1896	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2464 wrote to memory of 1896	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2464 wrote to memory of 1896	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2464 wrote to memory of 2864	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2464 wrote to memory of 2864	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2464 wrote to memory of 2864	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2464 wrote to memory of 2272	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2464 wrote to memory of 2272	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2464 wrote to memory of 2272	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2464 wrote to memory of 2780	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2464 wrote to memory of 2780	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2464 wrote to memory of 2780	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2464 wrote to memory of 2012	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2464 wrote to memory of 2012	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2464 wrote to memory of 2012	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2464 wrote to memory of 2568	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2464 wrote to memory of 2568	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2464 wrote to memory of 2568	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2464 wrote to memory of 2704	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2464 wrote to memory of 2704	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2464 wrote to memory of 2704	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2464 wrote to memory of 2644	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2464 wrote to memory of 2644	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2464 wrote to memory of 2644	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2464 wrote to memory of 2552	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2464 wrote to memory of 2552	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2464 wrote to memory of 2552	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2464 wrote to memory of 3016	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2464 wrote to memory of 3016	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2464 wrote to memory of 3016	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2464 wrote to memory of 2404	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2464 wrote to memory of 2404	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2464 wrote to memory of 2404	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2464 wrote to memory of 1384	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2464 wrote to memory of 1384	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2464 wrote to memory of 1384	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2464 wrote to memory of 1156	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2464 wrote to memory of 1156	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2464 wrote to memory of 1156	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2464 wrote to memory of 2800	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2464 wrote to memory of 2800	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2464 wrote to memory of 2800	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2464 wrote to memory of 2004	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2464 wrote to memory of 2004	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2464 wrote to memory of 2004	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2464 wrote to memory of 1960	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2464 wrote to memory of 1960	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2464 wrote to memory of 1960	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2464 wrote to memory of 776	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2464 wrote to memory of 776	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2464 wrote to memory of 776	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2464 wrote to memory of 2288	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2464 wrote to memory of 2288	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2464 wrote to memory of 2288	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2464 wrote to memory of 1988	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	52
PID 2464 wrote to memory of 1988	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	52
PID 2464 wrote to memory of 1988	2464	2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe	52

C:\Users\Admin\AppData\Local\Temp\2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-21_6025176a0461d6c7c120be1197b35c54_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\System\sRPiJyI.exe
  C:\Windows\System\sRPiJyI.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\YBdfRVs.exe
  C:\Windows\System\YBdfRVs.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\FGjqedz.exe
  C:\Windows\System\FGjqedz.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\tVyhPDr.exe
  C:\Windows\System\tVyhPDr.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\FiXlWFT.exe
  C:\Windows\System\FiXlWFT.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\XPhzUgX.exe
  C:\Windows\System\XPhzUgX.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\NrBiuJf.exe
  C:\Windows\System\NrBiuJf.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\WoPzsxj.exe
  C:\Windows\System\WoPzsxj.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\JumgcXT.exe
  C:\Windows\System\JumgcXT.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\gLXiNka.exe
  C:\Windows\System\gLXiNka.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\eUbgkEc.exe
  C:\Windows\System\eUbgkEc.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ZhJeihW.exe
  C:\Windows\System\ZhJeihW.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\GovsRpW.exe
  C:\Windows\System\GovsRpW.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\UMoGZAA.exe
  C:\Windows\System\UMoGZAA.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\OswDzOb.exe
  C:\Windows\System\OswDzOb.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\mwaNABr.exe
  C:\Windows\System\mwaNABr.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\dpCVTaN.exe
  C:\Windows\System\dpCVTaN.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\FWjpCKw.exe
  C:\Windows\System\FWjpCKw.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\euXrlNc.exe
  C:\Windows\System\euXrlNc.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\NiJAKPa.exe
  C:\Windows\System\NiJAKPa.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\RARBPeC.exe
  C:\Windows\System\RARBPeC.exe
  2⤵
  - Executes dropped EXE
  PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FGjqedz.exe

Filesize
5.7MB

MD5
49b7c183b6a5435e7f84c59225308b70

SHA1
e97a727115573a445a5e3fc56af5094000a07224

SHA256
148912b9566e0bf153016a7a9591cfac29221057256429921cc575de192c7010

SHA512
8f3527327cc2793990bd65f27ba0484822a93111017421c25276de47d97c5efe406153341b855daa46444eedfffd8008df13b97e17fea8efae7563fe274a8adf

