Overview

overview

8

Static

static

3

fraudGPT_x64.exe

windows10-2004-x64

8

fraudGPT_x64.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    56s
  • max time network
    157s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/05/2026, 22:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fraudGPT_x64.exe
  • Size 120.8MB
  • Sample260508-2cca7se171
  • SHA256 113b865d96bf5d1b6664d019472476fb9fa412695857e914713dbeae5582e9b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 6 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks system information in the registry 2 TTPs 1 IoCs

    System information is often read in order to detect sandboxing environments.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fraudGPT_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\fraudGPT_x64.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks system information in the registry
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Windows\system32\ipconfig.exe
      "ipconfig"
      2⤵
      • Gathers network information
      PID:1100
    • C:\Windows\system32\getmac.exe
      "getmac" /FO CSV /NH
      2⤵
        PID:4320
      • C:\Users\Public\Videos\DisplayAdapter\UpdateManager\vicloud.exe
        "C:\Users\Public\Videos\DisplayAdapter\UpdateManager\vicloud.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4512
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --disable-background-networking --disable-sync --disable-logging --log-level=3 --disable-gpu about:blank
          3⤵
            PID:1628
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac609c728,0x7ffac609c734,0x7ffac609c740
              4⤵
                PID:3548
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1636,i,1734454804102065029,4303172391122798577,262144 --field-trial-handle=1924,i,3352888168353809667,12160126352764607784,262144 --variations-seed-version=20260129-170056.646000 --disable-logging --log-level=3 --mojo-platform-channel-handle=1920 /prefetch:2
                4⤵
                  PID:2112
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1088,i,15029892900135112712,8693359326873940659,524288 --field-trial-handle=1924,i,3352888168353809667,12160126352764607784,262144 --variations-seed-version=20260129-170056.646000 --disable-logging --log-level=3 --mojo-platform-channel-handle=2340 /prefetch:11
                  4⤵
                  • System Time Discovery
                  PID:5284
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,15168435009423343082,855676924791958086,524288 --field-trial-handle=1924,i,3352888168353809667,12160126352764607784,262144 --variations-seed-version=20260129-170056.646000 --disable-logging --log-level=3 --mojo-platform-channel-handle=2408 /prefetch:13
                  4⤵
                    PID:5496
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3084,i,13280527187034199976,3090964867476748887,2097152 --field-trial-handle=1924,i,3352888168353809667,12160126352764607784,262144 --variations-seed-version=20260129-170056.646000 --disable-logging --log-level=3 --mojo-platform-channel-handle=3104 /prefetch:1
                    4⤵
                      PID:1300
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3092,i,13078300422696422607,17808178810218526537,2097152 --field-trial-handle=1924,i,3352888168353809667,12160126352764607784,262144 --variations-seed-version=20260129-170056.646000 --disable-logging --log-level=3 --mojo-platform-channel-handle=3132 /prefetch:1
                      4⤵
                        PID:5832
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1088,i,14120044620373892016,12104031259068801661,524288 --field-trial-handle=1924,i,3352888168353809667,12160126352764607784,262144 --variations-seed-version=20260129-170056.646000 --disable-logging --log-level=3 --mojo-platform-channel-handle=3704 /prefetch:11
                        4⤵
                        • System Time Discovery
                        PID:3908
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5240,i,15591731468768847592,17262872066944797704,524288 --field-trial-handle=1924,i,3352888168353809667,12160126352764607784,262144 --variations-seed-version=20260129-170056.646000 --disable-logging --log-level=3 --mojo-platform-channel-handle=5288 /prefetch:14
                        4⤵
                          PID:4796
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5144,i,3087813648714925539,14597646059272540393,524288 --field-trial-handle=1924,i,3352888168353809667,12160126352764607784,262144 --variations-seed-version=20260129-170056.646000 --disable-logging --log-level=3 --mojo-platform-channel-handle=5136 /prefetch:14
                          4⤵
                            PID:4556
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5048,i,10092002902475518876,6847442976378297068,524288 --field-trial-handle=1924,i,3352888168353809667,12160126352764607784,262144 --variations-seed-version=20260129-170056.646000 --disable-logging --log-level=3 --mojo-platform-channel-handle=5080 /prefetch:14
                            4⤵
                              PID:5176
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,5675702798085528990,8920058166611447840,524288 --field-trial-handle=1924,i,3352888168353809667,12160126352764607784,262144 --variations-seed-version=20260129-170056.646000 --disable-logging --log-level=3 --mojo-platform-channel-handle=5116 /prefetch:14
                              4⤵
                                PID:6228
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --disable-background-networking --disable-sync --disable-logging --log-level=3 --disable-gpu about:blank
                              3⤵
                                PID:3612
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffac3f2c188,0x7ffac3f2c194,0x7ffac3f2c1a0
                                  4⤵
                                    PID:5184
