cobaltstrike | 586fc747b5b6918aa0670236f070a330751402d1c911a3c3ab76f5032b57239e

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-01-2025 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

5d0086a515c7ecf960c42648cfa9ff18
SHA1

94271bf8994e303b90c71978bf49107306c39893
SHA256

586fc747b5b6918aa0670236f070a330751402d1c911a3c3ab76f5032b57239e
SHA512

065a5fd063d36583b7dcf8557ffc8d05068f9a6b4f735a92c13129184dab1ea8edaf89007bb945e236fcc5e651d429d927c0a64ecad373325beb98af3e5577a3
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUz:j+R56utgpPF8u/7z

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0007000000012117-3.dat	cobalt_reflective_dll
behavioral1/files/0x00080000000144c9-9.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000014510-13.dat	cobalt_reflective_dll
behavioral1/files/0x00080000000145c0-19.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000146f9-33.dat	cobalt_reflective_dll
behavioral1/files/0x003000000001435e-30.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000014742-40.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000014a1d-51.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d31-101.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d48-107.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d88-123.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d80-119.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d60-113.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d15-95.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015d0a-90.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015ce4-77.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015cfd-83.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015ccf-71.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015cb9-65.dat	cobalt_reflective_dll
behavioral1/files/0x00080000000156b8-59.dat	cobalt_reflective_dll
behavioral1/files/0x000700000001487c-48.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral1/memory/2508-0-0x000000013FE80000-0x00000001401CD000-memory.dmp	xmrig
behavioral1/files/0x0007000000012117-3.dat	xmrig
behavioral1/memory/2524-7-0x000000013FDC0000-0x000000014010D000-memory.dmp	xmrig
behavioral1/files/0x00080000000144c9-9.dat	xmrig
behavioral1/files/0x0008000000014510-13.dat	xmrig
behavioral1/memory/2624-12-0x000000013F1B0000-0x000000013F4FD000-memory.dmp	xmrig
behavioral1/files/0x00080000000145c0-19.dat	xmrig
behavioral1/memory/1448-24-0x000000013F110000-0x000000013F45D000-memory.dmp	xmrig
behavioral1/files/0x00070000000146f9-33.dat	xmrig
behavioral1/memory/2456-35-0x000000013FE40000-0x000000014018D000-memory.dmp	xmrig
behavioral1/files/0x003000000001435e-30.dat	xmrig
behavioral1/memory/2544-22-0x000000013FD40000-0x000000014008D000-memory.dmp	xmrig
behavioral1/files/0x0007000000014742-40.dat	xmrig
behavioral1/memory/2992-49-0x000000013FB70000-0x000000013FEBD000-memory.dmp	xmrig
behavioral1/files/0x0009000000014a1d-51.dat	xmrig
behavioral1/memory/2000-55-0x000000013F690000-0x000000013F9DD000-memory.dmp	xmrig
behavioral1/memory/572-67-0x000000013F530000-0x000000013F87D000-memory.dmp	xmrig
behavioral1/memory/2792-85-0x000000013FA90000-0x000000013FDDD000-memory.dmp	xmrig
behavioral1/memory/2684-79-0x000000013FEA0000-0x00000001401ED000-memory.dmp	xmrig
behavioral1/memory/2816-91-0x000000013FF30000-0x000000014027D000-memory.dmp	xmrig
behavioral1/memory/2812-97-0x000000013FFD0000-0x000000014031D000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d31-101.dat	xmrig
behavioral1/files/0x0006000000015d48-107.dat	xmrig
behavioral1/memory/1640-126-0x000000013FC90000-0x000000013FFDD000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d88-123.dat	xmrig
behavioral1/memory/2484-121-0x000000013F2C0000-0x000000013F60D000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d80-119.dat	xmrig
behavioral1/memory/2168-115-0x000000013F180000-0x000000013F4CD000-memory.dmp	xmrig
behavioral1/files/0x0006000000015d60-113.dat	xmrig
behavioral1/files/0x0006000000015d15-95.dat	xmrig
behavioral1/files/0x0006000000015d0a-90.dat	xmrig
behavioral1/files/0x0006000000015ce4-77.dat	xmrig
behavioral1/files/0x0006000000015cfd-83.dat	xmrig
behavioral1/memory/1416-73-0x000000013F8D0000-0x000000013FC1D000-memory.dmp	xmrig
behavioral1/files/0x0006000000015ccf-71.dat	xmrig
behavioral1/files/0x0006000000015cb9-65.dat	xmrig
behavioral1/files/0x00080000000156b8-59.dat	xmrig
behavioral1/memory/1744-43-0x000000013FFF0000-0x000000014033D000-memory.dmp	xmrig
behavioral1/files/0x000700000001487c-48.dat	xmrig
behavioral1/memory/2532-41-0x000000013FA60000-0x000000013FDAD000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2524	WUvjKAZ.exe
2624	glcXEiO.exe
2544	cTahfMV.exe
1448	HqPNMbd.exe
1744	BKtZmNo.exe
2456	fqcyCqF.exe
2532	dWcngES.exe
2992	qgJKgti.exe
2000	DrnzXDi.exe
532	aFNWQyE.exe
572	AAEPiOw.exe
1416	PVeKZtC.exe
2684	QHVqbgK.exe
2792	CSghLMK.exe
2816	pgRsfRP.exe
2812	GlltWAs.exe
1924	uHiaWHq.exe
1608	KeUxNbS.exe
2168	xTJtjjf.exe
2484	wxOnDmv.exe
1640	nnYqhCl.exe

