cobaltstrike | 70c94bffbb98a94a777c4b306ddd1d01dc52e30b00c079f93ba1a152c20ae6f0

Analysis

max time kernel
146s
max time network
151s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
21/01/2025, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

51868e035d41da60f68aed05a097d5ee
SHA1

4c2d17f2b2d58b8dd732c961976fa76f88f43152
SHA256

70c94bffbb98a94a777c4b306ddd1d01dc52e30b00c079f93ba1a152c20ae6f0
SHA512

f20fe98677d7b66970b231a1c02021f11a73fed124106108f711a9d41307855e61a35fa13d60860e86979cc585838c4c5f7d0747b6ad020c1afc639eba7519cb
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUA:j+R56utgpPF8u/7A

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000d000000012263-5.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000018f85-9.dat	cobalt_reflective_dll
behavioral1/files/0x000700000001932a-12.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000193a0-19.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000193b8-28.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000193c7-33.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000019480-48.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000019470-42.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019fdd-63.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a049-77.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a309-89.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a404-123.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a400-119.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a3fd-113.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a3f8-107.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a3f6-101.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a3ab-95.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a0b6-83.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a03c-71.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019fd4-58.dat	cobalt_reflective_dll
behavioral1/files/0x002e000000018baf-53.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral1/memory/2892-0-0x000000013F190000-0x000000013F4DD000-memory.dmp	xmrig
behavioral1/files/0x000d000000012263-5.dat	xmrig
behavioral1/memory/2772-6-0x000000013FE70000-0x00000001401BD000-memory.dmp	xmrig
behavioral1/files/0x0009000000018f85-9.dat	xmrig
behavioral1/files/0x000700000001932a-12.dat	xmrig
behavioral1/files/0x00060000000193a0-19.dat	xmrig
behavioral1/memory/2784-20-0x000000013FD20000-0x000000014006D000-memory.dmp	xmrig
behavioral1/memory/2920-15-0x000000013F240000-0x000000013F58D000-memory.dmp	xmrig
behavioral1/files/0x00060000000193b8-28.dat	xmrig
behavioral1/memory/2104-30-0x000000013FAF0000-0x000000013FE3D000-memory.dmp	xmrig
behavioral1/files/0x00060000000193c7-33.dat	xmrig
behavioral1/memory/2720-35-0x000000013F7D0000-0x000000013FB1D000-memory.dmp	xmrig
behavioral1/memory/2868-37-0x000000013F6E0000-0x000000013FA2D000-memory.dmp	xmrig
behavioral1/memory/1700-49-0x000000013FC10000-0x000000013FF5D000-memory.dmp	xmrig
behavioral1/files/0x0007000000019480-48.dat	xmrig
behavioral1/memory/2716-43-0x000000013F950000-0x000000013FC9D000-memory.dmp	xmrig
behavioral1/files/0x0007000000019470-42.dat	xmrig
behavioral1/memory/1092-61-0x000000013F920000-0x000000013FC6D000-memory.dmp	xmrig
behavioral1/files/0x0005000000019fdd-63.dat	xmrig
behavioral1/files/0x000500000001a049-77.dat	xmrig
behavioral1/memory/1304-85-0x000000013FD70000-0x00000001400BD000-memory.dmp	xmrig
behavioral1/files/0x000500000001a309-89.dat	xmrig
behavioral1/memory/2768-103-0x000000013FAD0000-0x000000013FE1D000-memory.dmp	xmrig
behavioral1/memory/3004-109-0x000000013F830000-0x000000013FB7D000-memory.dmp	xmrig
behavioral1/files/0x000500000001a404-123.dat	xmrig
behavioral1/memory/3040-126-0x000000013FCD0000-0x000000014001D000-memory.dmp	xmrig
behavioral1/memory/2344-121-0x000000013FD90000-0x00000001400DD000-memory.dmp	xmrig
behavioral1/files/0x000500000001a400-119.dat	xmrig
behavioral1/memory/2296-115-0x000000013F580000-0x000000013F8CD000-memory.dmp	xmrig
behavioral1/files/0x000500000001a3fd-113.dat	xmrig
behavioral1/files/0x000500000001a3f8-107.dat	xmrig
behavioral1/files/0x000500000001a3f6-101.dat	xmrig
behavioral1/memory/2192-97-0x000000013FD60000-0x00000001400AD000-memory.dmp	xmrig
behavioral1/files/0x000500000001a3ab-95.dat	xmrig
behavioral1/memory/2356-91-0x000000013F050000-0x000000013F39D000-memory.dmp	xmrig
behavioral1/files/0x000500000001a0b6-83.dat	xmrig
behavioral1/memory/264-79-0x000000013FF20000-0x000000014026D000-memory.dmp	xmrig
behavioral1/memory/1816-73-0x000000013FB00000-0x000000013FE4D000-memory.dmp	xmrig
behavioral1/files/0x000500000001a03c-71.dat	xmrig
behavioral1/memory/2168-67-0x000000013FDA0000-0x00000001400ED000-memory.dmp	xmrig
behavioral1/files/0x0005000000019fd4-58.dat	xmrig
behavioral1/memory/1644-55-0x000000013F9C0000-0x000000013FD0D000-memory.dmp	xmrig
behavioral1/files/0x002e000000018baf-53.dat	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2772	BpezwTk.exe
2920	IIzFyxh.exe
2784	zQGzwBm.exe
2104	EWXCNFt.exe
2868	dOfoXLS.exe
2720	DvLrNks.exe
2716	nPULwMt.exe
1700	uDcVjBQ.exe
1644	kPzEWha.exe
1092	qsWqokT.exe
2168	ORvoXxe.exe
1816	BTPlWaB.exe
264	ifNCWtm.exe
1304	TdhURkS.exe
2356	nSBqMda.exe
2192	IJHltoP.exe
2768	GFHRZIM.exe
3004	rTaYXFC.exe
2296	WGreoWM.exe
2344	SLGZXIO.exe
3040	oRkePMf.exe

