cobaltstrike | f1107562d8cf2ae8f14490b79b786c1a7a2379dea35ebd5024935d52f1bedd76

Analysis

max time kernel
137s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/01/2025, 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

35a575428e2b33bcb3bfb04e565ab220
SHA1

88f437fb93ec31ed8b0c878bf9f06ba61a41fa16
SHA256

f1107562d8cf2ae8f14490b79b786c1a7a2379dea35ebd5024935d52f1bedd76
SHA512

3cdf035683545b8b9951e8828915be423372538159621e84d7aa78984087991e35fc396b6fed764b70dcc8af1aead0773d526d40bd2a5540c3f6e1a3ce03e121
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUs:j+R56utgpPF8u/7s

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00080000000120cd-6.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000186ee-7.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000186fd-14.dat	cobalt_reflective_dll
behavioral1/files/0x000700000001873d-18.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001878f-22.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000187a5-25.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000019023-30.dat	cobalt_reflective_dll
behavioral1/files/0x000800000001925e-34.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000019261-37.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001960b-45.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001960f-53.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019615-66.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019619-74.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001961d-82.dat	cobalt_reflective_dll
behavioral1/files/0x0034000000018683-85.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001961b-77.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019617-69.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019613-61.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019611-58.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001960d-50.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019609-42.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral1/memory/2704-0-0x000000013F680000-0x000000013F9CD000-memory.dmp	xmrig
behavioral1/files/0x00080000000120cd-6.dat	xmrig
behavioral1/files/0x00070000000186ee-7.dat	xmrig
behavioral1/files/0x00070000000186fd-14.dat	xmrig
behavioral1/files/0x000700000001873d-18.dat	xmrig
behavioral1/files/0x000600000001878f-22.dat	xmrig
behavioral1/files/0x00060000000187a5-25.dat	xmrig
behavioral1/files/0x0007000000019023-30.dat	xmrig
behavioral1/files/0x000800000001925e-34.dat	xmrig
behavioral1/files/0x0007000000019261-37.dat	xmrig
behavioral1/files/0x000500000001960b-45.dat	xmrig
behavioral1/files/0x000500000001960f-53.dat	xmrig
behavioral1/files/0x0005000000019615-66.dat	xmrig
behavioral1/files/0x0005000000019619-74.dat	xmrig
behavioral1/files/0x000500000001961d-82.dat	xmrig
behavioral1/files/0x0034000000018683-85.dat	xmrig
behavioral1/files/0x000500000001961b-77.dat	xmrig
behavioral1/files/0x0005000000019617-69.dat	xmrig
behavioral1/files/0x0005000000019613-61.dat	xmrig
behavioral1/files/0x0005000000019611-58.dat	xmrig
behavioral1/files/0x000500000001960d-50.dat	xmrig
behavioral1/files/0x0005000000019609-42.dat	xmrig
behavioral1/memory/2776-86-0x000000013F9C0000-0x000000013FD0D000-memory.dmp	xmrig
behavioral1/memory/2636-99-0x000000013FE50000-0x000000014019D000-memory.dmp	xmrig
behavioral1/memory/2900-102-0x000000013F430000-0x000000013F77D000-memory.dmp	xmrig
behavioral1/memory/1500-105-0x000000013FE00000-0x000000014014D000-memory.dmp	xmrig
behavioral1/memory/2268-104-0x000000013F750000-0x000000013FA9D000-memory.dmp	xmrig
behavioral1/memory/580-103-0x000000013F3C0000-0x000000013F70D000-memory.dmp	xmrig
behavioral1/memory/2588-101-0x000000013FF60000-0x00000001402AD000-memory.dmp	xmrig
behavioral1/memory/2864-100-0x000000013F0A0000-0x000000013F3ED000-memory.dmp	xmrig
behavioral1/memory/1392-98-0x000000013F2B0000-0x000000013F5FD000-memory.dmp	xmrig
behavioral1/memory/1668-97-0x000000013F630000-0x000000013F97D000-memory.dmp	xmrig
behavioral1/memory/3024-96-0x000000013F080000-0x000000013F3CD000-memory.dmp	xmrig
behavioral1/memory/1840-95-0x000000013F7A0000-0x000000013FAED000-memory.dmp	xmrig
behavioral1/memory/2564-94-0x000000013FE70000-0x00000001401BD000-memory.dmp	xmrig
behavioral1/memory/2620-93-0x000000013F300000-0x000000013F64D000-memory.dmp	xmrig
behavioral1/memory/2712-92-0x000000013F470000-0x000000013F7BD000-memory.dmp	xmrig
behavioral1/memory/2744-90-0x000000013FB80000-0x000000013FECD000-memory.dmp	xmrig
behavioral1/memory/2128-91-0x000000013F1B0000-0x000000013F4FD000-memory.dmp	xmrig
behavioral1/memory/2748-89-0x000000013F6F0000-0x000000013FA3D000-memory.dmp	xmrig
behavioral1/memory/2808-88-0x000000013F660000-0x000000013F9AD000-memory.dmp	xmrig
behavioral1/memory/2760-87-0x000000013FA30000-0x000000013FD7D000-memory.dmp	xmrig
behavioral1/memory/1844-106-0x000000013F160000-0x000000013F4AD000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2776	qbIpzPv.exe
2748	NrcSGsS.exe
2760	wBDJlbm.exe
2128	KIwncUc.exe
2808	EMqfyfv.exe
2712	sDoogHB.exe
2744	bmEKiPZ.exe
2564	xpTZPMT.exe
2620	hrOVcDc.exe
3024	kLErSXy.exe
1840	BqSDeUB.exe
1392	lOEASCV.exe
1668	BSmdPeC.exe
2864	PqpfyUN.exe
2636	HJlHNls.exe
2900	iNhvUzB.exe
2588	FgNZBkL.exe
2268	rpNSshe.exe
580	RWCfTXw.exe
1500	uRuvESL.exe
1844	sbYIILi.exe

