asyncrat | hxxps://www[.]upload[.]ee/files/16394258/Cwelium[.]rar[.]html

Analysis

max time kernel
298s
max time network
312s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.upload.ee/files/16394258/Cwelium.rar.html
Sample240315-vd8bpsff43

Score

10^/10

asyncrat xworm +40 persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

authority-amazon.gl.at.ply.gg:41414

Mutex

yyWHOvIJF5WyaupK

Attributes

Install_directory
%ProgramData%
install_file
Win 10.exe

aes.plain

Extracted

Family

asyncrat

Botnet

authority-amazon.gl.at.ply.gg:41414

Mutex

qWL7诶Iqw比lp伊fΖr西比NVي0Β

Attributes

delay
1
install
true
install_file
svchost.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000232cc-75.dat	family_xworm
behavioral1/memory/5576-94-0x00000000008D0000-0x00000000008FE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x00070000000232cd-86.dat	family_asyncrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Cwelium.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Microsoft Defender Antivirus.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Defender Antivirus.lnk	Microsoft Defender Antivirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Defender Antivirus.lnk	Microsoft Defender Antivirus.exe

Executes dropped EXE 10 IoCs

pid	Process
5408	Cwelium.exe
5348	Cwelium.exe
5684	Setup.exe
5772	Cwelium.exe
5576	Microsoft Defender Antivirus.exe
260	svchost.exe
5928	svchost.exe
1668	Microsoft Defender Antivirus.exe
988	Microsoft Defender Antivirus.exe
2392	Microsoft Defender Antivirus.exe

Loads dropped DLL 20 IoCs

pid	Process
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe
5772	Cwelium.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Defender Antivirus = "C:\\ProgramData\\Microsoft Defender Antivirus.exe"	Microsoft Defender Antivirus.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
334	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6040	schtasks.exe
3968	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4604	timeout.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
5768	powershell.exe
5768	powershell.exe
5768	powershell.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
260	svchost.exe
5720	powershell.exe
5720	powershell.exe
5720	powershell.exe
260	svchost.exe
260	svchost.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
5576	Microsoft Defender Antivirus.exe
5576	Microsoft Defender Antivirus.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeRestorePrivilege	4608	7zG.exe
Token: 35	4608	7zG.exe
Token: SeSecurityPrivilege	4608	7zG.exe
Token: SeSecurityPrivilege	4608	7zG.exe
Token: SeDebugPrivilege	5576	Microsoft Defender Antivirus.exe
Token: SeDebugPrivilege	5768	powershell.exe
Token: SeDebugPrivilege	260	svchost.exe
Token: SeDebugPrivilege	260	svchost.exe
Token: SeDebugPrivilege	5720	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	5928	svchost.exe
Token: SeDebugPrivilege	5928	svchost.exe
Token: SeDebugPrivilege	5576	Microsoft Defender Antivirus.exe
Token: SeDebugPrivilege	376	taskmgr.exe
Token: SeSystemProfilePrivilege	376	taskmgr.exe
Token: SeCreateGlobalPrivilege	376	taskmgr.exe
Token: 33	376	taskmgr.exe
Token: SeIncBasePriorityPrivilege	376	taskmgr.exe
Token: SeDebugPrivilege	1668	Microsoft Defender Antivirus.exe
Token: SeDebugPrivilege	988	Microsoft Defender Antivirus.exe
Token: SeDebugPrivilege	2392	Microsoft Defender Antivirus.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4608	7zG.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe
376	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5576	Microsoft Defender Antivirus.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5408 wrote to memory of 5348	5408	Cwelium.exe	136
PID 5408 wrote to memory of 5348	5408	Cwelium.exe	136
PID 5408 wrote to memory of 5684	5408	Cwelium.exe	138
PID 5408 wrote to memory of 5684	5408	Cwelium.exe	138
PID 5348 wrote to memory of 5772	5348	Cwelium.exe	139
PID 5348 wrote to memory of 5772	5348	Cwelium.exe	139
PID 5684 wrote to memory of 5576	5684	Setup.exe	140
PID 5684 wrote to memory of 5576	5684	Setup.exe	140
PID 5684 wrote to memory of 260	5684	Setup.exe	141
PID 5684 wrote to memory of 260	5684	Setup.exe	141
PID 5772 wrote to memory of 4500	5772	Cwelium.exe	142
PID 5772 wrote to memory of 4500	5772	Cwelium.exe	142
PID 5772 wrote to memory of 6084	5772	Cwelium.exe	143
PID 5772 wrote to memory of 6084	5772	Cwelium.exe	143
PID 5772 wrote to memory of 5264	5772	Cwelium.exe	144
PID 5772 wrote to memory of 5264	5772	Cwelium.exe	144
PID 5772 wrote to memory of 3704	5772	Cwelium.exe	145
PID 5772 wrote to memory of 3704	5772	Cwelium.exe	145
PID 5576 wrote to memory of 5768	5576	Microsoft Defender Antivirus.exe	146
PID 5576 wrote to memory of 5768	5576	Microsoft Defender Antivirus.exe	146
PID 5576 wrote to memory of 5720	5576	Microsoft Defender Antivirus.exe	148
PID 5576 wrote to memory of 5720	5576	Microsoft Defender Antivirus.exe	148
PID 260 wrote to memory of 5668	260	svchost.exe	150
PID 260 wrote to memory of 5668	260	svchost.exe	150
PID 260 wrote to memory of 5320	260	svchost.exe	152
PID 260 wrote to memory of 5320	260	svchost.exe	152
PID 5668 wrote to memory of 6040	5668	cmd.exe	154
PID 5668 wrote to memory of 6040	5668	cmd.exe	154
PID 5320 wrote to memory of 4604	5320	cmd.exe	155
PID 5320 wrote to memory of 4604	5320	cmd.exe	155
PID 5576 wrote to memory of 2900	5576	Microsoft Defender Antivirus.exe	156
PID 5576 wrote to memory of 2900	5576	Microsoft Defender Antivirus.exe	156
PID 5320 wrote to memory of 5928	5320	cmd.exe	158
PID 5320 wrote to memory of 5928	5320	cmd.exe	158
PID 5576 wrote to memory of 3968	5576	Microsoft Defender Antivirus.exe	159
PID 5576 wrote to memory of 3968	5576	Microsoft Defender Antivirus.exe	159

