asyncrat | 82d75976bb4947e9da7e3e8f4bbeefa33cf4ed2eceba40a255875e74c82e81b8

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Auto-Resolutorio.js
Size 344KB
Sample260825-zyv94aah33
SHA256 82d75976bb4947e9da7e3e8f4bbeefa33cf4ed2eceba40a255875e74c82e81b8
MD5 2b7482504147976501675f330dbce29d
SHA1 c000a30cfb256cb2a273cef22bc2002974e287e4
SHA512 445a881c2651c3d3f3b420e5cba8a5ad4db364ad8ece062287c6c739af9bdc7db37349326c0ccbcb3dfd6a3f7ccda1ea5627cb64e8d6f0d140cd6bdf3363178b
SSDEEP 6144:HjYuPMbdKcsBu1ZQPUtLT13fPB5DlQcsLtlHVthbJCOjcn6blBXHAUFGrkVL:rEpsBuvoWP70ttsn6J9AUFVVL
TLSH
T19D74BFEE6A49DD381F8C72CD8F03685E3D6EB7C1185EB1CCA1C42127535A51BEAE0D29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

cal035 defense_evasion discovery execution asyncrat persistence rat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

CAL035

nuevaera2026202620262026.duckdns.org:7707
nuevaera2026202620262026.duckdns.org:3009

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Family: AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4268-95-0x0000000002AF0000-0x0000000002B06000-memory.dmp	family_asyncrat

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\GdiMapRefresh_QWXK = "C:\\Windows\\System32\\wscript.exe //B //nologo \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\notif_cache\\notif_cache_WBVEBOWP.vbs\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\GdiMapRefresh_QWXK = "C:\\Windows\\System32\\wscript.exe //B //nologo \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Caches\\notif_cache\\notif_cache_WBVEBOWP.vbs\""	reg.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3548	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1660 set thread context of 2232	1660	powershell.exe	113

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4276	powershell.exe
2460	powershell.exe
1660	powershell.exe
4176	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4176	powershell.exe
4176	powershell.exe
4276	powershell.exe
2460	powershell.exe
2460	powershell.exe
4276	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe
1660	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1660	powershell.exe
1660	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	1660	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	msiexec.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 4176	4516	wscript.exe	89
PID 4516 wrote to memory of 3548	4516	wscript.exe	91
PID 3548 wrote to memory of 4276	3548	cmd.exe	93
PID 3548 wrote to memory of 2140	3548	cmd.exe	94
PID 3548 wrote to memory of 1688	3548	cmd.exe	95
PID 3548 wrote to memory of 2692	3548	cmd.exe	96
PID 3548 wrote to memory of 6104	3548	cmd.exe	97
PID 3548 wrote to memory of 3264	3548	cmd.exe	98
PID 3548 wrote to memory of 1240	3548	cmd.exe	99
PID 3548 wrote to memory of 3404	3548	cmd.exe	100
PID 3548 wrote to memory of 5804	3548	cmd.exe	101
PID 3548 wrote to memory of 3400	3548	cmd.exe	102
PID 3548 wrote to memory of 4736	3548	cmd.exe	103
PID 3548 wrote to memory of 2460	3548	cmd.exe	104
PID 2460 wrote to memory of 1660	2460	powershell.exe	106
PID 3548 wrote to memory of 1648	3548	cmd.exe	108
PID 1660 wrote to memory of 3428	1660	powershell.exe	109
PID 3428 wrote to memory of 5196	3428	csc.exe	110
PID 1660 wrote to memory of 1836	1660	powershell.exe	111
PID 1836 wrote to memory of 2292	1836	csc.exe	112
PID 1660 wrote to memory of 2232	1660	powershell.exe	113
PID 1660 wrote to memory of 4340	1660	powershell.exe	114
PID 2232 wrote to memory of 4268	2232	msiexec.exe	115
PID 2232 wrote to memory of 4268	2232	msiexec.exe	115
PID 2232 wrote to memory of 4268	2232	msiexec.exe	115

