cobaltstrike | 4f878fd7849a07bfaab51e16a592d776e9ac4c078db8292481c9575dab069a3e

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/01/2025, 01:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

70f9c5ef9ccc19313da60697311c63fc
SHA1

01900032928eb1f355ebddf43dfa3a602ffa6787
SHA256

4f878fd7849a07bfaab51e16a592d776e9ac4c078db8292481c9575dab069a3e
SHA512

611f95e7e9bb3c321e947947be418fa2ae9a55ce4322a46ec2c2d9579203cc02db21016c29c9da531452b923728e6987a1447c2ced5b661044dfc5a2b903b244
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUm:j+R56utgpPF8u/7m

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x0007000000012117-6.dat	cobalt_reflective_dll
behavioral1/files/0x0009000000017409-10.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000174ac-26.dat	cobalt_reflective_dll
behavioral1/files/0x000800000001748f-21.dat	cobalt_reflective_dll
behavioral1/files/0x000800000001752f-36.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000018690-48.dat	cobalt_reflective_dll
behavioral1/files/0x00080000000190d6-59.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000195e4-116.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001961b-124.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019539-113.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000194d8-108.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001947e-101.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019441-96.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019403-84.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001942f-89.dat	cobalt_reflective_dll
behavioral1/files/0x0005000000019401-78.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000193df-72.dat	cobalt_reflective_dll
behavioral1/files/0x00050000000193d9-65.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001879b-54.dat	cobalt_reflective_dll
behavioral1/files/0x000a000000018678-40.dat	cobalt_reflective_dll
behavioral1/files/0x000800000001747b-17.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral1/memory/2036-0-0x000000013F5B0000-0x000000013F8FD000-memory.dmp	xmrig
behavioral1/files/0x0007000000012117-6.dat	xmrig
behavioral1/files/0x0009000000017409-10.dat	xmrig
behavioral1/memory/3032-11-0x000000013F490000-0x000000013F7DD000-memory.dmp	xmrig
behavioral1/files/0x00070000000174ac-26.dat	xmrig
behavioral1/files/0x000800000001748f-21.dat	xmrig
behavioral1/files/0x000800000001752f-36.dat	xmrig
behavioral1/files/0x0006000000018690-48.dat	xmrig
behavioral1/files/0x00080000000190d6-59.dat	xmrig
behavioral1/memory/676-91-0x000000013FCA0000-0x000000013FFED000-memory.dmp	xmrig
behavioral1/files/0x00050000000195e4-116.dat	xmrig
behavioral1/memory/1612-125-0x000000013F450000-0x000000013F79D000-memory.dmp	xmrig
behavioral1/files/0x000500000001961b-124.dat	xmrig
behavioral1/memory/1748-121-0x000000013FCF0000-0x000000014003D000-memory.dmp	xmrig
behavioral1/memory/2928-115-0x000000013F3A0000-0x000000013F6ED000-memory.dmp	xmrig
behavioral1/files/0x0005000000019539-113.dat	xmrig
behavioral1/memory/2592-109-0x000000013F850000-0x000000013FB9D000-memory.dmp	xmrig
behavioral1/files/0x00050000000194d8-108.dat	xmrig
behavioral1/memory/2836-103-0x000000013FE40000-0x000000014018D000-memory.dmp	xmrig
behavioral1/files/0x000500000001947e-101.dat	xmrig
behavioral1/memory/1488-97-0x000000013FCB0000-0x000000013FFFD000-memory.dmp	xmrig
behavioral1/files/0x0005000000019441-96.dat	xmrig
behavioral1/memory/2196-85-0x000000013FE10000-0x000000014015D000-memory.dmp	xmrig
behavioral1/files/0x0005000000019403-84.dat	xmrig
behavioral1/files/0x000500000001942f-89.dat	xmrig
behavioral1/memory/2652-73-0x000000013FD60000-0x00000001400AD000-memory.dmp	xmrig
behavioral1/memory/1796-79-0x000000013F100000-0x000000013F44D000-memory.dmp	xmrig
behavioral1/files/0x0005000000019401-78.dat	xmrig
behavioral1/files/0x00050000000193df-72.dat	xmrig
behavioral1/memory/2608-67-0x000000013F980000-0x000000013FCCD000-memory.dmp	xmrig
behavioral1/files/0x00050000000193d9-65.dat	xmrig
behavioral1/memory/2780-61-0x000000013FC40000-0x000000013FF8D000-memory.dmp	xmrig
behavioral1/memory/2808-55-0x000000013F410000-0x000000013F75D000-memory.dmp	xmrig
behavioral1/files/0x000600000001879b-54.dat	xmrig
behavioral1/memory/2904-49-0x000000013FFA0000-0x00000001402ED000-memory.dmp	xmrig
behavioral1/memory/2752-32-0x000000013FB10000-0x000000013FE5D000-memory.dmp	xmrig
behavioral1/memory/2916-30-0x000000013F5E0000-0x000000013F92D000-memory.dmp	xmrig
behavioral1/memory/2876-43-0x000000013FB90000-0x000000013FEDD000-memory.dmp	xmrig
behavioral1/memory/2852-41-0x000000013FFC0000-0x000000014030D000-memory.dmp	xmrig
behavioral1/files/0x000a000000018678-40.dat	xmrig
behavioral1/memory/2284-25-0x000000013FCC0000-0x000000014000D000-memory.dmp	xmrig
behavioral1/memory/2348-13-0x000000013F440000-0x000000013F78D000-memory.dmp	xmrig
behavioral1/files/0x000800000001747b-17.dat	xmrig