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.upload.ee/files/16394258/Cwelium.rar.html
1⤵
PID:4608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3936 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3612 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:5028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4600 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5516 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:1212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5476 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5864 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=6020 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6220 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=4912 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:5188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=4596 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:5200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6916 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --mojo-platform-channel-handle=6956 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=7328 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --mojo-platform-channel-handle=7732 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --mojo-platform-channel-handle=7884 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:5688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --mojo-platform-channel-handle=8044 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6292 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6776 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7412 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:3336

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap4490:76:7zEvent13121
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5776

C:\Users\Admin\Downloads\Cwelium\Cwelium.exe
"C:\Users\Admin\Downloads\Cwelium\Cwelium.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5408
- C:\Users\Admin\AppData\Local\Temp\Cwelium.exe
  "C:\Users\Admin\AppData\Local\Temp\Cwelium.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5348
- - C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\Cwelium.exe
    "C:\Users\Admin\AppData\Local\Temp\Cwelium.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:4500
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title Cwelium
      4⤵
      PID:6084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:5264
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c title Cwelium - Connected as Admin
      4⤵
      PID:3704
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Users\Admin\AppData\Local\Temp\Microsoft Defender Antivirus.exe
    "C:\Users\Admin\AppData\Local\Temp\Microsoft Defender Antivirus.exe"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5576
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Microsoft Defender Antivirus.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Microsoft Defender Antivirus.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft Defender Antivirus.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2900
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft Defender Antivirus" /tr "C:\ProgramData\Microsoft Defender Antivirus.exe"
      4⤵
      Creates scheduled task(s)
      PID:3968
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:260
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5668
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
        5⤵
        Creates scheduled task(s)
        
        PID:6040
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp6B05.tmp.bat""
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5320
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4604
    - - C:\Users\Admin\AppData\Roaming\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5928

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:376

C:\ProgramData\Microsoft Defender Antivirus.exe
"C:\ProgramData\Microsoft Defender Antivirus.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\ProgramData\Microsoft Defender Antivirus.exe
"C:\ProgramData\Microsoft Defender Antivirus.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:988

C:\ProgramData\Microsoft Defender Antivirus.exe
"C:\ProgramData\Microsoft Defender Antivirus.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

svchost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
Size 871B
SHA256 5e1611e4d915fd9759825811fa4463f09172889f85889a2942be1561948fab8a
MD5 d58f949aad7df2e7b55248bfdfc6e1b8
SHA1 6713cad396b5808b66ede2dd9b169e00d5e5018f
SHA512 bdddb838108c4f3f0a7737703cbde935fe26aaea97459bb099c4c773c0789997283d7f20ac7ea4ac2aedef23515afc0b251b5b461aa12d3b7a60846b87b26e38
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96
MD5 fd98baf5a9c30d41317663898985593b
SHA1 ea300b99f723d2429d75a6c40e0838bf60f17aad
SHA512 bf4dbbd671b5d7afb326622a7c781f150860294d3dba7160330046c258c84a15981c70e50d84dc7faaa7cc8b8c90bf8df818b3f2d3806a8a3671dfe5e38fe7b0
MD5 SHA1 SHA512

Submit Download

Cwelium.exe

Path C:\Users\Admin\AppData\Local\Temp\Cwelium.exe
Size 10.4MB
SHA256 0cb274a67a355f6bb929e4e606bdcd299e11a2b2e68f9a3bfbd24d7c8ce6f984
MD5 43d53ff4356b6b0ac1427b803227d33e
SHA1 7c5119f5088ffcd9c3911270cbf08fa84d93940c
SHA512 58b49c35ff08a96799bbfcc92aa4146df02f77478a355222f26d79789d957100a214060cd9fdb0e86dd45fecc06fc9910632be06a96697775476cde3f837e957
SSDEEP 196608:nx/0PakDMNBeURYLMxjlxLzBsUM5uL2QdO5e3JaRtgwK4xbF5npnHm:nxcPapBtqL8r1U5sOA3JaRWwTVpnHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cwelium.exe

