Overview

overview

10

Static

static

3

New Tax Fi...ns.exe

windows10-2004-x64

10

New Tax Fi...ns.exe

windows11-ltsc_2024-x64

10

VSPMsg.dll

windows10-2004-x64

10

VSPMsg.dll

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    64s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/10/2026, 12:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VSPMsg.dll
  • Size 348KB
  • Sample261014-pmesvsvwev
  • SHA256 008c571e964f6ca718f5ae483c71ca5c19d9251821156e3f8910af395c6c10f8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceprivilege_escalationransomware

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 8.210.231.207:9090

  • 8.210.231.207:6666

Signatures

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Detects ValleyRAT payload 9 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 TTPs 6 IoCs
    defense_evasionprivilege_escalation
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\VSPMsg.dll,#1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:5236
  • C:\ProgramData\EdgeUpdate\gvuwz3x9\e1hw4fdy.exe
    C:\ProgramData\EdgeUpdate\gvuwz3x9\e1hw4fdy.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:5604
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:4624
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:2568
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:3244
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:860
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:3588
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:5884
  • C:\ProgramData\EdgeUpdate\4gu0m6ct\okwqpr9r.exe
    C:\ProgramData\EdgeUpdate\4gu0m6ct\okwqpr9r.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:4756
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:4836
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:5528
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:3892
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:2544
  • C:\ProgramData\EdgeUpdate\jpy6dez8\45s8lq0s.exe
    C:\ProgramData\EdgeUpdate\jpy6dez8\45s8lq0s.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:5260
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:3400
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:2412
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:2628
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:5964
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:640
  • C:\ProgramData\EdgeUpdate\p64zi327\4osikdfc.exe
    C:\ProgramData\EdgeUpdate\p64zi327\4osikdfc.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:5520
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:3832
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:5736
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:6124
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:1812
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:1044
  • C:\ProgramData\EdgeUpdate\c2rdqp0r\rhbh0xra.exe
    C:\ProgramData\EdgeUpdate\c2rdqp0r\rhbh0xra.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:3904
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:5016
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:3868
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:1860
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:5268
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:5628
  • C:\ProgramData\EdgeUpdate\pmxuxbm3\z85nctoo.exe
    C:\ProgramData\EdgeUpdate\pmxuxbm3\z85nctoo.exe
    1⤵
      PID:5880
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3524
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4732
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:5712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1696
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2596
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3000
    • C:\ProgramData\EdgeUpdate\5h7bz0ef\k4es86z2.exe
      C:\ProgramData\EdgeUpdate\5h7bz0ef\k4es86z2.exe
      1⤵
        PID:2628
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4396
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2368
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5952
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4556
      • C:\ProgramData\EdgeUpdate\zc8pcizv\wk3ahmeu.exe
        C:\ProgramData\EdgeUpdate\zc8pcizv\wk3ahmeu.exe
        1⤵
          PID:2620
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:2128
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1324
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:908
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1456
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
          1⤵
            PID:4768
          • C:\ProgramData\EdgeUpdate\1rwe5csb\devev8c6.exe
            C:\ProgramData\EdgeUpdate\1rwe5csb\devev8c6.exe
            1⤵
              PID:5012
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4748
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4468
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5480
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1752
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2012
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:968
            • C:\ProgramData\EdgeUpdate\x69ezl09\4wktati2.exe
              C:\ProgramData\EdgeUpdate\x69ezl09\4wktati2.exe
              1⤵
                PID:6072
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3180
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4980
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3308
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3988
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1240
              • C:\ProgramData\EdgeUpdate\q9zk3ip1\qdspivb1.exe
                C:\ProgramData\EdgeUpdate\q9zk3ip1\qdspivb1.exe
                1⤵
                  PID:1060
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3120
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:936
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4924
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:860
                • C:\ProgramData\EdgeUpdate\7xnubi30\pjfypb4m.exe
                  C:\ProgramData\EdgeUpdate\7xnubi30\pjfypb4m.exe
                  1⤵
                    PID:1076
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:1552
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4236
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5820
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5276
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:1328
                  • C:\ProgramData\EdgeUpdate\cekrpm0b\j6w5egqj.exe
                    C:\ProgramData\EdgeUpdate\cekrpm0b\j6w5egqj.exe
                    1⤵
                      PID:5428
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:216
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:2776
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:636
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:5252
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:32

