cobaltstrike | 55f7a18fada369ad944511c315c4be423cc001c664ed7a57e261b6a41f880e3d

Analysis

max time kernel
140s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-01-2025 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

d3bc172294e592706b53fa1e81bbd1eb
SHA1

d79d668b6462e43694c4260e59fb87afd285b0e6
SHA256

55f7a18fada369ad944511c315c4be423cc001c664ed7a57e261b6a41f880e3d
SHA512

99cc3bcc5668df3f4bd770446ec135750458fa3c9736e3d69ff171ca74727b4b20a7dd2175633d767f33a9f466483ed429b182bbe0b5a19f1fc5f8720058b57c
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUa:j+R56utgpPF8u/7a

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000a000000015685-3.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015d0a-8.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015d31-12.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015d48-20.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000015ccf-35.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016399-46.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000164de-49.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016890-71.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016c89-83.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016d22-107.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016d6f-123.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016d4c-113.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016d68-118.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016cf0-101.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016ca0-89.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016cab-95.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016b86-77.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016689-65.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001660e-59.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000015d88-42.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015d60-30.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral1/memory/2328-0-0x000000013FF70000-0x00000001402BD000-memory.dmp	xmrig
behavioral1/files/0x000a000000015685-3.dat	xmrig
behavioral1/memory/2452-7-0x000000013F490000-0x000000013F7DD000-memory.dmp	xmrig
behavioral1/files/0x0008000000015d0a-8.dat	xmrig
behavioral1/files/0x0007000000015d31-12.dat	xmrig
behavioral1/memory/2132-13-0x000000013FEC0000-0x000000014020D000-memory.dmp	xmrig
behavioral1/files/0x0007000000015d48-20.dat	xmrig
behavioral1/memory/2276-19-0x000000013F540000-0x000000013F88D000-memory.dmp	xmrig
behavioral1/memory/2652-24-0x000000013F4F0000-0x000000013F83D000-memory.dmp	xmrig
behavioral1/memory/2816-31-0x000000013F740000-0x000000013FA8D000-memory.dmp	xmrig
behavioral1/files/0x0009000000015ccf-35.dat	xmrig
behavioral1/memory/2832-37-0x000000013FAE0000-0x000000013FE2D000-memory.dmp	xmrig
behavioral1/files/0x0007000000016399-46.dat	xmrig
behavioral1/memory/2680-48-0x000000013F960000-0x000000013FCAD000-memory.dmp	xmrig
behavioral1/files/0x00060000000164de-49.dat	xmrig
behavioral1/memory/2592-55-0x000000013FCE0000-0x000000014002D000-memory.dmp	xmrig
behavioral1/memory/2556-61-0x000000013FC70000-0x000000013FFBD000-memory.dmp	xmrig
behavioral1/files/0x0006000000016890-71.dat	xmrig
behavioral1/files/0x0006000000016c89-83.dat	xmrig
behavioral1/files/0x0006000000016d22-107.dat	xmrig
behavioral1/memory/2436-115-0x000000013F660000-0x000000013F9AD000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d6f-123.dat	xmrig
behavioral1/memory/1908-126-0x000000013F420000-0x000000013F76D000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d4c-113.dat	xmrig
behavioral1/memory/1268-120-0x000000013FC20000-0x000000013FF6D000-memory.dmp	xmrig
behavioral1/files/0x0006000000016d68-118.dat	xmrig
behavioral1/memory/1688-109-0x000000013F840000-0x000000013FB8D000-memory.dmp	xmrig
behavioral1/memory/1788-103-0x000000013F5E0000-0x000000013F92D000-memory.dmp	xmrig
behavioral1/files/0x0006000000016cf0-101.dat	xmrig
behavioral1/memory/2524-91-0x000000013F760000-0x000000013FAAD000-memory.dmp	xmrig
behavioral1/files/0x0006000000016ca0-89.dat	xmrig
behavioral1/memory/1400-97-0x000000013F080000-0x000000013F3CD000-memory.dmp	xmrig
behavioral1/files/0x0006000000016cab-95.dat	xmrig
behavioral1/memory/1644-85-0x000000013F3A0000-0x000000013F6ED000-memory.dmp	xmrig
behavioral1/memory/1000-79-0x000000013FD20000-0x000000014006D000-memory.dmp	xmrig
behavioral1/files/0x0006000000016b86-77.dat	xmrig
behavioral1/memory/3020-73-0x000000013FE70000-0x00000001401BD000-memory.dmp	xmrig
behavioral1/memory/3016-67-0x000000013F7F0000-0x000000013FB3D000-memory.dmp	xmrig
behavioral1/files/0x0006000000016689-65.dat	xmrig
behavioral1/files/0x000600000001660e-59.dat	xmrig
behavioral1/memory/2848-43-0x000000013F8A0000-0x000000013FBED000-memory.dmp	xmrig
behavioral1/files/0x0009000000015d88-42.dat	xmrig
behavioral1/files/0x0007000000015d60-30.dat	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2452	QAROywd.exe
2132	lNdlvuM.exe
2276	otPFydp.exe
2652	pAbhgDt.exe
2816	ExPHoEZ.exe
2832	xseuhDr.exe
2848	AjtBRDS.exe
2680	ttvADDe.exe
2592	OArCwCI.exe
2556	QkLowCT.exe
3016	CUdZFnO.exe
3020	ZvJYbRp.exe
1000	TqemmbW.exe
1644	PqXnOjj.exe
2524	WrcFkUs.exe
1400	iyBUkwA.exe
1788	uJQvHQI.exe
1688	MEsEFdh.exe
2436	oUQxaSk.exe
1268	pkfZOCu.exe
1908	DLsfLpM.exe