Path C:\Users\Admin\AppData\Local\Temp\Cwelium.exe
Size 4.8MB
SHA256 6b1927bfa46c29b01bb6caefffdbf980895fee1c5cfb523c2c7db4acc94474cf
MD5 b8d8df854cc56358c6d29a176ff2ef83
SHA1 7ab60bb077c9fccdb17c60b7d75d172290f16dd9
SHA512 c4b50deb3ef956312d3f935e3795890fb4cd065afa026080996deaa64c5e724d07760c3ee1bd5b9b606ad737f6e71e265c9575057555371f0e7035415db315df
SSDEEP 98304:bCWWWPAdoIF+4ZPakTkcwobWNBeXEyM8TBG1EiPxttlxLzwkg8sUFy5GuVP:nx/0PakDMNBeURYLMxjlxLzBsUM5z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cwelium.exe

Path C:\Users\Admin\AppData\Local\Temp\Cwelium.exe
Size 2.0MB
SHA256 5a56c7b1990321591c905a78ff9f63a4b0a678d05127e02313a36094aadbe73f
MD5 e6e997262e22b2cf67d0698ecaf3b0bd
SHA1 cfe9bc4235b6555315f894c127f8bf099588eeee
SHA512 ba6e95d36c109e3d8c19b5eb072dfc89004961bd64220f254101f2e054616f4af6017392eb76bfb11abeb04ab2d532312cd49125a7fc468af3154ba6e30ad609
SSDEEP 49152:yZahCWWWg9K9aOYc0uZIdX+il7ZPapivSmkuSM9wpqoHq:bCWWWPAdoIF+4ZPakTkcwoF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Defender Antivirus.exe

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Defender Antivirus.exe
Size 160KB
SHA256 318f9be2552e147d53f7c1df22db2d4a9889f8be345c33792b180eec9e32a20c
MD5 fa0b8e23c75c926ad6e1e33f845ca6bf
SHA1 c06770a6069948e90a284d6261a509802a1a6d2c
SHA512 5b4ecc2c267f785f5be558030a36b5781e20a19b0015218011bddc212af8b9ae862cb3d99b731028b021b10a0455eb3741ceb5110d09dc7b0baf2e162ab5772a
SSDEEP 3072:M3FD988OwJokVVVVVVgNHlYVVVVkVVVVYVVVVvVVVVOVVVVVVVVVVVVVUpwRN9wZ:GD9PVVVVVVIHlYVVVVkVVVVYVVVVvVVY
MD5 SHA1 SHA512 SSDEEP

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
Size 64KB
SHA256 11b75237e8a4df6f72d4cc4df3612b4fefcf7aa220e060feeeac1fc60a8514b3
MD5 4e428305cf54f814007cc0da9f9bea6e
SHA1 8279e59e22bf2d9785e132c18fc34add637fc395
SHA512 f95340d445ad295fa2bbddf0c71299d348f47abb35b4cb8631b023a143da81c301a89b672463a7233a5d04fec7b34464edafb0a4b7962f91bc0fea3e3461da24
SSDEEP 1536:d8lVv4w0dHVaH4uBdVuFn1V1OdR8fRF9tthDA9CpbGSI6VpKbINi2e:dmVQjdHV0KFn1VEdR8fRXhbpbGSI6Vps
MD5 SHA1 SHA512 SSDEEP

Submit Download

md__mypyc.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md__mypyc.pyd
Size 116KB
SHA256 3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753
MD5 9ea8098d31adb0f9d928759bdca39819
SHA1 e309c85c1c8e6ce049eea1f39bee654b9f98d7c5
SHA512 86af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707
SSDEEP 1536:OzgMw0g+m/+rxC9Jtd960WsCyqPD1/bZMlDML48Be9zGTVmZRJIRbvB:OsTH+VC9Jtd9VdCr7fMp/8yGTVmzmZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll
Size 1.1MB
SHA256 75fdb815ae8081dc55a9f5e8f91f331797bbe672e3f4f94d4fe56eba78823d40
MD5 4e06d51a57ab6f1f35ce876646441fbd
SHA1 8c17cdcf061eda162658e5c5483db4d549183e5a
SHA512 cf9b4b10815c4433b032fa51462a39f10e5f0e76d0f0fe3a1dd272b3bf3fc7726882bee844a95684453685d72995d1622a13c18eef85bed712f25932094a8cdb
SSDEEP 24576:yTKuk2HP4VIH06iyn9OjPW5XZmgcloudKqV+phSL:yTKuk2HAIU6iS9OjPW1ZsJdIpgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

tls-client-64.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\tls_client\dependencies\tls-client-64.dll
Size 640KB
SHA256 91625d1f75684259f37f410d6de6e6d9c0606ba8ef40b48074b216ee7f8d6ecf
MD5 8cc04353f0a64f9bde4c6d3139ca0f83
SHA1 89c3eb935de2f69cb7c22dcf8f26fdb9a1a56297
SHA512 66586e7c4605a9c1e7a9216ed4b57831860292184f8e210de999af9b0aa7f165947d5a1abfe82ad5423a51f8092211e9c2221545b8c253e70bd5d05a55a4cf82
SSDEEP 12288:6wEgaHyk0IGJH2sX6A9k0hJ/2JwN02k7uLx2d:+F0IGJWsXNkpJwNeuV2d
MD5 SHA1 SHA512 SSDEEP