Loads dropped DLL 21 IoCs

pid	Process
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\BKtZmNo.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\CSghLMK.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\pgRsfRP.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GlltWAs.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\uHiaWHq.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WUvjKAZ.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\glcXEiO.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HqPNMbd.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\dWcngES.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qgJKgti.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\aFNWQyE.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wxOnDmv.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fqcyCqF.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KeUxNbS.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nnYqhCl.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\cTahfMV.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\DrnzXDi.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\AAEPiOw.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PVeKZtC.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\QHVqbgK.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\xTJtjjf.exe	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2524	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 2508 wrote to memory of 2524	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 2508 wrote to memory of 2524	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 2508 wrote to memory of 2624	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 2508 wrote to memory of 2624	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 2508 wrote to memory of 2624	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 2508 wrote to memory of 2544	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2508 wrote to memory of 2544	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2508 wrote to memory of 2544	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2508 wrote to memory of 1448	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2508 wrote to memory of 1448	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2508 wrote to memory of 1448	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2508 wrote to memory of 1744	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2508 wrote to memory of 1744	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2508 wrote to memory of 1744	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2508 wrote to memory of 2456	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2508 wrote to memory of 2456	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2508 wrote to memory of 2456	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2508 wrote to memory of 2532	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2508 wrote to memory of 2532	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2508 wrote to memory of 2532	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2508 wrote to memory of 2992	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2508 wrote to memory of 2992	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2508 wrote to memory of 2992	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2508 wrote to memory of 2000	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2508 wrote to memory of 2000	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2508 wrote to memory of 2000	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2508 wrote to memory of 532	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2508 wrote to memory of 532	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2508 wrote to memory of 532	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2508 wrote to memory of 572	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2508 wrote to memory of 572	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2508 wrote to memory of 572	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2508 wrote to memory of 1416	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2508 wrote to memory of 1416	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2508 wrote to memory of 1416	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2508 wrote to memory of 2684	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2508 wrote to memory of 2684	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2508 wrote to memory of 2684	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2508 wrote to memory of 2792	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2508 wrote to memory of 2792	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2508 wrote to memory of 2792	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2508 wrote to memory of 2816	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2508 wrote to memory of 2816	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2508 wrote to memory of 2816	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2508 wrote to memory of 2812	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2508 wrote to memory of 2812	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2508 wrote to memory of 2812	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2508 wrote to memory of 1924	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2508 wrote to memory of 1924	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2508 wrote to memory of 1924	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2508 wrote to memory of 1608	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2508 wrote to memory of 1608	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2508 wrote to memory of 1608	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2508 wrote to memory of 2168	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2508 wrote to memory of 2168	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2508 wrote to memory of 2168	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2508 wrote to memory of 2484	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2508 wrote to memory of 2484	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2508 wrote to memory of 2484	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2508 wrote to memory of 1640	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2508 wrote to memory of 1640	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2508 wrote to memory of 1640	2508	2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe	49