Executes dropped EXE 21 IoCs

pid	Process
3032	pvsVTvg.exe
2348	gUwwSOB.exe
2916	kWrZmxc.exe
2284	qebXwGn.exe
2752	UCdpnun.exe
2852	sUOnues.exe
2876	Ddwgwhb.exe
2904	jEVZQbL.exe
2808	RiLcTvC.exe
2780	PeTuHbr.exe
2608	wpfUSUK.exe
2652	KRFuifj.exe
1796	xoREunf.exe
2196	WIUvkjc.exe
676	pNSnaIQ.exe
1488	nYYGsCq.exe
2836	mwdNnBW.exe
2592	yRHUOaF.exe
2928	TDwlEIZ.exe
1748	mPPBVYQ.exe
1612	SiCKvVJ.exe

Loads dropped DLL 21 IoCs

pid	Process
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\kWrZmxc.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qebXwGn.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\UCdpnun.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\PeTuHbr.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\SiCKvVJ.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\yRHUOaF.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\pvsVTvg.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\sUOnues.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\RiLcTvC.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\KRFuifj.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\pNSnaIQ.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jEVZQbL.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\xoREunf.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nYYGsCq.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mwdNnBW.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\mPPBVYQ.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\gUwwSOB.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\Ddwgwhb.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\wpfUSUK.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\WIUvkjc.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\TDwlEIZ.exe	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 3032	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2036 wrote to memory of 3032	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2036 wrote to memory of 3032	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	31
PID 2036 wrote to memory of 2348	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2036 wrote to memory of 2348	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2036 wrote to memory of 2348	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2036 wrote to memory of 2916	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2036 wrote to memory of 2916	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2036 wrote to memory of 2916	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2036 wrote to memory of 2284	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2036 wrote to memory of 2284	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2036 wrote to memory of 2284	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2036 wrote to memory of 2752	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2036 wrote to memory of 2752	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2036 wrote to memory of 2752	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2036 wrote to memory of 2852	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2036 wrote to memory of 2852	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2036 wrote to memory of 2852	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2036 wrote to memory of 2876	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2036 wrote to memory of 2876	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2036 wrote to memory of 2876	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2036 wrote to memory of 2904	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2036 wrote to memory of 2904	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2036 wrote to memory of 2904	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2036 wrote to memory of 2808	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2036 wrote to memory of 2808	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2036 wrote to memory of 2808	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2036 wrote to memory of 2780	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2036 wrote to memory of 2780	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2036 wrote to memory of 2780	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2036 wrote to memory of 2608	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2036 wrote to memory of 2608	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2036 wrote to memory of 2608	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2036 wrote to memory of 2652	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2036 wrote to memory of 2652	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2036 wrote to memory of 2652	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2036 wrote to memory of 1796	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2036 wrote to memory of 1796	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2036 wrote to memory of 1796	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2036 wrote to memory of 2196	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2036 wrote to memory of 2196	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2036 wrote to memory of 2196	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2036 wrote to memory of 676	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2036 wrote to memory of 676	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2036 wrote to memory of 676	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2036 wrote to memory of 1488	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2036 wrote to memory of 1488	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2036 wrote to memory of 1488	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2036 wrote to memory of 2836	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2036 wrote to memory of 2836	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2036 wrote to memory of 2836	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2036 wrote to memory of 2592	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2036 wrote to memory of 2592	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2036 wrote to memory of 2592	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2036 wrote to memory of 2928	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2036 wrote to memory of 2928	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2036 wrote to memory of 2928	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2036 wrote to memory of 1748	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2036 wrote to memory of 1748	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2036 wrote to memory of 1748	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2036 wrote to memory of 1612	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2036 wrote to memory of 1612	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2036 wrote to memory of 1612	2036	2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe	51

