cobaltstrike | 5bf2337368b2bbecdfe055fb8b94f5e20f04214225ece2d0888c440a69092173

Analysis

max time kernel
134s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 01:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
Size

5.7MB
MD5

02d1e04d585de5c4c4e07510af599583
SHA1

1d12a44d9e059db91801000cf89df0d328e1f5cc
SHA256

5bf2337368b2bbecdfe055fb8b94f5e20f04214225ece2d0888c440a69092173
SHA512

df4b91113b1322eebb15df14e513f90acf13f7861a8e6e341423b7844bc27dba21bbb58826d29dfed9fceaf9cbb2dfb2e5f78c81c7cc2ce1567d428eff1b2cdf
SSDEEP

98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lU2:j+R56utgpPF8u/72

Score

10^/10

cobaltstrike xmrig 0 backdoor miner trojan

Malware Config

Extracted

Family

cobaltstrike

Botnet

http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books

Attributes

access_type
512
beacon_type
256
create_remote_thread
768
crypto_scheme
256
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
http_method1
GET
http_method2
POST
maxdns
255
pipe_name
\\%s\pipe\msagent_%x
polling_time
5000
port_number
443
sc_process32
%windir%\syswow64\rundll32.exe
sc_process64
%windir%\sysnative\rundll32.exe
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
unknown1
4096
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
uri
/N4215/adj/amzn.us.sr.aps
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
watermark
0

Signatures

Cobalt Strike reflective loader 21 IoCs

Detects the reflective loader used by Cobalt Strike.

resource	yara_rule
behavioral1/files/0x000b000000012259-3.dat	cobalt_reflective_dll
behavioral1/files/0x000700000001925c-8.dat	cobalt_reflective_dll
behavioral1/files/0x0007000000019273-10.dat	cobalt_reflective_dll
behavioral1/files/0x00070000000192f0-20.dat	cobalt_reflective_dll
behavioral1/files/0x000600000001933e-26.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000019346-35.dat	cobalt_reflective_dll
behavioral1/files/0x0006000000019384-38.dat	cobalt_reflective_dll
behavioral1/files/0x00080000000193af-45.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a41c-53.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a41d-57.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a455-64.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a486-76.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a48a-80.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a478-72.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a497-84.dat	cobalt_reflective_dll
behavioral1/files/0x0008000000019228-115.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a4a8-117.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a4a2-110.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a4a0-108.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a477-68.dat	cobalt_reflective_dll
behavioral1/files/0x000500000001a41e-60.dat	cobalt_reflective_dll

Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike
Cobaltstrike family
cobaltstrike
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 43 IoCs

