cobaltstrike | 980b30878f30c9a389e1b0ba8afdac940fae796d1718b0a4b6af21512023664e

Analysis

max time kernel
135s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-01-2025 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

19f20b95fd3576302bdaa85a60e8e1aa
SHA1

d8d7a9181209fd0c14aa51231c4d86bff3ff7b7c
SHA256

980b30878f30c9a389e1b0ba8afdac940fae796d1718b0a4b6af21512023664e
SHA512

b700726288987fc88a081abd8fd03720fb1d5fe694e5a02339448cd51faa8a08cae8424308bef4b617addf97f946672ea2075a2376ccee0b6affff8a645c66df
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUg:j+R56utgpPF8u/7g

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0008000000012102-6.dat	cobalt_reflective_dll
behavioral1/files/0x000700000001867d-8.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000186c8-16.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001878d-17.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000190c9-32.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000019217-43.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019da4-51.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019db8-55.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019f9f-59.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a067-67.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a42b-87.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a42d-91.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a345-83.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a301-79.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a0a1-75.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a07b-71.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019fb9-63.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019d44-47.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000191fd-40.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000191f3-36.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000190c6-26.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 42 IoCs

miner

resource	yara_rule
behavioral1/memory/1752-0-0x000000013FE40000-0x000000014018D000-memory.dmp	xmrig
behavioral1/files/0x0008000000012102-6.dat	xmrig
behavioral1/memory/2444-7-0x000000013F290000-0x000000013F5DD000-memory.dmp	xmrig
behavioral1/files/0x000700000001867d-8.dat	xmrig
behavioral1/files/0x00070000000186c8-16.dat	xmrig
behavioral1/files/0x000600000001878d-17.dat	xmrig
behavioral1/files/0x00070000000190c9-32.dat	xmrig
behavioral1/files/0x0007000000019217-43.dat	xmrig
behavioral1/files/0x0005000000019da4-51.dat	xmrig
behavioral1/files/0x0005000000019db8-55.dat	xmrig
behavioral1/files/0x0005000000019f9f-59.dat	xmrig
behavioral1/files/0x000500000001a067-67.dat	xmrig
behavioral1/files/0x000500000001a42b-87.dat	xmrig
behavioral1/files/0x000500000001a42d-91.dat	xmrig
behavioral1/files/0x000500000001a345-83.dat	xmrig
behavioral1/files/0x000500000001a301-79.dat	xmrig
behavioral1/files/0x000500000001a0a1-75.dat	xmrig
behavioral1/memory/3064-112-0x000000013F780000-0x000000013FACD000-memory.dmp	xmrig
behavioral1/memory/572-106-0x000000013F3D0000-0x000000013F71D000-memory.dmp	xmrig
behavioral1/memory/1228-105-0x000000013F7B0000-0x000000013FAFD000-memory.dmp	xmrig
behavioral1/memory/1336-104-0x000000013FA60000-0x000000013FDAD000-memory.dmp	xmrig
behavioral1/memory/2660-103-0x000000013F1B0000-0x000000013F4FD000-memory.dmp	xmrig
behavioral1/memory/1936-102-0x000000013FAD0000-0x000000013FE1D000-memory.dmp	xmrig
behavioral1/memory/2800-101-0x000000013F080000-0x000000013F3CD000-memory.dmp	xmrig
behavioral1/memory/2628-100-0x000000013F9C0000-0x000000013FD0D000-memory.dmp	xmrig
behavioral1/memory/2824-99-0x000000013FF20000-0x000000014026D000-memory.dmp	xmrig
behavioral1/memory/2176-98-0x000000013FB20000-0x000000013FE6D000-memory.dmp	xmrig
behavioral1/memory/2372-97-0x000000013F260000-0x000000013F5AD000-memory.dmp	xmrig
behavioral1/memory/2816-96-0x000000013F2B0000-0x000000013F5FD000-memory.dmp	xmrig
behavioral1/memory/2832-95-0x000000013FFF0000-0x000000014033D000-memory.dmp	xmrig
behavioral1/memory/2756-94-0x000000013F650000-0x000000013F99D000-memory.dmp	xmrig
behavioral1/memory/2820-92-0x000000013FDF0000-0x000000014013D000-memory.dmp	xmrig
behavioral1/memory/2836-93-0x000000013F8D0000-0x000000013FC1D000-memory.dmp	xmrig
behavioral1/files/0x000500000001a07b-71.dat	xmrig
behavioral1/files/0x0005000000019fb9-63.dat	xmrig
behavioral1/files/0x0005000000019d44-47.dat	xmrig
behavioral1/files/0x00070000000191fd-40.dat	xmrig
behavioral1/memory/1704-22-0x000000013FE30000-0x000000014017D000-memory.dmp	xmrig
behavioral1/memory/2296-27-0x000000013FC90000-0x000000013FFDD000-memory.dmp	xmrig
behavioral1/memory/2460-21-0x000000013FCC0000-0x000000014000D000-memory.dmp	xmrig
behavioral1/files/0x00060000000191f3-36.dat	xmrig
behavioral1/files/0x00070000000190c6-26.dat	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2444	qlKLlCB.exe
1704	ZtOqyht.exe
2820	fBptSJH.exe
2460	bIgfmck.exe
2296	htcSVca.exe
2836	ivgarCC.exe
2832	OpdPGBU.exe
2756	bcFVUvc.exe
2372	duBRdCG.exe
2816	cUtgHrC.exe
2824	RYcvvVH.exe
2176	aYkUjTE.exe
2800	hotiUZe.exe
2628	TiGGskY.exe
2660	ByXvTeb.exe
1936	hrLcfaq.exe
3064	xuqLWmO.exe
1336	ZZqGKJE.exe
572	vZXwOqO.exe
1228	rLHShPp.exe
2872	UjnoXWV.exe