Loads dropped DLL 21 IoCs

pid	Process
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\qbIpzPv.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\bmEKiPZ.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\xpTZPMT.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HJlHNls.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\iNhvUzB.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rpNSshe.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RWCfTXw.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wBDJlbm.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PqpfyUN.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\NrcSGsS.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\kLErSXy.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\FgNZBkL.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uRuvESL.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KIwncUc.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\EMqfyfv.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\sDoogHB.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\hrOVcDc.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\BqSDeUB.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\lOEASCV.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\BSmdPeC.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\sbYIILi.exe	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2776	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2704 wrote to memory of 2776	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2704 wrote to memory of 2776	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2704 wrote to memory of 2748	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2704 wrote to memory of 2748	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2704 wrote to memory of 2748	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2704 wrote to memory of 2760	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2704 wrote to memory of 2760	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2704 wrote to memory of 2760	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2704 wrote to memory of 2128	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2704 wrote to memory of 2128	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2704 wrote to memory of 2128	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2704 wrote to memory of 2808	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2704 wrote to memory of 2808	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2704 wrote to memory of 2808	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2704 wrote to memory of 2712	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2704 wrote to memory of 2712	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2704 wrote to memory of 2712	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2704 wrote to memory of 2744	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2704 wrote to memory of 2744	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2704 wrote to memory of 2744	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2704 wrote to memory of 2564	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2704 wrote to memory of 2564	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2704 wrote to memory of 2564	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2704 wrote to memory of 2620	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2704 wrote to memory of 2620	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2704 wrote to memory of 2620	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2704 wrote to memory of 3024	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2704 wrote to memory of 3024	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2704 wrote to memory of 3024	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2704 wrote to memory of 1840	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2704 wrote to memory of 1840	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2704 wrote to memory of 1840	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2704 wrote to memory of 1392	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2704 wrote to memory of 1392	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2704 wrote to memory of 1392	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2704 wrote to memory of 1668	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2704 wrote to memory of 1668	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2704 wrote to memory of 1668	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2704 wrote to memory of 2864	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2704 wrote to memory of 2864	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2704 wrote to memory of 2864	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2704 wrote to memory of 2636	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2704 wrote to memory of 2636	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2704 wrote to memory of 2636	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2704 wrote to memory of 2900	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2704 wrote to memory of 2900	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2704 wrote to memory of 2900	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2704 wrote to memory of 2588	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2704 wrote to memory of 2588	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2704 wrote to memory of 2588	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2704 wrote to memory of 2268	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2704 wrote to memory of 2268	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2704 wrote to memory of 2268	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2704 wrote to memory of 580	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2704 wrote to memory of 580	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2704 wrote to memory of 580	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2704 wrote to memory of 1500	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2704 wrote to memory of 1500	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2704 wrote to memory of 1500	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2704 wrote to memory of 1844	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2704 wrote to memory of 1844	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2704 wrote to memory of 1844	2704	2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe	51