miner

resource	yara_rule
behavioral1/memory/2244-0-0x000000013F440000-0x000000013F78D000-memory.dmp	xmrig
behavioral1/files/0x000b000000012259-3.dat	xmrig
behavioral1/files/0x000700000001925c-8.dat	xmrig
behavioral1/memory/2344-12-0x000000013F4B0000-0x000000013F7FD000-memory.dmp	xmrig
behavioral1/files/0x0007000000019273-10.dat	xmrig
behavioral1/files/0x00070000000192f0-20.dat	xmrig
behavioral1/memory/2252-18-0x000000013FB20000-0x000000013FE6D000-memory.dmp	xmrig
behavioral1/files/0x000600000001933e-26.dat	xmrig
behavioral1/memory/1868-25-0x000000013F690000-0x000000013F9DD000-memory.dmp	xmrig
behavioral1/memory/2336-7-0x000000013FB90000-0x000000013FEDD000-memory.dmp	xmrig
behavioral1/files/0x0006000000019346-35.dat	xmrig
behavioral1/memory/2648-31-0x000000013F5F0000-0x000000013F93D000-memory.dmp	xmrig
behavioral1/memory/2744-37-0x000000013F910000-0x000000013FC5D000-memory.dmp	xmrig
behavioral1/files/0x0006000000019384-38.dat	xmrig
behavioral1/files/0x00080000000193af-45.dat	xmrig
behavioral1/files/0x000500000001a41c-53.dat	xmrig
behavioral1/files/0x000500000001a41d-57.dat	xmrig
behavioral1/files/0x000500000001a455-64.dat	xmrig
behavioral1/files/0x000500000001a486-76.dat	xmrig
behavioral1/files/0x000500000001a48a-80.dat	xmrig
behavioral1/files/0x000500000001a478-72.dat	xmrig
behavioral1/files/0x000500000001a497-84.dat	xmrig
behavioral1/memory/1644-109-0x000000013FBC0000-0x000000013FF0D000-memory.dmp	xmrig
behavioral1/files/0x0008000000019228-115.dat	xmrig
behavioral1/memory/3008-99-0x000000013F3F0000-0x000000013F73D000-memory.dmp	xmrig
behavioral1/files/0x000500000001a4a8-117.dat	xmrig
behavioral1/files/0x000500000001a4a2-110.dat	xmrig
behavioral1/memory/2616-98-0x000000013F480000-0x000000013F7CD000-memory.dmp	xmrig
behavioral1/memory/2596-97-0x000000013FA40000-0x000000013FD8D000-memory.dmp	xmrig
behavioral1/memory/2728-96-0x000000013FE60000-0x00000001401AD000-memory.dmp	xmrig
behavioral1/memory/2236-95-0x000000013FC90000-0x000000013FFDD000-memory.dmp	xmrig
behavioral1/memory/2996-90-0x000000013F820000-0x000000013FB6D000-memory.dmp	xmrig
behavioral1/memory/2556-89-0x000000013F650000-0x000000013F99D000-memory.dmp	xmrig
behavioral1/memory/2676-88-0x000000013F0F0000-0x000000013F43D000-memory.dmp	xmrig
behavioral1/memory/2576-87-0x000000013FDA0000-0x00000001400ED000-memory.dmp	xmrig
behavioral1/files/0x000500000001a4a0-108.dat	xmrig
behavioral1/memory/2284-124-0x000000013F230000-0x000000013F57D000-memory.dmp	xmrig
behavioral1/memory/1208-122-0x000000013FD70000-0x00000001400BD000-memory.dmp	xmrig
behavioral1/memory/2352-121-0x000000013F5D0000-0x000000013F91D000-memory.dmp	xmrig
behavioral1/files/0x000500000001a477-68.dat	xmrig
behavioral1/files/0x000500000001a41e-60.dat	xmrig
behavioral1/memory/2796-48-0x000000013F630000-0x000000013F97D000-memory.dmp	xmrig
behavioral1/memory/2804-46-0x000000013F8F0000-0x000000013FC3D000-memory.dmp	xmrig

Executes dropped EXE 21 IoCs

pid	Process
2336	vVmOjhS.exe
2344	HTonPec.exe
2252	FvniTFB.exe
1868	JAPFMOR.exe
2648	fHqOlQz.exe
2744	eLRpBJz.exe
2804	DZKuwhl.exe
2796	ZnmidoF.exe
2236	VqkILGl.exe
2576	jULzDUy.exe
2728	nXTyWcM.exe
2676	FgQVcrQ.exe
2596	rUatLqf.exe
2556	VbZyzBE.exe
2616	AdFWMjl.exe
2996	qlSSCLU.exe
3008	rmtndFe.exe
1644	cNfawfi.exe
1208	THvKZNb.exe
2352	UZmJnoO.exe
2284	XNprEHh.exe