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          config.log
                          • Path C:\ProgramData\EdgeUpdate\gvuwz3x9\config.log
                          • Size 360KB
                          • SHA256 c728b54b4d4db18f2b0fa3426f12bd9006b9f8d7d58cc5c87726a360da2cc6bc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          e1hw4fdy.exe
                          • Path C:\ProgramData\EdgeUpdate\gvuwz3x9\e1hw4fdy.exe
                          • Size 367KB
                          • SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          powershell.exe.log
                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                          • Size 2KB
                          • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 e2fb83098e114084f51ed7187334f861ce670051046c39f338928296ca9a49cf
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 88d90847196bf6fc6a8fd339d6f1fa31adc369eeb40efb83b24fe7160409ee2c
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 e834e1da338b9644d538cefd70176768816da2556939c1255d386931bd085105
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 ab075b491d20c6f66c7bd40b57538c1cfdaab5aac4715bfe3bbc7f4745860a74
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 b2dd636b7b0d3bfe44cef5e1175828b1fa7bd84d5563f54342944156ba996c16
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 976f9534aa2976c85c2455bdde786a3f55d63aefdd40942eba1223c4c93590db
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 9d97a5bbc88fdcceac25f293383f7e5ce242675460ffbfb2ee9090870c034e96
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 9fe186d8304132169445fbecc53ee702080f9f8f701e2398516600ab0479c781
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 2987e99ec7fa17bd4ab7de3cb4dc62645e1052012a5a357904d6fc6db9054147
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 366473e774d8976c7fd4dc582220666fb61a4feb3f7c95e69b2a68ad9e446ec9
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 e7fcfed5376d00e784f09167de08f1559ae2ffc5a3b3e49c10af538153d7f806
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 0e1f0e684adb40a5d0668df5fed007c9046137d7ae16a1f2f343b139d5f9bc93
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 bd827af3192bf83c75a32e51ed2de83bd3b90d6b99350721a189a57cec15d063
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 15d51ca694a0e2981e5c8c8e99285c592c9ffed28c40d25ddcd12e1df033ebbd
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 0e772f1d15426881d1c79b319c8d52919383d1c1b861d1893a94c0e8bd472f06
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 dc600748250d0dd0ffa2678049fd27ec8e56e262601f3d8a1fd7165b03f97fb8
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 ca0dfe104c1bf27f7e01999fcdabc16c6400c3da937c832c26bdbca322381d31
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 944B
                          • SHA256 77a94ef8c4258445d538a6006ffadb05afdf888f6f044e1e5466b981a07f16c5
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          __PSScriptPolicyTest_fuzfkt0y.4b0.ps1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fuzfkt0y.4b0.ps1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          memory/3256-310-0x000000000E9E0000-0x000000000EA42000-memory.dmp
                          Download

                          memory/3256-238-0x000000000C9B0000-0x000000000CA12000-memory.dmp
                          Download

                          memory/3256-5-0x00000000034D0000-0x0000000003528000-memory.dmp
                          Download

                          memory/3256-66-0x000000000A570000-0x000000000A5D2000-memory.dmp
                          Download

                          memory/3256-65-0x000000000A570000-0x000000000A5D2000-memory.dmp
                          Download

                          memory/3256-4-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-48-0x000000000A570000-0x000000000A5D2000-memory.dmp
                          Download

                          memory/3256-49-0x000000000A570000-0x000000000A5D2000-memory.dmp
                          Download

                          memory/3256-93-0x000000000A570000-0x000000000A5D2000-memory.dmp
                          Download

                          memory/3256-50-0x000000000A570000-0x000000000A5D2000-memory.dmp
                          Download

                          memory/3256-106-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-107-0x000000000A570000-0x000000000A5D2000-memory.dmp
                          Download

                          memory/3256-108-0x000000000A570000-0x000000000A5D2000-memory.dmp
                          Download

                          memory/3256-127-0x000000000A570000-0x000000000A5D2000-memory.dmp
                          Download

                          memory/3256-129-0x0000000001090000-0x0000000001091000-memory.dmp
                          Download

                          memory/3256-44-0x000000000A570000-0x000000000A5D2000-memory.dmp
                          Download

                          memory/3256-149-0x000000000B7E0000-0x000000000B842000-memory.dmp
                          Download

                          memory/3256-148-0x000000000B7E0000-0x000000000B842000-memory.dmp
                          Download

                          memory/3256-147-0x000000000B7E0000-0x000000000B842000-memory.dmp
                          Download

                          memory/3256-146-0x000000000B7E0000-0x000000000B842000-memory.dmp
                          Download

