Overview

overview

10

Static

static

3

New Tax Fi...ns.exe

windows10-2004-x64

10

New Tax Fi...ns.exe

windows11-ltsc_2024-x64

10

VSPMsg.dll

windows10-2004-x64

10

VSPMsg.dll

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    35s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/10/2026, 12:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    VSPMsg.dll
  • Size 348KB
  • Sample261014-pmesvsvwev
  • SHA256 008c571e964f6ca718f5ae483c71ca5c19d9251821156e3f8910af395c6c10f8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceprivilege_escalationransomware

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 8.210.231.207:9090

  • 8.210.231.207:6666

Signatures

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Detects ValleyRAT payload 10 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 50 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 TTPs 3 IoCs
    defense_evasionprivilege_escalation
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\VSPMsg.dll,#1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:5460
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:4352
  • C:\ProgramData\EdgeUpdate\k4mt0tza\aybscvqc.exe
    C:\ProgramData\EdgeUpdate\k4mt0tza\aybscvqc.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:2620
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious use of AdjustPrivilegeToken
    PID:3968
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:5380
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:3692
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:5792
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:1744
  • C:\ProgramData\EdgeUpdate\jv05ee5n\5bnoo4fi.exe
    C:\ProgramData\EdgeUpdate\jv05ee5n\5bnoo4fi.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious behavior: MapViewOfSection
    PID:5344
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:2280
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:2772
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:1244
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:4300
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
    1⤵
    • Command and Scripting Interpreter: PowerShell
    PID:1404
  • C:\ProgramData\EdgeUpdate\79t7xc1j\vsalx7nf.exe
    C:\ProgramData\EdgeUpdate\79t7xc1j\vsalx7nf.exe
    1⤵
      PID:1724
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4296
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1976
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:716
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
      1⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4000
    • C:\ProgramData\EdgeUpdate\en1hh39c\vgawmd4o.exe
      C:\ProgramData\EdgeUpdate\en1hh39c\vgawmd4o.exe
      1⤵
        PID:5052
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:2784
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
        1⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5388
        • C:\Windows\System32\Conhost.exe
          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          2⤵
            PID:2772
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:1244
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:3996
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
          1⤵
          • Command and Scripting Interpreter: PowerShell
          PID:4180
        • C:\ProgramData\EdgeUpdate\f260pn6s\m7q4n57l.exe
          C:\ProgramData\EdgeUpdate\f260pn6s\m7q4n57l.exe
          1⤵
            PID:4860
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3744
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4440
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:4912
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2572
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
            1⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2064
          • C:\ProgramData\EdgeUpdate\k4mkl83k\qpmsasmy.exe
            C:\ProgramData\EdgeUpdate\k4mkl83k\qpmsasmy.exe
            1⤵
              PID:3372
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3716
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1768
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5132
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1244
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
              1⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3824
            • C:\ProgramData\EdgeUpdate\ahgadtg1\o8nmoxez.exe
              C:\ProgramData\EdgeUpdate\ahgadtg1\o8nmoxez.exe
              1⤵
                PID:4672
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4044
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4844
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1088
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1796
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:2572
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
                1⤵
                • Command and Scripting Interpreter: PowerShell
                PID:3716
              • C:\ProgramData\EdgeUpdate\x5i6b716\xpmdp2sp.exe
                C:\ProgramData\EdgeUpdate\x5i6b716\xpmdp2sp.exe
                1⤵
                  PID:3592
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1084
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4704
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5452
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
                  1⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3672
                • C:\ProgramData\EdgeUpdate\cxmqwsqa\057jt02m.exe
                  C:\ProgramData\EdgeUpdate\cxmqwsqa\057jt02m.exe
                  1⤵
                    PID:5916
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2668
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5792
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3040
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:5560
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
                    1⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4932
                  • C:\ProgramData\EdgeUpdate\94v658lf\f2a66wuf.exe
                    C:\ProgramData\EdgeUpdate\94v658lf\f2a66wuf.exe
                    1⤵
                      PID:3292
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate' -Force -ErrorAction SilentlyContinue"
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4544
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'explorer.exe' -Force -ErrorAction SilentlyContinue"
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4224
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'Thunder.exe' -Force -ErrorAction SilentlyContinue"
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:3132
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force -ErrorAction SilentlyContinue"
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:4524
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -Command "Add-MpPreference -ExclusionProcess 'VSPMsg.dll' -Force -ErrorAction SilentlyContinue"
                      1⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:2144