Views/modifies file attributes 1 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3264	attrib.exe
1648	attrib.exe
2140	attrib.exe
3404	attrib.exe
3400	attrib.exe
5804	attrib.exe
1688	attrib.exe
2692	attrib.exe
6104	attrib.exe
1240	attrib.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Auto-Resolutorio.js
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -command $LTBLSIX=$env:ZGOGLB;$ZQQKJJG=$env:FJCJTIY;$TLNZRQI=$env:AZPXXV+$env:BFCY+$env:BUZTCZP+'.'+$env:AIKWMORB;[void][IO.Directory]::CreateDirectory([IO.Path]::GetDirectoryName($TLNZRQI));$DATUGLD=foreach($TJHIX in [IO.File]::ReadAllLines($ZQQKJJG)){if($TJHIX.IndexOf($LTBLSIX)-eq 0){$TJHIX.Substring($LTBLSIX.Length)}};[IO.File]::WriteAllLines($TLNZRQI,[string[]]@($DATUGLD),[Text.Encoding]::ASCII)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c call "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787692115613.cmd" & attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787692115613.cmd"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:EEGJUECY))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.cmd"
    3⤵
    - Views/modifies file attributes
    PID:2140
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\*.bat"
    3⤵
    - Views/modifies file attributes
    PID:1688
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\notif_cache\notif_cache.dat"
    3⤵
    - Views/modifies file attributes
    PID:2692
- - C:\Windows\system32\attrib.exe
    attrib -h -s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\notif_cache\notif_cache_PQKMIGOY.cmd"
    3⤵
    - Views/modifies file attributes
    PID:6104
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\notif_cache\notif_cache.dat"
    3⤵
    - Views/modifies file attributes
    PID:3264
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\notif_cache\notif_cache_PQKMIGOY.cmd"
    3⤵
    - Views/modifies file attributes
    PID:1240
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\notif_cache"
    3⤵
    - Views/modifies file attributes
    PID:3404
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787692115613.cmd"
    3⤵
    - Views/modifies file attributes
    PID:5804
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\notif_cache\notif_cache_WBVEBOWP.vbs"
    3⤵
    - Views/modifies file attributes
    PID:3400
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v GdiMapRefresh_QWXK /t REG_SZ /d "C:\Windows\System32\wscript.exe //B //nologo ""C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\notif_cache\notif_cache_WBVEBOWP.vbs"""
    3⤵
    - Adds Run key to start application
    PID:4736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:EEGJUECY))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -Command "&($executioncontext.InvokeCommand.NewScriptBlock([string]$env:EEGJUECY))"
      4⤵
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1660
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tiusjiba\tiusjiba.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3428
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES74E8.tmp" "c:\Users\Admin\AppData\Local\Temp\tiusjiba\CSCA11EFDE9BB1A495F90EB91B5F26A8CE6.TMP"
        6⤵
        
        PID:5196
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ur0ombac\ur0ombac.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1836
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7594.tmp" "c:\Users\Admin\AppData\Local\Temp\ur0ombac\CSC556B1DCBE573405EADC5B47F3C13D332.TMP"
        6⤵
        
        PID:2292
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2232
      - C:\Windows\SysWOW64\prevhost.exe
        
        "C:\Windows\SysWOW64\prevhost.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4268
    - - C:\Windows\SysWOW64\choice.exe
        
        "C:\Windows\system32\choice.exe"
        5⤵
        
        PID:4340
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787692115613.cmd"
    3⤵
    - Views/modifies file attributes
    PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20267251787692115613.cmd

