cobaltstrike | fe70b72d46ae42d2f17032bedbd79196ae0aa8ac85c6c9646e5ec8c7c19b10d7

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/01/2025, 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

1eccbd7f69e77d6bf75c9faeb4ff4a32
SHA1

003cf206f3496cf22a98738e0889affd038e743c
SHA256

fe70b72d46ae42d2f17032bedbd79196ae0aa8ac85c6c9646e5ec8c7c19b10d7
SHA512

4c524ad1656ad4dca90b03aa9750dfd6abdd88c9bee2155db2c743ff36fd3d903a0f6cc9d08c164f47280c41028f3806942ae65d73b17581c99cc190320026ae
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUr:j+R56utgpPF8u/7r

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x00090000000120d6-3.dat	cobalt_reflective_dll
behavioral1/files/0x000800000001506e-9.dat	cobalt_reflective_dll
behavioral1/files/0x000800000001567f-15.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015689-32.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015685-28.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000014c66-26.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015fa6-65.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000160da-68.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016141-72.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000164de-84.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016689-92.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016b86-100.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016890-96.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001660e-88.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000016399-80.dat	cobalt_reflective_dll
behavioral1/files/0x00060000000162e4-76.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000015ce4-64.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000015f4e-62.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000015cb9-61.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000156a8-59.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000156b8-53.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 41 IoCs

miner

resource	yara_rule
behavioral1/memory/2420-0-0x000000013FE20000-0x000000014016D000-memory.dmp	xmrig
behavioral1/files/0x00090000000120d6-3.dat	xmrig
behavioral1/memory/2236-6-0x000000013F780000-0x000000013FACD000-memory.dmp	xmrig
behavioral1/files/0x000800000001506e-9.dat	xmrig
behavioral1/memory/1796-12-0x000000013F1D0000-0x000000013F51D000-memory.dmp	xmrig
behavioral1/files/0x000800000001567f-15.dat	xmrig
behavioral1/memory/776-29-0x000000013F580000-0x000000013F8CD000-memory.dmp	xmrig
behavioral1/memory/2888-27-0x000000013F4D0000-0x000000013F81D000-memory.dmp	xmrig
behavioral1/files/0x0008000000015689-32.dat	xmrig
behavioral1/files/0x0008000000015685-28.dat	xmrig
behavioral1/files/0x0008000000014c66-26.dat	xmrig
behavioral1/memory/2960-25-0x000000013FCF0000-0x000000014003D000-memory.dmp	xmrig
behavioral1/memory/2104-51-0x000000013F200000-0x000000013F54D000-memory.dmp	xmrig
behavioral1/files/0x0006000000015fa6-65.dat	xmrig
behavioral1/files/0x00060000000160da-68.dat	xmrig
behavioral1/files/0x0006000000016141-72.dat	xmrig
behavioral1/files/0x00060000000164de-84.dat	xmrig
behavioral1/files/0x0006000000016689-92.dat	xmrig
behavioral1/files/0x0006000000016b86-100.dat	xmrig
behavioral1/files/0x0006000000016890-96.dat	xmrig
behavioral1/files/0x000600000001660e-88.dat	xmrig
behavioral1/files/0x0006000000016399-80.dat	xmrig
behavioral1/files/0x00060000000162e4-76.dat	xmrig
behavioral1/files/0x0008000000015ce4-64.dat	xmrig
behavioral1/files/0x0006000000015f4e-62.dat	xmrig
behavioral1/files/0x0007000000015cb9-61.dat	xmrig
behavioral1/memory/2140-60-0x000000013F590000-0x000000013F8DD000-memory.dmp	xmrig
behavioral1/files/0x00070000000156a8-59.dat	xmrig
behavioral1/memory/2796-57-0x000000013FFF0000-0x000000014033D000-memory.dmp	xmrig
behavioral1/files/0x00070000000156b8-53.dat	xmrig
behavioral1/memory/2632-124-0x000000013F370000-0x000000013F6BD000-memory.dmp	xmrig
behavioral1/memory/2728-121-0x000000013F6B0000-0x000000013F9FD000-memory.dmp	xmrig
behavioral1/memory/3000-120-0x000000013FDC0000-0x000000014010D000-memory.dmp	xmrig
behavioral1/memory/2168-117-0x000000013FED0000-0x000000014021D000-memory.dmp	xmrig
behavioral1/memory/2868-116-0x000000013F9A0000-0x000000013FCED000-memory.dmp	xmrig
behavioral1/memory/2556-111-0x000000013F0B0000-0x000000013F3FD000-memory.dmp	xmrig
behavioral1/memory/2616-107-0x000000013F4A0000-0x000000013F7ED000-memory.dmp	xmrig
behavioral1/memory/2544-106-0x000000013F850000-0x000000013FB9D000-memory.dmp	xmrig
behavioral1/memory/2636-105-0x000000013F6F0000-0x000000013FA3D000-memory.dmp	xmrig
behavioral1/memory/2700-102-0x000000013FF60000-0x00000001402AD000-memory.dmp	xmrig
behavioral1/memory/2492-122-0x000000013F210000-0x000000013F55D000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2236	GfsfDGS.exe
1796	ZyQFSRk.exe
2960	opwbAGv.exe
2888	yahxJVl.exe
776	pjhUoFs.exe
2104	fJBfKpU.exe
2796	rutpOAO.exe
2140	TGyFgNS.exe
2228	UCPMTei.exe
2728	TlcYxwo.exe
2636	xPjlPaw.exe
2700	HfsvXFF.exe
2632	ZVbxvyP.exe
2616	nYvfNPX.exe
2844	bBkfojv.exe
2868	IpXeszE.exe
2544	FZJxhiq.exe
2492	XHTCiRx.exe
2556	naQYnoE.exe
3000	lYMcgbQ.exe
2168	WLrXNoH.exe