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          aybscvqc.exe
                          • Path C:\ProgramData\EdgeUpdate\k4mt0tza\aybscvqc.exe
                          • Size 367KB
                          • SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          config.log
                          • Path C:\ProgramData\EdgeUpdate\k4mt0tza\config.log
                          • Size 360KB
                          • SHA256 c728b54b4d4db18f2b0fa3426f12bd9006b9f8d7d58cc5c87726a360da2cc6bc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 14fa66001cba0c73845bd42bba778c571c3b9f3caf5ae7387e6c0b21dc43d182
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 d90f3998d1f445fd9c0c5e670ed9de48fde231a80eb890ce052ff7fe49803cc2
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 2aae14c903dbaec09d0daa87a050d2c6fb51c9126650ccfe8bb35d847215c9b2
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 cbde6fd31b9903db4e809d7f0ebd997efc350b2c29caf2b70ae491c3432d4a1a
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 f593a5bc18c609f44f0ab9d2d72046b7ff5d2841494193e5ef06bbd8028cfb5d
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 830aefc5b1c7717a5829a916b7268d29e846fcc05374208412b34fdeabc08bda
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 99a5a863f82d412cb158c0273d2d358f0b00d6b30e8961c2e2eabd4e1e0a34f8
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 3122bb6da954dc4a07f27f1fb71f77f57f8a7491719f8bc1b4e65962b5f3bbc5
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 7043c9c4ddec3db9e7d85096c55bece21c065753492c1f572f35c6ce2903d15f
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 8f501a67b3f61b2dea575bf9ee28a3be3474af7a898fe37a7329015702d6c0a9
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 f788757bce52fa84d6a58e1c7ae0e891bee10854ee5a5658595b44f5ae39d0c8
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 cf7a6ee5633934fc30e25c47f4a043cb621b4d666bedf6dcfa2c900ea6ec86ac
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 aea3d97d05063195fbb06e1f2ab076de8e2cccc5979fda502c78e39b5b7e871b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 2307028c768767d7f131a8c5b416037f6bc975943dec7491be7a5738777dbd1c
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 3139e85d0378410a1aff3e7981a762025c00177c0a5a8574b70932bf778fb29c
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 3e64f23640e03aa144cb19e5f26c92ed1389df81bd8c834c2c2c79654596eeb7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 1b8d3d60ca13687aadf2807ba4741527b1c2e9ead3b1d17f42b2a76a7198b71e
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 24d8ae5f4116797c59fc197d8cbb19fcbb8728a987496abd69750cc5714a3b51
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 f09822e9b330ef3c823b77c123adba836f0dbb80aac4f1a6cf92ff832f3426e2
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 f7680072ca5221cf2d0f5ef9769a208e6ade25923ae1978cfe80fbdc4748dc3a
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 c80aa925cca26bbf8cbcd2bef1e3c54972994e46f98e077c20c795f776bc1616
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 dc4ebf4baa7b27ac79e1e8787c84c5adaaaad1ec2f83eaf97b5e28040afcf03b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 982b93f070c82c3324e46932d4e64d3560b7b6bb42d998876b3c3c14ca9022d4
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 da5eb62ec0a0befe9b7c569fcb8929d4a175a1465e63d612a12712931b961d98
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 8d6b1dfd6fb8f3776796cecf135b5d77a8bb39c5256ea5a2c72c7d4b5c00d865
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 c3eca1ec6f65452a3a8c3b797f54095da9dd00543cf6f3838b583d961f906869
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 ceb4c721eb0fdf508cb272c8e6f0a2c0eba831c392ba5dda0602dcc502ebe1f4
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 f37afed98e5008dc276f9ddd26ca208402a8c1cb8a55112fd7f09d344b3e0d3c
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          __PSScriptPolicyTest_m3pp2tce.n11.psm1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m3pp2tce.n11.psm1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          memory/2348-289-0x00000000091A0000-0x0000000009202000-memory.dmp
                          Download

                          memory/2348-229-0x00000000091A0000-0x0000000009202000-memory.dmp
                          Download

                          memory/2348-4-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-3-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-6-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-5-0x00000000008F0000-0x0000000000948000-memory.dmp
                          Download

                          memory/2348-2-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-72-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-73-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-71-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-70-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-69-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-75-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-74-0x0000000004EA0000-0x0000000004EFB000-memory.dmp
                          Download

                          memory/2348-1-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-80-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-79-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-8-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-84-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-7-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-11-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-374-0x000000000E040000-0x000000000E0A2000-memory.dmp
                          Download

                          memory/2348-106-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-110-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-113-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-131-0x0000000003130000-0x0000000003131000-memory.dmp
                          Download

                          memory/2348-134-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-373-0x000000000E040000-0x000000000E0A2000-memory.dmp
                          Download

                          memory/2348-375-0x000000000E040000-0x000000000E0A2000-memory.dmp
                          Download

                          memory/2348-156-0x0000000005000000-0x0000000005062000-memory.dmp
                          Download

                          memory/2348-152-0x0000000005000000-0x0000000005062000-memory.dmp
                          Download