Loads dropped DLL 21 IoCs

pid	Process
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\WrcFkUs.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\iyBUkwA.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\MEsEFdh.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\otPFydp.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\QkLowCT.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ttvADDe.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PqXnOjj.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uJQvHQI.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ExPHoEZ.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\AjtBRDS.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZvJYbRp.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TqemmbW.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\oUQxaSk.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\DLsfLpM.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\QAROywd.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OArCwCI.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\xseuhDr.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\CUdZFnO.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\pkfZOCu.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\lNdlvuM.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\pAbhgDt.exe	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2452	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2328 wrote to memory of 2452	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2328 wrote to memory of 2452	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2328 wrote to memory of 2132	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2328 wrote to memory of 2132	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2328 wrote to memory of 2132	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2328 wrote to memory of 2276	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2328 wrote to memory of 2276	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2328 wrote to memory of 2276	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2328 wrote to memory of 2652	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2328 wrote to memory of 2652	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2328 wrote to memory of 2652	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2328 wrote to memory of 2816	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2328 wrote to memory of 2816	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2328 wrote to memory of 2816	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2328 wrote to memory of 2832	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2328 wrote to memory of 2832	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2328 wrote to memory of 2832	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2328 wrote to memory of 2848	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2328 wrote to memory of 2848	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2328 wrote to memory of 2848	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2328 wrote to memory of 2680	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2328 wrote to memory of 2680	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2328 wrote to memory of 2680	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2328 wrote to memory of 2592	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2328 wrote to memory of 2592	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2328 wrote to memory of 2592	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2328 wrote to memory of 2556	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2328 wrote to memory of 2556	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2328 wrote to memory of 2556	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2328 wrote to memory of 3016	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2328 wrote to memory of 3016	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2328 wrote to memory of 3016	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2328 wrote to memory of 3020	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2328 wrote to memory of 3020	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2328 wrote to memory of 3020	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2328 wrote to memory of 1000	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2328 wrote to memory of 1000	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2328 wrote to memory of 1000	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2328 wrote to memory of 1644	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2328 wrote to memory of 1644	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2328 wrote to memory of 1644	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2328 wrote to memory of 2524	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2328 wrote to memory of 2524	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2328 wrote to memory of 2524	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2328 wrote to memory of 1400	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2328 wrote to memory of 1400	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2328 wrote to memory of 1400	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2328 wrote to memory of 1788	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2328 wrote to memory of 1788	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2328 wrote to memory of 1788	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2328 wrote to memory of 1688	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2328 wrote to memory of 1688	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2328 wrote to memory of 1688	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2328 wrote to memory of 2436	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2328 wrote to memory of 2436	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2328 wrote to memory of 2436	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2328 wrote to memory of 1268	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2328 wrote to memory of 1268	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2328 wrote to memory of 1268	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2328 wrote to memory of 1908	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	52
PID 2328 wrote to memory of 1908	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	52
PID 2328 wrote to memory of 1908	2328	2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe	52