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\20267251787692115613.cmd
Size 323KB
SHA256 6a5f24afe8e6b69e217dfbd3529f7c25d65254bfdbee5976c84d1c1c8d6e04ce
MD5 288c98e0dbf53aa060aea7895ffe7330
SHA1 f9ee9bb9a0e4dfd42ee08b8a867302d9560ac6c3
SHA512 5ea2446e92e4912e2d308dff813f466ec5f4778dbde3e7e043b18128bf520d11ccae97a1ebcf0dd706ec3bb2dab80c0bdccb4ee3b926a0e2d283bc09ba88ad30
SSDEEP 6144:isfPbbbpcXV2kZEPXtLM1SQCB5QMQcFLylHVkhQJCO+MnGSlBXSAY9/xQ:pjiXV2usHP3tys8nGMoAY9u
TLSH
T1E36402E695023F302CF5C08AC70295592FD9FBCA17B7D6CD718A3266218FA27CDB1919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 beb89f9355be2debcce3233a89ad4d63ec861b41b73c309d63444f4b800dc129
MD5 8ac3b3d1e522c27c6356583a6fe08ab7
SHA1 843f0de63fe13cc218d2671d5ca98bf1fd8e3dcc
SHA512 7491597d98da352fd86897832f1e3d01e14fec90f54625a275063124a6f419bb053029cf1482e65aae0e3b2769e9d7c6ff30d2e5c6a08412d6e55e0d14dd4408
TLSH
T13E116673F3CC8624DC5A403650CEAD1137B687CB449EDE6B7B84D155B82F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
MD5 113f79d4fe28129d0415c818fa6d499c
SHA1 49463c25adf3e775245b24d76f3d3ae90016318d
SHA512 faf630a2e47a033226ebeff047c44fe1c2a59a75f88192dfadc9a25a5ef349058bbaee6cca6c4afbb66a2d5e03817397244808f2b43c66ab89a975d3b294c419
TLSH
T116218933B3CC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544A42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

RES74E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES74E8.tmp
Size 1KB
SHA256 b1c2faada52d2e3cdcc62a220c2dc7012b2dc5705f1fa7de944a2ee8136ccbe2
MD5 1da802f4c5f4df1bb9e3be041d63ff45
SHA1 d5fd48d6bc1ae389c1d5837da4228ec0e9d62b78
SHA512 1e2033f3a31f4ba521ec7ed0ee2e659bbe972d2eefd6637529e9ba1a0ec830ae99b2e2f2aa44726daf6e5c6f9fbd435b63a6b69b238f98aba9d93367e5ecc181
TLSH
T1A021CC0153ED470BF1B35B3168F6132BA275FDA5EF62A36B8540522C2C11608EEF1AB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES7594.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7594.tmp
Size 1KB
SHA256 7c6ffb3330731984149b508031f233c67e1043bd17557014d3e53320e4b39593
MD5 e454924d6022d83ec8d27f66d96feab2
SHA1 c23ded3d42322ee21501947862f6b74626eb38f6
SHA512 9baefa0b28a08a3772e607e9be18c2fb5292a4cbaa3ca2596624b09fb77672b9da2009f556c3f986be14eceea6bad74a2b90da25e96e4dcb76118670dbf058a8
TLSH
T17F21C00593ED430FF07357327AFA132BA635FD55EF62A36E4540022A2C51648EEE1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rncegqkw.n3w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rncegqkw.n3w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_1660_e59764f.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_1660_e59764f.txt
Size 70B
SHA256 2369887a57570463e4914d0ae5dbfaab13d8750555c820831116225793af3b43
MD5 47eae97032805c29c18229c7f6b6cb38
SHA1 49b9048ac6ef07f561ea155052cc998aeb025f6b
SHA512 1b5c8bd4364ccfc93ddb62d8d54fb6b2b6e43440358f2523f58350e0a4691434a16e26131d3dcf772429580461783ede41dd302167ace4da9a907e91cfcc405b
TLSH
T151A0222F0CB30C0BC30A0F20280C20F002A0B0828BC2A80083C083F0B0A8E30CB0038C
MD5 SHA1 SHA512 TLSH

