cobaltstrike | 5e39928e422dd757d749cef86afd8115ea9655eafb1de52c092911de9444bbce

Analysis

max time kernel
150s
max time network
157s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21-01-2025 00:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

cd0fdc0fc5e1a52796ff0154f43fc48f
SHA1

b6b2d83482cc7b825a19e45cc5e55df495c3bc5a
SHA256

5e39928e422dd757d749cef86afd8115ea9655eafb1de52c092911de9444bbce
SHA512

5131cc1130371dfb544ebdad4895e3bf77c6c96e77a62ea16c09809e41676650e7f7a0b82e45b8a5f92958ae5532ea5d8e98be3d80762ffe56ff6fa923b1b376
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUT:j+R56utgpPF8u/7T

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0008000000016ce9-9.dat	cobalt_reflective_dll
behavioral1/files/0x00100000000122f3-5.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016d0c-17.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016cf0-16.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016d1c-24.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000016d2c-32.dat	cobalt_reflective_dll
behavioral1/files/0x0002000000018334-36.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001950f-43.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019547-51.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195a9-64.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195af-75.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195b1-80.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195b3-83.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195b5-125.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195ad-72.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195ab-67.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195a7-59.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001957c-55.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019515-47.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000194ef-39.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000016ccc-27.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral1/memory/2736-0-0x000000013F620000-0x000000013F96D000-memory.dmp	xmrig
behavioral1/memory/2724-7-0x000000013F9F0000-0x000000013FD3D000-memory.dmp	xmrig
behavioral1/files/0x0008000000016ce9-9.dat	xmrig
behavioral1/files/0x00100000000122f3-5.dat	xmrig
behavioral1/files/0x0007000000016d0c-17.dat	xmrig
behavioral1/files/0x0007000000016cf0-16.dat	xmrig
behavioral1/files/0x0007000000016d1c-24.dat	xmrig
behavioral1/files/0x0009000000016d2c-32.dat	xmrig
behavioral1/files/0x0002000000018334-36.dat	xmrig
behavioral1/files/0x000500000001950f-43.dat	xmrig
behavioral1/files/0x0005000000019547-51.dat	xmrig
behavioral1/files/0x00050000000195a9-64.dat	xmrig
behavioral1/files/0x00050000000195af-75.dat	xmrig
behavioral1/files/0x00050000000195b1-80.dat	xmrig
behavioral1/files/0x00050000000195b3-83.dat	xmrig
behavioral1/memory/2412-93-0x000000013F930000-0x000000013FC7D000-memory.dmp	xmrig
behavioral1/memory/2968-112-0x000000013FED0000-0x000000014021D000-memory.dmp	xmrig
behavioral1/memory/1572-111-0x000000013F950000-0x000000013FC9D000-memory.dmp	xmrig
behavioral1/memory/2600-110-0x000000013F600000-0x000000013F94D000-memory.dmp	xmrig
behavioral1/memory/2288-109-0x000000013F6D0000-0x000000013FA1D000-memory.dmp	xmrig
behavioral1/memory/2776-108-0x000000013FD70000-0x00000001400BD000-memory.dmp	xmrig
behavioral1/memory/2164-107-0x000000013FAC0000-0x000000013FE0D000-memory.dmp	xmrig
behavioral1/memory/2964-106-0x000000013F150000-0x000000013F49D000-memory.dmp	xmrig
behavioral1/memory/1452-105-0x000000013F370000-0x000000013F6BD000-memory.dmp	xmrig
behavioral1/memory/3012-104-0x000000013FDC0000-0x000000014010D000-memory.dmp	xmrig
behavioral1/memory/2652-103-0x000000013F790000-0x000000013FADD000-memory.dmp	xmrig
behavioral1/memory/2304-92-0x000000013F7B0000-0x000000013FAFD000-memory.dmp	xmrig
behavioral1/memory/2844-91-0x000000013F780000-0x000000013FACD000-memory.dmp	xmrig
behavioral1/memory/2808-90-0x000000013FF40000-0x000000014028D000-memory.dmp	xmrig
behavioral1/memory/2944-89-0x000000013F7C0000-0x000000013FB0D000-memory.dmp	xmrig
behavioral1/memory/2128-87-0x000000013F730000-0x000000013FA7D000-memory.dmp	xmrig
behavioral1/memory/3004-86-0x000000013F540000-0x000000013F88D000-memory.dmp	xmrig
behavioral1/memory/2924-85-0x000000013FEF0000-0x000000014023D000-memory.dmp	xmrig
behavioral1/memory/1832-126-0x000000013F330000-0x000000013F67D000-memory.dmp	xmrig
behavioral1/files/0x00050000000195b5-125.dat	xmrig
behavioral1/files/0x00050000000195ad-72.dat	xmrig
behavioral1/files/0x00050000000195ab-67.dat	xmrig
behavioral1/files/0x00050000000195a7-59.dat	xmrig
behavioral1/files/0x000500000001957c-55.dat	xmrig
behavioral1/files/0x0005000000019515-47.dat	xmrig
behavioral1/files/0x00060000000194ef-39.dat	xmrig
behavioral1/files/0x0009000000016ccc-27.dat	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2724	exXXsBb.exe
2652	pZCEMfh.exe
2924	eDzcxxX.exe
3012	gcHBONu.exe
3004	yUoCzpZ.exe
1452	zkKxbxS.exe
2128	qRGWinu.exe
2964	qlWdXuX.exe
2988	nCvcLVM.exe
2164	tzYvbVb.exe
2944	TZDZOfu.exe
2776	myGceNU.exe
2808	wqeYleX.exe
2288	orAkKVZ.exe
2844	zAvhbIW.exe
2600	djJKWKa.exe
2304	CbIqNpZ.exe
1572	GSnGFZZ.exe
2412	qAgvfOF.exe
2968	lcLOeTq.exe
1832	VyUsJVn.exe