Loads dropped DLL 21 IoCs

pid	Process
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\pjhUoFs.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\yahxJVl.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\UCPMTei.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZVbxvyP.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nYvfNPX.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\IpXeszE.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZyQFSRk.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TlcYxwo.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\bBkfojv.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\XHTCiRx.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\lYMcgbQ.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WLrXNoH.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\GfsfDGS.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\opwbAGv.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\fJBfKpU.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TGyFgNS.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rutpOAO.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\xPjlPaw.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\naQYnoE.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HfsvXFF.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\FZJxhiq.exe	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2236	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 2420 wrote to memory of 2236	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 2420 wrote to memory of 2236	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	29
PID 2420 wrote to memory of 1796	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 2420 wrote to memory of 1796	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 2420 wrote to memory of 1796	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	30
PID 2420 wrote to memory of 2960	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2420 wrote to memory of 2960	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2420 wrote to memory of 2960	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2420 wrote to memory of 776	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2420 wrote to memory of 776	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2420 wrote to memory of 776	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2420 wrote to memory of 2888	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2420 wrote to memory of 2888	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2420 wrote to memory of 2888	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2420 wrote to memory of 2104	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2420 wrote to memory of 2104	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2420 wrote to memory of 2104	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2420 wrote to memory of 2140	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2420 wrote to memory of 2140	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2420 wrote to memory of 2140	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2420 wrote to memory of 2796	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2420 wrote to memory of 2796	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2420 wrote to memory of 2796	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2420 wrote to memory of 2228	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2420 wrote to memory of 2228	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2420 wrote to memory of 2228	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2420 wrote to memory of 2636	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2420 wrote to memory of 2636	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2420 wrote to memory of 2636	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2420 wrote to memory of 2728	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2420 wrote to memory of 2728	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2420 wrote to memory of 2728	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2420 wrote to memory of 2700	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2420 wrote to memory of 2700	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2420 wrote to memory of 2700	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2420 wrote to memory of 2632	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2420 wrote to memory of 2632	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2420 wrote to memory of 2632	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2420 wrote to memory of 2616	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2420 wrote to memory of 2616	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2420 wrote to memory of 2616	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2420 wrote to memory of 2844	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2420 wrote to memory of 2844	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2420 wrote to memory of 2844	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2420 wrote to memory of 2868	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2420 wrote to memory of 2868	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2420 wrote to memory of 2868	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2420 wrote to memory of 2544	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2420 wrote to memory of 2544	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2420 wrote to memory of 2544	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2420 wrote to memory of 2492	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2420 wrote to memory of 2492	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2420 wrote to memory of 2492	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2420 wrote to memory of 2556	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2420 wrote to memory of 2556	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2420 wrote to memory of 2556	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2420 wrote to memory of 3000	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2420 wrote to memory of 3000	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2420 wrote to memory of 3000	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2420 wrote to memory of 2168	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2420 wrote to memory of 2168	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2420 wrote to memory of 2168	2420	2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe	49