C:\Users\Admin\AppData\Local\Temp\2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-25_35a575428e2b33bcb3bfb04e565ab220_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\System\qbIpzPv.exe
  C:\Windows\System\qbIpzPv.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\NrcSGsS.exe
  C:\Windows\System\NrcSGsS.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\wBDJlbm.exe
  C:\Windows\System\wBDJlbm.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\KIwncUc.exe
  C:\Windows\System\KIwncUc.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\EMqfyfv.exe
  C:\Windows\System\EMqfyfv.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\sDoogHB.exe
  C:\Windows\System\sDoogHB.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\bmEKiPZ.exe
  C:\Windows\System\bmEKiPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\xpTZPMT.exe
  C:\Windows\System\xpTZPMT.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\hrOVcDc.exe
  C:\Windows\System\hrOVcDc.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\kLErSXy.exe
  C:\Windows\System\kLErSXy.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\BqSDeUB.exe
  C:\Windows\System\BqSDeUB.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\lOEASCV.exe
  C:\Windows\System\lOEASCV.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\BSmdPeC.exe
  C:\Windows\System\BSmdPeC.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\PqpfyUN.exe
  C:\Windows\System\PqpfyUN.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\HJlHNls.exe
  C:\Windows\System\HJlHNls.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\iNhvUzB.exe
  C:\Windows\System\iNhvUzB.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\FgNZBkL.exe
  C:\Windows\System\FgNZBkL.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\rpNSshe.exe
  C:\Windows\System\rpNSshe.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\RWCfTXw.exe
  C:\Windows\System\RWCfTXw.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\uRuvESL.exe
  C:\Windows\System\uRuvESL.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\sbYIILi.exe
  C:\Windows\System\sbYIILi.exe
  2⤵
  - Executes dropped EXE
  PID:1844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BSmdPeC.exe

Filesize
5.7MB

MD5
a04bd6a43463f2656d198094299f6e99

SHA1
027f6b664033d93c7576681610a673aa53015860

SHA256
6fda17695adfb179aedaad4a3e7b4af35c4911af95cd32f76716b97bb5386b34

SHA512
274b2562c48bc88cd3e796f90ad597a24c699fd2c58cdf27660d4c9cad9cbc06e374e590ec71b11f7dba0a83d38320b5e377376bb5c32889d7fc6c1296d1fbf1

Download Submit
C:\Windows\system\BqSDeUB.exe

Filesize
5.7MB

MD5
662b0ca64fc141533fa30e607282986a

SHA1
871fbb3442814feb59f0581e15665deff8ac967b

SHA256
5a9521174e3886b715d8a04101fbc1302d1d2fb6c1402c8e38519b9189d92f28

SHA512
586bd150ecb5f0fc02a17331cc84966c5a780f5e3b709380980f3d22a8e09c2ee3bb69e8f1ab628cc6290d327909f83146f214195c793203d5a7409a88088a18

Download Submit
C:\Windows\system\EMqfyfv.exe

Filesize
5.7MB

MD5
f9bb36f76cde1c7f700f1f4197a8e6da

SHA1
6d6b682f7ef885dac7e9c8340369c8f9ca157e08

SHA256
eb4f4ef03d5115dbc209919522296ecb61e84b5005c873e58d9d6ef2d9f0e90b

SHA512
7220fefd560abe2f8cb8270f1265c526012636ae66f66af8ca2cb5e6ae7669cc953fc8b63b02cbc096837805aee1db7cd8f2822e1cf228826ad2ccd5ad6ef926

Download Submit
C:\Windows\system\FgNZBkL.exe

Filesize
5.7MB

MD5
2328899c42041d6a8998754fa1f0701d

SHA1
289eda061accc8f952e06b1c82174a036e817b5e

SHA256
a5fd2b1f73a521f405b582504d580153e0362a0ec6f88df2d7292795be7ef5a8

SHA512
44b4370a8779690bfcb161c6ce15041982eac6e3b9c23ed2d64ee1e2ef8442060be98319a3a9f4346c72d718a000f5a9cd8620d21bdec23f6b06329a494b7755