C:\Users\Admin\AppData\Local\Temp\2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-21_d3bc172294e592706b53fa1e81bbd1eb_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\System\QAROywd.exe
  C:\Windows\System\QAROywd.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\lNdlvuM.exe
  C:\Windows\System\lNdlvuM.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\otPFydp.exe
  C:\Windows\System\otPFydp.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\pAbhgDt.exe
  C:\Windows\System\pAbhgDt.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\ExPHoEZ.exe
  C:\Windows\System\ExPHoEZ.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\xseuhDr.exe
  C:\Windows\System\xseuhDr.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\AjtBRDS.exe
  C:\Windows\System\AjtBRDS.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ttvADDe.exe
  C:\Windows\System\ttvADDe.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\OArCwCI.exe
  C:\Windows\System\OArCwCI.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\QkLowCT.exe
  C:\Windows\System\QkLowCT.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\CUdZFnO.exe
  C:\Windows\System\CUdZFnO.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\ZvJYbRp.exe
  C:\Windows\System\ZvJYbRp.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\TqemmbW.exe
  C:\Windows\System\TqemmbW.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\PqXnOjj.exe
  C:\Windows\System\PqXnOjj.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\WrcFkUs.exe
  C:\Windows\System\WrcFkUs.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\iyBUkwA.exe
  C:\Windows\System\iyBUkwA.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\uJQvHQI.exe
  C:\Windows\System\uJQvHQI.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\MEsEFdh.exe
  C:\Windows\System\MEsEFdh.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\oUQxaSk.exe
  C:\Windows\System\oUQxaSk.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\pkfZOCu.exe
  C:\Windows\System\pkfZOCu.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\DLsfLpM.exe
  C:\Windows\System\DLsfLpM.exe
  2⤵
  - Executes dropped EXE
  PID:1908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AjtBRDS.exe

Filesize
5.7MB

MD5
64a43b236d9373340949b58e541c5cca

SHA1
f58f61643a669530587aa20425a09e4a14227625

SHA256
598f255f74a9f61452798c80e14078766bd9bd04a508ce926bc2f5e6164d6b38

SHA512
a19d198b264fe6999cbecfc3ace05194aa90c18ecc3fb25faabe1404512f605f8c2c27c63dd2f003a5700e687dd9940939cc2a21d946e44415762d6b043afde7

Download Submit
C:\Windows\system\CUdZFnO.exe

Filesize
5.7MB

MD5
0161357cb3027037dac7c793604cf7da

SHA1
38d41519a5ff6f1a76a6f26712ec38bf5804c4f3

SHA256
bd35f1813984d62ddac816c4b08d8d083bb53dd034356a4519c51232a5b67e58

SHA512
080865e6396b0f56c94eb450de75b953fd0df648383b25f6c0e79cfcf3d5c47fc9c2d07fc2b7a051801ac09e89d0ccc595f4bca2b5920545c38cd5a6bf2c7e0b

Download Submit
C:\Windows\system\ExPHoEZ.exe

Filesize
5.7MB

MD5
958c0c5f04dedf3a96036962a65b1355

SHA1
1e11ed317b78691df7d3139f928543df5c4773cb

SHA256
839878f740ac3dbfd9c129293a41dd96b14803b24b2f5dba2adc75117a611963

SHA512
3410f3fa45e3c778d2a33a98b79ef11d6dc0c23698e8319e0dc2109809d47319a18f5982fc1abe160bef0c8b32c380d03bd3ae9aa6fc143f73ab7ce264c21a89

Download Submit
C:\Windows\system\MEsEFdh.exe

Filesize
5.7MB

MD5
05d6606825e5038518eee5b19d05834e

SHA1
ff0e80bde40762505a5b777e402bdda3e5c5e3e6

SHA256
7a4d033a623390fc8754a30cd83b65a70c667048e5ba2f8acbf715fe95b07e1b

SHA512
e7d772443993338d3be3320a1ebdbc536a759c9fa03921f81a54d2f9f2483333264771f2af5f6132b70f90709a9d574d9e1314409eeca9cd2484d5594b1fce21