Submit Download

handoff_dbg_1660_e59764f.txt

Path C:\Users\Admin\AppData\Local\Temp\handoff_dbg_1660_e59764f.txt
Size 86B
SHA256 7d37b622bace8334499bb6dca16b112605ccde9d02eacd75b856c4f64c5b0f8b
MD5 b33bb8900afb5d42aa5dc28770c8dccf
SHA1 e20680a974eab62fbe62e47f09d8b600802e041b
SHA512 015afde9c667f938ba3c48d77fe4d24669cc5402aa7f3e274d1086d2bd7b65a3b3ae7a2d212d847e3d9b7efce211d362328ae4c7ddfa898aaf41d038d87f9681
TLSH
T14BA0122A08630C06C2150F50240D34E10150B44247C15480469043F07058E22CF00348
MD5 SHA1 SHA512 TLSH

Submit Download

tiusjiba.dll

Path C:\Users\Admin\AppData\Local\Temp\tiusjiba\tiusjiba.dll
Size 3KB
SHA256 bb59a4d9f5e8aee52ddf1cc08ef4bedea29534904de908daba2887b38764fe64
MD5 6f0ef5df9d3b5ff43a8dae0c932ece68
SHA1 284645b03d63cf057aac64b2e781c63343182f06
SHA512 e42654bc981c825788fcaa28790f76468b57f7fe3cd7ae9f5124f8a96b0f9db517ec6057f36d264692029232680a550c17d4edc84934e1fafb8ae099521d9770
TLSH
T160515A2697EC4627F0B74B306EF7171672B4FC609F7693AA1981432C6C606649E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

ur0ombac.dll

Path C:\Users\Admin\AppData\Local\Temp\ur0ombac\ur0ombac.dll
Size 66KB
SHA256 6a3e77da6b54953dabe4dd8ee99dbe43aa81993e5b36666c739878898b711dd0
MD5 5fbe6c2d2ea77fb267cc32eafa5afc5b
SHA1 fc8a795050d142eb5851c818e38d2c059f207a08
SHA512 aa1ba808205cf571d3343480585c3f5865c83f9aa9025b8aa22ba6319e3e682e6af60215c34d3c76d50399cc90d00c6f0323e212ec6ffdf68bc2802cb7b27d25
SSDEEP 1536:lpApJfk8mK288KbTC31L0Ea4WVIqJtPnItNGcMUYtTUSV47fCO+y3CwkHHo5g97b:lpApJfTmKD8KbTClL0Ea4WfQQ5Uxp3C3
TLSH
T12463F89577F44968F2BE6B769AB10280973470973B73E78E07E541A96F333C08606BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCA11EFDE9BB1A495F90EB91B5F26A8CE6.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\tiusjiba\CSCA11EFDE9BB1A495F90EB91B5F26A8CE6.TMP
Size 652B
SHA256 bf49b4ad1895bfd8fdc79d6ed93bcbf3f7951314a6bea0d053826292eed830c2
MD5 4c5b98b48c820f55e04c9ec81a82995a
SHA1 e25fc6f0e0444ff26e5ff73b0c1e804dd8050b62
SHA512 369a6d3b9cf54366ec90932c1277f7ed58449443d0575a1dedabfbff985d8c05dd98838568d7ae12e50e2c21cdf1752f763859ee38feb3a09f677ab1ba1c352a
TLSH
T16EF03A0963FC120AF0F34B30B9F643A391A9BCA5DE3293ED1440131D6C64624C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

tiusjiba.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tiusjiba\tiusjiba.0.cs
Size 60B
SHA256 987fefb55f5ec95ae927ada3bfbfb64e8f022193cfb3296ec65b561053578c72
MD5 5008e65bbf396b7984284b437a87f2f2
SHA1 05c32416a4a9ffc8f61bbc7c754803b56dbc06d6
SHA512 004d9177e0fab5c1e109d5243259b07c4de2c67ae4f9137b611f866395bf987f534c1f58011dbfd3c5b54de2819469fd21fd83e79678d68b28578f01f28b73f8
TLSH
T1E0A002413651E5350987D803C511CC33EB0694F05BBC7E12C1550F113E0040BB23816B
MD5 SHA1 SHA512 TLSH