Loads dropped DLL 21 IoCs

pid	Process
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\bcFVUvc.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\hotiUZe.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\UjnoXWV.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qlKLlCB.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZtOqyht.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\OpdPGBU.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ivgarCC.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\duBRdCG.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RYcvvVH.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\hrLcfaq.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\xuqLWmO.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZZqGKJE.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fBptSJH.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\htcSVca.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\vZXwOqO.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\aYkUjTE.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TiGGskY.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ByXvTeb.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rLHShPp.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\bIgfmck.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\cUtgHrC.exe	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 2444	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 1752 wrote to memory of 2444	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 1752 wrote to memory of 2444	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 1752 wrote to memory of 1704	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 1752 wrote to memory of 1704	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 1752 wrote to memory of 1704	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 1752 wrote to memory of 2820	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 1752 wrote to memory of 2820	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 1752 wrote to memory of 2820	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 1752 wrote to memory of 2460	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 1752 wrote to memory of 2460	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 1752 wrote to memory of 2460	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 1752 wrote to memory of 2296	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 1752 wrote to memory of 2296	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 1752 wrote to memory of 2296	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 1752 wrote to memory of 2836	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 1752 wrote to memory of 2836	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 1752 wrote to memory of 2836	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 1752 wrote to memory of 2832	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 1752 wrote to memory of 2832	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 1752 wrote to memory of 2832	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 1752 wrote to memory of 2756	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 1752 wrote to memory of 2756	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 1752 wrote to memory of 2756	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 1752 wrote to memory of 2372	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 1752 wrote to memory of 2372	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 1752 wrote to memory of 2372	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 1752 wrote to memory of 2816	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 1752 wrote to memory of 2816	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 1752 wrote to memory of 2816	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 1752 wrote to memory of 2824	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 1752 wrote to memory of 2824	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 1752 wrote to memory of 2824	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 1752 wrote to memory of 2176	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 1752 wrote to memory of 2176	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 1752 wrote to memory of 2176	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 1752 wrote to memory of 2800	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 1752 wrote to memory of 2800	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 1752 wrote to memory of 2800	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 1752 wrote to memory of 2628	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 1752 wrote to memory of 2628	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 1752 wrote to memory of 2628	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 1752 wrote to memory of 2660	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 1752 wrote to memory of 2660	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 1752 wrote to memory of 2660	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 1752 wrote to memory of 1936	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 1752 wrote to memory of 1936	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 1752 wrote to memory of 1936	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 1752 wrote to memory of 3064	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 1752 wrote to memory of 3064	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 1752 wrote to memory of 3064	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 1752 wrote to memory of 1336	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 1752 wrote to memory of 1336	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 1752 wrote to memory of 1336	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 1752 wrote to memory of 572	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 1752 wrote to memory of 572	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 1752 wrote to memory of 572	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 1752 wrote to memory of 1228	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 1752 wrote to memory of 1228	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 1752 wrote to memory of 1228	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 1752 wrote to memory of 2872	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 1752 wrote to memory of 2872	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 1752 wrote to memory of 2872	1752	2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe	51

