Overview

overview

10

Static

static

3

New Tax Fi...ns.exe

windows10-2004-x64

10

New Tax Fi...ns.exe

windows11-ltsc_2024-x64

10

VSPMsg.dll

windows10-2004-x64

10

VSPMsg.dll

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    67s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 12:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    New Tax Filing Regulations.exe
  • Size 367KB
  • Sample261014-pmesvsvwev
  • SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceprivilege_escalationransomware

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 8.210.231.207:9090

  • 8.210.231.207:6666

Signatures

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Detects ValleyRAT payload 8 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 59 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 TTPs 6 IoCs
    defense_evasionprivilege_escalation
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Tax Filing Regulations.exe
    "C:\Users\Admin\AppData\Local\Temp\New Tax Filing Regulations.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:888
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:5284
  • C:\ProgramData\EdgeUpdate\xx7dnm13\l26k3x7n.exe
    C:\ProgramData\EdgeUpdate\xx7dnm13\l26k3x7n.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:4532
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:5792
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:2652
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:4032
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:4808
  • C:\ProgramData\EdgeUpdate\q9ph2q52\t99ocwa0.exe
    C:\ProgramData\EdgeUpdate\q9ph2q52\t99ocwa0.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:2368
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:5064
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:1948
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:1048
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:6036
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:4936
  • C:\ProgramData\EdgeUpdate\mmvj0a80\c6ay36p6.exe
    C:\ProgramData\EdgeUpdate\mmvj0a80\c6ay36p6.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:1660
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:5900
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:5800
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:3956
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:4624
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:6028
  • C:\ProgramData\EdgeUpdate\z2n6f9i3\0rs90qrv.exe
    C:\ProgramData\EdgeUpdate\z2n6f9i3\0rs90qrv.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:5740
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:4528
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:3528
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:2352
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:5568
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:392
  • C:\ProgramData\EdgeUpdate\vw1ay5me\w0zqdftt.exe
    C:\ProgramData\EdgeUpdate\vw1ay5me\w0zqdftt.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:4352
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:5348
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:908
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:4696
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:5276
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:3808
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:4372
  • C:\ProgramData\EdgeUpdate\asct1l0g\qtk92jzf.exe
    C:\ProgramData\EdgeUpdate\asct1l0g\qtk92jzf.exe
    1⤵
      PID:5076
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3308
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4316
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2780
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3628
    • C:\ProgramData\EdgeUpdate\284l4nu1\tcwardwv.exe
      C:\ProgramData\EdgeUpdate\284l4nu1\tcwardwv.exe
      1⤵
        PID:5368
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5816
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5880
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5020
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5696
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:1520
      • C:\ProgramData\EdgeUpdate\9hicj8zj\kftnlgzu.exe
        C:\ProgramData\EdgeUpdate\9hicj8zj\kftnlgzu.exe
        1⤵
          PID:4308
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:5248
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:3316
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1676
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1184
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:5344
        • C:\ProgramData\EdgeUpdate\egjovs7p\gllbsinz.exe
          C:\ProgramData\EdgeUpdate\egjovs7p\gllbsinz.exe
          1⤵
            PID:5420
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2800
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4780
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2908
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4824
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4968
          • C:\ProgramData\EdgeUpdate\zzmbbbfj\b7bqudsc.exe
            C:\ProgramData\EdgeUpdate\zzmbbbfj\b7bqudsc.exe
            1⤵
              PID:6084
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1364
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4372
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1088
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4036
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5308
            • C:\ProgramData\EdgeUpdate\trlp0x30\lg5ple01.exe
              C:\ProgramData\EdgeUpdate\trlp0x30\lg5ple01.exe
              1⤵
                PID:5716
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4752
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2628
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4892
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:6012
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3800
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:5304
              • C:\ProgramData\EdgeUpdate\4gu7wrti\ayor7g8u.exe
                C:\ProgramData\EdgeUpdate\4gu7wrti\ayor7g8u.exe
                1⤵
                  PID:3360
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1220
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4160
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3032