Loads dropped DLL 21 IoCs

pid	Process
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\System\fHqOlQz.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\DZKuwhl.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\nXTyWcM.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rmtndFe.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\UZmJnoO.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\HTonPec.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\JAPFMOR.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\ZnmidoF.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\VqkILGl.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\jULzDUy.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\AdFWMjl.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\qlSSCLU.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\vVmOjhS.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\FvniTFB.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\rUatLqf.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\VbZyzBE.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\cNfawfi.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\THvKZNb.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\XNprEHh.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\eLRpBJz.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
File created	C:\Windows\System\FgQVcrQ.exe	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
Token: SeLockMemoryPrivilege	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2336	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2244 wrote to memory of 2336	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2244 wrote to memory of 2336	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	32
PID 2244 wrote to memory of 2344	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2244 wrote to memory of 2344	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2244 wrote to memory of 2344	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	33
PID 2244 wrote to memory of 2252	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2244 wrote to memory of 2252	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2244 wrote to memory of 2252	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	34
PID 2244 wrote to memory of 1868	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2244 wrote to memory of 1868	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2244 wrote to memory of 1868	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	35
PID 2244 wrote to memory of 2648	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2244 wrote to memory of 2648	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2244 wrote to memory of 2648	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	36
PID 2244 wrote to memory of 2744	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2244 wrote to memory of 2744	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2244 wrote to memory of 2744	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	37
PID 2244 wrote to memory of 2804	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2244 wrote to memory of 2804	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2244 wrote to memory of 2804	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	38
PID 2244 wrote to memory of 2796	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2244 wrote to memory of 2796	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2244 wrote to memory of 2796	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	39
PID 2244 wrote to memory of 2236	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2244 wrote to memory of 2236	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2244 wrote to memory of 2236	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	40
PID 2244 wrote to memory of 2576	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2244 wrote to memory of 2576	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2244 wrote to memory of 2576	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	41
PID 2244 wrote to memory of 2728	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2244 wrote to memory of 2728	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2244 wrote to memory of 2728	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	42
PID 2244 wrote to memory of 2676	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2244 wrote to memory of 2676	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2244 wrote to memory of 2676	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	43
PID 2244 wrote to memory of 2596	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2244 wrote to memory of 2596	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2244 wrote to memory of 2596	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	44
PID 2244 wrote to memory of 2556	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2244 wrote to memory of 2556	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2244 wrote to memory of 2556	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	45
PID 2244 wrote to memory of 2616	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2244 wrote to memory of 2616	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2244 wrote to memory of 2616	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	46
PID 2244 wrote to memory of 2996	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2244 wrote to memory of 2996	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2244 wrote to memory of 2996	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	47
PID 2244 wrote to memory of 3008	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2244 wrote to memory of 3008	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2244 wrote to memory of 3008	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	48
PID 2244 wrote to memory of 1644	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2244 wrote to memory of 1644	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2244 wrote to memory of 1644	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	49
PID 2244 wrote to memory of 2352	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2244 wrote to memory of 2352	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2244 wrote to memory of 2352	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	50
PID 2244 wrote to memory of 1208	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2244 wrote to memory of 1208	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2244 wrote to memory of 1208	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	51
PID 2244 wrote to memory of 2284	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	52
PID 2244 wrote to memory of 2284	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	52
PID 2244 wrote to memory of 2284	2244	2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe	52

C:\Users\Admin\AppData\Local\Temp\2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2025-01-28_02d1e04d585de5c4c4e07510af599583_cobalt-strike_cobaltstrike_poet-rat.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\System\vVmOjhS.exe
  C:\Windows\System\vVmOjhS.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\HTonPec.exe
  C:\Windows\System\HTonPec.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\FvniTFB.exe
  C:\Windows\System\FvniTFB.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\JAPFMOR.exe
  C:\Windows\System\JAPFMOR.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\fHqOlQz.exe
  C:\Windows\System\fHqOlQz.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\eLRpBJz.exe
  C:\Windows\System\eLRpBJz.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\DZKuwhl.exe
  C:\Windows\System\DZKuwhl.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\ZnmidoF.exe
  C:\Windows\System\ZnmidoF.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\VqkILGl.exe
  C:\Windows\System\VqkILGl.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\jULzDUy.exe
  C:\Windows\System\jULzDUy.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\nXTyWcM.exe
  C:\Windows\System\nXTyWcM.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\FgQVcrQ.exe
  C:\Windows\System\FgQVcrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\rUatLqf.exe
  C:\Windows\System\rUatLqf.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\VbZyzBE.exe
  C:\Windows\System\VbZyzBE.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\AdFWMjl.exe
  C:\Windows\System\AdFWMjl.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\qlSSCLU.exe
  C:\Windows\System\qlSSCLU.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\rmtndFe.exe
  C:\Windows\System\rmtndFe.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\cNfawfi.exe
  C:\Windows\System\cNfawfi.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\UZmJnoO.exe
  C:\Windows\System\UZmJnoO.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\THvKZNb.exe
  C:\Windows\System\THvKZNb.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\XNprEHh.exe
  C:\Windows\System\XNprEHh.exe
  2⤵
  - Executes dropped EXE
  PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AdFWMjl.exe