Loads dropped DLL 21 IoCs

pid	Process
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\exXXsBb.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\pZCEMfh.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\eDzcxxX.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\zkKxbxS.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qlWdXuX.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gcHBONu.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nCvcLVM.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\myGceNU.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\djJKWKa.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wqeYleX.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\orAkKVZ.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\CbIqNpZ.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GSnGFZZ.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qAgvfOF.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\VyUsJVn.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\yUoCzpZ.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qRGWinu.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\tzYvbVb.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TZDZOfu.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\zAvhbIW.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\lcLOeTq.exe	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2724	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2736 wrote to memory of 2724	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2736 wrote to memory of 2724	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2736 wrote to memory of 2652	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2736 wrote to memory of 2652	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2736 wrote to memory of 2652	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2736 wrote to memory of 2924	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2736 wrote to memory of 2924	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2736 wrote to memory of 2924	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2736 wrote to memory of 3012	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2736 wrote to memory of 3012	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2736 wrote to memory of 3012	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2736 wrote to memory of 3004	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2736 wrote to memory of 3004	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2736 wrote to memory of 3004	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2736 wrote to memory of 1452	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2736 wrote to memory of 1452	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2736 wrote to memory of 1452	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2736 wrote to memory of 2128	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2736 wrote to memory of 2128	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2736 wrote to memory of 2128	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2736 wrote to memory of 2964	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2736 wrote to memory of 2964	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2736 wrote to memory of 2964	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2736 wrote to memory of 2988	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2736 wrote to memory of 2988	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2736 wrote to memory of 2988	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2736 wrote to memory of 2164	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2736 wrote to memory of 2164	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2736 wrote to memory of 2164	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2736 wrote to memory of 2944	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2736 wrote to memory of 2944	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2736 wrote to memory of 2944	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2736 wrote to memory of 2776	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2736 wrote to memory of 2776	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2736 wrote to memory of 2776	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2736 wrote to memory of 2808	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2736 wrote to memory of 2808	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2736 wrote to memory of 2808	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2736 wrote to memory of 2288	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2736 wrote to memory of 2288	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2736 wrote to memory of 2288	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2736 wrote to memory of 2844	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2736 wrote to memory of 2844	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2736 wrote to memory of 2844	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2736 wrote to memory of 2600	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2736 wrote to memory of 2600	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2736 wrote to memory of 2600	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2736 wrote to memory of 2304	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2736 wrote to memory of 2304	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2736 wrote to memory of 2304	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2736 wrote to memory of 1572	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2736 wrote to memory of 1572	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2736 wrote to memory of 1572	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2736 wrote to memory of 2412	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2736 wrote to memory of 2412	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2736 wrote to memory of 2412	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2736 wrote to memory of 2968	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2736 wrote to memory of 2968	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2736 wrote to memory of 2968	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2736 wrote to memory of 1832	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2736 wrote to memory of 1832	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2736 wrote to memory of 1832	2736	2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe	51