Loads dropped DLL 21 IoCs

pid	Process
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\kPzEWha.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\dOfoXLS.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uDcVjBQ.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nPULwMt.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nSBqMda.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GFHRZIM.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rTaYXFC.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SLGZXIO.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\BpezwTk.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\IIzFyxh.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ORvoXxe.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ifNCWtm.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TdhURkS.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\oRkePMf.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\EWXCNFt.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qsWqokT.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\BTPlWaB.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\IJHltoP.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WGreoWM.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\zQGzwBm.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\DvLrNks.exe	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2772	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2892 wrote to memory of 2772	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2892 wrote to memory of 2772	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2892 wrote to memory of 2920	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2892 wrote to memory of 2920	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2892 wrote to memory of 2920	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2892 wrote to memory of 2784	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2892 wrote to memory of 2784	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2892 wrote to memory of 2784	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2892 wrote to memory of 2104	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2892 wrote to memory of 2104	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2892 wrote to memory of 2104	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2892 wrote to memory of 2868	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2892 wrote to memory of 2868	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2892 wrote to memory of 2868	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2892 wrote to memory of 2720	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2892 wrote to memory of 2720	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2892 wrote to memory of 2720	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2892 wrote to memory of 2716	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2892 wrote to memory of 2716	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2892 wrote to memory of 2716	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2892 wrote to memory of 1700	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2892 wrote to memory of 1700	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2892 wrote to memory of 1700	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2892 wrote to memory of 1644	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2892 wrote to memory of 1644	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2892 wrote to memory of 1644	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2892 wrote to memory of 1092	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2892 wrote to memory of 1092	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2892 wrote to memory of 1092	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2892 wrote to memory of 2168	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2892 wrote to memory of 2168	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2892 wrote to memory of 2168	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2892 wrote to memory of 1816	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2892 wrote to memory of 1816	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2892 wrote to memory of 1816	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2892 wrote to memory of 264	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2892 wrote to memory of 264	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2892 wrote to memory of 264	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2892 wrote to memory of 1304	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2892 wrote to memory of 1304	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2892 wrote to memory of 1304	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2892 wrote to memory of 2356	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2892 wrote to memory of 2356	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2892 wrote to memory of 2356	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2892 wrote to memory of 2192	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2892 wrote to memory of 2192	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2892 wrote to memory of 2192	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2892 wrote to memory of 2768	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2892 wrote to memory of 2768	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2892 wrote to memory of 2768	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2892 wrote to memory of 3004	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2892 wrote to memory of 3004	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2892 wrote to memory of 3004	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2892 wrote to memory of 2296	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2892 wrote to memory of 2296	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2892 wrote to memory of 2296	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2892 wrote to memory of 2344	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2892 wrote to memory of 2344	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2892 wrote to memory of 2344	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2892 wrote to memory of 3040	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2892 wrote to memory of 3040	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2892 wrote to memory of 3040	2892	2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe	51