C:\Users\Admin\AppData\Local\Temp\2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-21_19f20b95fd3576302bdaa85a60e8e1aa_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\System\qlKLlCB.exe
  C:\Windows\System\qlKLlCB.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\ZtOqyht.exe
  C:\Windows\System\ZtOqyht.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\fBptSJH.exe
  C:\Windows\System\fBptSJH.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\bIgfmck.exe
  C:\Windows\System\bIgfmck.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\htcSVca.exe
  C:\Windows\System\htcSVca.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\ivgarCC.exe
  C:\Windows\System\ivgarCC.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\OpdPGBU.exe
  C:\Windows\System\OpdPGBU.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\bcFVUvc.exe
  C:\Windows\System\bcFVUvc.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\duBRdCG.exe
  C:\Windows\System\duBRdCG.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\cUtgHrC.exe
  C:\Windows\System\cUtgHrC.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\RYcvvVH.exe
  C:\Windows\System\RYcvvVH.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\aYkUjTE.exe
  C:\Windows\System\aYkUjTE.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\hotiUZe.exe
  C:\Windows\System\hotiUZe.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\TiGGskY.exe
  C:\Windows\System\TiGGskY.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\ByXvTeb.exe
  C:\Windows\System\ByXvTeb.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\hrLcfaq.exe
  C:\Windows\System\hrLcfaq.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\xuqLWmO.exe
  C:\Windows\System\xuqLWmO.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ZZqGKJE.exe
  C:\Windows\System\ZZqGKJE.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\vZXwOqO.exe
  C:\Windows\System\vZXwOqO.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\rLHShPp.exe
  C:\Windows\System\rLHShPp.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\UjnoXWV.exe
  C:\Windows\System\UjnoXWV.exe
  2⤵
  - Executes dropped EXE
  PID:2872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ByXvTeb.exe

Filesize
5.7MB

MD5
e874dbb48fd06162ca88eed7e83faf10

SHA1
778a8a4dced50503094a9e5df3c92102beffc1f2

SHA256
873b3192876ae7a09cc559769f1b9ff88dd42140353a0900ebc333383a92903c

SHA512
fe38abc46a96250ca5e0bd14045d22718bb3bd64309cfe8316dd929a1571e50fa595af9d2ffb557447e3dea277bf4687dd062eadaf1be96cdae3f209360b4fd0

Download Submit
C:\Windows\system\OpdPGBU.exe

Filesize
5.7MB

MD5
d18b028bc41b61e7cede6f2d14c36326

SHA1
3cff2051442f6a1c994c1b3473f6f37c0d19eb67

SHA256
b15fd98917f2e184ad7858f5d9608fa2a4fd2e1f834450ade6014dd82f828b25

SHA512
2f4371c166e03bafb8a7f8498b6cb8157860e9cea8c7f7ff139df1cc65eed7a7cac618d1ac0575e50440aca0501bd56c29b349ef8e7654b635c4cba0f255d76f

Download Submit
C:\Windows\system\RYcvvVH.exe

Filesize
5.7MB

MD5
0b318cb116c25a9ef083f0f28960b802

SHA1
653b4816a4a28ec321bdef075d7921fa132810bc

SHA256
ea686e180adeb5645aa9f14ce23fa489c1d0035a21b503dc5b35261ca5658a8d

SHA512
0a06e9802257b2bd21623cbd508f40698e8f7535d06a3c764662344bfb2f58c43f2b9850d1b7c331d8ae90f7ad52e31a6c85a8e22221e53359fe91ceb3fce2dc

Download Submit
C:\Windows\system\TiGGskY.exe

Filesize
5.7MB

MD5
2b3dfec0f3864a2fabaa4d884b7d22e7

SHA1
16e516ab725d3290aee263639353950eeb0ac403

SHA256
9cda2ad4eeb568ecdd6c9d40a8fb72740a1e1407fd7064606653566b50e4c9f4

SHA512
a8f2fff02fe8663c885de586f7d4be74d989c6ec3767fd99dad3744ee70cf1ccb140775a5954572983aa033097c7d026ba8f8902d71624b4879b58ab2823ff5b

