cobaltstrike | 4d9c7528f41d534baa635c0596c3e25834f74671ed6de46015fa1f326aa2442f

Analysis

max time kernel
141s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-01-2025 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

c68bacc74b1cf7a5705c0dce5975d8cf
SHA1

7070eb9d8f4739dec7d94e9f461c6109ebbbeffc
SHA256

4d9c7528f41d534baa635c0596c3e25834f74671ed6de46015fa1f326aa2442f
SHA512

bf822e71731ac5e79337b6d86631b8996e8a88d40d288869da050877d61b6feaba4f73be288d0de6b6f6554a7982e605dfd4a82656b493ed74a5c9e000d5d27d
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUp:j+R56utgpPF8u/7p

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000d000000016aa9-6.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016d9a-8.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016dbe-18.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000016d36-19.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000016dd1-27.dat	cobalt_reflective_dll
behavioral1/files/0x000a000000016dd7-30.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000016ea4-42.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001903b-75.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019244-104.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000191d4-95.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000191ff-93.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000190e0-85.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000018c26-66.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000018792-54.dat	cobalt_reflective_dll
behavioral1/files/0x0016000000018663-46.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019256-109.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001922c-100.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000190ce-82.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000018f53-72.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000018c1a-61.dat	cobalt_reflective_dll
behavioral1/files/0x000f00000001866e-50.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral1/memory/1248-0-0x000000013FEC0000-0x000000014020D000-memory.dmp	xmrig
behavioral1/files/0x000d000000016aa9-6.dat	xmrig
behavioral1/files/0x0007000000016d9a-8.dat	xmrig
behavioral1/memory/2236-7-0x000000013F6A0000-0x000000013F9ED000-memory.dmp	xmrig
behavioral1/memory/1800-12-0x000000013FA00000-0x000000013FD4D000-memory.dmp	xmrig
behavioral1/files/0x0007000000016dbe-18.dat	xmrig
behavioral1/files/0x0009000000016d36-19.dat	xmrig
behavioral1/files/0x0007000000016dd1-27.dat	xmrig
behavioral1/memory/2220-23-0x000000013F260000-0x000000013F5AD000-memory.dmp	xmrig
behavioral1/files/0x000a000000016dd7-30.dat	xmrig
behavioral1/memory/2768-35-0x000000013FCB0000-0x000000013FFFD000-memory.dmp	xmrig
behavioral1/files/0x0009000000016ea4-42.dat	xmrig
behavioral1/memory/2624-63-0x000000013FCD0000-0x000000014001D000-memory.dmp	xmrig
behavioral1/memory/2064-47-0x000000013FC70000-0x000000013FFBD000-memory.dmp	xmrig
behavioral1/files/0x000600000001903b-75.dat	xmrig
behavioral1/files/0x0005000000019244-104.dat	xmrig
behavioral1/memory/1512-126-0x000000013F8E0000-0x000000013FC2D000-memory.dmp	xmrig
behavioral1/files/0x00050000000191d4-95.dat	xmrig
behavioral1/files/0x00050000000191ff-93.dat	xmrig
behavioral1/memory/1196-123-0x000000013F970000-0x000000013FCBD000-memory.dmp	xmrig
behavioral1/files/0x00060000000190e0-85.dat	xmrig
behavioral1/memory/1132-120-0x000000013FA20000-0x000000013FD6D000-memory.dmp	xmrig
behavioral1/files/0x0006000000018c26-66.dat	xmrig
behavioral1/files/0x0005000000018792-54.dat	xmrig
behavioral1/memory/2028-117-0x000000013FEE0000-0x000000014022D000-memory.dmp	xmrig
behavioral1/memory/2700-114-0x000000013FCE0000-0x000000014002D000-memory.dmp	xmrig
behavioral1/memory/2916-110-0x000000013FF30000-0x000000014027D000-memory.dmp	xmrig
behavioral1/files/0x0016000000018663-46.dat	xmrig
behavioral1/files/0x0005000000019256-109.dat	xmrig
behavioral1/memory/1496-103-0x000000013FB10000-0x000000013FE5D000-memory.dmp	xmrig
behavioral1/files/0x000500000001922c-100.dat	xmrig
behavioral1/files/0x00060000000190ce-82.dat	xmrig
behavioral1/memory/2668-79-0x000000013FC10000-0x000000013FF5D000-memory.dmp	xmrig
behavioral1/memory/1812-74-0x000000013FD10000-0x000000014005D000-memory.dmp	xmrig
behavioral1/files/0x0006000000018f53-72.dat	xmrig
behavioral1/files/0x0006000000018c1a-61.dat	xmrig
behavioral1/memory/2808-57-0x000000013F4D0000-0x000000013F81D000-memory.dmp	xmrig
behavioral1/files/0x000f00000001866e-50.dat	xmrig
behavioral1/memory/2880-33-0x000000013F8F0000-0x000000013FC3D000-memory.dmp	xmrig
behavioral1/memory/2832-32-0x000000013F920000-0x000000013FC6D000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2236	pJDBUXj.exe
1800	mvHnqpV.exe
2880	rgnHaeV.exe
2220	fIScEGn.exe
2768	HMnVKrt.exe
2832	SLZEZmf.exe
2808	sJCdaXB.exe
2064	aeNCOAm.exe
2648	MFvMTlx.exe
2624	wgkRRtq.exe
2668	ZtvDUcU.exe
1812	SRBeiZs.exe
564	HXiVYlz.exe
2684	pLMhmmX.exe
1496	fSOOXTl.exe
2916	rNdVQHh.exe
2700	esGhafp.exe
2028	eBZwcOd.exe
1132	PdgQdnY.exe
1196	ZCnBVPa.exe
1512	fDwsaVr.exe