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      config.log
                      • Path C:\ProgramData\EdgeUpdate\xx7dnm13\config.log
                      • Size 360KB
                      • SHA256 c728b54b4d4db18f2b0fa3426f12bd9006b9f8d7d58cc5c87726a360da2cc6bc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      l26k3x7n.exe
                      • Path C:\ProgramData\EdgeUpdate\xx7dnm13\l26k3x7n.exe
                      • Size 367KB
                      • SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      powershell.exe.log
                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      • Size 2KB
                      • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 c3077e4cadb4ed246c02abe55aa6cf832fee4c2546b7addb7d22cd1c7c8c1294
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 1359d6daeaed2f254b162914203c891b23139cc236a3bf75c2dfcbe26265c84a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 976f9534aa2976c85c2455bdde786a3f55d63aefdd40942eba1223c4c93590db
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 34dd19ebba6598d5f586b5c7ac30babf89d055b5f1a6e959129a39311fe4026b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 67d7131d1a0ced6b906f2578bb0593629d6aaaedb4b843dc51912d3a35f79da2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 9d6aa78156417d11d1f960a68fdae4572deea1118a25914d99410f0dba572231
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 862d25ed22075f3d1f5e8d29a3c6e050dc91e53a4dc653c3f0f7c627a12ee26c
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 77f69011c214ea5a01fd2035d781914c4893aee66d784deadc22179eadfdf77f
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 e8f1393a9e1a21ef9c18231e6d1301624694e6036ec8ddf1234219eb96222a28
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 ad07460e061642c0dd4e7dfa7b821aacce873e290389e72f708e9f3504f9d135
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 c88e4bbb64f7fa31429ebe82c1cf07785c44486f37576f783a26ac856e02a4eb
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 944B
                      • SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      __PSScriptPolicyTest_ryykhurr.xkg.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ryykhurr.xkg.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      memory/3288-138-0x000000000A0A0000-0x000000000A102000-memory.dmp
                      Download

                      memory/3288-223-0x000000000C560000-0x000000000C5C2000-memory.dmp
                      Download

                      memory/3288-55-0x000000000A0A0000-0x000000000A102000-memory.dmp
                      Download

                      memory/3288-56-0x000000000A0A0000-0x000000000A102000-memory.dmp
                      Download

                      memory/3288-54-0x000000000A0A0000-0x000000000A102000-memory.dmp
                      Download

                      memory/3288-53-0x000000000A0A0000-0x000000000A102000-memory.dmp
                      Download

                      memory/3288-57-0x0000000009C80000-0x0000000009CDB000-memory.dmp
                      Download

                      memory/3288-52-0x000000000A0A0000-0x000000000A102000-memory.dmp
                      Download

                      memory/3288-1-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-80-0x000000000A0A0000-0x000000000A102000-memory.dmp
                      Download

                      memory/3288-81-0x000000000A0A0000-0x000000000A102000-memory.dmp
                      Download

                      memory/3288-4-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-6-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-102-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-103-0x000000000A0A0000-0x000000000A102000-memory.dmp
                      Download

                      memory/3288-105-0x000000000A0A0000-0x000000000A102000-memory.dmp
                      Download

                      memory/3288-124-0x0000000001320000-0x0000000001321000-memory.dmp
                      Download

                      memory/3288-136-0x000000000BD40000-0x000000000BDA2000-memory.dmp
                      Download

                      memory/3288-135-0x000000000BD40000-0x000000000BDA2000-memory.dmp
                      Download

                      memory/3288-134-0x000000000BD40000-0x000000000BDA2000-memory.dmp
                      Download

                      memory/3288-133-0x000000000BD40000-0x000000000BDA2000-memory.dmp
                      Download

                      memory/3288-132-0x000000000BD40000-0x000000000BDA2000-memory.dmp
                      Download

                      memory/3288-0-0x00000000035C0000-0x0000000003618000-memory.dmp
                      Download

                      memory/3288-34-0x00000000012F0000-0x00000000012F1000-memory.dmp
                      Download

                      memory/3288-149-0x000000000BD40000-0x000000000BDA2000-memory.dmp
                      Download