C:\Users\Admin\AppData\Local\Temp\2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-25_5d0086a515c7ecf960c42648cfa9ff18_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\System\WUvjKAZ.exe
  C:\Windows\System\WUvjKAZ.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\glcXEiO.exe
  C:\Windows\System\glcXEiO.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\cTahfMV.exe
  C:\Windows\System\cTahfMV.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\HqPNMbd.exe
  C:\Windows\System\HqPNMbd.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\BKtZmNo.exe
  C:\Windows\System\BKtZmNo.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\fqcyCqF.exe
  C:\Windows\System\fqcyCqF.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\dWcngES.exe
  C:\Windows\System\dWcngES.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\qgJKgti.exe
  C:\Windows\System\qgJKgti.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\DrnzXDi.exe
  C:\Windows\System\DrnzXDi.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\aFNWQyE.exe
  C:\Windows\System\aFNWQyE.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\AAEPiOw.exe
  C:\Windows\System\AAEPiOw.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\PVeKZtC.exe
  C:\Windows\System\PVeKZtC.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\QHVqbgK.exe
  C:\Windows\System\QHVqbgK.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\CSghLMK.exe
  C:\Windows\System\CSghLMK.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\pgRsfRP.exe
  C:\Windows\System\pgRsfRP.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\GlltWAs.exe
  C:\Windows\System\GlltWAs.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\uHiaWHq.exe
  C:\Windows\System\uHiaWHq.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\KeUxNbS.exe
  C:\Windows\System\KeUxNbS.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\xTJtjjf.exe
  C:\Windows\System\xTJtjjf.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\wxOnDmv.exe
  C:\Windows\System\wxOnDmv.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\nnYqhCl.exe
  C:\Windows\System\nnYqhCl.exe
  2⤵
  - Executes dropped EXE
  PID:1640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AAEPiOw.exe

Filesize
5.7MB

MD5
45bc2024005e4488d82467d189efd04f

SHA1
4123bc59c8195a15e28e74e7e18ee11999eaca4e

SHA256
e744ac53b7949e3af0c45f373758431691b7646200ca076d0cd85de5654661da

SHA512
01002a91c619d4e92be57e9c557ae37be4ea0fe2ee759bd2555b4d8cd3dfb9aefebf9884853f656153fd80f68c1f0679ddf8f005809b6c436297264b343b52c2

Download Submit
C:\Windows\system\BKtZmNo.exe

Filesize
5.7MB

MD5
04de4cea289421f4c54f3b3974421204

SHA1
d52d1a55e62fd610177b64f5123c77e05b07448b

SHA256
6a69cf016f427ff60383dce90590078bfe5f068bd074aeda4d6511349c6c4315

SHA512
9e25aaf3ebbf0cc43a3a100bbb733dc50b5f2791a998ce8355f1928e0841c05e84c6a90063d024c5db425be303ac60c3c74a2e61fd738703fe4690cce2a67a8d

Download Submit
C:\Windows\system\CSghLMK.exe

Filesize
5.7MB

MD5
7334fb192f8f66dfca0cfdfc9c841c21

SHA1
a7296f65cd99ad864b140ada0b46beb2451051b9

SHA256
7b77f9703b13d2fa76660cedd892e0d381b1c02b48c2f565e01b29e48f5f373e

SHA512
b7a3cc21eea3cebef404c9ae5d36e34d9d24f747bb5c42ded0f3f335d4e8e1f28f506b803e455e52e8e54d899aec569a8146a1fcaec963bf174ceebf87ce25b4

Download Submit
C:\Windows\system\GlltWAs.exe

Filesize
5.7MB

MD5
ecddda4990096234ddc0f95fb3de6133

SHA1
3a7c77a990ac9795f7c8ef817c9585ae37cc7d89

SHA256
86f8f5409a10cf50a7288809971a291caa9590e6b618ca874740eded351763cb

SHA512
b0f3eac88fd3c9b4edff8939057cd079b834486dec0a9b5e77d5731081a50d46405533e286c7c52e315558eb79252fc778a631b48b597657e6ef3a5b129e5889