Submit Download

backend_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd
Size 512KB
SHA256 b990efbda8a50c49cd7fde5894f3c8f3715cb850f8cc4c10bc03fd92e310260f
MD5 dc08f04c9e03452764b4e228fc38c60b
SHA1 317bcc3f9c81e2fc81c86d5a24c59269a77e3824
SHA512 fbc24dd36af658cece54be14c1118af5fda4e7c5b99d22f99690a1fd625cc0e8aa41fd9accd1c74bb4b03d494b6c3571b24f2ee423aaae9a5ad50adc583c52f7
SSDEEP 12288:LhqzrH09USNNSNkUvpMnAp5Oqwj/k6OsoOfu/PYS/O51Y/H:LhqzrH0evpMnApu86OsynYUPv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Setup.exe
Size 121KB
SHA256 42e8a64315c3c12fe15b18ff7885a48f21dce961337d76f5dbfc09c2bd25b30a
MD5 b6029cfda298d2b1ec5ca6b5c134ac66
SHA1 0c77a9b5c1046a85be78417222b6d66d5061c989
SHA512 d07f7725dce1edd1177cb386752464d0748bb155ca6abb72bbb96ef162fa4aed87a694ef81e0c7e230dc6b2d22344911c5c54f921cfd821ea147891442aea968
SSDEEP 3072:9HfxoaBJJZYsKGRiD2zV0+erp3I4Vxq9Wt:BfxbJcoVGOyg0
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_jxse3lzc.xwk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jxse3lzc.xwk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Cwelium.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\Cwelium.exe
Size 2.3MB
SHA256 896dd2eea15e348c342bc62a43eab6eccbda94772747b1ffa5f677858763833b
MD5 c6d5b5152323ab14bb3aacc43f4c766e
SHA1 f924e65d13c4def1e2a9ea8271738e3f1decb9b6
SHA512 32acf72c9cf3a591d65c87f4318034025d34cfd35e7b3825835046c54dfde86e994fcdaaa36d41a4002dfaf4f1c577f2ecba06c082dcc0fe6b5e24b2beb444ac
SSDEEP 49152:GwQ/z9ldVVKJ1e1t2lMR730bgc2uDmrljPYnooZ/95K7Zf8NmPyzSLFeuk:GwgTYe1t2lM10bgc3DmrljPAooZ/95gC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cwelium.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\Cwelium.exe
Size 2.6MB
SHA256 db58ce193fc6ac4e8b1120618e979499698bd655db2f8dd84bd3260983fe1221
MD5 845781fd29f235f3c0de00d31ac491fb
SHA1 73b7ae4c837cf3e16a259462c0fcb31eedf86b9c
SHA512 f6bf7b64c9ac9daaa86d0af784faf96ea05f2fc423cfde15e899b142f3338aaf3d8da88d749fbe41f93c9ac99fa38399419941408c3a33c7037a399cdfbb1e04
SSDEEP 49152:GwQ/z9ldVVKJ1e1t2lMR730bgc2uDmrljPYnooZ/95K7Zf8NmPyzSLFeu3IP9:GwgTYe1t2lM10bgc3DmrljPAooZ/95gw
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\_bz2.pyd
Size 82KB
SHA256 a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a
MD5 3859239ced9a45399b967ebce5a6ba23
SHA1 6f8ff3df90ac833c1eb69208db462cda8ca3f8d6
SHA512 030e5ce81e36bd55f69d55cbb8385820eb7c1f95342c1a32058f49abeabb485b1c4a30877c07a56c9d909228e45a4196872e14ded4f87adaa8b6ad97463e5c69
SSDEEP 1536:PdQz7pZ3catNZTRGE51LOBK5bib8tsfYqpIPCV17SyQPx:VQz9Z5VOwiItsAqpIPCV1Gx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\_ctypes.pyd