Download Submit
C:\Windows\system\PqXnOjj.exe

Filesize
5.7MB

MD5
ce660ed468041a896040881f182c72df

SHA1
35728424a22ff60fd669d9efd261af0a28e732c3

SHA256
97ce5e6e2e4e8e460275ccc87ab3879a2efbf6f3500fbc4c258d528ff274f35e

SHA512
81d850cdbd4c1b5121de09a70381d87ddb1d6324bcd4e26157f2e9593a673e78c56d92cbb59d36c4ea7bbf6f0c606e81610010d74711ca636e32b394572debc0

Download Submit
C:\Windows\system\QkLowCT.exe

Filesize
5.7MB

MD5
2fcb0ab5d24390f170c46dbf799ed21b

SHA1
2bbff75797b042f98a7795ff32c846d196525f13

SHA256
c7881af659c2b92c9dec440e4eaa8d39813b392f6b95e3db1309399cca5cc8bd

SHA512
97de495fb963b84a1865c7879f579551a4f8e1ade364b933a6dc31a9a32ae257852375525cb99f91aa24df7f97b3335cc9960b68a16b4cf6689d255f0a3843f4

Download Submit
C:\Windows\system\TqemmbW.exe

Filesize
5.7MB

MD5
2b94c199e5ec5d34058e14b1be311c0b

SHA1
0c9cb0261f923073dc2f1823f8bd2ad6daa6e030

SHA256
bc3050f65206df8235c2281d91584dfb7c9409d6f544886dfbede59b06e59811

SHA512
14c7ed1de84a0134b5b3596613b4554f0af53b5cb8a5f1eb683dcf0fac17ee9cd54de92847b347177ff80152f993927e2ab93173472f52abbcc843940a6aa088

Download Submit
C:\Windows\system\WrcFkUs.exe

Filesize
5.7MB

MD5
852af46a145dd0a74975d46b01b34f94

SHA1
ba4659df0ca1ce73fa4a39343cdb26c3ae643d66

SHA256
4600fbb0db38f5c9812c5fa1531e445725a90276953b06feaf7fda2855cbf8dc

SHA512
ac37b531b44cf0509a29b696d13486eceb9f39c46a6e9817727bb2f9574b42dd67344a97615d0b457e94534aff5cfe64e99a3dc1ca0c37edc77f1da91c0c9429

Download Submit
C:\Windows\system\ZvJYbRp.exe

Filesize
5.7MB

MD5
ee53480b7c22237b1568d7339c2e4773

SHA1
7b24aebec0c56a9b88e96b5325261568bcb9c429

SHA256
66f3f4e5b0baa8320c724896850c5aeefc1f9a0fbc94044a9486c3decaeea208

SHA512
d20582ea10bf16f76ddfbe2e637e8427fc297cd7e3c215d4dc6c41086ed47c531dfd42740430b72a15789699ffd1bb1d2328929f2476258a659e72f701d8e063

Download Submit
C:\Windows\system\iyBUkwA.exe

Filesize
5.7MB

MD5
f5e8430bbbc75d07465b506ee021ee9a

SHA1
eb70c69b5b4805b2f89120982ea382e2afabb1cf

SHA256
e6c10d085971b2bc70f18cfb178ef15c203c3d74a316bc0625df296688f05067

SHA512
d2982a41e258c4154f0e94944c835c09567dffbb15f93b68d264044bd58f975ec72d1f0a1bd62eda8d10e8a183951c6c67250d7477200fc3c465360fd1e78019

Download Submit
C:\Windows\system\oUQxaSk.exe

Filesize
5.7MB

MD5
0ad3b0bcde328e65f7e4357784c086f1

SHA1
01f154f0899fd41e15d7d01a15b0f39c6f93fdf0

SHA256
b1ca8483e286b48bcd4b58824afebf556f11a751f78b6f07a4569d9214028337

SHA512
b803782c356354aeff17e43203d6d174e04a3ee54b185ea51d187f98f277c2778d66317b9c01f6fef880b939d235dd27ec4a329481e027b3c3c6309c9c9f1819