Download Submit
C:\Windows\system\KeUxNbS.exe

Filesize
5.7MB

MD5
8c43eff1632ba07ccafac914bb4007d0

SHA1
bc07711f698ee10f11a455ce8d2f01cfb759898e

SHA256
5dd4f48377dd7fe1cdfd90e99f1280ff559ab843b1988f520b880c030e82fa24

SHA512
c55053612c9849117d5055cd7f0a6aff2606cad6aa228ee7a3e961c064c60c3e4c2d5cb827115bde94eb4a32b6ee67e293b131fa5b1acfc602aa81fe0ee0104d

Download Submit
C:\Windows\system\PVeKZtC.exe

Filesize
5.7MB

MD5
6dc81418580c4ba61e74e4b02cff4632

SHA1
273d305d67a85842057cd36bce76b660ddb2cf8d

SHA256
ce1d71957b20670a01d16698405f0fdc89cf3cb8758d4a941d3512122816be2a

SHA512
e2851ed5131fc15db45b2ea5efa9bf9d87ba6f87f3d1f8f1e4ce533bcfd4cfc2f27ee3ac7396ae6bf87bda27380ffd418e872345c4f5fa968f48c15c027a8dda

Download Submit
C:\Windows\system\QHVqbgK.exe

Filesize
5.7MB

MD5
cfd34ae55df29db9ec51d8380bf2ca17

SHA1
b07bc4fb5db31ee5aca3435cf5202ccd3452adc4

SHA256
cecfd48ad3506c3ec8255d6494cfd45b61b3165f657d736cdfc0d03908e37190

SHA512
54187ae2a2f8cc1ef4f3776892e296d20541f41a5242bacc87de438ff73a539e3ea688882fea4ca1c96d533da8b1f385abb6a1c7c7672ad95d5e46e22dcb1f6e

Download Submit
C:\Windows\system\aFNWQyE.exe

Filesize
5.7MB

MD5
77e5cddf46caa872adcd80da1c37e05e

SHA1
e6cb021455b5997b870ca81190c2e1c279bc34ea

SHA256
f37ffa00fad0f83f8e1568bbf4563a218f1b4dbc7256fce8094811b333bb6200

SHA512
9f28857b3577653b871626267bba2bf6dc37e8ea077db5245e5083a0d85902e0ba63ab073b6b4f951636773fd39e296dbe8f35d9a4748f4b8b597f16faabb8b2

Download Submit
C:\Windows\system\cTahfMV.exe

Filesize
5.7MB

MD5
7c0d0baf2382536d2327887a3d702b4b

SHA1
fcf370b52ad6677626b7def822c80182e29fb0b5

SHA256
b41d34f3897e99abeabacc05ebba1f3c379154b775c3433515fa6fb54d0bd3a9

SHA512
819f53ffc896cb7566603f6d0704c8a455571759e964f32c3da8ddeedef81a3fe80a1dd1ce0e5a13a93b75fc72ac783bface1c6f2dc6d1181371db252ba4e26d

Download Submit
C:\Windows\system\dWcngES.exe

Filesize
5.7MB

MD5
918b6b1a9c24fa17ee4c1da3bf267666

SHA1
3130c0204512ad102e0cf7fef114bd5b11f935b4

SHA256
5a67ccbed9634ed2a1f29c2ac53c836b63d35cf7c426a617023b32dea7e1115c

SHA512
acde1037af5a74e5cf239dee12ae2616f652643d69e3ca0092e11506a543db8d3536a18498e9310ba8dd0fadf6fe129632c5bcbeff52dbc5aab2ba9c6feef796

Download Submit
C:\Windows\system\fqcyCqF.exe

Filesize
5.7MB

MD5
e13800c503a14e33a17cc0228d5d0d9e

SHA1
1f64e4e64b00d54b9e7576bf679f61126d79e6da

SHA256
117a433945477d49472079c42273a968226dcbd7df11e461559c1d0a543edf37

SHA512
9608469adb2405bd3b7204047014c1779dfa6900e22d1577581524f1bc91637b21929f66f12a2f710b18686767d739cbc7c00e31ee1da51b4ec4b9eaabecd707