C:\Users\Admin\AppData\Local\Temp\2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-26_1eccbd7f69e77d6bf75c9faeb4ff4a32_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\System\GfsfDGS.exe
  C:\Windows\System\GfsfDGS.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ZyQFSRk.exe
  C:\Windows\System\ZyQFSRk.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\opwbAGv.exe
  C:\Windows\System\opwbAGv.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\pjhUoFs.exe
  C:\Windows\System\pjhUoFs.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\yahxJVl.exe
  C:\Windows\System\yahxJVl.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\fJBfKpU.exe
  C:\Windows\System\fJBfKpU.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\TGyFgNS.exe
  C:\Windows\System\TGyFgNS.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\rutpOAO.exe
  C:\Windows\System\rutpOAO.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\UCPMTei.exe
  C:\Windows\System\UCPMTei.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\xPjlPaw.exe
  C:\Windows\System\xPjlPaw.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\TlcYxwo.exe
  C:\Windows\System\TlcYxwo.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\HfsvXFF.exe
  C:\Windows\System\HfsvXFF.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\ZVbxvyP.exe
  C:\Windows\System\ZVbxvyP.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\nYvfNPX.exe
  C:\Windows\System\nYvfNPX.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\bBkfojv.exe
  C:\Windows\System\bBkfojv.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\IpXeszE.exe
  C:\Windows\System\IpXeszE.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\FZJxhiq.exe
  C:\Windows\System\FZJxhiq.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\XHTCiRx.exe
  C:\Windows\System\XHTCiRx.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\naQYnoE.exe
  C:\Windows\System\naQYnoE.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\lYMcgbQ.exe
  C:\Windows\System\lYMcgbQ.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\WLrXNoH.exe
  C:\Windows\System\WLrXNoH.exe
  2⤵
  - Executes dropped EXE
  PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FZJxhiq.exe

Filesize
5.7MB

MD5
cd253851057623e4c45e37f0d97880a8

SHA1
66399c714f7d52dad29b8fd64d387491562b1ad7

SHA256
1ee322f9f456f4babf458c2b873db626c42305a703c70abd99399b27090aa4a7

SHA512
0d7fb9fb82ae7d6988b8f809abd8eb496225a53f24f4acb385a148b1ced9ce1e7f03fc78163c25fcead37063eb4622c1a7b1407655d0371df63bbc39475c0c18

Download Submit
C:\Windows\system\HfsvXFF.exe

Filesize
5.7MB

MD5
9ada0235d09a843a0408760401a9b3b9

SHA1
d35131421ae3eb784686fef4029104ea4009a274

SHA256
aed0420315bd39c873629917bea39e559950940e3933c69de0875b451308d408

SHA512
afb5b282ca7d9959c6b8370ced112e62574aa2526cb755dee706355766d7f65a124e4d1e8f66290ea1cc2e1712ae7a3c8a225b42b714206125b9e3ee72ba88f6

Download Submit
C:\Windows\system\IpXeszE.exe

Filesize
5.7MB

MD5
392d250441ee5d22531b853dbc36338e

SHA1
23522878648464a759a457d9e528e762b5f7ef4e

SHA256
c99aa84091d41b6b52b26c39fe1d344ec4263addf5f1d75525e163ff58f047d9

SHA512
e80b0d97c841c759526cb297ac8b987308e849adaa4dd1e147bc57c697dfaa56ff1909f924d4f28ec308dedd0750b20a8bad13a6849a7fe916fc0cc23fe39bb5

Download Submit
C:\Windows\system\TGyFgNS.exe

Filesize
5.7MB

MD5
0bae94a39781c8354bf0f30bf829789c

SHA1
1d86806d16116f5a21b44021f30470dc700ec6ba

SHA256
a5afff2aff9459cc9f1300cfc9f9ba74667db68c8e5b02a9f813a1ff4c1c1f5b

SHA512
d697f725711629622c2174fddc400d840cae6af52e67ce88085fdd13455b3b0ccb07733d8ff4ca02595c00df4b9436cf0454484e62259dad5cb7a9ed71fef9f1