C:\Users\Admin\AppData\Local\Temp\2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-26_70f9c5ef9ccc19313da60697311c63fc_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\System\pvsVTvg.exe
  C:\Windows\System\pvsVTvg.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\gUwwSOB.exe
  C:\Windows\System\gUwwSOB.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\kWrZmxc.exe
  C:\Windows\System\kWrZmxc.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\qebXwGn.exe
  C:\Windows\System\qebXwGn.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\UCdpnun.exe
  C:\Windows\System\UCdpnun.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\sUOnues.exe
  C:\Windows\System\sUOnues.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\Ddwgwhb.exe
  C:\Windows\System\Ddwgwhb.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\jEVZQbL.exe
  C:\Windows\System\jEVZQbL.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\RiLcTvC.exe
  C:\Windows\System\RiLcTvC.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\PeTuHbr.exe
  C:\Windows\System\PeTuHbr.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\wpfUSUK.exe
  C:\Windows\System\wpfUSUK.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\KRFuifj.exe
  C:\Windows\System\KRFuifj.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\xoREunf.exe
  C:\Windows\System\xoREunf.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\WIUvkjc.exe
  C:\Windows\System\WIUvkjc.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\pNSnaIQ.exe
  C:\Windows\System\pNSnaIQ.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\nYYGsCq.exe
  C:\Windows\System\nYYGsCq.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\mwdNnBW.exe
  C:\Windows\System\mwdNnBW.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\yRHUOaF.exe
  C:\Windows\System\yRHUOaF.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\TDwlEIZ.exe
  C:\Windows\System\TDwlEIZ.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\mPPBVYQ.exe
  C:\Windows\System\mPPBVYQ.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\SiCKvVJ.exe
  C:\Windows\System\SiCKvVJ.exe
  2⤵
  - Executes dropped EXE
  PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\Ddwgwhb.exe

Filesize
5.7MB

MD5
7eea702efd9b43253e8af091298d058b

SHA1
15726c8a8f7482e796a0d8bbb041a129ba88d7ca

SHA256
b98674bbedb0b910fd1866d059464abfcaf2f351513dd2e189ef7325744e8571

SHA512
c66eab75aeec3cb8998b4e11e451f89cda4dd9feffd6eaccd26dd289abd2e7a418a2f780e6a63be5593c3ba61b800c443e6b65fdab113de7a3bb219828b664ce

Download Submit
C:\Windows\system\KRFuifj.exe

Filesize
5.7MB

MD5
054b219d2546c6b2cbda767c254ff4cd

SHA1
1372974bcdda53a12c6fda8ec72a8df40cbfa424

SHA256
653edc7293d06e59015936a285bfa59881e134a8693dd688f4ac123bd80a0b25

SHA512
c8fea0bcaab6aa083380c4948a6660f55a52508f4cc86894c77cebfcf7433b5913ae8f4a991078e8322fce9a41acc7eba0dc7054422ed7d0efd87d0ef0ab0cb2

Download Submit
C:\Windows\system\PeTuHbr.exe

Filesize
5.7MB

MD5
062a29710e8e979b7f3dbd031183b501

SHA1
1326fe43a6f1abc5029228ed9fa0c863277c6274

SHA256
11dfabb9ded6a21511c83336846cc7611b91a1dace66ae2d8b76608fb9deb48f

SHA512
51b2c730b7dab78beda8fa80f64f4d25a5cdfea112a51f7f16d6c81329707be3d7420e4f53a3ad9e762e5f0980ab6c3c0c25f95995bdc033509031ccf7a13244