Loads dropped DLL 21 IoCs

pid	Process
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\aeNCOAm.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wgkRRtq.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PdgQdnY.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZCnBVPa.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mvHnqpV.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rgnHaeV.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HMnVKrt.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\sJCdaXB.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rNdVQHh.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\pJDBUXj.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HXiVYlz.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\pLMhmmX.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fDwsaVr.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\esGhafp.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZtvDUcU.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\eBZwcOd.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fSOOXTl.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fIScEGn.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SLZEZmf.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\MFvMTlx.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SRBeiZs.exe	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2236	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 1248 wrote to memory of 2236	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 1248 wrote to memory of 2236	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 1248 wrote to memory of 1800	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 1248 wrote to memory of 1800	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 1248 wrote to memory of 1800	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 1248 wrote to memory of 2880	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 1248 wrote to memory of 2880	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 1248 wrote to memory of 2880	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 1248 wrote to memory of 2220	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 1248 wrote to memory of 2220	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 1248 wrote to memory of 2220	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 1248 wrote to memory of 2768	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 1248 wrote to memory of 2768	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 1248 wrote to memory of 2768	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 1248 wrote to memory of 2832	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 1248 wrote to memory of 2832	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 1248 wrote to memory of 2832	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 1248 wrote to memory of 2808	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 1248 wrote to memory of 2808	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 1248 wrote to memory of 2808	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 1248 wrote to memory of 2064	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 1248 wrote to memory of 2064	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 1248 wrote to memory of 2064	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 1248 wrote to memory of 2648	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 1248 wrote to memory of 2648	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 1248 wrote to memory of 2648	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 1248 wrote to memory of 1812	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 1248 wrote to memory of 1812	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 1248 wrote to memory of 1812	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 1248 wrote to memory of 2624	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 1248 wrote to memory of 2624	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 1248 wrote to memory of 2624	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 1248 wrote to memory of 2700	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 1248 wrote to memory of 2700	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 1248 wrote to memory of 2700	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 1248 wrote to memory of 2668	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 1248 wrote to memory of 2668	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 1248 wrote to memory of 2668	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 1248 wrote to memory of 2028	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 1248 wrote to memory of 2028	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 1248 wrote to memory of 2028	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 1248 wrote to memory of 564	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 1248 wrote to memory of 564	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 1248 wrote to memory of 564	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 1248 wrote to memory of 1132	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 1248 wrote to memory of 1132	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 1248 wrote to memory of 1132	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 1248 wrote to memory of 2684	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 1248 wrote to memory of 2684	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 1248 wrote to memory of 2684	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 1248 wrote to memory of 1196	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 1248 wrote to memory of 1196	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 1248 wrote to memory of 1196	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 1248 wrote to memory of 1496	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 1248 wrote to memory of 1496	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 1248 wrote to memory of 1496	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 1248 wrote to memory of 1512	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 1248 wrote to memory of 1512	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 1248 wrote to memory of 1512	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 1248 wrote to memory of 2916	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 1248 wrote to memory of 2916	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 1248 wrote to memory of 2916	1248	2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe	51