Submit Download

tiusjiba.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\tiusjiba\tiusjiba.cmdline
Size 369B
SHA256 df90c008fcbc822e3bbbb48ff3a8ebacd6f7d52833aa9ebfcecc4faadc75dfa5
MD5 f44c471a9ef67caae601893660991cf4
SHA1 bc9985b616dd43c3f503a648f2fdeff6c26b0555
SHA512 fe95679d40450f3f9131bc0d0e73a15b1f0a9ce83cf5b9fcbf9f0e0da89e652f0789ecc8091e64990d13e9d3e02c6b613863cda396d92ab9b5fec30e4b0e7346
TLSH
T100E0C03A5386CE7D45FD20472169F8ACD37207432D86BFA4D040C80DE22710427D1745
MD5 SHA1 SHA512 TLSH

Submit Download

CSC556B1DCBE573405EADC5B47F3C13D332.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ur0ombac\CSC556B1DCBE573405EADC5B47F3C13D332.TMP
Size 652B
SHA256 81b2830fab049e726b623e5b612ef947958dbea46c7e3d4e26e155c4be4879f0
MD5 a7809227b67100780bb713bedd8fc98e
SHA1 295c3347190e64089b3f021e73535f803e1d59c4
SHA512 277e19ecacc0006b18dbbbbfe9a11d2468f2c17ae71f20eec63c9079124d55a8b907de7cd57f921a5b0a8a70b76d879e0dbf43a8b212b399e92f0dfe16e06b9b
TLSH
T1B9F0540963F8020EF0F34B31BEF543A39579BC65DE3253ED1550031A1C645108962F72
MD5 SHA1 SHA512 TLSH

Submit Download

ur0ombac.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ur0ombac\ur0ombac.0.cs
Size 94KB
SHA256 9ba228859e1ce93580ad10e95b4ce3861a1df13ce84bc3299fa3b5ae8214d905
MD5 947ce69c426ac5d1cf18bd701124d985
SHA1 ee2f395fb0c8c0fa9bf3ca05487b43879656166e
SHA512 3204ca222ad60c51288c938f46aeb88e3637a5e5b8b21e52924cc8c20ad2d572d5a8960c8be6f8fb9f598b30834ae3f7fcbda14557a78243670bb1aea56aa2e4
SSDEEP 1536:czrlD7vZAJLdOmXJ5UftfVpqu9qMipdjbbdAMwndoDNkm/MqB21Ss:k74dOg5UlfVpqu9qMipdjfdAMwdoDNkb
TLSH
T1A393C591A709912E6DD02529ACCC604EFB53C53123F914B4D9ADC1A03E4E67DD2BFFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur0ombac.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ur0ombac\ur0ombac.cmdline
Size 247B
SHA256 d080bdc5d66f8ddd9f0d6f3bc3c7d2d9a6ec7424330bde7a47944f95af9c02ec
MD5 2740c41de3e356c9cb9693747f4c42cf
SHA1 353e6a57cb2545fa0b10c3da1f21cf5fe5f35c09
SHA512 aa86f3772a2d7266e7f6e15b8666863c448a4e8303d456cf357672c0f92755fb4f88c7d98f78601469d4aabcb06db802e797b37daa60641d9a768338b1049a16
TLSH
T188D05E2B93C6C36A2EDA180B2D92C6AC4BB3192A1A073F608590894D119744CFBE13C2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1660-38-0x0000000006BB0000-0x0000000006BCE000-memory.dmp