Download Submit
C:\Windows\system\otPFydp.exe

Filesize
5.7MB

MD5
83dd3c67dc515a5b3b9ebee5d618bdfb

SHA1
ab8964bb1e714b63ca33799b35b84b858ae6af5a

SHA256
124e6133ecd203b2608076ea6529bbd48220d8bde5bde1a189cbaac64dc0fa67

SHA512
6baf266f5203aa6f58cbaac1f027b49c0a8be3aee012e2aff54db471c891bfaae6030fdfe16b46cffc0191266e35a77647666d24b1b3a2bb97326df5d91a8623

Download Submit
C:\Windows\system\pkfZOCu.exe

Filesize
5.7MB

MD5
f03332c507b7dbc4e4cd5290292bb2de

SHA1
b34cf9dac60496f6223adcbff45ed66e46bb08c9

SHA256
a58c9edeef791070b7a02ecd4ac4d2c6ae8a9e35930d79b85d591511f4dae99d

SHA512
0786933cac6a95808a8a2c39c061720a86d5ab34be57b6283ac00f90d20f291425533a05493e726cd9d05d02deab1ff5d2b02ca3ce2eb4226dff5bf925268bf6

Download Submit
C:\Windows\system\ttvADDe.exe

Filesize
5.7MB

MD5
19ffdc565679e7f3bd5861da78802ce3

SHA1
c52de3db17b114f28bba8bacb4c747080da8dcd3

SHA256
8161e2e58aa3ca23c3d513fba55f76d2a4cbb59fe508d2cb5638aa6cc4c1b1ae

SHA512
704a9e14aeca1875c77cc61d20a64a4983cae116766b01558d0265ef17a8ac27c59c0c8812b96c14c8014563f0b2c495776219044e659b0d1246f13b64b4dbca

Download Submit
C:\Windows\system\uJQvHQI.exe

Filesize
5.7MB

MD5
d57a3bc4068d05ac549bfae584fea06f

SHA1
2a29e39fc198065e41ed28f5e14db7dc3b8f1245

SHA256
75912761c22118876aecab7a523df90d5a955396c81365a04a7083c790fe0fc9

SHA512
248fef3f3b2e1059d7a3b456abd96a7fb0013d0c5b9a5f84355719ca3a2b60cadf5d9fb23d0c904d60f22978761231bcb8c9c41030bc85d69af1a6f786207638

Download Submit
C:\Windows\system\xseuhDr.exe

Filesize
5.7MB

MD5
43b8020d1973a2f217e293f29a56248e

SHA1
1461aed68a67ebfa0af980001ecf02c39eaad667

SHA256
e1d9b3091894b62b2dbc5b48d357ce8f0d9b56f4d8cb47c45167f1cbdc0aa767

SHA512
10e7e2f2c13d07c33ce1ec4faef61811fd9ae5c94e0ac603a785128adf1b1b6ad1afb954db330e85801c1458fb74ea9bd167273359242132b3f4159d476b192d

Download Submit
\Windows\system\DLsfLpM.exe

Filesize
5.7MB

MD5
826cca31db670fd4e9f2614559e78ddb

SHA1
981a2980258bc770accd23e16bd1aa8c83f8e254

SHA256
c397994b4322d9c4510e8c11bdaa6b7f3e6d8a8908ac5d00f7128e98e164ec0a

SHA512
5a7ec7e802fa08a272b7b5b1f41c55aac021c4da71bcc6d8e6b2600fe3e574052fde50fc060457b5d79dca5716d2146d9a146cccd72fbebbc09a5cbc0f70e19f

Download Submit
\Windows\system\OArCwCI.exe

Filesize
5.7MB

MD5
8e02a008e7b5d20fdd83e5f2da580a70

SHA1
7f14ea44466d16d91ce54c1ff65306b9d7662d00

SHA256
aa16897bd4f0dd3f1929885c8188c7ed49e47acdc0bd48aef6ce20915bb90853

SHA512
40756dcacd316ab5b3f6af73988a877255fe7c81521bfdc37d105e9ec857e503ee012ed2689e53ee269809c1e163cbdad79c35fb0ff3eacb74c76e84bb896961