C:\Users\Admin\AppData\Local\Temp\2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-25_c68bacc74b1cf7a5705c0dce5975d8cf_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Windows\System\pJDBUXj.exe
  C:\Windows\System\pJDBUXj.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\mvHnqpV.exe
  C:\Windows\System\mvHnqpV.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\rgnHaeV.exe
  C:\Windows\System\rgnHaeV.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\fIScEGn.exe
  C:\Windows\System\fIScEGn.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\HMnVKrt.exe
  C:\Windows\System\HMnVKrt.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\SLZEZmf.exe
  C:\Windows\System\SLZEZmf.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\sJCdaXB.exe
  C:\Windows\System\sJCdaXB.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\aeNCOAm.exe
  C:\Windows\System\aeNCOAm.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\MFvMTlx.exe
  C:\Windows\System\MFvMTlx.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\SRBeiZs.exe
  C:\Windows\System\SRBeiZs.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\wgkRRtq.exe
  C:\Windows\System\wgkRRtq.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\esGhafp.exe
  C:\Windows\System\esGhafp.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\ZtvDUcU.exe
  C:\Windows\System\ZtvDUcU.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\eBZwcOd.exe
  C:\Windows\System\eBZwcOd.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\HXiVYlz.exe
  C:\Windows\System\HXiVYlz.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\PdgQdnY.exe
  C:\Windows\System\PdgQdnY.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\pLMhmmX.exe
  C:\Windows\System\pLMhmmX.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\ZCnBVPa.exe
  C:\Windows\System\ZCnBVPa.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\fSOOXTl.exe
  C:\Windows\System\fSOOXTl.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\fDwsaVr.exe
  C:\Windows\System\fDwsaVr.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\rNdVQHh.exe
  C:\Windows\System\rNdVQHh.exe
  2⤵
  - Executes dropped EXE
  PID:2916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\HMnVKrt.exe

Filesize
5.7MB

MD5
826bd188fe6932cdc82d2c89b1e3f9e8

SHA1
e0fb02e88ba1ed016afb63e66879bd5dcc7d7915

SHA256
13f66d1c6f6b9881fc65eeb5851141ffb6a2bcfafdd986353afa759f0611479d

SHA512
a1af65e76628296ec9cd2772d419cddf08336a8c4eed2440ad158e003dfc681eda533f58375f7f60531e830b94512b5596acf703c3f15795ef25661ee5df5516

Download Submit
C:\Windows\system\HXiVYlz.exe

Filesize
5.7MB

MD5
546ed8e839d32a5739940bbe62005c12

SHA1
5196edfe0877d552d4f0d0d297ab4c024c669fdb

SHA256
3584bd0d34695c8533ab7c43466c1593e6afa93bcd05116381aeeacfceb56650

SHA512
41d55daa4769982c2adf3a6cba4f8205c4dd78364d48eff3282ca23e07415e24c2ce8f075b730d9c7acff48dc93daff32218add301c8a66dc467a21ac13becc9

Download Submit
C:\Windows\system\MFvMTlx.exe

Filesize
5.7MB

MD5
cf2da430f244eae656b3ea81f2c721db

SHA1
8d0d23b108544e574045f02dae0b704c7508c597

SHA256
606092122b4076dc8ce2a8246b538911bf1bc1c00bcd761fe241948adb1602a3

SHA512
0c4baa406ebbb4a6eca21ac988101c1668954ae3ba8d5a4c4534a07b7b645cd5ed19069bab19bdf0ce51ee137662d7aa0780a4b9b125882ef55c76a24b74558f