C:\Users\Admin\AppData\Local\Temp\2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-21_51868e035d41da60f68aed05a097d5ee_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\System\BpezwTk.exe
  C:\Windows\System\BpezwTk.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\IIzFyxh.exe
  C:\Windows\System\IIzFyxh.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\zQGzwBm.exe
  C:\Windows\System\zQGzwBm.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\EWXCNFt.exe
  C:\Windows\System\EWXCNFt.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\dOfoXLS.exe
  C:\Windows\System\dOfoXLS.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\DvLrNks.exe
  C:\Windows\System\DvLrNks.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\nPULwMt.exe
  C:\Windows\System\nPULwMt.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\uDcVjBQ.exe
  C:\Windows\System\uDcVjBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\kPzEWha.exe
  C:\Windows\System\kPzEWha.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\qsWqokT.exe
  C:\Windows\System\qsWqokT.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\ORvoXxe.exe
  C:\Windows\System\ORvoXxe.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\BTPlWaB.exe
  C:\Windows\System\BTPlWaB.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\ifNCWtm.exe
  C:\Windows\System\ifNCWtm.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\TdhURkS.exe
  C:\Windows\System\TdhURkS.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\nSBqMda.exe
  C:\Windows\System\nSBqMda.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\IJHltoP.exe
  C:\Windows\System\IJHltoP.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\GFHRZIM.exe
  C:\Windows\System\GFHRZIM.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\rTaYXFC.exe
  C:\Windows\System\rTaYXFC.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\WGreoWM.exe
  C:\Windows\System\WGreoWM.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\SLGZXIO.exe
  C:\Windows\System\SLGZXIO.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\oRkePMf.exe
  C:\Windows\System\oRkePMf.exe
  2⤵
  - Executes dropped EXE
  PID:3040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BTPlWaB.exe

Filesize
5.7MB

MD5
c53467b157bc3cb73424d8d29f23a309

SHA1
49d14ccfabd30402fb1a237ad6fb551fead709af

SHA256
c81c9277fdc894012b994c29f24a7c995710b69b86705bfd45bc41c857e585d9

SHA512
611bafea53baf6ffc722d84a5ed24a41d00adb3357f7d9ae706baaffac44d3629e09c1895a68e5c019c719c173d5664feff07a26991724d4fa084d91b5186d6f

Download Submit
C:\Windows\system\BpezwTk.exe

Filesize
5.7MB

MD5
eebd7fe3262d8629a7babc37a1a5eaa9

SHA1
263d21559a9dbbe8c58df4c3017eb1684263d2cd

SHA256
39c72e5e8807a9b8c34cddf4ce563b58122a130bb723f99a026492454ec8cc0d

SHA512
a4227af8b096f05c3248dac52424096848ac1842e9a9ef2747df8a2e76411ed1bc782d622c416022a66b3007812e96ba7d768cbe7e1a6f5633424120643d1eb9

Download Submit
C:\Windows\system\DvLrNks.exe

Filesize
5.7MB

MD5
96eda813dd9d0981db875713efa1e587

SHA1
d933b4e35c03d00946595722c8cd1fdef3019691

SHA256
207d2e0c40f47c855c93cfd6718c1938787fc273620e83fc395501b3fec4c6a6

SHA512
15d7a0628a08c8a21cf162224889968ee7e76f2cb776b7efd4208e650cec966005b8068da04e342a21df253351186e73e27eea19b32a281428a24c3b1af13bce

Download Submit
C:\Windows\system\GFHRZIM.exe

Filesize
5.7MB

MD5
81070a67548dfe931cf85b13c319c03d

SHA1
43f08efa9039693a17a0717ad0368ca65586f772

SHA256
5fb993534b913e439a08d142752bf1a38b2494acc1897d9f618c2057e13e4b19

SHA512
c870d4fed974a64284982e8189d331e10be46f464bff784b0e06e68d46407d2a7c76883ae2df4c93b25cc1cd52a9b3cbe85459dd82a123e9a6d7a82750046b58