Download Submit
C:\Windows\system\UjnoXWV.exe

Filesize
5.7MB

MD5
19feff7ee2a0efe183bc408f026a40b3

SHA1
46f5e1d149c95fd138b60d103958c3dc48d36765

SHA256
775ed50283baf331ca373b75f194787f4949d0721de5567f8fd16b6e9236f7b0

SHA512
15aa8d6eb5cbb0f17f012586052290ce9e288167e63cb4f4fcd6d7a55d4a18536c5161cd6442bf21d9d99c9a3592442920bc1df0d0114ee35681889e7c9dc224

Download Submit
C:\Windows\system\ZZqGKJE.exe

Filesize
5.7MB

MD5
249f945b54107ae0c5bea457b3e053c5

SHA1
6e0dbde7678fef53f4a6e716e88126b25eb55fdb

SHA256
4e4675b4b6e08cab9a2695e35ae7db3705e3edd69d197f5549e11b28dcb60b08

SHA512
3aa73e94fc5b00ccfa806e595765a4f09f29a92f688b4a17443a3adeab7b817634ddc9b4ab3f13251526980dc2eb8c4595774f3ac56fbae602f80db4f38dceb6

Download Submit
C:\Windows\system\aYkUjTE.exe

Filesize
5.7MB

MD5
6acea951b126c0db11997383135b6728

SHA1
7aef1c98a6a74f02584df1fe2138da80472ac4d8

SHA256
16c355707fe689f8f2e7fae11fe6277f9b7da041a8b4be86dbb9090e99590f2d

SHA512
dc6d21ae5c20490ef4e7169843f553489f0fcbe929dcdbd9a2f97a86b9bdd68d94ade94d5bc664bddc5e2a4e78d278fb8ec66860a8bfdcb91b1fc2d1de6f93e0

Download Submit
C:\Windows\system\bcFVUvc.exe

Filesize
5.7MB

MD5
f5810f90c986f73b742d9f6667e82549

SHA1
23ba07ecd6bf43541489ea2a2782452fef85fa0d

SHA256
9e8abdacac222f9c2dc1b5cce9d460becef2aee96e79d1d66d4fe797f610fc63

SHA512
242b0b2d135761b599acb9ed3a280684f63d099e6382883fe45ebf88acd1350d3ad3246bd42a59890b167601e69185503a3a8388d82dcee9254b462012179844

Download Submit
C:\Windows\system\cUtgHrC.exe

Filesize
5.7MB

MD5
c4ef880bb138a66be9412a5b357e3293

SHA1
e6079e4b4f54fa844b39c75e24991c0ddab0f580

SHA256
cedbc661278b5bcae3de13c15d8a273cb940b56dcc035d9018743a334d657f88

SHA512
4b3fe12fa37f450ffde8610e8470f41d52b2e88d2fa273cad6046be901a320f4ca4e351506398c8c900ccf30d21d078235e49ec2ac6e0e5ec6307da5d9560c2e

Download Submit
C:\Windows\system\duBRdCG.exe

Filesize
5.7MB

MD5
e64adeb6f5a8ef58e2f08b1a45e2cdbb

SHA1
8a1a4034450ae1f38364cf4952104dfefba7c1b0

SHA256
f861b26b935d16e043a6fba3f6506303a53b02499f0faab64cfc3421e9d9ecb4

SHA512
4427f3169a4aa65ef757f557c69deda2b55eb4204aeaa677789177e55cedaf6a3b7079f5b0f3a046520c9cb05d1c62d5ada185081ae43c91d7f44543bfc84de6

Download Submit
C:\Windows\system\fBptSJH.exe

Filesize
5.7MB

MD5
d90e7df559effedb6482779dad74dcd5

SHA1
6d7385d8ff7e5c3a760e53c2e2b025c91593a2ce

SHA256
d4b54abb538e22614357c465b9f827ef785c21774d84853bbc710ccd302c2275

SHA512
53573ab3b3d28185c7a286bfc6b6e94cb1b2582517bd3731381762fce72b544d7885bd28560f702602186e1da23ab66143064cb86dc6b40eb3bbb95b1af7a4e4