Download Submit
C:\Windows\system\HJlHNls.exe

Filesize
5.7MB

MD5
d2900759b16ec9a67b6e289dfa039601

SHA1
e2da863a132a24366e6bc2529b478b60c173124e

SHA256
4aa4746e7aeb58210329f454b9e0a8336212214ff76d630af9a1740e22daf2c2

SHA512
e6323e11e46c461c3a6c69d9c84412d3a989abce359bccb2f7b6c99aa1a2771f5d7771e96989518d77dc4e9ea5264739e562b40ae6e3c5c7bc70b1d49438586e

Download Submit
C:\Windows\system\KIwncUc.exe

Filesize
5.7MB

MD5
6b09aeedbe33de4e4e479227f9ffe340

SHA1
1150e520ae1d14ff3dc65da055630a1510452bb1

SHA256
0574c87c8cc14b715caafd7c2197fb41b65a0946fd3c7f1231d2b8671e4b3096

SHA512
012dc346f9e1c8e069250e26a18df6267481eae0e098d6454cf64b2a98ea71c85500cead542dfcf05cbaa9f0ab12d8a28fc6cf74df8551d4311fcf935036eea4

Download Submit
C:\Windows\system\PqpfyUN.exe

Filesize
5.7MB

MD5
456e39b43e97c5f14a3e00135f8e3aed

SHA1
27bee14e5b051acb362a0e7e55942517daf3ef18

SHA256
e926c8b7588f7409b24c540232b84eb7a357b408865bdaf9996ae3a73d4575f2

SHA512
391291f68d023e5468caff864d9f95a26bbecfa6d382585014b9883781aa7332dd5c1ad78d245174760ffad6f0414c23b501fe1e7c50946c6d2d1032ccb98e49

Download Submit
C:\Windows\system\RWCfTXw.exe

Filesize
5.7MB

MD5
497558abc14aeb502f8e0abced75e0d7

SHA1
5aa271130f0dd65eccd1454696c2428f31d11ef9

SHA256
d9b5fc9672bd7ae5d4edc23521b7c3b09364806b70987e56d5336d9d35439e88

SHA512
6969278129f43e04075c67487f51c1415e8f5842f617b67505d044f685f9e8f3cb025c0d0e8a41a607d54fde7b8864bad400d4bdce145f75b52c84fd79b404df

Download Submit
C:\Windows\system\bmEKiPZ.exe

Filesize
5.7MB

MD5
1e2c99b140d306b396a3875086d4142b

SHA1
aefa555b5c573f7381c32e83e1637ed311108b29

SHA256
443557b28315fe66baa9b85a35a2965ec794fdc296df0bedece13f671fa245c2

SHA512
41295b3bdd78e7743db135efd4d6cdec092378420f6e7ef4d48cb1c17756d6ed59adabe73269af37689049531dacbe46328206f6d3190e33bd03bfec574e1e96

Download Submit
C:\Windows\system\hrOVcDc.exe

Filesize
5.7MB

MD5
77a292326713c867607923b119b50432

SHA1
cabb6555f13aed366d0151aeb9fd0acae0b5d010

SHA256
5d0ee23211916f1d9d097fb7cd4600133a0e4f30a123505458f19446ab038dbe

SHA512
d71037cc48370cec9fd80585f60608ae82ee72c01ea2a69d461469d2c6e34ad9480dad5a0efd9cf67887e9ded23fed26fa162f37faec16abf7ad3ab20894f719

Download Submit
C:\Windows\system\iNhvUzB.exe

Filesize
5.7MB

MD5
4e08fd235f3748b3d3ed5cbfa1476b2a

SHA1
f99fa86c25d9b00b27ef04273b6d48aaddb86917

SHA256
745eb58c317eaaf378040210965f2fd6dc5723ab87db77bf7212f22a68aad46b

SHA512
58931c1ffc4d798eb2aa016ec6783237ba6977ffefec91ebfa3534907ea2eda0468e32b483f581df441ddfadd8a22f37d768d514780490fc7f0596f07d74be47