C:\Users\Admin\AppData\Local\Temp\2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-20_cd0fdc0fc5e1a52796ff0154f43fc48f_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\System\exXXsBb.exe
  C:\Windows\System\exXXsBb.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\pZCEMfh.exe
  C:\Windows\System\pZCEMfh.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\eDzcxxX.exe
  C:\Windows\System\eDzcxxX.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\gcHBONu.exe
  C:\Windows\System\gcHBONu.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\yUoCzpZ.exe
  C:\Windows\System\yUoCzpZ.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\zkKxbxS.exe
  C:\Windows\System\zkKxbxS.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\qRGWinu.exe
  C:\Windows\System\qRGWinu.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\qlWdXuX.exe
  C:\Windows\System\qlWdXuX.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\nCvcLVM.exe
  C:\Windows\System\nCvcLVM.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\tzYvbVb.exe
  C:\Windows\System\tzYvbVb.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\TZDZOfu.exe
  C:\Windows\System\TZDZOfu.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\myGceNU.exe
  C:\Windows\System\myGceNU.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\wqeYleX.exe
  C:\Windows\System\wqeYleX.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\orAkKVZ.exe
  C:\Windows\System\orAkKVZ.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\zAvhbIW.exe
  C:\Windows\System\zAvhbIW.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\djJKWKa.exe
  C:\Windows\System\djJKWKa.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\CbIqNpZ.exe
  C:\Windows\System\CbIqNpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\GSnGFZZ.exe
  C:\Windows\System\GSnGFZZ.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\qAgvfOF.exe
  C:\Windows\System\qAgvfOF.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\lcLOeTq.exe
  C:\Windows\System\lcLOeTq.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\VyUsJVn.exe
  C:\Windows\System\VyUsJVn.exe
  2⤵
  - Executes dropped EXE
  PID:1832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CbIqNpZ.exe

Filesize
5.7MB

MD5
ca21063ad44e243e6ce5acc4d9f2a58d

SHA1
37dfbd7e937a19cf8b98f122b292e83f1d487986

SHA256
835e9768e0365d6331e272d1b2cd23b9ba9fcc032c2d544e5885370c19743710

SHA512
701fd23c70ecb6c3d2fe8820bd17f020198793141ea3d13a190ec756c8e6537578cfeed1ed4c6976366c7a23981ac9a9926968e95a78f5ff9576714c714381c1

Download Submit
C:\Windows\system\GSnGFZZ.exe

Filesize
5.7MB

MD5
73e0251970accd5001209ac65ddec53d

SHA1
465205dbe1e234531e234d4f3ac3d70da5971054

SHA256
19ad78abb8af98a9a09bbde4dbaca8fc27969c00ee8ab1752d5e26d51eb78e85

SHA512
43aba7fd7aeb97183dfd275b41c01e2a3edf3378704d5838d4c0125d23d417bf53580b32bf45bb284cb2aacb444b915cbdc745a3bd5dda446ab0d642f7105592

Download Submit
C:\Windows\system\TZDZOfu.exe

Filesize
5.7MB

MD5
c6dac99ac29f4eb690e35ed1cd08093b

SHA1
7367c8227c95a2ca283b662aa6dd5e453be7d9bb

SHA256
80140b88a2f8cf7974e946b71929e23b5d10a5ab187e09da05120b167d4e6094

SHA512
5955cb6bdef4352dd3b762fff7e9f51c44ad22c59dd8da0679aedb9f8afa18b490ff1864cb9b8985420dd89728d825c6d8b705b4aee106a8ffe5689fd9a74a96

Download Submit
C:\Windows\system\VyUsJVn.exe

Filesize
5.7MB

MD5
8711e09389b3c4af3b82ac998f6ddb7a

SHA1
970008cac0695c5bf48bd7c510775b8138371f05

SHA256
5235d59227b5090757c871299237732e889b9782abe70dbbb349b25c318bf586

SHA512
7063efaa404efefe42b25c95b31d5d7c8e0b90e07cd1e22fced9d3fde9542e29d4c4d5ada33a0f40d88590b52487a048cfc03b6336009543e378a3e9d1a1112b