Download Submit
C:\Windows\system\FWjpCKw.exe

Filesize
5.7MB

MD5
fcfc53dbf4122907bbd07a1a000d16bf

SHA1
321671d040d0ed895fa07fbe0f063101b97c3e7c

SHA256
91ebf0f6b44c0fb4bd9c306a2bcedbc0d5f0d9e700d2d6ce21f052ede4e3fa2b

SHA512
6a136c0fe6a2efc499f564f73bb7eee02ffb74d6aa9eab5850e0f92d30002905c2b4eddfb1e91158dea1841b29b305d58d4995f132afb1a5e09329951f022dae

Download Submit
C:\Windows\system\FiXlWFT.exe

Filesize
5.7MB

MD5
e3ee8c7fb179f167cb03929ea060e3f5

SHA1
c325e82e419887f41b3c338523fb799c86dff04c

SHA256
b2f17bca4d4dc91c8743fbdabf08d187c3ca63bef0404822fbfd0818d7e9610a

SHA512
ec4afa7ee6076d72c398597cca0f3cbe92951c82aa1a5f044f08eec68efdade8024f72f9b8742b709670b549e5e89fb24f5696ca8ba71c8359938ee58607866e

Download Submit
C:\Windows\system\GovsRpW.exe

Filesize
5.7MB

MD5
c85a43d42b04a1dd1bbc3a4598196ce6

SHA1
6e7fc084985dd385fef6e97198b8c80856c9f4af

SHA256
43ee18f96ac32b6a2f99572e19b60b1fb8c106eabf91d2a97fcc21addba6e964

SHA512
3545824901e0ed9b300e3273d7b627f28a423649b3fda6433c7804baa180e8a3908adc5553315512940b0e2ec75ae63a830170012e2a1f333c8afcf8806cd609

Download Submit
C:\Windows\system\JumgcXT.exe

Filesize
5.7MB

MD5
01176f00e9fc2b83a5b44397acc6b836

SHA1
3957e46007556dba10e44de9cac0b486eeedb732

SHA256
b9fc8984177b6efd7b6e912a00b46b8a71033abf4603e97051b5caa894670f02

SHA512
b270c00fbf8480ffa7f6012ae424dc37ea685e74ec229a1f0685b3b8f5888471861073ade3d7b41d64e4365b4b41d3c3f6e5a51c4abe3178811820e248aa883f

Download Submit
C:\Windows\system\NiJAKPa.exe

Filesize
5.7MB

MD5
e384be30c24a0110f670084e828765eb

SHA1
7ea02f81956b019168da35721eaccf97dd49243a

SHA256
ae203818d2325f6c0bab6e197e12cf881e5fa10a7cce5e856a9bd775ffda65f8

SHA512
084b71ce97e338ffe28acf90631747fad1c016ccad15645bfa01a3edc2c02f99d6288b8471b54516dd40daa46d6b48601fcfc8e5775646443fffa611b837b068

Download Submit
C:\Windows\system\NrBiuJf.exe

Filesize
5.7MB

MD5
4330384aaf0b8fc1f5acf440d6e2008c

SHA1
db0fac370bdcf644f487d1c4d3224635d8bbd5b6

SHA256
43649690d8be910aa3f43f1a7da93eb06f99ddcc0a83a98d4c929e40b3896a57

SHA512
d75bf0a8f82f481f572c8ac2b2aef3ca36b85e6c33e5f64c2d529ea705dde16c4df006922676683326ab0dc3bfb29fc9e40351efbd3f9a6ab282d6318bb106b2

Download Submit
C:\Windows\system\OswDzOb.exe

Filesize
5.7MB

MD5
183a666d55f52d01289016b4be5df94b

SHA1
f31afdec68604271e94cbbacb169848514545597

SHA256
e7726e8f6675235b0c4742f772f4462503ded438ba5758da63d8da244b56a746

SHA512
81d05392567b17d130b3868f88b8b83b298252455741a4f405af79ca730d369e81b6b89b70f213d2584283aa5cbf5fa0da4dd2f12fed404e6bca4921a753d0ce

Download Submit
C:\Windows\system\UMoGZAA.exe

Filesize
5.7MB

MD5
c9945e1ab276a12d0c24093f9faf41cd

SHA1
a5e3ba34ffa93552745ededc81612b43c3958ee8

SHA256
ff17ef9d3d3b2fe55a3fc254fbcc6d2d0f019d6173bc970a8585953fbf77fbfb

SHA512
256ba75fb26a571c91a0768301e36791c2a0bcfa1918f4f895c94b884fbcad064a3bbaeb5db52a051dab43acd2e34dd576a3ec98a305838db78859188afdc33a

Download Submit
C:\Windows\system\WoPzsxj.exe

Filesize
5.7MB

MD5
00e97fe6ce81ce0843d91e5f88b88f9e

SHA1
9af6da12582bd48cbcbbb0136d4f826c6601eb2e

SHA256
59880186fe74663308b527fbe19c58d48dcd3efb312de009c37238802d4fcd9a

SHA512
6ed8bf1ce90620ea0e1b769fa3ca6e9d62d3bac928508740c8bbd32c043cff768bcc27672643153946c514911288c9d17f0e7f864d279ed08404af319c30764a