Download Submit
C:\Windows\system\RiLcTvC.exe

Filesize
5.7MB

MD5
a7e7afac5d3998ffb596a28fd4ae982d

SHA1
f81fa76ed0cccb0b02011f2e56e968b50f18a985

SHA256
a8d68c144e02dbf08e87a751c99689fa489b241ba7bb5c416278f9a10a258e46

SHA512
a64d65f39bd76a851190995bdae7c383a33201c02ba102b7681758e785466a087a61dc3f292c01cf6208c14719214ca3859ac605a37dbce08e7dbfbad0956085

Download Submit
C:\Windows\system\SiCKvVJ.exe

Filesize
5.7MB

MD5
9793f8e723ef334aa361f5673643fb53

SHA1
172df2cbc818a309a2b58e0b8b21ecaa0d7a7143

SHA256
49115f220e34390bae2379d04420389b9b51b242e456178114fe6d4ae8e36674

SHA512
8410f2915a1dbbc534f59c08e7bc1c9e3c879fd1eceb180d9867c48dd5470dfbb07bf142f68d6d97772def77ae958f5fee79a58576c799c005966baeba1b3f2d

Download Submit
C:\Windows\system\TDwlEIZ.exe

Filesize
5.7MB

MD5
dcb5d42e3dce1bdcc1df292dd84f375e

SHA1
05ba063cfe0546d8ee7a2c2d34870071ce0fc1e7

SHA256
c694c544f477f3343357f61c9cde4e58a2fade2efd3d1a4dfbb1675faf1dc656

SHA512
82dc0d80480efdde74b3ee34a3de1af1d4455c5fd584a20f66458b4ae367f0e5971944e2e96e3cce40c2afdbf3add5751ce85ac746f1647e0b431b9ee87b0a18

Download Submit
C:\Windows\system\UCdpnun.exe

Filesize
5.7MB

MD5
449011c8d12e1df233c568d7688e03a4

SHA1
e4d87ebf316a7fd3b34c6fd48adb5334fb0e0c15

SHA256
2b5ee2e8c3823750e27a8d039f4398dbe9ead2f3828cc410c67ffe2bf724fe0f

SHA512
ae3edc471d7bb1f3b1acd909c7a910d175ed3a00a8fcfb99a8f903f695c31f5830497d552dc8792686205a920b692f074587e9187d044c06d32f006f5e0d3036

Download Submit
C:\Windows\system\WIUvkjc.exe

Filesize
5.7MB

MD5
b7fe09c0b7e060bce34cf72ff91985c7

SHA1
fb11962d8275a4cb8c9ffe85e56b8af734b52cda

SHA256
8f359f35967b933378ee79f8f74f7c93e734c11194087572587184f6ba290b08

SHA512
4db89a70090697a78c782bdcfd2dc13a794df234ae8428cae7c531a1e54ff5961f0fddc6569e7d132b713163268d7228027d0409f345e036343cd21e7b2df1fa

Download Submit
C:\Windows\system\gUwwSOB.exe

Filesize
5.7MB

MD5
9d571259fe0beb56b6b8c0f2a914f427

SHA1
e4ef887c7fa7c0168096e53390a8bf2ebac4a4bd

SHA256
9ec1bbc3100cc2d7f9f154eefd239f49c9b1562ac4dadd7839534dad7e2349aa

SHA512
86573e4e1dae89f223395e10f9cc89b2f266cce46e204e979a8cee26cabed75b87516b14d5f02d201844c54805136807aafcf98ce4e02f09ecbe365a8f758254

Download Submit
C:\Windows\system\jEVZQbL.exe

Filesize
5.7MB

MD5
c2790bc7dd28172a2a471b17a96f27dd

SHA1
bd519989f97fa034d23c3165b80c9a30b89d9c26

SHA256
0263e84aaf773b1050d4a3a155d43b0b552f3cb3d6069cb1fa0823ba9cab93cd

SHA512
fecf2ab122a74bb07119b1425e4df888bc32125bcbba9d9bb26299dc6e14d40dcedc15219c469293177c8214b85ad9afa90bb72e453323ef852437fcda815a2b

Download Submit
C:\Windows\system\kWrZmxc.exe

Filesize
5.7MB

MD5
5c02ac31468d49c6ea0acb1d8fde71f3

SHA1
a9422ebe607872ed33bb00a4c078a524c51938fc

SHA256
9a79a8d7dce7fa8562e82b596d8f325c43a74eba14e466eec4f45897f316b62d

SHA512
ca86c111a764365d7fd05920cc00e5e9b7faac93864f6f26622d08d5d7342e1c96378f5e2b3c77c5d3bd9bdaa6cdcc51a17c6fdf024da07d7011b0fe3a33e162