                          memory/3256-145-0x000000000B7E0000-0x000000000B842000-memory.dmp
                          Download

                          memory/3256-46-0x000000000A510000-0x000000000A56B000-memory.dmp
                          Download

                          memory/3256-47-0x000000000A570000-0x000000000A5D2000-memory.dmp
                          Download

                          memory/3256-169-0x000000000B7E0000-0x000000000B842000-memory.dmp
                          Download

                          memory/3256-170-0x000000000B7E0000-0x000000000B842000-memory.dmp
                          Download

                          memory/3256-36-0x0000000001080000-0x0000000001081000-memory.dmp
                          Download

                          memory/3256-34-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-192-0x000000000B7E0000-0x000000000B842000-memory.dmp
                          Download

                          memory/3256-194-0x000000000B7E0000-0x000000000B842000-memory.dmp
                          Download

                          memory/3256-213-0x000000000B7E0000-0x000000000B842000-memory.dmp
                          Download

                          memory/3256-215-0x00000000030C0000-0x00000000030C1000-memory.dmp
                          Download

                          memory/3256-225-0x000000000C9B0000-0x000000000CA12000-memory.dmp
                          Download

                          memory/3256-227-0x000000000C9B0000-0x000000000CA12000-memory.dmp
                          Download

                          memory/3256-224-0x000000000C9B0000-0x000000000CA12000-memory.dmp
                          Download

                          memory/3256-226-0x000000000C9B0000-0x000000000CA12000-memory.dmp
                          Download

                          memory/3256-223-0x000000000C9B0000-0x000000000CA12000-memory.dmp
                          Download

                          memory/3256-239-0x000000000C9B0000-0x000000000CA12000-memory.dmp
                          Download

                          memory/3256-1-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-18-0x0000000180000000-0x0000000180100000-memory.dmp
                          Download

                          memory/3256-17-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-266-0x000000000C9B0000-0x000000000CA12000-memory.dmp
                          Download

                          memory/3256-16-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-280-0x000000000C9B0000-0x000000000CA12000-memory.dmp
                          Download

                          memory/3256-299-0x000000000C9B0000-0x000000000CA12000-memory.dmp
                          Download

                          memory/3256-301-0x00000000030B0000-0x00000000030B1000-memory.dmp
                          Download

                          memory/3256-313-0x000000000E9E0000-0x000000000EA42000-memory.dmp
                          Download

                          memory/3256-312-0x000000000E9E0000-0x000000000EA42000-memory.dmp
                          Download

                          memory/3256-311-0x000000000E9E0000-0x000000000EA42000-memory.dmp
                          Download

                          memory/3256-6-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-309-0x000000000E9E0000-0x000000000EA42000-memory.dmp
                          Download

                          memory/3256-15-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-14-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-332-0x000000000E9E0000-0x000000000EA42000-memory.dmp
                          Download

                          memory/3256-333-0x000000000E9E0000-0x000000000EA42000-memory.dmp
                          Download

                          memory/3256-12-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-9-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-352-0x000000000E9E0000-0x000000000EA42000-memory.dmp
                          Download

                          memory/3256-8-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-366-0x000000000E9E0000-0x000000000EA42000-memory.dmp
                          Download

                          memory/3256-385-0x000000000E9E0000-0x000000000EA42000-memory.dmp
                          Download

                          memory/3256-387-0x00000000032B0000-0x00000000032B1000-memory.dmp
                          Download

                          memory/3256-399-0x0000000010790000-0x00000000107F2000-memory.dmp
                          Download

                          memory/3256-398-0x0000000010790000-0x00000000107F2000-memory.dmp
                          Download

                          memory/3256-397-0x0000000010790000-0x00000000107F2000-memory.dmp
                          Download

                          memory/3256-396-0x0000000010790000-0x00000000107F2000-memory.dmp
                          Download

                          memory/3256-395-0x0000000010790000-0x00000000107F2000-memory.dmp
                          Download

                          memory/3256-0-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-419-0x0000000010790000-0x00000000107F2000-memory.dmp
                          Download

                          memory/3256-2-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/3256-3-0x00000000074D0000-0x000000000752F000-memory.dmp
                          Download

                          memory/4624-54-0x0000023F4B940000-0x0000023F4B962000-memory.dmp
                          Download

                          memory/4624-52-0x0000023F4B970000-0x0000023F4B980000-memory.dmp
                          Download

                          memory/4624-53-0x0000023F4B970000-0x0000023F4B980000-memory.dmp
                          Download