Size 120KB
SHA256 ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902
MD5 bd36f7d64660d120c6fb98c8f536d369
SHA1 6829c9ce6091cb2b085eb3d5469337ac4782f927
SHA512 bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56
SSDEEP 3072:c7u5LnIx1If3yJdqfLI2AYX5BO89IPLPPUxdF:cwxfijqfLI29BO8VF
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\_hashlib.pyd
Size 63KB
SHA256 e557873d5ad59fd6bd29d0f801ad0651dbb8d9ac21545defe508089e92a15e29
MD5 4255c44dc64f11f32c961bf275aab3a2
SHA1 c1631b2821a7e8a1783ecfe9a14db453be54c30a
SHA512 7d3a306755a123b246f31994cd812e7922943cdbbc9db5a6e4d3372ea434a635ffd3945b5d2046de669e7983ef2845bd007a441d09cfe05cf346523c12bdad52
SSDEEP 1536:6TO+CPN/pV8ETeERZX/fchw/IpBIPOIVQ7SygPx:mClZZow/IpBIPOIVQyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\_lzma.pyd
Size 155KB
SHA256 1796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb
MD5 e5abc3a72996f8fde0bcf709e6577d9d
SHA1 15770bdcd06e171f0b868c803b8cf33a8581edd3
SHA512 b347474dc071f2857e1e16965b43db6518e35915b8168bdeff1ead4dff710a1cc9f04ca0ced23a6de40d717eea375eedb0bf3714daf35de6a77f071db33dfae6
SSDEEP 3072:A4lirS97HrdVmEkGCm5hAznf49mNo2NOvJ02pIPZ1wBExN:VlirG0EkTVAYO2NQ3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\_queue.pyd
Size 31KB
SHA256 35609869edc57d806925ec52cca9bc5a035e30d5f40549647d4da6d7983f8659
MD5 f00133f7758627a15f2d98c034cf1657
SHA1 2f5f54eda4634052f5be24c560154af6647eee05
SHA512 1c77dd811d2184beedf3c553c3f4da2144b75c6518543f98c630c59cd597fcbf6fd22cfbb0a7b9ea2fdb7983ff69d0d99e8201f4e84a0629bc5733aa09ffc201
SSDEEP 384:AuCvO+MZFryl9SDCP6rXv+mkWsniRq9IPQUkHQIYiSy1pCQqIPxh8E9VF0NykOBw:1+yF+6rX2mk599IPQUO5YiSyv3PxWEun
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\_socket.pyd
Size 77KB
SHA256 74181072392a3727049ea3681fe9e59516373809ced53e08f6da7c496b76e117
MD5 1eea9568d6fdef29b9963783827f5867
SHA1 a17760365094966220661ad87e57efe09cd85b84
SHA512 d9443b70fcdc4d0ea1cb93a88325012d3f99db88c36393a7ded6d04f590e582f7f1640d8b153fe3c5342fa93802a8374f03f6cd37dd40cdbb5ade2e07fad1e09
SSDEEP 1536:0JltpedXL+3ujz9/s+S+pzpMoiyivViaE9IPLwj7SyZPx:07tp4i3ujz9/sT+pzqoavVpE9IPLwjHx
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\_ssl.pyd
Size 157KB
SHA256 5160500474ec95d4f3af7e467cc70cb37bec1d12545f0299aab6d69cea106c69
MD5 208b0108172e59542260934a2e7cfa85
SHA1 1d7ffb1b1754b97448eb41e686c0c79194d2ab3a
SHA512 41abf6deab0f6c048967ca6060c337067f9f8125529925971be86681ec0d3592c72b9cc85dd8bdee5dd3e4e69e3bb629710d2d641078d5618b4f55b8a60cc69d
SSDEEP 3072:LMaGbIQQbN9W3PiNGeA66l8rBk3xA87xfCA+nbUtFMsVjTNbEzc+pIPC7ODxd:LMaG0bN96oG1l8YA8ZMSR+E
MD5 SHA1 SHA512 SSDEEP