Download Submit
C:\Windows\system\kLErSXy.exe

Filesize
5.7MB

MD5
37cb9cdc320d38e73366d0a8a507255c

SHA1
e0fd62ed1b50b431fd776d8cad9203b986374b93

SHA256
55e8efdd9ffa104f655c29d3b696ef142edc3d8b0e1732ecc9a1fd26978beb13

SHA512
4d06c122e59ccd24948c94a9c8343caca2849749b4eb0a647e034f8062ec11734a72bd23ed591fcb940d881b3b7fed7243ea0fd92878e4cd7b49bdd25b890aa4

Download Submit
C:\Windows\system\lOEASCV.exe

Filesize
5.7MB

MD5
933955699bf60a2d17c2ce6f946572e6

SHA1
b5b971e42ae965cde1b807df668717cbecb340b7

SHA256
d978c3c57b9b0534aaab04512a30b7979639a301e0f54722cfe1c398d6e583b1

SHA512
cf9f9d5a61cb2ae69afec3ab9e9fea679a875685e7dadec88c3514f8c184f6f20f1bef1c4eed3d48b8fc13f6e869340a90fc1bdb77fb490d030198644b0702ac

Download Submit
C:\Windows\system\qbIpzPv.exe

Filesize
5.7MB

MD5
6938b7c2a50b6c99d6db05193ee95d70

SHA1
0f5b390c625096dfb516356fba2cc663affb27ac

SHA256
f860d53fa3e8e194d6ad4874d598e5afe17d248ce9f18cc59ea70d199bda3c24

SHA512
7432cba98c62047ef7b3ee6b9bed849d7f1fb3416dbffb77da07b7c98c01c1997127fe871798dd6677cad1b7c71653ca3b74e0287ca7e143149c336487f588f4

Download Submit
C:\Windows\system\rpNSshe.exe

Filesize
5.7MB

MD5
e0a1d0fbf83fc71075bf46e1551d5b24

SHA1
b39a4fb4aa5649ca0082c2679014828269fcaa44

SHA256
8220c0f16974d5e205bab9e7af8433af07b58892712678dccf054a32ad0788fb

SHA512
895c1a877da5ed142b809e207d0582019b19bb467ee492e005e24aed79381149e787c3e0c9229b8e53a98e5aaa3cc37a712599827377eb06c1b3e2a29572c453

Download Submit
C:\Windows\system\sDoogHB.exe

Filesize
5.7MB

MD5
a66904b5436798201e12f4e0bd9c86b4

SHA1
22aac0384a159fcb2f7f21b9dda1e61e5f7c9574

SHA256
5e3cbb14be95aa917c20013becc607db8229c2a53fa3a1aa8dc01db80d69da22

SHA512
9ba97ff6206da62cfdf2c8322c41e5837a7e30e746203235a0d316df2f1f6af4cbfbb1f8226de540985bda6e71feb1f1f5cbd6a13a193e8d7245644e87686673

Download Submit
C:\Windows\system\sbYIILi.exe

Filesize
5.7MB

MD5
1e1a0742e8b3f51908cab23317cf41fc

SHA1
37f91e83572a1d46858887e53343f880e8a5aafc

SHA256
c3d35b21a6a7b33525cc5be606a161ad059492a73d6b4faa9f833225ab4d6c77

SHA512
c3c06effd0fb43e8198587d7ea5b1a3f6832442f15ff948dd3555cc3f82c5ed680bd3a8278c839e60b5796705831875ac68fe69cd88fd7147b7f1ac59ff0a5da

Download Submit
C:\Windows\system\uRuvESL.exe

Filesize
5.7MB

MD5
e11ae3989bb56ff74a4a9c0636d0a2b3

SHA1
5a50dd5de6809bc4c39b95c2c794db99e8a6fb83

SHA256
d85f85cbb97aea6aa77cc234115559105ce4f03503dae127b21147d7127bd2f5

SHA512
89c94a1dd268e9252418eb53c2595f3922faff0c064bdc172da098bfedec893a9f4b0b1b6fc75a70612a0e1e731be901182df560f0d57b666453908ceff2fd77