Download Submit
C:\Windows\system\djJKWKa.exe

Filesize
5.7MB

MD5
5dbeb23b1c04f0030f0d51fcae0b3ae5

SHA1
5103c8f3d11a76eff196231aac38bfac5c461225

SHA256
79eed7ff04a3f8aecc53a5934ed0d80eff29ab051d021930e670f637370601cc

SHA512
368f345fc75d387b96a28419615533a0112bef73375d8fee49de8ff4195e0560ecf6e8e4e3db9af17b91a3a7069392e06bfe86be751ac0b31ca45de14bea3be7

Download Submit
C:\Windows\system\eDzcxxX.exe

Filesize
5.7MB

MD5
0492dbeb2e59f0e2db8c48d600e3cc6c

SHA1
8c7f92a21a4fe9ef4f3301a9ee18be7d53e43d24

SHA256
b0188c04f5fc33b6a39082ade594c63ff747f457e4fa8c69cdf91327a8b0e96c

SHA512
e5397c451515a269da608bec121921634cae4294934f12a30b7de4c75296de9211af612921a47204a64dadf02ce114311a66131e64f7c26d0ad35ee9e3afe1a2

Download Submit
C:\Windows\system\exXXsBb.exe

Filesize
5.7MB

MD5
fc988721956dbd41cd0dd2b9d50dc6b3

SHA1
714df499168739d6e8a60a5ba4477a1d63c94f98

SHA256
6c5c0d22b3454374de45a2f688bc16294eed8b4b9d051e68cf665e5f33a5bdd4

SHA512
1e071e67c59b698ea53b48f2106d9678969c00036d037cb7b40ba6ba633273f9b094b97fe1ca257fb760c23cb06d90284cb254705dc42bb1c10467b8de158940

Download Submit
C:\Windows\system\lcLOeTq.exe

Filesize
5.7MB

MD5
392c450e8a0dc935801d3751de4a1097

SHA1
8748aeffb8823a2cf80723be631a7a965a1ba7ef

SHA256
d62d2107e1c02e93be10b0e4dcc763e1064c7d8989a3bb03466398525382db00

SHA512
3a7f158ee73262a959c53904663d02241b0a47e30748d2085b93b59eb591e41d8fb670661213dab4259c0794ebf5ee06b6fdfef812598e01d847ad6d52160070

Download Submit
C:\Windows\system\myGceNU.exe

Filesize
5.7MB

MD5
db8e246c7b5484946104b139c4f51450

SHA1
d89616d472b633ac14179acf1a77371e8dca99c6

SHA256
4c09869cbc62dab79d4eecb8b83d0dfb0ef8b199bb314af46bdbfe63151b0353

SHA512
683ebb0b7b8d8d8684a3412ed904ef0bb626c097007f9132cebe29a0662ca6d8db89320f81eb3098c8630c0450c453745a34ca25d862ea6aa31760c3908ecd30

Download Submit
C:\Windows\system\nCvcLVM.exe

Filesize
5.7MB

MD5
f104db3612b44eed123ce757956973c6

SHA1
c7fae1cb0120f6e28d86b65b0c1d37517a69c022

SHA256
675acd4fbd7fe260bd932e4566fc754fde7aa48386cf23e93bc9f340afac3395

SHA512
4803a95a5869af3426e8196a6560524a229dbd3d91c692d63a186b658c8ca6b66e792b863077fca0578c015f3cddf9f77ca9728c9f0027578d07ae05dadd3a11

Download Submit
C:\Windows\system\orAkKVZ.exe

Filesize
5.7MB

MD5
2bf9e1ca9b77f9057832ab7a047e043e

SHA1
ef9855f9c3f65770e3003ddd0cd1c31c947a3bed

SHA256
2f8a0196d424b9787c603669e9be4df7bb82f719cdc3a6a975667079853af0a3

SHA512
daca854694dd0696157268f47857bba758cb6064ace804e53ff03a5cfdd2161537055b7f7fa9c0fad716966955c0246eb537919469115388b3f4acc56e558cc3