Download Submit
C:\Windows\system\pgRsfRP.exe

Filesize
5.7MB

MD5
7df84479da359b19830c0b3ad8a8db34

SHA1
acc0580350691878e6b98bde53392f72611ee225

SHA256
a81b9bf515357eb39f63018b759d7ab907c8de216c2600b2f5e56b0682f24b3f

SHA512
fb392b91e08ea72570e5a91db94d6c3cd18b1cfaec99f27436e766718468e81ec6378a0ccb5f978ce899a0c71184cdc3f6104014879bf39390182e7250382f03

Download Submit
C:\Windows\system\qgJKgti.exe

Filesize
5.7MB

MD5
7a67db4ca918be18b43bc1f7a22f2d2f

SHA1
40d15a6e317d6cd74fbfe9774aa846424f894fd8

SHA256
75df92844601dfe71ce7d14c2a5a1ffed45e675c7a8e831601737fe609c6efba

SHA512
489aeec2b1d35e6e4e7d34bbaf418fdb833bec1aa44616cfba71e4b84761ba708ac761b4995ccd47ec8edbfdcba8f33935fe73e237c7ae49c16d06094ce9b303

Download Submit
C:\Windows\system\uHiaWHq.exe

Filesize
5.7MB

MD5
ee1df7c63910964f1df8b0cf9d9446d4

SHA1
f2f3e59379bbd2be8489d3fdb346fe56343f64e8

SHA256
ba01d2152deafd1b579facf87f1c412ca31f111952c6b3a89f0a208e99e6d890

SHA512
a9d4ca8ab630992e2ae109f591f9f601b3d56ea3977641996ce248742c296572c0f8a469b4847d0d1fc5fc4483bdc12babdfb4bb0ff5cdeb93cf270410df95d9

Download Submit
C:\Windows\system\wxOnDmv.exe

Filesize
5.7MB

MD5
8dba8ca150c63c6f30c129a44aa91ee6

SHA1
e8284c0fff22eb46463da7d9af909ffca686d7b4

SHA256
8e8cf021be6d37c8373d75f4c6b89a170500e0b9af5c7dd9caf6e3a34cdeeaa3

SHA512
532761a9fe4a8cdfd1413b239b46df32c0dab44b92827cc68e21db22b704ba61c728c8cdea4094ca2cadba91f1e0651391d3ce61bcce72dd1754904c231f9e6e

Download Submit
C:\Windows\system\xTJtjjf.exe

Filesize
5.7MB

MD5
beacc6bf2e77bc57c4188a03a981b340

SHA1
c814d5fc9752df0b738751ef01c67c9b76fed493

SHA256
4a44b165bfc9a26d9604bc23d55bf868a0c368a226c04d43f64faf540f2a9d51

SHA512
7b33f61228863809c42a6aef0235aaa5c420267488ef6977a02e180a71bab97b2a9cc4c64acc629e782a17281abc653652350bb514ef80acf6150a7fdcf15114

Download Submit
\Windows\system\DrnzXDi.exe

Filesize
5.7MB

MD5
8142d2215b6295f1a70054f65b0a48a3

SHA1
52a62a2ed202edb78c5bbee6fb01ce4b84d278e4

SHA256
4aa847532ea16c093ced91e5057a3f79b8024128fbdceb771f6772a9400254b0

SHA512
34acbd1a1343fbdc8c870ca87629f927d2c642850caf2809937d09caad53bd11f0d265d2d1e0146071ef1f6baba52fb54d43ea75709bad2955b5f9004ddb8708

Download Submit
\Windows\system\HqPNMbd.exe

Filesize
5.7MB

MD5
c88dc5aeb85270f2dbda007b34d5e60b

SHA1
9e8e613db1b4183977bb57c7f0061f41fb022ad3

SHA256
a360a76ab6440facc3b96c365ae36fe8375b9aff2cccb0a7ce0952effe67ed8a

SHA512
29abded1e406684d32956eece9f531bc7006abe8632c26fd6a9ff41d0e69c149adb4957c07047b273311051654755ff8915cb6bfaa6a0c866f11372c2084eea8