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\_uuid.pyd
Size 24KB
SHA256 f6063622c0a0a34468679413d1b18d1f3be67e747696ab972361faed4b8d6735
MD5 46e9d7b5d9668c9db5caa48782ca71ba
SHA1 6bbc83a542053991b57f431dd377940418848131
SHA512 c5b171ebdb51b1755281c3180b30e88796db8aa96073489613dab96b6959a205846711187266a0ba30782102ce14fbfa4d9f413a2c018494597600482329ebf7
SSDEEP 384:SR9ZfwFpEWE6ivQpIPZwGjHQIYiSy1pCQKzmPxh8E9VF0NyptVQcM:SRvqpEM4QpIPZw65YiSyvamPxWE3PS
MD5 SHA1 SHA512 SSDEEP

Submit Download

md.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\charset_normalizer\md.pyd
Size 10KB
SHA256 790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94
MD5 723ec2e1404ae1047c3ef860b9840c29
SHA1 8fc869b92863fb6d2758019dd01edbef2a9a100a
SHA512 2e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878
SSDEEP 96:KG+p72HzA5iJGhU2Y0hQMsQJCUCLsZEA4elh3XQMtCFliHUWQcX6g8cim1qeSju1:A2HzzU2bRYoeLHkcqgvimoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\libcrypto-1_1.dll
Size 960KB
SHA256 2cc5fcae29455fb5f2d60d42316c44200727810fd307a6677b34e48b77ff57b2
MD5 d2201867df3bb3fa6f3e979752bb9a55
SHA1 7d35d238c3280d7b7da0372da9a750f99ae6577c
SHA512 a35a90a2b72f794e87383b4a9163f24d05819acdd67a84016769a6d5e2bcf6e4dc4c0e4058f1be1c01e4208ef0b07f2bc1eae081921126ce9e7cdd0815a0ddec
SSDEEP 24576:yTKuk2HP4VIH06iyn9OjPW5XZmgcloudKF:yTKuk2HAIU6iS9OjPW1ZsJdi
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\libcrypto-1_1.dll
Size 896KB
SHA256 01bce33b6bd20f88a3abc84596807a5e5f884f99b5233f6854d40f23916c1e99
MD5 bad0239a18b887f177a73be91a177218
SHA1 879b4f97061393094a41f6a3af9af70623c5a0a3
SHA512 e26fbdf90b82affe0229fc70250214655636dde4875e4696b7aad04867477946bb578ee4d91ff65d98beb701fbf431c004842506091c859d1106accc39d8b5b3
SSDEEP 12288:QU+TKuk2TWU/P4IttY3reTjD06MlNynEBUOjPW+p4VtVa0zVgWygclofO:yTKuk2HP4VIH06iyn9OjPW5XZmgclo2
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\libssl-1_1.dll
Size 688KB
SHA256 c8f7237e7040a73c2bea567acc9cec373aadd48654aaac6122416e160f08ca13
MD5 25bde25d332383d1228b2e66a4cb9f3e
SHA1 cd5b9c3dd6aab470d445e3956708a324e93a9160
SHA512 ca2f2139bb456799c9f98ef8d89fd7c09d1972fa5dd8fc01b14b7af00bf8d2c2175fb2c0c41e49a6daf540e67943aad338e33c1556fd6040ef06e0f25bfa88fa
SSDEEP 12288:ihO7/rNKmrouK/POt6h+7ToRLgo479dQwwLOpWW/dQ0T9qwfU2lvzA:iis/POtrzbLp5dQ0T9qcU2lvzA
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\python311.dll
Size 2.4MB
SHA256 6e59b1455011fbda60e1f12df827881bf7ebbbd9832d4eb463c167bfa8d1e2b0
MD5 017d7d694632362500ce657e5f56a4d5
SHA1 ce3570f16b7d490f7826a5a014f3282f44807db1
SHA512 af39a456c647074b5d421189179138e2d12490ba425e588cfffb4b3455cde6c3cddcda36d3eadefe6484eee9c110c5d35828768e4b39ff0cfa2556a3437f065e
SSDEEP 49152:73djosVvASxQKADxYBVD0NErnKqroleDkcWE/Q3pPITbwVFZL7VgV8:73ZOKRtlrJ7wfG8
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\python311.dll
Size 128KB
SHA256 f81dc0a09acd751eb03d8cb56bb9b9d2f8004ad57468fc7a65a2c54ee9fc9238
MD5 779a46a25ca09e1b0fb661aedd22dc7a
SHA1 8678cb45c4042633a2d4a9a6787bb5a9bda11ccd
SHA512 685df6319560dd609386ab9c946cd39d4a730dd39838f51eeaf4f5c1bcd01319da3896ce5aa1a79fb7adf25f3e4b0ebb0093c30dcde60034bc56e8fd4a7b3d33
SSDEEP 1536:reXrvyvHKJBeQ3gZ5DkSo+Cxd6Hhy4fBpZ2kMr0lUX/zM3yAxHcUNFb0bHrrNEZj:reXjqarwex4rMZQyu8SFMGdznVJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\select.pyd
Size 29KB
SHA256 c4aa9a106381835cfb5f9badfb9d77df74338bc66e69183757a5a3774ccdaccf
MD5 c97a587e19227d03a85e90a04d7937f6
SHA1 463703cf1cac4e2297b442654fc6169b70cfb9bf
SHA512 97784363f3b0b794d2f9fd6a2c862d64910c71591006a34eedff989ecca669ac245b3dfe68eaa6da621209a3ab61d36e9118ebb4be4c0e72ce80fab7b43bde12
SSDEEP 384:N1ecReJKrHqDUI7A700EZ9IPQGNHQIYiSy1pCQn1tPxh8E9VF0NykfF:3eUeJGHqNbD9IPQGR5YiSyvnnPxWEuN
MD5 SHA1 SHA512 SSDEEP