Download Submit
C:\Windows\system\qAgvfOF.exe

Filesize
5.7MB

MD5
5c4a2de2c7cce1d701c57fe59d1e7ade

SHA1
09750e5157a4efcf699bf0124f3a5eb550d3dc23

SHA256
7f31f45051a0d61675ce7f4c8da2edfe0adea981bb9b75786325c93a9171e105

SHA512
438742066f4e8b5d5a561c9369db514c538cd5112eae3b27ebe5fa2e0d010e57e4928e6a49b7e0a4249ad4ba0c4f7dcc4fb34605ee841d7bdf7db683beb72f12

Download Submit
C:\Windows\system\qRGWinu.exe

Filesize
5.7MB

MD5
bef90ee57b184315ae2114ffc6d3d2d5

SHA1
554d0fa3b36478559be134bfbdaf1ee74a50197a

SHA256
815ade68afe75d1629c0055a931820500303eaa4d16d5738555c73b62fa3cc60

SHA512
a7fa3631e17f989d26c301c3cd2d12ad57e155c3b303ddfe94a4e73f6c3f23a830945a01589fc7551845fbb831036d4ec88b7d8d44ea6801e31ec2e8ee9396cf

Download Submit
C:\Windows\system\qlWdXuX.exe

Filesize
5.7MB

MD5
68f036fecca03f138d2ec6dee708655d

SHA1
050a428789e6117709ab873d1c0535b4d351abc6

SHA256
ea9a6069afa35b5068522528527d2684c6723f3b13c30435efccb6c6fbb59ee3

SHA512
652b6dd4d59ce06269c8a8c7496de80bb610e396ea014397c8b8973f41b8391bc1796c34fafa56cb0653d1b85f853558bdf6a323e5358c7e55785dd1904009f2

Download Submit
C:\Windows\system\tzYvbVb.exe

Filesize
5.7MB

MD5
9cdcf752858fd52f81363db006eb4fc1

SHA1
c261547d2a9c541d734c642496e2f8aee8a44946

SHA256
0d13694ab9c4ab804b33a7e6f57f3a6b9951356693cb710ee1ca1357e32f0dc2

SHA512
3f2e3d6b58fc81e8457f930961b8e5d285d1b1b2e41438cbc1931106bb2999fe0812025371977fb4f87073f8dcb200230aadc95db0b9df610ca0a57a92bef8ff

Download Submit
C:\Windows\system\wqeYleX.exe

Filesize
5.7MB

MD5
dabc6da49321537990d94f591a07d71a

SHA1
2991d33147a9ee9bc7e9af5c73df9d362b99d1f9

SHA256
90d80151aecfc41287b901a4c89322024b5cb8e4ac7f8f5a762915559bd9ebb5

SHA512
8a7b104a14aaf335852d881ded3819e11df7ce39232455a289d7ee9b5275ba1152b1427b7341fceb74bbdcf595ac136234e1b755fb07ae42b848ef2434905159

Download Submit
C:\Windows\system\yUoCzpZ.exe

Filesize
5.7MB

MD5
14a385d2ff5796c7b38b1a82f6084f72

SHA1
979c652dc25d8b0fd7fff3c41f37f26a8caf9f57

SHA256
5796f7d80b9bf72595ec9ebb6ea6961a2412aadb81cc3a5f448d5510ca111aae

SHA512
0510b156f0114996c0b8b05c929f0609c87cc0a0caa0d4b9e31d334b6552998da0033a337cb16db5b5ef9d4753637019c594f0ae9d8734b8e2c5e4d22e5f2e06

Download Submit
C:\Windows\system\zAvhbIW.exe

Filesize
5.7MB

MD5
61b5e0e8385ddc803e683fe4031a848e

SHA1
f2e1a5c6a1f36cbb168836df86725f8029939a69

SHA256
97d5263f03be5612e51e61514b869909536fd4e2656382739e11973f2383366d

SHA512
bea9a6447c13e94b7350af70b8fb27cab36a33dde33a9e7743b88151544ddf2a50114ea9b0227fbf1b557a9831a47b3abd1b486293e49db512eb05e71568a52e