Download Submit
\Windows\system\QAROywd.exe

Filesize
5.7MB

MD5
915d49d097329c3004cf9be73551e2b4

SHA1
f78661f799e3a9a9111d355d341a1564f9b60cfa

SHA256
c20b0fa3890614c0259de44d60e700bf34521afcb06a9e0250102b4566bc218f

SHA512
52541a5b9cf898217c3f11c8d75e8e97b3b4e6ecdafd4775544b573b770eaedaffde3659c6e1679a18166933cae770397a25d50b782a35d818b7e4d29c757a8b

Download Submit
\Windows\system\lNdlvuM.exe

Filesize
5.7MB

MD5
affb6592b7c66e0ae5aa08283bc97471

SHA1
f903db2015fba2bb58959d89f07deaca92b1f5f6

SHA256
4535b2374542595aa627be3e864a25c5a8b384548cf4abc6463b91b516df6d2b

SHA512
1cb25e06459ac30c8df2e9bc168aef0cbf29b5cbd6a3cf19faee63b33ef0f1702cee4c04df92c748aed6f93919a94054469882c6533349083fb20789c68c8c25

Download Submit
\Windows\system\pAbhgDt.exe

Filesize
5.7MB

MD5
1837f848b1cacf4e885e0902d128e640

SHA1
befd40fd123a42dd5a69396d59b93693835cbc55

SHA256
0d000d4d0448c3b0eee80a6651eea817d49708a456076d44b6f8ff2db743d98e

SHA512
b13631148652753f478c9404b5b9454d1b06129a7a552eb32d1928da086bfd3f2c7deb5aadfd084687ece4b6ac434457daa730c765816cda81a01c4d616c8794

Download Submit
memory/1000-79-0x000000013FD20000-0x000000014006D000-memory.dmp

Filesize
3.3MB

Download
memory/1268-120-0x000000013FC20000-0x000000013FF6D000-memory.dmp

Filesize
3.3MB

Download
memory/1400-97-0x000000013F080000-0x000000013F3CD000-memory.dmp

Filesize
3.3MB

Download
memory/1644-85-0x000000013F3A0000-0x000000013F6ED000-memory.dmp

Filesize
3.3MB

Download
memory/1688-109-0x000000013F840000-0x000000013FB8D000-memory.dmp

Filesize
3.3MB

Download
memory/1788-103-0x000000013F5E0000-0x000000013F92D000-memory.dmp

Filesize
3.3MB

Download
memory/1908-126-0x000000013F420000-0x000000013F76D000-memory.dmp

Filesize
3.3MB

Download
memory/2132-13-0x000000013FEC0000-0x000000014020D000-memory.dmp

Filesize
3.3MB

Download
memory/2276-19-0x000000013F540000-0x000000013F88D000-memory.dmp

Filesize
3.3MB

Download
memory/2328-0-0x000000013FF70000-0x00000001402BD000-memory.dmp

Filesize
3.3MB

Download
memory/2328-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2436-115-0x000000013F660000-0x000000013F9AD000-memory.dmp

Filesize
3.3MB

Download
memory/2452-7-0x000000013F490000-0x000000013F7DD000-memory.dmp

Filesize
3.3MB

Download
memory/2524-91-0x000000013F760000-0x000000013FAAD000-memory.dmp

Filesize
3.3MB

Download
memory/2556-61-0x000000013FC70000-0x000000013FFBD000-memory.dmp

Filesize
3.3MB

Download
memory/2592-55-0x000000013FCE0000-0x000000014002D000-memory.dmp

Filesize
3.3MB

Download
memory/2652-24-0x000000013F4F0000-0x000000013F83D000-memory.dmp

Filesize
3.3MB

Download
memory/2680-48-0x000000013F960000-0x000000013FCAD000-memory.dmp

Filesize
3.3MB

Download
memory/2816-31-0x000000013F740000-0x000000013FA8D000-memory.dmp

Filesize
3.3MB

Download
memory/2832-37-0x000000013FAE0000-0x000000013FE2D000-memory.dmp

Filesize
3.3MB

Download
memory/2848-43-0x000000013F8A0000-0x000000013FBED000-memory.dmp

Filesize
3.3MB

Download
memory/3016-67-0x000000013F7F0000-0x000000013FB3D000-memory.dmp

Filesize
3.3MB

Download
memory/3020-73-0x000000013FE70000-0x00000001401BD000-memory.dmp

Filesize
3.3MB

Download