Download Submit
C:\Windows\system\mwdNnBW.exe

Filesize
5.7MB

MD5
fe0f29a1cf1546479ac9d56e72f071bb

SHA1
4fa2b7f4c858e86c56fbef0513353403fbb6f8a2

SHA256
1af71dde6889470673f10f3a280a28ee160985f00914cd307a362a957e2f02b1

SHA512
453aef90509655d74af0546eb5f6177e8052753cd88ab9c2e06f0bc0aedb19f0a40db0dd8ffdfe1e01d5cfd3230f389f8d8d4d4fe1cd5fd7dbf730f4b9b15eec

Download Submit
C:\Windows\system\nYYGsCq.exe

Filesize
5.7MB

MD5
137499889d72e697605188f1a1777ed7

SHA1
4fe7a1582951b6dc8a5e37606df57f3049c0b2c4

SHA256
c7af1473edfc054b26012c88ea668c5b87481722abb830c127c14e526de4207c

SHA512
203ac863fd7da667bf422dd23197b00f06ae93fb746376b596d027d89c1f2edf3783355b3ed8572b3f66add1503658ca5d9c8db9c14711d574325c402955979d

Download Submit
C:\Windows\system\pNSnaIQ.exe

Filesize
5.7MB

MD5
5309a01ed564b3433593aada4b5d51c1

SHA1
2a93e9a45d17eed06002fd61f5f70dcc01518e94

SHA256
29f8c0b9b44353e2fb3724c30bea28a9d53323ea5594cca4033a4eef6433532f

SHA512
c7b8e2b5291f3457d9edbf73e2c56de6dff2f74318bda60b34a80dad4a4789b1f4590e3f9c3bf22215d6db9705541ca0f763a14146b45a8f726cdbbc58960903

Download Submit
C:\Windows\system\pvsVTvg.exe

Filesize
5.7MB

MD5
973e4e7572d24c9b2306d59505834ba9

SHA1
717cc49159fb2228b978c4aa62ae1f8fb44fcf46

SHA256
615de99b918cc57b8b5558be15206c3818c8dfd076418b0fec5bea6833cd135b

SHA512
462682dd6952321db6b2d8dd287ed540c83caca2008b3d301f75735336edc99e26259e2d19f57d782e13eee18bfcb1336cbee4b594f7c8aa317f54efac8f50dc

Download Submit
C:\Windows\system\qebXwGn.exe

Filesize
5.7MB

MD5
2d0d463625cb9c77fea9148a57ae22fc

SHA1
3fa7f66dfa54a250cfa1e9ec0e664d046bc09967

SHA256
8b68211dba5ee97d5dfe285926fb71267ff1f9550df976fdd72264c4a24684ea

SHA512
7efd56ea2c11872ce2e150ee4097b777c9dd734d39ca2970b16374736140b9cf99082c73cb750740e5594ad57431f7e23e19a3b3ce46b8612359814c6141ecb0

Download Submit
C:\Windows\system\sUOnues.exe

Filesize
5.7MB

MD5
65345a354ef0e97f4e8950928075a43f

SHA1
b7bede0780a166f08792e92a6ac57ba52e4d6503

SHA256
2eba7026c05afb956e690649e6c4af0c698ae31a9432dc12dd279ecba2ea8710

SHA512
65098197f06719526c8bfca7af2d0c37143971ff29637bffdc0b698f8d167466d8df41823eaa30ac3c71144f4d8a41f5119238d5d52a0b54b5b6f6be067e90d5

Download Submit
C:\Windows\system\wpfUSUK.exe

Filesize
5.7MB

MD5
8c583ebf9a2268a44c3d7ca0b4f7fbeb

SHA1
6fe6aa3e93f1d7d97367a556e7da86f24b35f1e6

SHA256
bf969251fdf827995943d5f413b77ea3101ff738c77d05e955c11233dd98b8bd

SHA512
8796f3f8d4b8ea15cae732939708615cfc8568346d9c06f15f21fe59f70b2244fec66bdd48b52f47c630d9e50714a0e63bb2b241aeb24feac98d0729ea62c6ab