Download

memory/1660-73-0x0000000008060000-0x00000000080A0000-memory.dmp

Download

memory/1660-28-0x0000000005C40000-0x0000000005CC2000-memory.dmp

Download

memory/1660-29-0x0000000005DC0000-0x0000000005DE2000-memory.dmp

Download

memory/1660-30-0x00000000064C0000-0x0000000006526000-memory.dmp

Download

memory/1660-33-0x0000000006530000-0x0000000006596000-memory.dmp

Download

memory/1660-34-0x00000000065A0000-0x00000000068FB000-memory.dmp

Download

memory/1660-35-0x0000000005E60000-0x0000000005E70000-memory.dmp

Download

memory/1660-59-0x0000000007F50000-0x0000000007F58000-memory.dmp

Download

memory/1660-37-0x0000000006A40000-0x0000000006B42000-memory.dmp

Download

memory/1660-26-0x0000000005730000-0x0000000005766000-memory.dmp

Download

memory/1660-39-0x0000000006C00000-0x0000000006C4C000-memory.dmp

Download

memory/1660-27-0x0000000005E70000-0x00000000064BA000-memory.dmp

Download

memory/1660-42-0x0000000007390000-0x00000000073B2000-memory.dmp

Download

memory/1660-40-0x0000000007E10000-0x0000000007EA6000-memory.dmp

Download

memory/1660-43-0x0000000008470000-0x0000000008A2A000-memory.dmp

Download

memory/1660-44-0x00000000090B0000-0x000000000972C000-memory.dmp

Download

memory/1660-45-0x0000000007FB0000-0x0000000007FCE000-memory.dmp

Download

memory/1660-72-0x0000000007F90000-0x0000000007FA8000-memory.dmp

Download

memory/1660-41-0x0000000007340000-0x000000000735A000-memory.dmp

Download

memory/2232-74-0x0000000005350000-0x0000000005390000-memory.dmp

Download

memory/2232-78-0x0000000010000000-0x0000000010040000-memory.dmp

Download

memory/2232-87-0x0000000005350000-0x0000000005390000-memory.dmp

Download

memory/2232-90-0x0000000005410000-0x0000000005420000-memory.dmp

Download

memory/2232-91-0x0000000005410000-0x0000000005420000-memory.dmp

Download

memory/4176-12-0x00007FF8B5C90000-0x00007FF8B6634000-memory.dmp

Download

memory/4176-2-0x00007FF8B5C90000-0x00007FF8B6634000-memory.dmp

Download

memory/4176-4-0x00007FF8B5C90000-0x00007FF8B6634000-memory.dmp

Download

memory/4176-8-0x0000027EF5B30000-0x0000027EF5B52000-memory.dmp

Download

memory/4176-3-0x0000027EF5BC0000-0x0000027EF5C42000-memory.dmp

Download

memory/4176-10-0x00007FF8B5C90000-0x00007FF8B6634000-memory.dmp

Download

memory/4176-9-0x0000027EF5A80000-0x0000027EF5A90000-memory.dmp

Download

memory/4176-0-0x00007FF8B5E1F000-0x00007FF8B5E20000-memory.dmp

Download

memory/4176-11-0x0000027EF5D60000-0x0000027EF5E62000-memory.dmp

Download

memory/4176-5-0x00007FF8B5C90000-0x00007FF8B6634000-memory.dmp

Download

memory/4176-16-0x00007FF8B5C90000-0x00007FF8B6634000-memory.dmp

Download

memory/4176-14-0x00007FF8B5C90000-0x00007FF8B6634000-memory.dmp

Download

memory/4176-1-0x00007FF8B5C90000-0x00007FF8B6634000-memory.dmp

Download

memory/4268-95-0x0000000002AF0000-0x0000000002B06000-memory.dmp

Download

memory/4268-96-0x0000000010000000-0x0000000010020000-memory.dmp

Download

memory/4268-93-0x0000000010000000-0x0000000010020000-memory.dmp

Download