Download Submit
C:\Windows\system\IJHltoP.exe

Filesize
5.7MB

MD5
39ab7dabc70c5914759ebedceda20278

SHA1
85c9a1b5f0e2702ab3a4fa19ddc2d75fcc5a9786

SHA256
c18658805b8ce23fcdb9e1d1f8e6877af69b695374b8e3b0c3a762d1b5ab6598

SHA512
6efdce3c32c704d0fcc14df5d483b275bef6726d98ef7592a0d8b94941d7e683a83e5819918d07a5c23a5c3314e8242cfc4aae7f99b5283fab1c03fb333b1535

Download Submit
C:\Windows\system\SLGZXIO.exe

Filesize
5.7MB

MD5
02b2d3b7e19b1a16291d66bb056215d7

SHA1
be9c2cc1e4a4df3d9c2f2cbecfcb2e18e5e4f29a

SHA256
450922454d9d5982e83f5c13be467f3f6edb659000168ae556ca4da90ca6e8eb

SHA512
0e7ed3a73a44095ac2e3a04117d19a79131fa20d93bdda669fcb10acc967cba9195b55d135633e46594563943f5827464e9b1c76fa60bd31c46909b8204a173f

Download Submit
C:\Windows\system\TdhURkS.exe

Filesize
5.7MB

MD5
2b94ac040bbdfcc9fe1eca1c40e8b53c

SHA1
c65e0248f30214c50003ffe798ead8b4dae7b0fd

SHA256
332c0f24b93fa01a1c00525e650fad6b528869aa4fce9403de79080f5704d1bf

SHA512
8f388b29c66f983175473258fc618f607a6c4443b7f70f7d8b621f9f29e5647c21adb5d9e067d5b5bdeea69ad3a05033b06cf8ac7835e1d148c6ee0492b2d84f

Download Submit
C:\Windows\system\WGreoWM.exe

Filesize
5.7MB

MD5
9353096a12d390d94a4c100e9b33ca1f

SHA1
3a76730c34aa32203b200c0c3e7b91008e054f03

SHA256
b65ad644bc69925467ce6c1024837aa28933b1bcba3e1b8e08c4927be1d8816f

SHA512
a32070ab374a9d4af65770bb2b797d46c96381f4b0fcab37bbb55186e2d570ba7b5249cffe26f040fb02b3fea3e9a78c0bd8a807a6f4abfedbe7aaf8e5fc55b4

Download Submit
C:\Windows\system\dOfoXLS.exe

Filesize
5.7MB

MD5
cc8eb69f19136a39d5c22092a8924243

SHA1
af55c7bd52b7e6d7b0f6ff02bee3e5d9642c746a

SHA256
f124599fbc6d15371c6c00da9e6789cba1cfb8f58e773e4e2ca8eb388216033d

SHA512
1239e12c77bd42b7095da8f4d3ef7501da1edade4ca130762fba2d86efcd8cdad40666857765c27a1c4d0a4e3b8f38ccd29d15ea7c850663ced6c65cb7315500

Download Submit
C:\Windows\system\ifNCWtm.exe

Filesize
5.7MB

MD5
a8a038b381553e67adcf7d89faf4e180

SHA1
27d47cb8be0024f36a7dadc465c01b0d070e88bb

SHA256
cc16854820f99629503a8ea8d32389d505a3f308d141a7962af8a987787ce37e

SHA512
845729d7b67050dd9f9ffa56385902b4eb37fae087ace139b425729d9128a672b29587e179dabc8b91482a4582a9c27d74a16992abbe4a2d4bb249e125b9659b

Download Submit
C:\Windows\system\kPzEWha.exe

Filesize
5.7MB

MD5
9445301bb6603e989457d7b503415dac

SHA1
eb5288be5a87dbaabb402c16bd46a01f1c58dc50

SHA256
d878d0a0134e9c951e50b6cb190d3fb2e17c6f4190365fc7ffd320f1cf0eccf2

SHA512
78ba9cf9b34ac8db2ca38921b6e47018a9e933b490aafd9446dcc9e9d96c5a1de02966cde60ba67cd3c682646ce1ed5b0400107a649b867336f50aafb8278917