Filesize
5.7MB

MD5
d9fb1452b49a756dfbfa336e6400cbb5

SHA1
c82012b377e3db816c2501ba5b9281481dd8c282

SHA256
698b45d0df0884f91b080ef534f3c04f837363c52d230422efbee1062f30ced0

SHA512
1f94dddecc3f25fdb4220bd55af18aec08846b4765ac1cbc7af6386742523f306010ca549316d998ac56017c14d5db1764b5fc345e2a53ecea3c02e567b24dc9

Download Submit
C:\Windows\system\FgQVcrQ.exe

Filesize
5.7MB

MD5
4af74d8277f642f437edc4eb051868d2

SHA1
7cf5c0de53f8fa21f71bbd2f5b499df50b0480b8

SHA256
f20eec03f6e17ac4c4dddd24a67774bfdb5ab1e4dbd6d0fa43d3a3b658703643

SHA512
77d2d0af98117711d6dbf943e270a33623d3a470bd02650a5b9c49c89413fae193acff3c25d90e122bd9dd24deb5c4af012db142526cad9dae20944f2b27fa56

Download Submit
C:\Windows\system\FvniTFB.exe

Filesize
5.7MB

MD5
52b8ee701d8161c90d0151fc7d4b1f6d

SHA1
30fc84f8c41313ba7b5f1d6d291135f29339604b

SHA256
15bc4c16e20d5c192f761f069da8e5efd8aafc7029bb8904db8e75e703953357

SHA512
88ffe1f63ca7480ae76112ac6a5f4a69626bc61472101adfd027ff673025644caf610c430e253f338704390106151982f83003d472c151cc97420a2cbea9061e

Download Submit
C:\Windows\system\THvKZNb.exe

Filesize
5.7MB

MD5
4b68a8ecf28e616963e66d93a8badf98

SHA1
8336275e6c679529af1cbc59a27927ecba3648cc

SHA256
1fe5efd53c900e105129484680f654155773ae50ceade29fb973d72fd55763c8

SHA512
5940cd72946f9e0d4ba16a503888a26999a7219704a0b0122a66e115ba894a955934a8b623cd0806f27a73e4b6614a8d5fa4f18f5feb667e85d916d569f947d8

Download Submit
C:\Windows\system\VbZyzBE.exe

Filesize
5.7MB

MD5
ad9d6a91409f5b9d32a4ab630e571884

SHA1
6ce487161704bd728f9c7013794e3b5cbaa287c1

SHA256
94792b090cf99b612edd9b56dc9dbff9fd5617982ac705a1e013baa0154032c1

SHA512
2c72a11be2c17dadbf6151acc8a1d3de5a2d3f4c96f86ce32c9193bb9869f4c6672cf532392046aaf7c45ac037e92f6922436e44095d19b0d61328cfa8759bfb

Download Submit
C:\Windows\system\VqkILGl.exe

Filesize
5.7MB

MD5
75acc104c5fa1d99e70ba45c1be4f851

SHA1
ae9f96af196a689873f7385936fd238c32f2ef92

SHA256
64ee5202be5b33e88ccdbf3dcd0c230e33d230b832e9023cde9f6fa123c627f8

SHA512
7dd25d89624eb56de6eb1eaa0d92e741162778be862ef7391bbb79ea99837b9c0a80ce980afde30a6492e558c3d9c331061b55f8fbbaae5e64af3ad13b50c8b3