Download Submit
C:\Windows\system\TlcYxwo.exe

Filesize
5.7MB

MD5
72d47b45ededac96376636664932144f

SHA1
5a55b8fff6f57311f15fd4fd0ed2032a43c50c6e

SHA256
cbfbd1c9d718b90e8cc6079ee485d8656f7bbcaa9b7edf87bca36d33f2e2d319

SHA512
d068f367f68b00fc616f196a3368b1cbdb6d58fe7f94cd8d5df18f0741a4a3cd702975b1bd519321f189d67b49a7419e1e6aaaa0b17dd8911ef63520589ead26

Download Submit
C:\Windows\system\UCPMTei.exe

Filesize
5.7MB

MD5
b62ad52732fd4bde9e0940beac3f887a

SHA1
75eff777bc6acbebdb8a1a0f6f553b66281861b9

SHA256
5e2b4c6b31cdf00038145bdda6665dd0dca082f0c10a735eccd4b8e5e6e31a7f

SHA512
c63aaa05b51609dac689ac83906d0519fbeb703e62dbd138edd92efa7aac7f7d1b6b0585acbd5bde24d0f9eecf3651a554937fbf6414b65270b74f1d38123e99

Download Submit
C:\Windows\system\WLrXNoH.exe

Filesize
5.7MB

MD5
94711eb3a4751ad4d672d74d7d321613

SHA1
8bb8a155756517363fd9f6f318121cfad6bd4a4d

SHA256
41091325eb1976e149e8278d5da7427cee46775f548b51d0a90fbbb70abf811b

SHA512
3eaaa316cd6e70c421ec85d5e0a9347dcf091ebfdeeab029ff5021d877a47e0044bc36b7ddad7cdf8800382047b6954e97e1d46906d67c81439a61227013a4bb

Download Submit
C:\Windows\system\XHTCiRx.exe

Filesize
5.7MB

MD5
2d381959de28f4fd360e969fdece10ee

SHA1
871b00d7e054d59903b4dc36f05ca9b1056a4ef9

SHA256
ec30515f3ee0459690a8efab4977e4e4b2d5a3aacc2e6783efe203addb193b89

SHA512
c497ff73c0346fbd53670bf837c8474678d7487b5c9bdac5afa6e8e02225e9f70d9af5de34248a8ab33ec4a4ba3abdd27dd91890639ce0a74cf433bb30c4e324

Download Submit
C:\Windows\system\ZVbxvyP.exe

Filesize
5.7MB

MD5
f35b0e070195db707667c0b29729bfcf

SHA1
7b6e6eb2d9144f371d4b2dfaf78d9b0252c7f265

SHA256
7bb25db29dd256405dbfff9c1521e822952cb25cd3498a88cabdcd49b1d04076

SHA512
34ebc16a6cf4692918fe63064cb4e3ee8345e09feea081e22b61e3bdf416226c01f79836d553cc3a9b10705e41b0642c20da31ab1182c27b39fd3da68730556c

Download Submit
C:\Windows\system\bBkfojv.exe

Filesize
5.7MB

MD5
9ce7dfac066878a7047c66512bea4e7e

SHA1
64bb82f1b7d6a6719a09078106374d0ee46d9522

SHA256
f1cee984f32eacf761f79074efe046543b17951d9420362b0b1298191f76c910

SHA512
a91c1ec0353829d3f713859dd9f64de16e089cc5d7f9e0457d2217f06ff7378cd5309604f9443e9d7d460fc1f7036c733e788ab7b5363c36d7ebdde871cb0c84

Download Submit
C:\Windows\system\lYMcgbQ.exe

Filesize
5.7MB

MD5
be2278ee5d0ed4035f45eaa0314d23d8

SHA1
b96c9ffc9cb1e30cdb5215a1b03c2848f7eeb5c2

SHA256
2874d1a2af12639b39e1faae9ea2c12874041fc8f097f6e9b8ceae167e68ae9f

SHA512
90f045ca5bb944d0863cf608a44e68a17308e82c6bf137e5dc742e2100aae7af41534b66a2c050221cc2042a63af1e893f07696e503f4bbd8719b131f8247cf9