Submit Download

tls-client-64.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\tls_client\dependencies\tls-client-64.dll
Size 2.9MB
SHA256 7fb56c9c5061fd4b56fafa85fc14184589f397ee86a0aeb0f43a50cedeea140d
MD5 4090cb1dd89d9025799badafe3ac12b2
SHA1 b1b4d1af93d24e3f4caf6b2ba8cd345520beb50a
SHA512 a84204fc5d5a71f703de280fc987b18d5fa8e3548e33843cc324807086b790d29c7cfb6ccaecd0c3178db6678e4e3024e385b860fc338f475c03fe779dbff771
SSDEEP 49152:+CJWsXy/wNvVlrb/THvO90d7HjmAFd4A64nsfJ8e/HOq+oew+oSVDQDvI/JukG11:yOWOoew+oSVDsWU
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\unicodedata.pyd
Size 1.1MB
SHA256 8fbed20e9225ff82132e97b4fefbb5ddbc10c062d9e3f920a6616ab27bb5b0fb
MD5 aa13ee6770452af73828b55af5cd1a32
SHA1 c01ece61c7623e36a834d8b3c660e7f28c91177e
SHA512 b2eeb9a7d4a32e91084fdae302953aac57388a5390f9404d8dfe5c4a8f66ca2ab73253cf5ba4cc55350d8306230dd1114a61e22c23f42fbcc5c0098046e97e0f
SSDEEP 12288:83kYbfjwR6nblonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1ol:8UYbMA0IDJcjEwPgPOG6Xyd461ol
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_5348_133549953085289532\vcruntime140.dll
Size 64KB
SHA256 dd7c6d62a581809ab069f23605a5db6d6902d19b97ae32658f2b6af11fe78591
MD5 6ddced470268add42e478a6c68f33724
SHA1 598725bf8d23a76ba148db155d2dfaa670fa2a75
SHA512 9911033e808070fea5c621178bcdeb8102ee9b8cf57b3cab411fd6130b31e307376c7b797287c91f3c6d0282c279e6933549ff3f72de218c3e1f605443db1cd3
SSDEEP 768:G8p6+QPSU7nmGbNTlkGhEYbGXaaYQK6YkOAZWnEZhWHLKBkMq4XqqLwknbfK98kS:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjOp
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 63KB
SHA256 4fba008e86456e752218c1529ed4bb70e631b40df6c6d839192ce93e863c6992
MD5 b85cfffb067b690bf8c723bfe4d924f4
SHA1 9b7519cda2055197f364500f4c4fc34c37a967cb
SHA512 e0b7e3287b9d21f44c99b4efce7634221d6232f00662df1e2b5a6ecacac10fc7bd8f89af3255ff6224d83d7c0a76d282ceed637f8e1c8012e463badb407980de
SSDEEP 1536:V5tTXAF5j5BnihYUbfh9yG+u1SdpqKmY7:nWv9BnaYUbfeJGz
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp6B05.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp6B05.tmp.bat
Size 151B
SHA256 68587e8eb1ba61d68df3cc76290a42e81e2f5250ecf5511e25cc2657d6887b21
MD5 350c63dcfce36842ef171e356b4b3155
SHA1 67ad5c8c86c740f607d069e7ce21cca5afe2771e
SHA512 a6fb1d9c4b7796ec731992d497769b8e1632d0e37fc6272366ec373f18666f32c240cdb351757a759eef952297559684188cad63812635b1c60cb68454cd644d
MD5 SHA1 SHA512

Submit Download

Microsoft Defender Antivirus.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Defender Antivirus.lnk
Size 777B
SHA256 45a90057ddcb48f3ce8c0fba714b890806df95550323865dbc68817cc42a4840
MD5 dbdf14cf14f73ee71b02389bb1f6a5ff
SHA1 8c00cd5a79afda56221661b5ea3f44e65f8a6b5f
SHA512 e36168c694c856516c58f29caa2da3241178df42d3f3931ea5e01cc630bd43ac21b24ebbb53fd7e46ccaf6c42a1a5ae49e5a1e99768a74c0539d530e1f71a57a
MD5 SHA1 SHA512

Submit Download

Cwelium.exe

Path C:\Users\Admin\Downloads\Cwelium\Cwelium.exe
Size 5.0MB
SHA256 93093c5fc0c5031f634d8405ff6425d12e2802e096708215a0dd39ddb5437dda
MD5 3d80c59a9fc9467dccb729cc4a6ea65d
SHA1 2ad743b7fdc06af0981126dae596e3d76723d3aa
SHA512 e22d7bdbbd8b86ccb1b3afca71f4c5f26697362cc709de9ff2330afa0b247b1528f3e8ac973f44c1605499f29ea756fd5e88f29bca11399abe6cfa56ccf7094b
SSDEEP 98304:0foQpcazcc6nz4I7cfkOlYn4q3O2+2TvGbNUOYj1B7LH7NOEsaRugIxqK:Yo1AWz4IOin4qeZWoL2b7LH7vsa0gU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cwelium.exe

Path C:\Users\Admin\Downloads\Cwelium\Cwelium.exe
Size 4.8MB
SHA256 8325dde9300af8108f59bb3162c989399b5b1a6e1077318b2ece764ab2714d2e
MD5 0de65c41ecd597e4a18e3c9f2f49beed
SHA1 7f5995c9701a00ad0d2ff57df1421c109d17450b
SHA512 fb41b04c5005d33c9a4527ea95f69a619d9cbfc733620f50baf673b6f9c379c24a1f4842c69d235ae57350e5e84b45c8c30e9bbfc4814574f2d01c3568594c70
SSDEEP 98304:0foQpcazcc6nz4I7cfkOlYn4q3O2+2TvGbNUOYj1B7LH7NOEsaRugIxqY:Yo1AWz4IOin4qeZWoL2b7LH7vsa0gi
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.json