Download Submit
C:\Windows\system\zkKxbxS.exe

Filesize
5.7MB

MD5
fdb1c11499485dba77ebb2bf567a37f4

SHA1
78e865a219f1d6be6c571422473a9356bdc02b74

SHA256
38f3d4e95a20ba2ba1a8b4d21d5dbadc9fefde202c43839f3cf6b9a821283159

SHA512
9ad8fcf387f97b1747f26ce730f19f3f519b6d5a703b5cf439e27c0fd5d3e5c78b60b1fd17b6714415ac51c9487f8a0b1f1165b61a3100618cfc39dd98044ae0

Download Submit
\Windows\system\gcHBONu.exe

Filesize
5.7MB

MD5
e2c088c2b8eaf4c62e8f028df67c8544

SHA1
21f0e791110f177ba01cad881ee545113d863c77

SHA256
da6d254037e28a58e1e6ac478cf1834e61638fcc7bd8242efbdce9901c7a1767

SHA512
945e1fb84c1741c0ee5a9fd45a55ab0b1b5b6dfd0d2086c6a5d790a74de1ec7610ee8917c952f2c57dde3a35e8f57f51622292f386e5c82f83fb5bbb6ac8b293

Download Submit
\Windows\system\pZCEMfh.exe

Filesize
5.7MB

MD5
ff2663a1278ab6eddc19b7a7ea52ec8e

SHA1
9f1aece18a70192be503832f88db9497744fa5a1

SHA256
e78ef5f7e15d81f675894e3c84821a2e6f9dd2fc1509d7875ef9b190094b58d9

SHA512
79a29ee86453595c1676dcb62efd8cb3efd93868f8c3047660dae0e9ac6d487257b3260ec6f22a9c4a5dc7f11a9effc2e264ca3d64c187323ef6a6b3b5361162

Download Submit
memory/1452-105-0x000000013F370000-0x000000013F6BD000-memory.dmp

Filesize
3.3MB

Download
memory/1572-111-0x000000013F950000-0x000000013FC9D000-memory.dmp

Filesize
3.3MB

Download
memory/1832-126-0x000000013F330000-0x000000013F67D000-memory.dmp

Filesize
3.3MB

Download
memory/2128-87-0x000000013F730000-0x000000013FA7D000-memory.dmp

Filesize
3.3MB

Download
memory/2164-107-0x000000013FAC0000-0x000000013FE0D000-memory.dmp

Filesize
3.3MB

Download
memory/2288-109-0x000000013F6D0000-0x000000013FA1D000-memory.dmp

Filesize
3.3MB

Download
memory/2304-92-0x000000013F7B0000-0x000000013FAFD000-memory.dmp

Filesize
3.3MB

Download
memory/2412-93-0x000000013F930000-0x000000013FC7D000-memory.dmp

Filesize
3.3MB

Download
memory/2600-110-0x000000013F600000-0x000000013F94D000-memory.dmp

Filesize
3.3MB

Download
memory/2652-103-0x000000013F790000-0x000000013FADD000-memory.dmp

Filesize
3.3MB

Download
memory/2724-7-0x000000013F9F0000-0x000000013FD3D000-memory.dmp

Filesize
3.3MB

Download
memory/2736-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2736-0-0x000000013F620000-0x000000013F96D000-memory.dmp

Filesize
3.3MB

Download
memory/2776-108-0x000000013FD70000-0x00000001400BD000-memory.dmp

Filesize
3.3MB

Download
memory/2808-90-0x000000013FF40000-0x000000014028D000-memory.dmp

Filesize
3.3MB

Download
memory/2844-91-0x000000013F780000-0x000000013FACD000-memory.dmp

Filesize
3.3MB

Download
memory/2924-85-0x000000013FEF0000-0x000000014023D000-memory.dmp

Filesize
3.3MB

Download
memory/2944-89-0x000000013F7C0000-0x000000013FB0D000-memory.dmp

Filesize
3.3MB

Download
memory/2964-106-0x000000013F150000-0x000000013F49D000-memory.dmp

Filesize
3.3MB

Download
memory/2968-112-0x000000013FED0000-0x000000014021D000-memory.dmp

Filesize
3.3MB

Download
memory/3004-86-0x000000013F540000-0x000000013F88D000-memory.dmp

Filesize
3.3MB

Download
memory/3012-104-0x000000013FDC0000-0x000000014010D000-memory.dmp

Filesize
3.3MB

Download