Download Submit
C:\Windows\system\nYvfNPX.exe

Filesize
5.7MB

MD5
1b17f47860625928d11598fc2cbcf480

SHA1
f9e317ccf04d718abe037713fa2efd97cdef00b9

SHA256
e41754c8d78fba2382d79dcfb7ecdf6e6fbe1054216b7ae1d4aaf2046586e2e6

SHA512
5a635f59d6c9a2eeb99fb38c87f5226f587a0b3be8a5917f2d4ebfb411a75b21a25e400ae67911ed0fa4d9a714e304b5707ccb22579a3f18c4c94f94c5ccd87b

Download Submit
C:\Windows\system\naQYnoE.exe

Filesize
5.7MB

MD5
db3349b6fb212fcddcff6fb97f49679d

SHA1
b9541d5b4e3438000feb1ad78f9b10f9b066ddf0

SHA256
70d23092c2a68b086c90da2b33dafaae7f25965a75a4b5ebae89c11ef2c7bbc1

SHA512
fcba85a25e0ee6886476560426e624bb0ee346c1441e6d1383e93a69399b7b86426edad5fb51015f78608828cc073b4b7492a65ecacc35d7e50e3a8cf628be16

Download Submit
C:\Windows\system\pjhUoFs.exe

Filesize
5.7MB

MD5
3cd786d246af81fde2cffc012884f616

SHA1
9c0dc7c51388183129bcfbafaab00ef3137d3577

SHA256
7f74fecdbb409e965e53c3d671f80584951fed574f2c71141c6cb40cad9beef0

SHA512
f1610bbb9b12276035acf19a604c0d6559148a9db2a961ad6396f83efd746c6d4f2df136e13f28c3899d57f15b8abc5263acf0c58809deeb99e8167fd2ffb31d

Download Submit
C:\Windows\system\rutpOAO.exe

Filesize
5.7MB

MD5
70fea896d25aadbdb8fc601f8a5a51ca

SHA1
aa510b9de6571504a57e35eb74617e2e6aef107b

SHA256
3083537ac7cb5165c96b217f528e055e2acc2c07797fca2da52a251e964fc4c6

SHA512
50d9b2b378dd6bc0f59c15b300f1c403bdca8c2a3edfff17fa09f2d2b5572779dc25a5a3dc0c73fc72715e70a55b276c2d37922a37e2ff07719cfb09570636b9

Download Submit
C:\Windows\system\xPjlPaw.exe

Filesize
5.7MB

MD5
e448d7c3aaed1131e2db84f2181f3a2e

SHA1
7bd10e7b9caeb43d9a463130623da5d29c17a645

SHA256
2be64d4f1a37aefd9e15c717e67736464c051912d79442b3c81345f02aac6257

SHA512
c3bc942a644fcf0dba89a43a93c0170b94583d24767d351b67774e7e4f6a8b0eecf5edeb8176d4dbbf306f79a1a691175a5333c4cb8da0bab03c470fd9243a40

Download Submit
C:\Windows\system\yahxJVl.exe

Filesize
5.7MB

MD5
1e2a75bc0d55f23276accda4de866ad3

SHA1
73a67b16c8ee040c4df7446ebde7d9155e3a1ff3

SHA256
f00195c62e627afcbf31630b6c0ef93ce47de7df6207ce8a5c531c5af35aead6

SHA512
00e4726ec514e01c4c7594193f56054b75ea80376231c883471a14d511162fd368dacd2f31af9f9b667a6b6be29ddefc79fbcb440b09763a2ffee79b8a1a7b26

Download Submit
\Windows\system\GfsfDGS.exe

Filesize
5.7MB

MD5
c9d9c93687a4c773c70d72f4aa9f9328

SHA1
ac1e7ecefedb391c9d9ea3d759b4baeb65f4a98b

SHA256
ff8c2a1cfaca8d9d0446625a182e8513ffb38f8fd9b14126be3688a18a8a1459

SHA512
de8dec249d7243b39e30a30c5a620c19bf4ecd9dbf1653e0ebcf5a79919b3c0c9fff7e535941e90476d2703e03085ba51fb5d35ae3cea4714e0e0817cb690e90