Download Submit
C:\Windows\system\nPULwMt.exe

Filesize
5.7MB

MD5
afb31b5a2bf698814a7abf77966a2e62

SHA1
a89f4219fe2cc5d9435c920cef59b95c9fc26f3f

SHA256
e9900577c268ccfb33118beacfb5c13b76e03cf5a5a16c9214a62d427e777c47

SHA512
3ef43177153723997bef656acf3ccfc75c269300fcf82e1019c4756e8a4bb5f4e910c7091343173ff41e0f91e7ca789368f5c0832bb6a60da89d7f18a16f36d3

Download Submit
C:\Windows\system\nSBqMda.exe

Filesize
5.7MB

MD5
0d9c79feb18cd1ac051dcfdca5b2b8fb

SHA1
818ac3fee7be8a55fafa6c741116a9a492352d67

SHA256
5dabef19acf6c5bd9e20c08c4d1e31fc29f0b45bb7094168824ecfe857fd300d

SHA512
43b596d5baa3cfe1801b64094e3e307763cb8deb6195566cec892eb800bb57070ef1ecc592e792570439ee2355f3e3051fcfe711d4e3495d3d0874c7dc243ba7

Download Submit
C:\Windows\system\qsWqokT.exe

Filesize
5.7MB

MD5
764878286802ac4e66b47622e1091160

SHA1
ca753c9b0d242d86742e2aa1e020da3ae2dc0fa4

SHA256
3a22f398bac27297ec42260501527e9231aa34dc62b96db6939ea77106756d1e

SHA512
a0afa62820b2cd3ac33d6d16dd9adebad171767a345973843c340ab564cc00e6ecaa1e107ee4ce41c47181fd5d4374c762098e58af5d9f8f9358d4a8ff38f14b

Download Submit
C:\Windows\system\rTaYXFC.exe

Filesize
5.7MB

MD5
0da31e5d0013a518c4c6ec94c78104f3

SHA1
7499eac3952e251ed521f4ff2761d7d58d7cbc39

SHA256
ca72ce4df612c0d99048104bc04063ace4526cdca2e195d5b4b10ad287aadf04

SHA512
457425d51f5e5d00567a4634db19e8dc17c15b790cf3da8aecb30d02f3678a80b81fc19cda598fde5d417feb8701a243ffb66272b4c0fc83170f6bef79fd481e

Download Submit
C:\Windows\system\uDcVjBQ.exe

Filesize
5.7MB

MD5
0f9dc3b2bcafff38f877b80961b11b8e

SHA1
b1088586d6f917e0bd272795254e2ad3cf4ef2e8

SHA256
75f926d726d5acd9301a7b95989eca1b33c22a07230de796cf298eb6f9efeeea

SHA512
1f675ed8610dcf390773d5f0fd8e6f31363ad099739c43fbc49816f1bbf50f925e01dbbf5b977b931e66663ee12bfc7ced545da55021fd73b32b187ac1bfaf85

Download Submit
C:\Windows\system\zQGzwBm.exe

Filesize
5.7MB

MD5
ff1ce5b40e5025cd75a13bd2372164ba

SHA1
5b8604153e0ab2325a52b99d3e1a698683802210

SHA256
799006ade6cdded0a1ef2fb26b988b0f81e1b7ca18bcb2c66fba1b0b6d6008e2

SHA512
95460fd64660f020c8dce0b8d36424ac592a8da08cb19be3768cfaf701eff30c257323d2ceebed45730b614288914dfa77bd8c94186d1855b44db4dff0e1ada1

Download Submit
\Windows\system\EWXCNFt.exe

Filesize
5.7MB

MD5
ffc48ad21d3510f7cbb83241c05279df

SHA1
7b7ab59ef795fde4e0d55b6412584d92c7414a7a

SHA256
fb7bf5711d4217623913c75df92473940388d93956ff2b2d1e7b39498c1c1c79

SHA512
1a4289a377a7b6ce91cd28267532e2ccb3fc8878a0067d224e4289cc744c23d6b3e879fe183e9fa39ee9cedf34828386e632ed32ac02e4b4ea510da3cd9b4063