Download Submit
C:\Windows\system\XPhzUgX.exe

Filesize
5.7MB

MD5
7b829a76d7ea49be944582ae2473a718

SHA1
bdb754d031662c25e43b769ebdd9aa19b52bfa7f

SHA256
3a3c2417043e8f0603c54f6272fed46ac718a7b1e8bc4b01163281709f4af8a0

SHA512
6477c07e8b95e349a170873288ecfbfb40ccff73b75511956b694c194a8b0fdeddeed1623b85202fdc79b7cf8d6c69e2eb4982ced6948c89d45e6e616f985dab

Download Submit
C:\Windows\system\ZhJeihW.exe

Filesize
5.7MB

MD5
1ac1794343612a41cf9f38241fe9e871

SHA1
3427a2e38c3216f346c80bb81ae8ef70a2e89eab

SHA256
850d97a193212b28ca9678b450c697f260dead6701ad72fb47068bc5625ca157

SHA512
f55548796470d00ef577b38da683a706ce9885d2c1a1bf7d6b0f74c447df9cedfce8306915bddddad1c5e880e4e7d010c445ef1b5fd0c9924ef22913b7d563e6

Download Submit
C:\Windows\system\dpCVTaN.exe

Filesize
5.7MB

MD5
08ea972d7820eebcc860bc4a0d816729

SHA1
bac67547db5a23ab2ca0df4caadac86ece58f323

SHA256
048a03b667b78dcd541a562c7647095f2f928b8ac9cbca31d39c139d13149637

SHA512
d1afe0b4ebc7ba0b0ca7a92bf496570d892fc192efd547f12539fe036d8b57f4e611f9a531ad2553116dfbe8cf8a0d58fcdf3fd2fe157fc2c842489b3e216eb1

Download Submit
C:\Windows\system\eUbgkEc.exe

Filesize
5.7MB

MD5
bebe69f0503f7f78b29249ca6d21cc6a

SHA1
617215b99960a36160e96b79fe69aa0187adb337

SHA256
4cf7882a7e9ea1dd61f4596a631eaf992bcd9461f210b2f9e6aa5979b95c8700

SHA512
9eaa6dd59a8071dbb50f7fa9ec0052edd4f40a3e7ad28363bf080cdc8751401cab3e4658dd19655092a624b6e0f29881479b4792bac89fffa009c5a9267d4173

Download Submit
C:\Windows\system\euXrlNc.exe

Filesize
5.7MB

MD5
86cc8955ea680acf0610035c2fcc137a

SHA1
8bfd6264666a3a620d1a806ade0560bec4c41bb2

SHA256
cc1df12e24a976e06b100b08c9969491cbd5133b7d2e87e95c194c67e8423677

SHA512
363b5f52b35426296b0dc8673e46312d848ced709d98921ca3ae20fe33bb98b6b5ddc167caa2fb6d213977e96503dfe55d7da24e27aeb5a7e1a9ec6857471b83

Download Submit
C:\Windows\system\gLXiNka.exe

Filesize
5.7MB

MD5
ab0bdd4c084a5e1fd4458063726b1633

SHA1
e8265a660514884dea3b9546ac46e0e9695896b9

SHA256
a2e3d71f8c553668fd6619af9bc58f0bb609551f543154ffd277eaa6c8681827

SHA512
9d9a46c095d0517d3a4da207e2b8f8a366df3733b49b8adca4e13cca6408a2584159663ceb8c140b38670fe7a998fbe8e02ccf3b6fc9213ab782a3fbfb480812

Download Submit
C:\Windows\system\mwaNABr.exe

Filesize
5.7MB

MD5
854eb33aa87b0779356cbc124b3c9c5e

SHA1
0bc7c5ff3a4f4eeb9721aba4e667e64e34b0350b

SHA256
7f7a637014405cc09c723eeef64649a20e5a4437441f203446981372ca330457

SHA512
acf969ed48412bca78c1483384387561e225fe1e0db0045b0085533c9313df8e297031cfe7a46bfafbe42d03ae60138b3e7e9d399a13675f44f95b59e1b77547

Download Submit
C:\Windows\system\tVyhPDr.exe

Filesize
5.7MB

MD5
e39ad9383ff2377ea3e53e8d43b297d4

SHA1
83c307b442f5b31d74416d2dd663246885a9198b

SHA256
8fbc818c64337ebbbf23805ffef2ca86f5b6d5b6ec1a8911db3a55fabea4838d

SHA512
1e2a1c67c39b7ff4bd560248a1653549f3f88d0237fb6c8a727c704a9c410997aaed86fd1cff12f2fa0d1be22452eeee7aa8a8eb9dbeec12057398dd92ec6e2b