Download Submit
C:\Windows\system\SLZEZmf.exe

Filesize
5.7MB

MD5
0f1608d7b1cd4f50c735bcba3293d1e8

SHA1
88208b18071bd6e2ff732d32b4cd1b3e181d3df0

SHA256
bc5f134396624f3d8442bb46e06eb5436672d7142f31e43e66f241b2ad5217ec

SHA512
39cca20d446abc912b32017eb99acfbaddd2aed0f344c63eb205d262e2db1790d31e9e9887ce9d95ba405763807deba2601ea0d7532b0cdf3d8d1f65ab407bc7

Download Submit
C:\Windows\system\ZtvDUcU.exe

Filesize
5.7MB

MD5
2612d02b311577b8fab79373c5aeae1a

SHA1
dca37e69b3e9bbabff8e41207a645174a10a62e5

SHA256
827522b2c3f2cf39fe8850022cc0b550d2d73c5f29bd9fd01af41aa221498800

SHA512
fc9d4097afe06261570231b77a1953a649b91ade78a121f4e2ea7e95774cffaf81b3edebb36fb2ac2ca526db783bddba8668d4fafeb3e5c44bba66757d695776

Download Submit
C:\Windows\system\aeNCOAm.exe

Filesize
5.7MB

MD5
9003353394955c0669c9fb84ad482594

SHA1
17e4050cea7e15586405d56c6dc9e74d0248bb3b

SHA256
0c89c973cef84f9763a917ce13819334fbc1b094f48e76d3b875ee2b1059b3c5

SHA512
716551320ff9bba2ac8607400b787af5f36390467fbf94b5726da6cc44b9fbf5daf87deaa463134955c45a22d3e055eba7ddac4214f0432f9e696cd3f18efb73

Download Submit
C:\Windows\system\fSOOXTl.exe

Filesize
5.7MB

MD5
171bbf70d4abf6ad18d66e29b52d464b

SHA1
daad4465e1cb8de0fda5ed337e309106d39d47ef

SHA256
77e28f048dfa7a163831d06851ba26976028848677c7f781c3fc1756d7a88296

SHA512
84d93fa258d05c78678ad2fb9f70773ae83c5b00ad38586169893b84bad95eab3991418160d992b95733319fa8ae8d53ec8eb30d3778aca75cf61c6fbcba04fb

Download Submit
C:\Windows\system\pJDBUXj.exe

Filesize
5.7MB

MD5
959411d437946228a913409326c08b97

SHA1
f17dd8112d03a4543868561b60e06a7c8b456d7e

SHA256
14e1ee7079d7136cdd7fd9ddcb7443e5e810599f8d7ea068a2a25ba38145a668

SHA512
803cd44294c1d7f52362ec2d3f6069e539013949891cd9c7f5efccd714a24cb0b3899394d5b7b425171845580ccccb8ef46cd8619d5c880e18b0cd04eca39d6e

Download Submit
C:\Windows\system\pLMhmmX.exe

Filesize
5.7MB

MD5
2b974b992e440d6ce940cba19b6b0fe8

SHA1
d78a6ee3a7ba754c1d44fa6a4649b3fdff3ade1f

SHA256
53ce10bde5fa2ae384efb4d089ec7b80e44c22878b4e17ee875b41166aeadf1b

SHA512
1e22fa4dae9b08e70e28345534aeff8bc6e71205e9cb09971af16cefe37868d92156053d7662731f3a7e6a3a204baf159e0d9a07bb22dae0fdd92972b285351e

Download Submit
C:\Windows\system\rNdVQHh.exe

Filesize
5.7MB

MD5
854351e61f99a86b895fa61dc67e25be

SHA1
a32ee948353b8735e01ec74d84c1f5427cab4019

SHA256
0c1f0bc9b0df5fed22f0f4caadedabe9c812012ab4576e7a586e60bcc07a9d46

SHA512
bbf9c5f802f1f4a94f30c55cbf4a290b07d662eb7cce34e33c3724e76fcbaa0dae200754d7496f33e13ce7cc8d900dadba0249370880f761a4a70e02174f0545

Download Submit
C:\Windows\system\rgnHaeV.exe

Filesize
5.7MB

MD5
7f6b8e8271ca834f4b738e907c634e73

SHA1
14c2acb644efdee582a841d32c46ad930448cb9a

SHA256
5163af1747879c7e65b6803253fe304bebaa66e0890249ac02ab12105b075292

SHA512
5c33eef5ece7a60fc702d966a1912beb2fb70783bafa636b09a4b60d0e12b65d8c8082963cb2314fb0f40c96478f863831f3447f3534959996a4620542bd6986