Download Submit
\Windows\system\IIzFyxh.exe

Filesize
5.7MB

MD5
956c67ae0b26160daf24fe8a98eb760b

SHA1
f994a96c5f0890ecb5274ab14da7e1d39d7cc9de

SHA256
126d7cd80a12667a866a610556b3d775cf1771537fcff26894c205adfdcd5654

SHA512
5ad68175369f97c82219e0b3a882062525bcb22e058dd5de868e59d3775b7ffa0bd515ce10dd305c2aaeb5f91fa2a2c58fc4e481dc19ff5c878e1ab601a580af

Download Submit
\Windows\system\ORvoXxe.exe

Filesize
5.7MB

MD5
9d1831f6b48b723342c5be146451d681

SHA1
3b49b13718e92a6ef958c3d044bd11d6634c2a82

SHA256
c9cf499210469aaaef17c6c72120aad4511ad4cc5f4e7fd8bc372eed4e896607

SHA512
2374a8d96a5c31508da963d14dcf732bf94d5fd0fe1bbf61ab938354007a107056a167fb91f80e2c5d1d332f7791c682b214079931adc4ca64b067909810ea70

Download Submit
\Windows\system\oRkePMf.exe

Filesize
5.7MB

MD5
5df9bfcbd5ef626d411a0b45656a6a3d

SHA1
c937c784b8ad3d7aad242526859fb76bef6b6b60

SHA256
a422f55dba892075f2557431250ccac4bd5fa7d60023501fb97251a444e4f6e0

SHA512
a68bea7ba6343fd1798664633a34bcfa412c9cd0b4fb57f382fa8dee4824d630830e519bf2b4f7fdd822221e4c6f09a29347c69a7dad353a0b7b029928703f19

Download Submit
memory/264-79-0x000000013FF20000-0x000000014026D000-memory.dmp

Filesize
3.3MB

Download
memory/1092-61-0x000000013F920000-0x000000013FC6D000-memory.dmp

Filesize
3.3MB

Download
memory/1304-85-0x000000013FD70000-0x00000001400BD000-memory.dmp

Filesize
3.3MB

Download
memory/1644-55-0x000000013F9C0000-0x000000013FD0D000-memory.dmp

Filesize
3.3MB

Download
memory/1700-49-0x000000013FC10000-0x000000013FF5D000-memory.dmp

Filesize
3.3MB

Download
memory/1816-73-0x000000013FB00000-0x000000013FE4D000-memory.dmp

Filesize
3.3MB

Download
memory/2104-30-0x000000013FAF0000-0x000000013FE3D000-memory.dmp

Filesize
3.3MB

Download
memory/2168-67-0x000000013FDA0000-0x00000001400ED000-memory.dmp

Filesize
3.3MB

Download
memory/2192-97-0x000000013FD60000-0x00000001400AD000-memory.dmp

Filesize
3.3MB

Download
memory/2296-115-0x000000013F580000-0x000000013F8CD000-memory.dmp

Filesize
3.3MB

Download
memory/2344-121-0x000000013FD90000-0x00000001400DD000-memory.dmp

Filesize
3.3MB

Download
memory/2356-91-0x000000013F050000-0x000000013F39D000-memory.dmp

Filesize
3.3MB

Download
memory/2716-43-0x000000013F950000-0x000000013FC9D000-memory.dmp

Filesize
3.3MB

Download
memory/2720-35-0x000000013F7D0000-0x000000013FB1D000-memory.dmp

Filesize
3.3MB

Download
memory/2768-103-0x000000013FAD0000-0x000000013FE1D000-memory.dmp

Filesize
3.3MB

Download
memory/2772-6-0x000000013FE70000-0x00000001401BD000-memory.dmp

Filesize
3.3MB

Download
memory/2784-20-0x000000013FD20000-0x000000014006D000-memory.dmp

Filesize
3.3MB

Download
memory/2868-37-0x000000013F6E0000-0x000000013FA2D000-memory.dmp

Filesize
3.3MB

Download
memory/2892-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2892-0-0x000000013F190000-0x000000013F4DD000-memory.dmp

Filesize
3.3MB

Download
memory/2920-15-0x000000013F240000-0x000000013F58D000-memory.dmp

Filesize
3.3MB

Download
memory/3004-109-0x000000013F830000-0x000000013FB7D000-memory.dmp

Filesize
3.3MB

Download
memory/3040-126-0x000000013FCD0000-0x000000014001D000-memory.dmp

Filesize
3.3MB

Download