Download Submit
C:\Windows\system\hotiUZe.exe

Filesize
5.7MB

MD5
304c0416dc054b5cb69f8c802a3bf21f

SHA1
00993c9e7048401f2ece64de27a0c30189758d7a

SHA256
6544e1254070106c4dadc10defb276d02cfd480608b129a41997db8a30c23141

SHA512
11b8b906960e3c9a853d72bcd7948ec294183431cfb2c4fd64cbe86085c3953c796796a62e34764e9ca36527ada8c20febe06f0fff32fd7d0b577d1758884012

Download Submit
C:\Windows\system\hrLcfaq.exe

Filesize
5.7MB

MD5
14248e3ee5bd3ff81ed95c4b37b6550e

SHA1
a789db63e9b74e9c1bb47719e8b53fd15cd2748c

SHA256
3b9e5612b19d775724fcf1759dfa0100884825be8d76d3fdf6b55b58c95c08fa

SHA512
12f84d271418d1d1bdc322c58c3c2ab9388a4826b9c907611952cfb01e5108b3d9e7dd7d04dd2638e16df7100ff59629f767ec7b4fc8e411c1cc00791fef3077

Download Submit
C:\Windows\system\htcSVca.exe

Filesize
5.7MB

MD5
f2c9b42d82ed224ffe59ff2a1062386d

SHA1
5fe9d06645ff009dc69504d9b555d30573afa3fe

SHA256
642cd50490a65db65e083653c3fef352ead131da044fffdadb68c0c9d96beab6

SHA512
9f642d1982c9d0cdadee5c487a106f5e02e5d98d97c12b08002f48b2e8f3ba8579b1b9aae0878cb3801bd9490f7e6c5c6dfa5365c8d28c21b00a5f8d36bebd25

Download Submit
C:\Windows\system\ivgarCC.exe

Filesize
5.7MB

MD5
6abf21b6cea023173c1dd9bf4c69587a

SHA1
5bccabb90a5f065dc29bef10d57016378840d25d

SHA256
816cc2d9de0caf437831bfff7e9f7beec7c0147da6746bf6c244530403ac5032

SHA512
85ac11cbe9c60c1380d5a69ad7c831a9f45c9be33e3ef0b3509f54f61e396679ba31c26a5c68e1c57d577353c39f969c0ae97d77c13f0b6857216b67a85a9291

Download Submit
C:\Windows\system\qlKLlCB.exe

Filesize
5.7MB

MD5
5dc7bb80ebd1dc680abde15041097e7a

SHA1
c7b35a0195fa39b6ed08e1b7fd30f0f88fdc52eb

SHA256
590e84830adb038a67da649b3dbe39e672b24f9c55d7075ca667ba8b6d48ce38

SHA512
314dc49f2c3b3a31b5f46ff85a725942435635db1e183c026488aa4a4fbc868c9ec75831bb8d01467aba59f35172140600de1e7549d66c28dfda0737dcf7f81b

Download Submit
C:\Windows\system\rLHShPp.exe

Filesize
5.7MB

MD5
0ed055e2e49967a0d64f14b3dac70ebd

SHA1
f8a5591f0a0d90227b181df6e60a2fab1b569b82

SHA256
765b9ec1d71935eace3786073b48abad74adf0ff96b879ef6eddd2a784dc2f68

SHA512
485ab51e10fdf34223da68f0c7bbd09b6c0de26bde8033bd909c119b85d069c31028cfcc84eadf9c0cf9c1cc0e120a42c6bce32b1494edbaf0d36ad6f58f9849

Download Submit
C:\Windows\system\vZXwOqO.exe

Filesize
5.7MB

MD5
ecc86767fddb48349aeb5877d8b91af0

SHA1
a698350369a4e733905c2610a5fa4f3d10a07a50

SHA256
40277e0ceef0e28a0e25bcbfec01d7b74e88c1cead9eec56077b89f9baf0466d

SHA512
5f673d2f3172d40409b69a99b27b6f3d729f7eccca99bdde5b2b8015094bb85a20a9708a0e56e7f607a714f0cb28e83b527a217c571e0ce59ab973c5bfef4a5f