Download Submit
C:\Windows\system\sJCdaXB.exe

Filesize
5.7MB

MD5
bf984f73ad1822197169f543b0cb188f

SHA1
f7cc2b187ddcb6675dd9466ae54c728654f48a2d

SHA256
e2a7797e1a77410818a23cd3b111be1b237759e5a0f4c2c3d25a5b2f150deb32

SHA512
3b1b297aa12a97754f9e9aca244697905fd329a7095c7c7001d3b27abcea9849a1f228e3062c3d0f2165e0fcd05128994b4ca7d88bd47105a5974b313aea6cb7

Download Submit
C:\Windows\system\wgkRRtq.exe

Filesize
5.7MB

MD5
09c1d8d4d8f47db28c66aa3d3b7d6d71

SHA1
1a26dfcb8243cb7a51dc9c1ecd14e85e3280d686

SHA256
1022deeac61cdcbf4b914d34c6a4cb1f53efb14232fdee15e84843920ee7c996

SHA512
bf70f2f7aa579b9e613f0fba8f51c393fca077f3b9af33cf5bc27b9b6a717105f61ebea94c705efc8ab65e26a8104d9a8ade92124abf153592660f1e7ed6703f

Download Submit
\Windows\system\PdgQdnY.exe

Filesize
5.7MB

MD5
491fdc9a73128e4e0c35a2c5f3ad914e

SHA1
de0ab6d40d49b5496bd34f986e69b26b91010095

SHA256
09a2f34033a6ed5a01692ebce1c9fc37d94ca4efaaa0d6d663f3be32ebcfbd3b

SHA512
dcda6eb446abd3eb572861323f243bd11c5f3dc1feb49ff127c9824ae88cbb5d0bec2d0f2e63a4fe767f38d03240fd4c4cefa3df16dd3cdaa38f5adb9e831946

Download Submit
\Windows\system\SRBeiZs.exe

Filesize
5.7MB

MD5
bafd425998bec8f047675415c3ea9f31

SHA1
1908b1260bf987599d2451b1b84e00de262d378a

SHA256
89edc77592e8de34fb6e593394b204f0dcc531eceb9684ae6690733c38c360c9

SHA512
d09b7ad55bf90aaf35569e416dfbc6f9052d4329eea98f5f512c01347dc2c35eb7ca8564634d845d9287bdbec1c3c0041bff0c359bd93807a9c0f5da8e4cb74e

Download Submit
\Windows\system\ZCnBVPa.exe

Filesize
5.7MB

MD5
c4f5b47524d78f022e6a0e6f185b23bc

SHA1
f1dd7b6123122be5dd337208fbfa1a97321744a9

SHA256
d555bfe58b9a3003df779e8a6f383a19fff7ddca4b588a65cfa06c386b36c534

SHA512
4fd366a1b2e446a6722e59dc1dfefb0b98f464b4e16a2a3e13e19b249c234939d553fb71a5d9370caedf99122a224366b4664649736216d4126cf301b574d7d0

Download Submit
\Windows\system\eBZwcOd.exe

Filesize
5.7MB

MD5
5684ace581600311fa309558841a0a3c

SHA1
5c4cecadf109c6bc4bce94f998acd031d57f5dc0

SHA256
41d6537e19a804484e64716d21ecd84c11ec28517f4c82ee158a6173af3b1a0e

SHA512
494e6cc10db2ca800f8d85cc6d18c8246915b7e12133d1b2d3ffad57aa51899121ed2634bb866169cd47a6f22b7736d4186f6e55f8e06d9edeb093497393c7ee

Download Submit
\Windows\system\esGhafp.exe

Filesize
5.7MB

MD5
a25ee526561ac44a1d0f3e815853f367

SHA1
1daabe9de6c5f28858fd4f2f85f164caf70b1df9

SHA256
b1b74e9ac6f8c3e1861d647285ac7127a6f2b21bda014e93d9e887ca51340d96

SHA512
863bf93c2266fb04a1aaa16f15d7299ac273da74d654ae245a4e2d0eb3ea33fb0df81c180afe0c8f5423b32eb24f8feee272f0f86f11b830b58477853e8522c4