Download Submit
C:\Windows\system\ZnmidoF.exe

Filesize
5.7MB

MD5
a6c1024808cec585537c0eeea4c53130

SHA1
6d080a21fc4d84d3bc42b356b4717b9d72f91bf7

SHA256
b455b1b5a56f1878aa8b18a99d97005ff0d2093ff25670f88712ca097b4dcf2f

SHA512
90525ca0ef30c0609849638d933e7df0037a99040df1ca119f6d91f554240bdcca8dfb091564c7b68aa4d047b1f3906aff0322d445944a691c68bb44c4792673

Download Submit
C:\Windows\system\cNfawfi.exe

Filesize
5.7MB

MD5
291a76405a3c620c9e1147f9fc9657bc

SHA1
9f285ccdd06e5ccc51697aeefa1f473bfecf8067

SHA256
4e271b62a768d20f1417a929881ad948334bd819c03041d412b6a541ff2f0bbf

SHA512
4436a4c21541444b5f519e4ff5128926cf0c7d2a5c3e4bc7fafa6863c03f25651f1ae825f7cb6b6df8e7bcad9a6cc1671f941b5d980608911c75c2b5f244474e

Download Submit
C:\Windows\system\eLRpBJz.exe

Filesize
5.7MB

MD5
22d9b6f5f72210cb3d97119c94723823

SHA1
ed33b6f538911b8d2cd37c56273003dd262ba060

SHA256
271869f722ff333de7fc87cabbf2cbe7bce1bec4eeb4878caedb377d6af6b9ed

SHA512
86ff209d4c1cd02ab021fc4ce08d186c30911c2d4173bf1c510c9e799bc9010410bdd01b124f61f8cbab551081b80d3155beac017df8dbd500e92cb805ea1fd3

Download Submit
C:\Windows\system\jULzDUy.exe

Filesize
5.7MB

MD5
a637d08655da0bf0a2b04e60bbef4095

SHA1
47f07a1d25f0aa480fd0e5d5c688e678492e3f59

SHA256
1ca2746ffe639985957c36ff008bb8ff3a8bbb60e3c31c51b9c34405a80c1703

SHA512
a130ec1bd5919dcb5943f6a05b890cdd75830123f66326328e03e802be02ae4a59af33535fc9b5ee4b9a8eccc64dcfcfd7e6708195f3d3a44a97a3fcef3ca34f

Download Submit
C:\Windows\system\nXTyWcM.exe

Filesize
5.7MB

MD5
49b0b173b9107550dfd86fb2edfbb952

SHA1
9afab7ee821b5639eb3374db4d60cf500a57051a

SHA256
e238f62f392d231603593daba186d6721e1d43d89811fea305f6c8fdf46ff302

SHA512
0a1f460c17771e40e0b2291ad90385203817382beda67f8fab3058e990cfc6003282e6661136cc99aab7167e6a86cbd8c8a0a17db0577aeda14152d5184a2300

Download Submit
C:\Windows\system\qlSSCLU.exe

Filesize
5.7MB

MD5
9dbfaa0732a096e2a5ab0096b06707c8

SHA1
8927f5b719eb1805140c12ed2b6399d4aae7d808

SHA256
da5907b13b69889e7f5fe5ddd6997d46bc9767d75f8874298dc59fe640720293

SHA512
4e0577773caf5d10adb886a3a4ca56e1bdd3d083124ac3b7aa1a6b14599418df8d73f6b2d10882db628773fa1af593f87bf1656b616bc14ad0cd11619b7a13d5