Download Submit
C:\Windows\system\wBDJlbm.exe

Filesize
5.7MB

MD5
84b5b626d4d20ece81e5c79401b2497e

SHA1
e93f42b31c16be19a04d2adbdd0448f4967c8036

SHA256
7578dfd6f101565028a2eac39f319f6d949c8450ec471c4f9765053d492d29ac

SHA512
0b2ac08c47b076b9ef008d04a153156e8eb824f0906ffd05f040909e8227fd157a5dce734ec1679a2e6fb37c80adb68257de992eec8ecd45877373e0eb96b72d

Download Submit
C:\Windows\system\xpTZPMT.exe

Filesize
5.7MB

MD5
cfcced656d33b514b432032b4e3a38d6

SHA1
516011682466a3c66f89a0ee73efb161e6c9439e

SHA256
6a5d437c852f5aa82dbaa2d729c74d1c02d4caf96a0004e6e5f928e831d5a56d

SHA512
801f0bf569cd914d66e413501deb2c1be5d3d19835ebb86b9712ee7dc829e78379b0de3e007e2a3871c289b56b1d60187ebaa14a4963bd2489b18ee6edaaf165

Download Submit
\Windows\system\NrcSGsS.exe

Filesize
5.7MB

MD5
738033b4fbe121b77be80f682dc88c2f

SHA1
cffa773c4e96a863e4bc0dc848d289cf33a8c98e

SHA256
90facd5cfba860e19b78f31908ed8d3b31d2bedfef9fde7d383659dd748a900c

SHA512
0a2a4705ecc2cc75129259fe1aa7532bc6c7f3a2cbbcc0fadfc0f35051114a246c17c46687027014aad503492e6a8fceca119c96bc5512c650043feb2172d968

Download Submit
memory/580-103-0x000000013F3C0000-0x000000013F70D000-memory.dmp

Filesize
3.3MB

Download
memory/1392-98-0x000000013F2B0000-0x000000013F5FD000-memory.dmp

Filesize
3.3MB

Download
memory/1500-105-0x000000013FE00000-0x000000014014D000-memory.dmp

Filesize
3.3MB

Download
memory/1668-97-0x000000013F630000-0x000000013F97D000-memory.dmp

Filesize
3.3MB

Download
memory/1840-95-0x000000013F7A0000-0x000000013FAED000-memory.dmp

Filesize
3.3MB

Download
memory/1844-106-0x000000013F160000-0x000000013F4AD000-memory.dmp

Filesize
3.3MB

Download
memory/2128-91-0x000000013F1B0000-0x000000013F4FD000-memory.dmp

Filesize
3.3MB

Download
memory/2268-104-0x000000013F750000-0x000000013FA9D000-memory.dmp

Filesize
3.3MB

Download
memory/2564-94-0x000000013FE70000-0x00000001401BD000-memory.dmp

Filesize
3.3MB

Download
memory/2588-101-0x000000013FF60000-0x00000001402AD000-memory.dmp

Filesize
3.3MB

Download
memory/2620-93-0x000000013F300000-0x000000013F64D000-memory.dmp

Filesize
3.3MB

Download
memory/2636-99-0x000000013FE50000-0x000000014019D000-memory.dmp

Filesize
3.3MB

Download
memory/2704-0-0x000000013F680000-0x000000013F9CD000-memory.dmp

Filesize
3.3MB

Download
memory/2704-1-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/2712-92-0x000000013F470000-0x000000013F7BD000-memory.dmp

Filesize
3.3MB

Download
memory/2744-90-0x000000013FB80000-0x000000013FECD000-memory.dmp

Filesize
3.3MB

Download
memory/2748-89-0x000000013F6F0000-0x000000013FA3D000-memory.dmp

Filesize
3.3MB

Download
memory/2760-87-0x000000013FA30000-0x000000013FD7D000-memory.dmp

Filesize
3.3MB

Download
memory/2776-86-0x000000013F9C0000-0x000000013FD0D000-memory.dmp

Filesize
3.3MB

Download
memory/2808-88-0x000000013F660000-0x000000013F9AD000-memory.dmp

Filesize
3.3MB

Download
memory/2864-100-0x000000013F0A0000-0x000000013F3ED000-memory.dmp

Filesize
3.3MB

Download
memory/2900-102-0x000000013F430000-0x000000013F77D000-memory.dmp

Filesize
3.3MB

Download
memory/3024-96-0x000000013F080000-0x000000013F3CD000-memory.dmp

Filesize
3.3MB

Download