Path C:\Users\Admin\Downloads\Cwelium\config.json
Size 125B
SHA256 0ef7646d8aa27007342734660fca3a6e0e73a91aa84cfc83de81c324ed86d921
MD5 bbc77768202bab00cb53cb0f535fb3ab
SHA1 e558a3a31db553e64c856d2b774caa701947f811
SHA512 faaa5fba3b6b9e738cead24be44fd61ae62a96cced4306484d85019b6a92c403fb69bbe71ed9a5e77d47f352fcb7dd1f1e8d250ed5d859f56cf80e6be4ed2825
MD5 SHA1 SHA512

Submit Download

memory/260-105-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/260-176-0x00007FFC422F0000-0x00007FFC424E5000-memory.dmp

Download

memory/260-98-0x0000000000CF0000-0x0000000000D06000-memory.dmp

Download

memory/260-181-0x00007FFC2D550000-0x00007FFC2D569000-memory.dmp

Download

memory/260-182-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/260-183-0x00007FFC422F0000-0x00007FFC424E5000-memory.dmp

Download

memory/376-229-0x00000214B9AC0000-0x00000214B9AC1000-memory.dmp

Download

memory/376-232-0x00000214B9AC0000-0x00000214B9AC1000-memory.dmp

Download

memory/376-228-0x00000214B9AC0000-0x00000214B9AC1000-memory.dmp

Download

memory/376-223-0x00000214B9AC0000-0x00000214B9AC1000-memory.dmp

Download

memory/376-224-0x00000214B9AC0000-0x00000214B9AC1000-memory.dmp

Download

memory/376-222-0x00000214B9AC0000-0x00000214B9AC1000-memory.dmp

Download

memory/376-233-0x00000214B9AC0000-0x00000214B9AC1000-memory.dmp

Download

memory/376-231-0x00000214B9AC0000-0x00000214B9AC1000-memory.dmp

Download

memory/376-230-0x00000214B9AC0000-0x00000214B9AC1000-memory.dmp

Download

memory/376-234-0x00000214B9AC0000-0x00000214B9AC1000-memory.dmp

Download

memory/988-274-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/988-273-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/1668-252-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/1668-250-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/2392-294-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/2392-293-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/2900-199-0x000001ED2DA50000-0x000001ED2DA60000-memory.dmp

Download

memory/2900-203-0x000001ED2DA50000-0x000001ED2DA60000-memory.dmp

Download

memory/2900-205-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/2900-198-0x000001ED2DA50000-0x000001ED2DA60000-memory.dmp

Download

memory/2900-202-0x000001ED2DA50000-0x000001ED2DA60000-memory.dmp

Download

memory/2900-197-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5348-139-0x00007FF6DF560000-0x00007FF6E064A000-memory.dmp

Download

memory/5408-39-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5408-14-0x000000001BF20000-0x000000001BF30000-memory.dmp

Download

memory/5408-13-0x00000000000B0000-0x00000000011A8000-memory.dmp

Download

memory/5408-12-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5576-240-0x000000001B4E0000-0x000000001B4EA000-memory.dmp

Download

memory/5576-200-0x000000001B700000-0x000000001B710000-memory.dmp

Download

memory/5576-94-0x00000000008D0000-0x00000000008FE000-memory.dmp

Download

memory/5576-142-0x000000001B700000-0x000000001B710000-memory.dmp

Download

memory/5576-179-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5576-99-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5684-71-0x00000000014C0000-0x00000000014D0000-memory.dmp

Download

memory/5684-104-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5684-37-0x0000000000CD0000-0x0000000000CF4000-memory.dmp

Download

memory/5684-38-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5720-186-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5720-180-0x00000274362F0000-0x0000027436300000-memory.dmp

Download

memory/5720-173-0x00000274362F0000-0x0000027436300000-memory.dmp

Download

memory/5720-172-0x00000274362F0000-0x0000027436300000-memory.dmp

Download

memory/5720-171-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5768-144-0x0000027423DB0000-0x0000027423DC0000-memory.dmp

Download

memory/5768-156-0x0000027423DB0000-0x0000027423DC0000-memory.dmp

Download

memory/5768-152-0x0000027423D50000-0x0000027423D72000-memory.dmp

Download

memory/5768-159-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5768-143-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5768-145-0x0000027423DB0000-0x0000027423DC0000-memory.dmp

Download

memory/5772-141-0x00007FFC18F70000-0x00007FFC1A0FF000-memory.dmp

Download

memory/5772-140-0x00007FF6B1C30000-0x00007FF6B2B31000-memory.dmp

Download

memory/5928-244-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download

memory/5928-248-0x00007FFC422F0000-0x00007FFC424E5000-memory.dmp

Download

memory/5928-221-0x00007FFC422F0000-0x00007FFC424E5000-memory.dmp

Download

memory/5928-213-0x00007FFC20580000-0x00007FFC21041000-memory.dmp

Download