Download Submit
C:\Windows\system\rUatLqf.exe

Filesize
5.7MB

MD5
2f23ff8576843ebc356efa6ce2a16a9e

SHA1
0ea20a6de88fb4f50659e7c525a5f12af23e4a36

SHA256
785ee85b3f43bfb9674fafda0129e42c58a18d69b06bfb4021eae2e1f7079437

SHA512
002c1c4df7503f4a7d79a7686a5c8e65e2e385f92eeb0ed9c70d27975a10437ddbb0d370f746dd0e31d260a8a2089c3d47bc08f47202152bb4d541c6ba65b52a

Download Submit
C:\Windows\system\rmtndFe.exe

Filesize
5.7MB

MD5
4aaab52825b1e79d0b913fd6552a43be

SHA1
08f6b6e5c0e4cf9ee4d4df503a7fb5aa8c020dd1

SHA256
d715ab44da7bfbd191e305feb2b2817f3066b395ed6bb2c81c23ab0a19b76299

SHA512
93476125aad36a15db52511df508df38127eade0d0b69670dd49241fd4a479e4be98f7ae51293d7ef31e694151a20fcfc3d1d53654f4484f08059b3a7214f355

Download Submit
\Windows\system\DZKuwhl.exe

Filesize
5.7MB

MD5
52c7b50329453f8fdb1ce3a354bca47b

SHA1
446f10845b5f992c68b0266d5f3cc25cd82009f4

SHA256
a91fd963c9486472a5ea6dab7d961a37d247441518ec3ed3ca57cb9f972935e5

SHA512
463ccfee750cc859dc4102efad32acb5e6f0bd2d8b5f3c4eaba07a3d7d32427f00286e545fd71311a5f0897d37a591fd137d08fa7196531f0a6a5a4da89946a3

Download Submit
\Windows\system\HTonPec.exe

Filesize
5.7MB

MD5
65b21e55e9a07e667e803dd81d508e31

SHA1
fab6428c33450f81c14d6ba56fe0b06132ec157c

SHA256
2a68d28f098242dd96eccf20d2184db052c27f9c42cf2a0e1c6f5bcb86c282f9

SHA512
835cda3ef4148ff39ed06b1c406808e6b4fff0cd73b8a46e8a40794d699cf48c5341d4889c91ce85d88c403f6d6c1ec2770a47fa4b2c31a59e870bc3d5441ea0

Download Submit
\Windows\system\JAPFMOR.exe

Filesize
5.7MB

MD5
8df9522a04413602b8025c314c370106

SHA1
10773741359b383628fc52682effa0320bfc6cde

SHA256
e66806564b1768e11f265b33752adbd582c72dcf2b3c2de6b33d5e792bdb7f10

SHA512
8809cc5ebeffeb83b9aaedfbe00277af21d754cd82ca76ca464a9acfb013b8d4b684b0d9ee3e47367c6b74de543d7ea4d2688ddf378d7e83cb37c5495551112e

Download Submit
\Windows\system\UZmJnoO.exe

Filesize
5.7MB

MD5
fe9d4dc1ec5633945a4f872270271346

SHA1
8b75eb107e0bf341fd3bfbb5595b1490009f719c

SHA256
f326c86f89be25e6087d008d45dee9b77c33ddd70d6362a9f4bd3844e71ffb5f

SHA512
6c253a6b85d912ac5751024eed01edcd0f2f269e2f5b1db3af6c4777b867df8af6c3181ce6f1e4ce19349a65cc9de2d2e786aeb275c719724dcd7a5c688625b7

Download Submit
\Windows\system\XNprEHh.exe

Filesize
5.7MB

MD5
3cc70f5a9346c3b95da3348e9ff09dbc

SHA1
95d37c5411627b53d7ba4b671ccf98f43e49c4a6

SHA256
5d0ea0935e3a6635a254e53291aabef5a7143de22066e53a35a7930e398e0fbe

SHA512
8ff39a23910446f190b117b9f025b62f042305e472e8135f154fc0ae9f2f78457172e90ca052a6db7a47fc3347de3d144ce091a1f65389b2961c1a66be1aa998