Download Submit
C:\Windows\system\xuqLWmO.exe

Filesize
5.7MB

MD5
9ee27003f25f19ff5ac57c981b351de2

SHA1
725c29c43f7e7486b499f3cc79dd5355f5f24250

SHA256
02ca2c97d14ef3c7a500e1434931cc5a3cc93f66ac6b1fa53bdcdcd8781bd88d

SHA512
7d38df24961f0b8498796556af71a7655bca9835f717bcb22911f22c5e3e14a44e7beeeedc2388a9e111d2d8d2acfa4d564b7c93a605d5e031c996a35e9b8b03

Download Submit
\Windows\system\ZtOqyht.exe

Filesize
5.7MB

MD5
f5e9d7366ab582ac08abd8a5dda72196

SHA1
ed9f05b0b7fa65f174a76c9879fa728a44816489

SHA256
b87b2959055007c9e3984adeac2d53ce285c1c5078888470bdfb1a71c8ef3e7c

SHA512
cbe7fc0fb54bbd8a32eae4c272d3f973e03dc48dfaa4d8f4a5884735fd6fb8d4bc63fd621578d5d30aaaccafe9a826f3c016a1ab28481d8e64ec6a82e1660aa0

Download Submit
\Windows\system\bIgfmck.exe

Filesize
5.7MB

MD5
c9624cbc5bfe0e5f5a35527df069fc9f

SHA1
cbd66feaf2176a2a459e32a6c4052b56559f0d46

SHA256
951be6cc7f730a988c78a49f46504d542d075f00bcf84abbdfbf5b1441b219ee

SHA512
032981b46932092f972572940a7fbbd34eb834e87501c10f1870e5ca31d48db522d44459204f99f5f5c92c3cf335aecd2aaad96af873067ec5f0b381281e6211

Download Submit
memory/572-106-0x000000013F3D0000-0x000000013F71D000-memory.dmp

Filesize
3.3MB

Download
memory/1228-105-0x000000013F7B0000-0x000000013FAFD000-memory.dmp

Filesize
3.3MB

Download
memory/1336-104-0x000000013FA60000-0x000000013FDAD000-memory.dmp

Filesize
3.3MB

Download
memory/1704-22-0x000000013FE30000-0x000000014017D000-memory.dmp

Filesize
3.3MB

Download
memory/1752-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1752-0-0x000000013FE40000-0x000000014018D000-memory.dmp

Filesize
3.3MB

Download
memory/1936-102-0x000000013FAD0000-0x000000013FE1D000-memory.dmp

Filesize
3.3MB

Download
memory/2176-98-0x000000013FB20000-0x000000013FE6D000-memory.dmp

Filesize
3.3MB

Download
memory/2296-27-0x000000013FC90000-0x000000013FFDD000-memory.dmp

Filesize
3.3MB

Download
memory/2372-97-0x000000013F260000-0x000000013F5AD000-memory.dmp

Filesize
3.3MB

Download
memory/2444-7-0x000000013F290000-0x000000013F5DD000-memory.dmp

Filesize
3.3MB

Download
memory/2460-21-0x000000013FCC0000-0x000000014000D000-memory.dmp

Filesize
3.3MB

Download
memory/2628-100-0x000000013F9C0000-0x000000013FD0D000-memory.dmp

Filesize
3.3MB

Download
memory/2660-103-0x000000013F1B0000-0x000000013F4FD000-memory.dmp

Filesize
3.3MB

Download
memory/2756-94-0x000000013F650000-0x000000013F99D000-memory.dmp

Filesize
3.3MB

Download
memory/2800-101-0x000000013F080000-0x000000013F3CD000-memory.dmp

Filesize
3.3MB

Download
memory/2816-96-0x000000013F2B0000-0x000000013F5FD000-memory.dmp

Filesize
3.3MB

Download
memory/2820-92-0x000000013FDF0000-0x000000014013D000-memory.dmp

Filesize
3.3MB

Download
memory/2824-99-0x000000013FF20000-0x000000014026D000-memory.dmp

Filesize
3.3MB

Download
memory/2832-95-0x000000013FFF0000-0x000000014033D000-memory.dmp

Filesize
3.3MB

Download
memory/2836-93-0x000000013F8D0000-0x000000013FC1D000-memory.dmp

Filesize
3.3MB

Download
memory/3064-112-0x000000013F780000-0x000000013FACD000-memory.dmp

Filesize
3.3MB

Download