Download Submit
\Windows\system\WUvjKAZ.exe

Filesize
5.7MB

MD5
74148cd0046dace0e85c22f2563ae6b9

SHA1
f7a08a074af0ef831c8f5834be247098e88f2a28

SHA256
0d00b79634b88daf03e683902be83600daf35889e9276e9022b2a792e8006765

SHA512
4d0d74de9c65c9c5058293254d185fa733443295bc3339c77e41eb9dc5b19fd88c4e4091f09954e0e52aa1c5cc2fbb2bf08c69525b01e2c8008fd84c18d61551

Download Submit
\Windows\system\glcXEiO.exe

Filesize
5.7MB

MD5
768d93af7e16f6889c4bdd7f1aad2110

SHA1
df75559c32c919c7a3f78457313895750b587f1f

SHA256
89d397dfa07dcd835b1679de2537f4711f73dd8c43f6f9b40007815b53a7df37

SHA512
6aa9410c106881d0131d38e28271e6c3fe50319196a9c159b41111c4a1765631295d66d602899323c5442d68707800b8df0bd5a4ffa4916087b232b98a31daea

Download Submit
\Windows\system\nnYqhCl.exe

Filesize
5.7MB

MD5
8e6591311583a37a1200b5b1e289db2d

SHA1
07b0a482eb8c10bccf31e5d2192b51d14e4b68f1

SHA256
b62ba871c2bdc851b3b1e876db35f102a9afb514b514362cf5aea32f6a6ca3e2

SHA512
69601073848a70fa0cd8ae996f6bc3c604a545b26c90198dc87c356c8f0c2516f47e1ff1c770792d95b717a489e3474cfbdf45a077aea1f93b3a593ffd6bc47e

Download Submit
memory/572-67-0x000000013F530000-0x000000013F87D000-memory.dmp

Filesize
3.3MB

Download
memory/1416-73-0x000000013F8D0000-0x000000013FC1D000-memory.dmp

Filesize
3.3MB

Download
memory/1448-24-0x000000013F110000-0x000000013F45D000-memory.dmp

Filesize
3.3MB

Download
memory/1640-126-0x000000013FC90000-0x000000013FFDD000-memory.dmp

Filesize
3.3MB

Download
memory/1744-43-0x000000013FFF0000-0x000000014033D000-memory.dmp

Filesize
3.3MB

Download
memory/2000-55-0x000000013F690000-0x000000013F9DD000-memory.dmp

Filesize
3.3MB

Download
memory/2168-115-0x000000013F180000-0x000000013F4CD000-memory.dmp

Filesize
3.3MB

Download
memory/2456-35-0x000000013FE40000-0x000000014018D000-memory.dmp

Filesize
3.3MB

Download
memory/2484-121-0x000000013F2C0000-0x000000013F60D000-memory.dmp

Filesize
3.3MB

Download
memory/2508-0-0x000000013FE80000-0x00000001401CD000-memory.dmp

Filesize
3.3MB

Download
memory/2508-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2524-7-0x000000013FDC0000-0x000000014010D000-memory.dmp

Filesize
3.3MB

Download
memory/2532-41-0x000000013FA60000-0x000000013FDAD000-memory.dmp

Filesize
3.3MB

Download
memory/2544-22-0x000000013FD40000-0x000000014008D000-memory.dmp

Filesize
3.3MB

Download
memory/2624-12-0x000000013F1B0000-0x000000013F4FD000-memory.dmp

Filesize
3.3MB

Download
memory/2684-79-0x000000013FEA0000-0x00000001401ED000-memory.dmp

Filesize
3.3MB

Download
memory/2792-85-0x000000013FA90000-0x000000013FDDD000-memory.dmp

Filesize
3.3MB

Download
memory/2812-97-0x000000013FFD0000-0x000000014031D000-memory.dmp

Filesize
3.3MB

Download
memory/2816-91-0x000000013FF30000-0x000000014027D000-memory.dmp

Filesize
3.3MB

Download
memory/2992-49-0x000000013FB70000-0x000000013FEBD000-memory.dmp

Filesize
3.3MB

Download