Download Submit
\Windows\system\fDwsaVr.exe

Filesize
5.7MB

MD5
83b486b3ac142fe50ddd2e35a3d82ae1

SHA1
ef7ca6e9420e3b0d5d3d626236371423c767c844

SHA256
bf42188ec6a34c1118a48ab71ed35edc3deeaf764854e4da56d5d1ce6ecacaa3

SHA512
b1fb2fbeb82e9f7cc4cf9dbc3ffb0d8aa3cdc6203464df6355496aebff136ae919237ab7e55d48004c17e66eb55a9f6c726b69ed90a026a266dd994a1312a4a2

Download Submit
\Windows\system\fIScEGn.exe

Filesize
5.7MB

MD5
cb741cf8877292ef68af552c65ea5cfb

SHA1
67712dd8e41e7fb4818bd84ec6fd47098f58a371

SHA256
398928d61f04bd0116aa57e67af2b202e0e191ba8a31493dcfa7290feab1d049

SHA512
3a176817529d29499d0961f1d50e182aaf4b4977ad8b9ca026daa9ffb38a4590b97e037e475b88669b9b73685e6d23faa4ab26d525ce3bc0d51abee78c7bc580

Download Submit
\Windows\system\mvHnqpV.exe

Filesize
5.7MB

MD5
14b6429b5747463ddfa0ff1c076e1694

SHA1
e547e2ba6c3d36e7da128079062d124e9cec3ac4

SHA256
746d49530c13319611982ed2263dac2baeb57d51374987e2ed560ae2a0ce03c9

SHA512
c05470ab95336e8de0328f80c41a65cdbb6cb5f7c9e8167c64086bbcf568fdf4d5e6f5d53a757ff65b8819bdfec4f854290d555daa1536ad36be61325b398ac5

Download Submit
memory/1132-120-0x000000013FA20000-0x000000013FD6D000-memory.dmp

Filesize
3.3MB

Download
memory/1196-123-0x000000013F970000-0x000000013FCBD000-memory.dmp

Filesize
3.3MB

Download
memory/1248-0-0x000000013FEC0000-0x000000014020D000-memory.dmp

Filesize
3.3MB

Download
memory/1248-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1496-103-0x000000013FB10000-0x000000013FE5D000-memory.dmp

Filesize
3.3MB

Download
memory/1512-126-0x000000013F8E0000-0x000000013FC2D000-memory.dmp

Filesize
3.3MB

Download
memory/1800-12-0x000000013FA00000-0x000000013FD4D000-memory.dmp

Filesize
3.3MB

Download
memory/1812-74-0x000000013FD10000-0x000000014005D000-memory.dmp

Filesize
3.3MB

Download
memory/2028-117-0x000000013FEE0000-0x000000014022D000-memory.dmp

Filesize
3.3MB

Download
memory/2064-47-0x000000013FC70000-0x000000013FFBD000-memory.dmp

Filesize
3.3MB

Download
memory/2220-23-0x000000013F260000-0x000000013F5AD000-memory.dmp

Filesize
3.3MB

Download
memory/2236-7-0x000000013F6A0000-0x000000013F9ED000-memory.dmp

Filesize
3.3MB

Download
memory/2624-63-0x000000013FCD0000-0x000000014001D000-memory.dmp

Filesize
3.3MB

Download
memory/2668-79-0x000000013FC10000-0x000000013FF5D000-memory.dmp

Filesize
3.3MB

Download
memory/2700-114-0x000000013FCE0000-0x000000014002D000-memory.dmp

Filesize
3.3MB

Download
memory/2768-35-0x000000013FCB0000-0x000000013FFFD000-memory.dmp

Filesize
3.3MB

Download
memory/2808-57-0x000000013F4D0000-0x000000013F81D000-memory.dmp

Filesize
3.3MB

Download
memory/2832-32-0x000000013F920000-0x000000013FC6D000-memory.dmp

Filesize
3.3MB

Download
memory/2880-33-0x000000013F8F0000-0x000000013FC3D000-memory.dmp

Filesize
3.3MB

Download
memory/2916-110-0x000000013FF30000-0x000000014027D000-memory.dmp

Filesize
3.3MB

Download