Download Submit
\Windows\system\fHqOlQz.exe

Filesize
5.7MB

MD5
8124c163ff405f19187ee9920d740a73

SHA1
5e3fbb00b748739dce5fa7042f718572f93953ab

SHA256
c3442134bb06e8bfbd00d99c28c24e94ee023ce284c9297aa2213db50bbe876e

SHA512
725fa70718ed7395b9eedf5acbcdce0b29202f341f3ead76eb31611dd1ba5f28d577ef9e231cf8472c883f7dc2e56ec3ac30657b460575967be0c6a7b3e5a82e

Download Submit
\Windows\system\vVmOjhS.exe

Filesize
5.7MB

MD5
1cf47970fddfd5a3be9e744095069824

SHA1
0770f9faae889b2aed0633be83f4d631681b6846

SHA256
2db99a3d058bc6437d07d1b2a852d7f45e9cd5ae85423808100270f33d03f0f2

SHA512
964b4c2b9a9d15976e244480d52531251369c8c3bd9e9f1a83643c96a11ace451dba7ea95a535c3508f6ae09fd93b452de48c82b7820535d01db80a59011a5fc

Download Submit
memory/1208-122-0x000000013FD70000-0x00000001400BD000-memory.dmp

Filesize
3.3MB

Download
memory/1644-109-0x000000013FBC0000-0x000000013FF0D000-memory.dmp

Filesize
3.3MB

Download
memory/1868-25-0x000000013F690000-0x000000013F9DD000-memory.dmp

Filesize
3.3MB

Download
memory/2236-95-0x000000013FC90000-0x000000013FFDD000-memory.dmp

Filesize
3.3MB

Download
memory/2244-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2244-0-0x000000013F440000-0x000000013F78D000-memory.dmp

Filesize
3.3MB

Download
memory/2252-18-0x000000013FB20000-0x000000013FE6D000-memory.dmp

Filesize
3.3MB

Download
memory/2284-124-0x000000013F230000-0x000000013F57D000-memory.dmp

Filesize
3.3MB

Download
memory/2336-7-0x000000013FB90000-0x000000013FEDD000-memory.dmp

Filesize
3.3MB

Download
memory/2344-12-0x000000013F4B0000-0x000000013F7FD000-memory.dmp

Filesize
3.3MB

Download
memory/2352-121-0x000000013F5D0000-0x000000013F91D000-memory.dmp

Filesize
3.3MB

Download
memory/2556-89-0x000000013F650000-0x000000013F99D000-memory.dmp

Filesize
3.3MB

Download
memory/2576-87-0x000000013FDA0000-0x00000001400ED000-memory.dmp

Filesize
3.3MB

Download
memory/2596-97-0x000000013FA40000-0x000000013FD8D000-memory.dmp

Filesize
3.3MB

Download
memory/2616-98-0x000000013F480000-0x000000013F7CD000-memory.dmp

Filesize
3.3MB

Download
memory/2648-31-0x000000013F5F0000-0x000000013F93D000-memory.dmp

Filesize
3.3MB

Download
memory/2676-88-0x000000013F0F0000-0x000000013F43D000-memory.dmp

Filesize
3.3MB

Download
memory/2728-96-0x000000013FE60000-0x00000001401AD000-memory.dmp

Filesize
3.3MB

Download
memory/2744-37-0x000000013F910000-0x000000013FC5D000-memory.dmp

Filesize
3.3MB

Download
memory/2796-48-0x000000013F630000-0x000000013F97D000-memory.dmp

Filesize
3.3MB

Download
memory/2804-46-0x000000013F8F0000-0x000000013FC3D000-memory.dmp

Filesize
3.3MB

Download
memory/2996-90-0x000000013F820000-0x000000013FB6D000-memory.dmp

Filesize
3.3MB

Download
memory/3008-99-0x000000013F3F0000-0x000000013F73D000-memory.dmp

Filesize
3.3MB

Download