                          memory/2348-155-0x0000000005000000-0x0000000005062000-memory.dmp
                          Download

                          memory/2348-154-0x0000000005000000-0x0000000005062000-memory.dmp
                          Download

                          memory/2348-153-0x0000000005000000-0x0000000005062000-memory.dmp
                          Download

                          memory/2348-377-0x000000000E040000-0x000000000E0A2000-memory.dmp
                          Download

                          memory/2348-163-0x0000000005000000-0x0000000005062000-memory.dmp
                          Download

                          memory/2348-162-0x0000000005000000-0x0000000005062000-memory.dmp
                          Download

                          memory/2348-376-0x000000000E040000-0x000000000E0A2000-memory.dmp
                          Download

                          memory/2348-172-0x0000000005000000-0x0000000005062000-memory.dmp
                          Download

                          memory/2348-13-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-184-0x00000000064E0000-0x0000000006542000-memory.dmp
                          Download

                          memory/2348-185-0x0000000005000000-0x0000000005062000-memory.dmp
                          Download

                          memory/2348-204-0x00000000038E0000-0x00000000038E1000-memory.dmp
                          Download

                          memory/2348-15-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-215-0x0000000005000000-0x0000000005062000-memory.dmp
                          Download

                          memory/2348-355-0x0000000009C70000-0x0000000009CD2000-memory.dmp
                          Download

                          memory/2348-228-0x00000000091A0000-0x0000000009202000-memory.dmp
                          Download

                          memory/2348-352-0x00000000031F0000-0x00000000031F1000-memory.dmp
                          Download

                          memory/2348-227-0x00000000091A0000-0x0000000009202000-memory.dmp
                          Download

                          memory/2348-226-0x00000000091A0000-0x0000000009202000-memory.dmp
                          Download

                          memory/2348-225-0x00000000091A0000-0x0000000009202000-memory.dmp
                          Download

                          memory/2348-331-0x0000000009C70000-0x0000000009CD2000-memory.dmp
                          Download

                          memory/2348-235-0x00000000091A0000-0x0000000009202000-memory.dmp
                          Download

                          memory/2348-236-0x00000000091A0000-0x0000000009202000-memory.dmp
                          Download

                          memory/2348-320-0x0000000009C70000-0x0000000009CD2000-memory.dmp
                          Download

                          memory/2348-243-0x00000000091A0000-0x0000000009202000-memory.dmp
                          Download

                          memory/2348-16-0x0000000180000000-0x0000000180100000-memory.dmp
                          Download

                          memory/2348-256-0x00000000091A0000-0x0000000009202000-memory.dmp
                          Download

                          memory/2348-277-0x0000000003070000-0x0000000003071000-memory.dmp
                          Download

                          memory/2348-312-0x0000000009C70000-0x0000000009CD2000-memory.dmp
                          Download

                          memory/2348-0-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-35-0x00000000030D0000-0x000000000312F000-memory.dmp
                          Download

                          memory/2348-302-0x0000000009C70000-0x0000000009CD2000-memory.dmp
                          Download

                          memory/2348-300-0x0000000009C70000-0x0000000009CD2000-memory.dmp
                          Download

                          memory/2348-299-0x0000000009C70000-0x0000000009CD2000-memory.dmp
                          Download

                          memory/2348-301-0x0000000009C70000-0x0000000009CD2000-memory.dmp
                          Download

                          memory/2348-298-0x0000000009C70000-0x0000000009CD2000-memory.dmp
                          Download

                          memory/2348-32-0x00000000008E0000-0x00000000008E1000-memory.dmp
                          Download

                          memory/2348-313-0x0000000009C70000-0x0000000009CD2000-memory.dmp
                          Download

                          memory/2668-649-0x00000255DB980000-0x00000255DBA32000-memory.dmp
                          Download

                          memory/3716-583-0x000001BE5AF60000-0x000001BE5B012000-memory.dmp
                          Download

                          memory/4352-53-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-54-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-61-0x000002284F980000-0x000002284F99E000-memory.dmp
                          Download

                          memory/4352-46-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-47-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-48-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-49-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-50-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-51-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-55-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-43-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-40-0x00007FFDBF02F000-0x00007FFDBF030000-memory.dmp
                          Download

                          memory/4352-52-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-56-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-78-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-57-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-64-0x000002284FA60000-0x000002284FA6A000-memory.dmp
                          Download

                          memory/4352-63-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-58-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download

                          memory/4352-62-0x000002284F9A0000-0x000002284FA52000-memory.dmp
                          Download

                          memory/4352-42-0x0000022837480000-0x00000228374A2000-memory.dmp
                          Download

                          memory/4352-41-0x00007FFDBEEA0000-0x00007FFDBF844000-memory.dmp
                          Download