Download Submit
\Windows\system\RARBPeC.exe

Filesize
5.7MB

MD5
c6289b54f3befe1d1cd2c74f37a9154b

SHA1
8b1fbc5693a09c977575677ac6f2e5c56c0bc5fa

SHA256
eebf578ec63e20309ff8bed26f99328fe2bb7228b77be8142247b34da99567b9

SHA512
66d38f19258249a138ddff37a586c20073d119af234361d98ab2f7fe4c2d1b009549fa8e7f7a836165998eb8fce52c4307780f8da883cff41481d2f305989659

Download Submit
\Windows\system\YBdfRVs.exe

Filesize
5.7MB

MD5
6fd6211ce7b43091e4ece549b063489a

SHA1
9cc4e9a9d6364e71dc8db8c26ae2656c7221e20e

SHA256
74e4eb2234938134114d96504984f299e8a1fa2f35a2b75ed107060937abdc2c

SHA512
d85c8c4021115ece30f7a9814805260851877f2b7275ebe2c5ee2c61a19915b5f71d853c055aeeb9b2e68a682cb965db6ee3745e43657c57b51da3647b6193d3

Download Submit
\Windows\system\sRPiJyI.exe

Filesize
5.7MB

MD5
4b1c83020ee8aa4e659d6ac66dd8f498

SHA1
903bcd12d92952b605622539237f2732a068071d

SHA256
a0a9f3225d4ac7dda4a84a371e7ae5a9bbcb8f81e795074cdfd6f1fb60262c45

SHA512
6b4a16a14891473575d08f43693152fe88d7f06c92e57cbe45800a59f43ef1540eb2a6ea28399d41d3721924ca5d2f2f5ee63a66e02534e15e628cba0f0d3e6f

Download Submit
memory/776-115-0x000000013FC70000-0x000000013FFBD000-memory.dmp

Filesize
3.3MB

Download
memory/1156-91-0x000000013F0B0000-0x000000013F3FD000-memory.dmp

Filesize
3.3MB

Download
memory/1384-85-0x000000013F460000-0x000000013F7AD000-memory.dmp

Filesize
3.3MB

Download
memory/1608-13-0x000000013FB50000-0x000000013FE9D000-memory.dmp

Filesize
3.3MB

Download
memory/1896-19-0x000000013F9B0000-0x000000013FCFD000-memory.dmp

Filesize
3.3MB

Download
memory/1960-109-0x000000013F880000-0x000000013FBCD000-memory.dmp

Filesize
3.3MB

Download
memory/1988-126-0x000000013FBB0000-0x000000013FEFD000-memory.dmp

Filesize
3.3MB

Download
memory/2004-103-0x000000013F190000-0x000000013F4DD000-memory.dmp

Filesize
3.3MB

Download
memory/2012-43-0x000000013FEC0000-0x000000014020D000-memory.dmp

Filesize
3.3MB

Download
memory/2272-28-0x000000013F310000-0x000000013F65D000-memory.dmp

Filesize
3.3MB

Download
memory/2288-121-0x000000013FD70000-0x00000001400BD000-memory.dmp

Filesize
3.3MB

Download
memory/2320-7-0x000000013FD50000-0x000000014009D000-memory.dmp

Filesize
3.3MB

Download
memory/2404-79-0x000000013FAA0000-0x000000013FDED000-memory.dmp

Filesize
3.3MB

Download
memory/2464-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2464-0-0x000000013F540000-0x000000013F88D000-memory.dmp

Filesize
3.3MB

Download
memory/2552-67-0x000000013FF90000-0x00000001402DD000-memory.dmp

Filesize
3.3MB

Download
memory/2568-49-0x000000013FBE0000-0x000000013FF2D000-memory.dmp

Filesize
3.3MB

Download
memory/2644-61-0x000000013F270000-0x000000013F5BD000-memory.dmp

Filesize
3.3MB

Download
memory/2704-55-0x000000013FEB0000-0x00000001401FD000-memory.dmp

Filesize
3.3MB

Download
memory/2780-34-0x000000013F4D0000-0x000000013F81D000-memory.dmp

Filesize
3.3MB

Download
memory/2800-97-0x000000013FEF0000-0x000000014023D000-memory.dmp

Filesize
3.3MB

Download
memory/2864-35-0x000000013FD60000-0x00000001400AD000-memory.dmp

Filesize
3.3MB

Download
memory/3016-73-0x000000013F020000-0x000000013F36D000-memory.dmp

Filesize
3.3MB

Download