Download Submit
C:\Windows\system\xoREunf.exe

Filesize
5.7MB

MD5
74a339830b49be8cc0927444a28a402b

SHA1
18ce61c61b90bc4fdcae1433eb38bad88f76c378

SHA256
b3bb3bae3458f052637dc586a30005352a1a0d37f6da7465b268c1264f4bc721

SHA512
d41a344c1a4692b5db3a32379566403d95a2abe4373e321cea870394d02c72589319428eb59e8a1cfe03fb9e8aee7c0c1adfc2460c807fd1f2988016b5dc20fe

Download Submit
C:\Windows\system\yRHUOaF.exe

Filesize
5.7MB

MD5
a9be803688ffea429d77bc7d86ba446c

SHA1
415e369ad1b84b01b5587fd8af8ae94fc2c74f81

SHA256
bd3107b5fac1b6f340105629c879516ccec74a9d89247f87f29564dc30e89e98

SHA512
4828ec58d9955ea13f3c764ad6b0b063756990ef1f2e4b53d071600e556496e7e03d15669b77d87e5a2a37a87b8539b2a60c7de41828e6fc230d00305c1ebc65

Download Submit
\Windows\system\mPPBVYQ.exe

Filesize
5.7MB

MD5
57821b6076ac05f3e005a878e0f68168

SHA1
749e6a7eae50cdd2b54e7ed8bc972e8af2ef4cb7

SHA256
d01ddbe2dab18c3a57c8cd1eef113305628225fe3823ac6b4e3a4c8d5ffdb133

SHA512
8bd8d30c038d2bee7a82a7a8c8886addbefe97f3a0eb8af065fa2c5efca761a73fc59303453e1321fbe657837413ae10f6c99b302c3fcbd98d6b28d277bff592

Download Submit
memory/676-91-0x000000013FCA0000-0x000000013FFED000-memory.dmp

Filesize
3.3MB

Download
memory/1488-97-0x000000013FCB0000-0x000000013FFFD000-memory.dmp

Filesize
3.3MB

Download
memory/1612-125-0x000000013F450000-0x000000013F79D000-memory.dmp

Filesize
3.3MB

Download
memory/1748-121-0x000000013FCF0000-0x000000014003D000-memory.dmp

Filesize
3.3MB

Download
memory/1796-79-0x000000013F100000-0x000000013F44D000-memory.dmp

Filesize
3.3MB

Download
memory/2036-0-0x000000013F5B0000-0x000000013F8FD000-memory.dmp

Filesize
3.3MB

Download
memory/2036-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2196-85-0x000000013FE10000-0x000000014015D000-memory.dmp

Filesize
3.3MB

Download
memory/2284-25-0x000000013FCC0000-0x000000014000D000-memory.dmp

Filesize
3.3MB

Download
memory/2348-13-0x000000013F440000-0x000000013F78D000-memory.dmp

Filesize
3.3MB

Download
memory/2592-109-0x000000013F850000-0x000000013FB9D000-memory.dmp

Filesize
3.3MB

Download
memory/2608-67-0x000000013F980000-0x000000013FCCD000-memory.dmp

Filesize
3.3MB

Download
memory/2652-73-0x000000013FD60000-0x00000001400AD000-memory.dmp

Filesize
3.3MB

Download
memory/2752-32-0x000000013FB10000-0x000000013FE5D000-memory.dmp

Filesize
3.3MB

Download
memory/2780-61-0x000000013FC40000-0x000000013FF8D000-memory.dmp

Filesize
3.3MB

Download
memory/2808-55-0x000000013F410000-0x000000013F75D000-memory.dmp

Filesize
3.3MB

Download
memory/2836-103-0x000000013FE40000-0x000000014018D000-memory.dmp

Filesize
3.3MB

Download
memory/2852-41-0x000000013FFC0000-0x000000014030D000-memory.dmp

Filesize
3.3MB

Download
memory/2876-43-0x000000013FB90000-0x000000013FEDD000-memory.dmp

Filesize
3.3MB

Download
memory/2904-49-0x000000013FFA0000-0x00000001402ED000-memory.dmp

Filesize
3.3MB

Download
memory/2916-30-0x000000013F5E0000-0x000000013F92D000-memory.dmp

Filesize
3.3MB

Download
memory/2928-115-0x000000013F3A0000-0x000000013F6ED000-memory.dmp

Filesize
3.3MB

Download
memory/3032-11-0x000000013F490000-0x000000013F7DD000-memory.dmp

Filesize
3.3MB

Download