Download Submit
\Windows\system\ZyQFSRk.exe

Filesize
5.7MB

MD5
93d3777494b7852866255ef6e7992d70

SHA1
a600cca6acba120e5b0ccd426bfc3b4dcbb656f2

SHA256
f1a717f608c2be407b53f3bc859faa0673761d5516080a29d63ac9fd6ea33aea

SHA512
73fb0389821649bc204e26fc9a8008135625ae6c18a57a5b728c834dcc0525cc6a5380ee3cf0f3f882acdec2dec862c284db67e9b581c981ef34667e8cc5c0b2

Download Submit
\Windows\system\fJBfKpU.exe

Filesize
5.7MB

MD5
c8d45bc40574fbf3a581dff4987af1e2

SHA1
933269a4af25b53c034526a0899972f1bbbc2261

SHA256
ec6bae7e1f4eaf2bc098b180182df2b8e6f7c38ed31b98707069f8156a41195e

SHA512
98a362012d72e5037a8fcff4cb8741aebaed877196243f833cce17846c09acfb620b07a536981bf86a8ef81cd3f5c3a239658c957a7ee4ed13aee2d20dfacf1e

Download Submit
\Windows\system\opwbAGv.exe

Filesize
5.7MB

MD5
e2d26edfeef910d8a955acc36844f831

SHA1
3fbbcd0341621cbdaa850ed297b294d499a05719

SHA256
397826fe4a7838e45d1540d07d53ce764c3ebf0f30303999b22a47a30af85a98

SHA512
ec3b5898a4a81eeba3f7f9a05aa7a7e7b02bb1bc148c63181d6d4a6d343e2f5f84e296f8b711370d3103b801ec4f7d39b338d703285a1317afd11b80b36d619e

Download Submit
memory/776-29-0x000000013F580000-0x000000013F8CD000-memory.dmp

Filesize
3.3MB

Download
memory/1796-12-0x000000013F1D0000-0x000000013F51D000-memory.dmp

Filesize
3.3MB

Download
memory/2104-51-0x000000013F200000-0x000000013F54D000-memory.dmp

Filesize
3.3MB

Download
memory/2140-60-0x000000013F590000-0x000000013F8DD000-memory.dmp

Filesize
3.3MB

Download
memory/2168-117-0x000000013FED0000-0x000000014021D000-memory.dmp

Filesize
3.3MB

Download
memory/2236-6-0x000000013F780000-0x000000013FACD000-memory.dmp

Filesize
3.3MB

Download
memory/2420-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2420-0-0x000000013FE20000-0x000000014016D000-memory.dmp

Filesize
3.3MB

Download
memory/2492-122-0x000000013F210000-0x000000013F55D000-memory.dmp

Filesize
3.3MB

Download
memory/2544-106-0x000000013F850000-0x000000013FB9D000-memory.dmp

Filesize
3.3MB

Download
memory/2556-111-0x000000013F0B0000-0x000000013F3FD000-memory.dmp

Filesize
3.3MB

Download
memory/2616-107-0x000000013F4A0000-0x000000013F7ED000-memory.dmp

Filesize
3.3MB

Download
memory/2632-124-0x000000013F370000-0x000000013F6BD000-memory.dmp

Filesize
3.3MB

Download
memory/2636-105-0x000000013F6F0000-0x000000013FA3D000-memory.dmp

Filesize
3.3MB

Download
memory/2700-102-0x000000013FF60000-0x00000001402AD000-memory.dmp

Filesize
3.3MB

Download
memory/2728-121-0x000000013F6B0000-0x000000013F9FD000-memory.dmp

Filesize
3.3MB

Download
memory/2796-57-0x000000013FFF0000-0x000000014033D000-memory.dmp

Filesize
3.3MB

Download
memory/2868-116-0x000000013F9A0000-0x000000013FCED000-memory.dmp

Filesize
3.3MB

Download
memory/2888-27-0x000000013F4D0000-0x000000013F81D000-memory.dmp

Filesize
3.3MB

Download
memory/2960-25-0x000000013FCF0000-0x000000014003D000-memory.dmp

Filesize
3.3MB

Download
memory/3000-120-0x000000013FDC0000-0x000000014010D000-memory.dmp

Filesize
3.3MB

Download