                      memory/3288-150-0x000000000BD40000-0x000000000BDA2000-memory.dmp
                      Download

                      memory/3288-32-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-16-0x0000000180000000-0x0000000180100000-memory.dmp
                      Download

                      memory/3288-177-0x000000000BD40000-0x000000000BDA2000-memory.dmp
                      Download

                      memory/3288-15-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-191-0x000000000BD40000-0x000000000BDA2000-memory.dmp
                      Download

                      memory/3288-210-0x0000000001310000-0x0000000001311000-memory.dmp
                      Download

                      memory/3288-211-0x000000000BD40000-0x000000000BDA2000-memory.dmp
                      Download

                      memory/3288-221-0x000000000C560000-0x000000000C5C2000-memory.dmp
                      Download

                      memory/3288-224-0x000000000C560000-0x000000000C5C2000-memory.dmp
                      Download

                      memory/3288-58-0x000000000A0A0000-0x000000000A102000-memory.dmp
                      Download

                      memory/3288-222-0x000000000C560000-0x000000000C5C2000-memory.dmp
                      Download

                      memory/3288-220-0x000000000C560000-0x000000000C5C2000-memory.dmp
                      Download

                      memory/3288-14-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-235-0x000000000C560000-0x000000000C5C2000-memory.dmp
                      Download

                      memory/3288-236-0x000000000C560000-0x000000000C5C2000-memory.dmp
                      Download

                      memory/3288-13-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-11-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-272-0x000000000C560000-0x000000000C5C2000-memory.dmp
                      Download

                      memory/3288-277-0x000000000C560000-0x000000000C5C2000-memory.dmp
                      Download

                      memory/3288-296-0x000000000C560000-0x000000000C5C2000-memory.dmp
                      Download

                      memory/3288-298-0x0000000003260000-0x0000000003261000-memory.dmp
                      Download

                      memory/3288-310-0x000000000D6F0000-0x000000000D752000-memory.dmp
                      Download

                      memory/3288-309-0x000000000D6F0000-0x000000000D752000-memory.dmp
                      Download

                      memory/3288-308-0x000000000D6F0000-0x000000000D752000-memory.dmp
                      Download

                      memory/3288-307-0x000000000D6F0000-0x000000000D752000-memory.dmp
                      Download

                      memory/3288-306-0x000000000D6F0000-0x000000000D752000-memory.dmp
                      Download

                      memory/3288-8-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-7-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-330-0x000000000D6F0000-0x000000000D752000-memory.dmp
                      Download

                      memory/3288-329-0x000000000D6F0000-0x000000000D752000-memory.dmp
                      Download

                      memory/3288-2-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-3-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-358-0x000000000D6F0000-0x000000000D752000-memory.dmp
                      Download

                      memory/3288-363-0x000000000D6F0000-0x000000000D752000-memory.dmp
                      Download

                      memory/3288-382-0x0000000003530000-0x0000000003531000-memory.dmp
                      Download

                      memory/3288-394-0x000000000F190000-0x000000000F1F2000-memory.dmp
                      Download

                      memory/3288-392-0x000000000F190000-0x000000000F1F2000-memory.dmp
                      Download

                      memory/3288-391-0x000000000F190000-0x000000000F1F2000-memory.dmp
                      Download

                      memory/3288-390-0x000000000F190000-0x000000000F1F2000-memory.dmp
                      Download

                      memory/3288-393-0x000000000F190000-0x000000000F1F2000-memory.dmp
                      Download

                      memory/3288-5-0x0000000008CC0000-0x0000000008D1F000-memory.dmp
                      Download

                      memory/3288-404-0x000000000D6F0000-0x000000000D752000-memory.dmp
                      Download

                      memory/5284-38-0x00000160FA760000-0x00000160FA770000-memory.dmp
                      Download

                      memory/5284-41-0x00000160FA760000-0x00000160FA770000-memory.dmp
                      Download

                      memory/5284-42-0x00000160FA590000-0x00000160FA5B2000-memory.dmp
                      Download