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,8175279490880001722,10626031551772161997,524288 --field-trial-handle=2616,i,11900495409127462644,7717261647783815666,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2684 /prefetch:11
                                    4⤵
                                    • System Time Discovery
                                    PID:4892
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1624,i,5269222657589014101,11130044686240624232,262144 --field-trial-handle=2616,i,11900495409127462644,7717261647783815666,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2612 /prefetch:2
                                    4⤵
                                      PID:3144
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,12128022884734252175,3619147663293810150,524288 --field-trial-handle=2616,i,11900495409127462644,7717261647783815666,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2672 /prefetch:13
                                      4⤵
                                        PID:2464
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3308,i,16492427985468173464,217619351460535031,2097152 --field-trial-handle=2616,i,11900495409127462644,7717261647783815666,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3336 /prefetch:1
                                        4⤵
                                          PID:5808
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3328,i,1410103369586181084,5757202256008699591,2097152 --field-trial-handle=2616,i,11900495409127462644,7717261647783815666,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3368 /prefetch:1
                                          4⤵
                                            PID:5456
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,9959458691152641423,2734774399745116906,524288 --field-trial-handle=2616,i,11900495409127462644,7717261647783815666,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4900 /prefetch:14
                                            4⤵
                                              PID:4028
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,3642329927277772886,8783874211185548135,524288 --field-trial-handle=2616,i,11900495409127462644,7717261647783815666,262144 --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4920 /prefetch:14
                                              4⤵
                                                PID:3848
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
                                              3⤵
                                                PID:808
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome808240782015 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome808240782015\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome808240782015 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffac609c728,0x7ffac609c734,0x7ffac609c740
                                                  4⤵
                                                    PID:6756
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
                                                  3⤵
                                                    PID:4624
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4624240782203 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4624240782203\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ffac3f2c188,0x7ffac3f2c194,0x7ffac3f2c1a0
                                                      4⤵
                                                        PID:4644
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
                                                      3⤵
                                                        PID:568
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 about:blank
                                                          4⤵
                                                            PID:1044
                                                      • C:\Users\Public\Videos\DisplayAgent\GraphicsUpdater\OneSync.exe
                                                        "C:\Users\Public\Videos\DisplayAgent\GraphicsUpdater\OneSync.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1492
                                                        • C:\Windows\system32\ipconfig.exe
                                                          "ipconfig"
                                                          3⤵
                                                          • Gathers network information
                                                          PID:1164
                                                        • C:\Windows\system32\getmac.exe
                                                          "getmac" /FO CSV /NH
                                                          3⤵
                                                            PID:1656
                                                        • C:\Users\Public\Videos\AudioSupport\USBService\onedrive_sync.exe
                                                          "C:\Users\Public\Videos\AudioSupport\USBService\onedrive_sync.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          PID:2320
                                                        • C:\Users\Public\Pictures\SystemDriver\UpdateAgent\svc_service.exe
                                                          "C:\Users\Public\Pictures\SystemDriver\UpdateAgent\svc_service.exe"
                                                          2⤵
                                                            PID:1856
                                                            • C:\Windows\system32\netsh.exe
                                                              "netsh" advfirewall firewall add rule name=Telemetry_In_57001 dir=in action=allow protocol=TCP localport=57001
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              PID:2176
                                                            • C:\Windows\system32\netsh.exe
                                                              "netsh" advfirewall firewall add rule name=Telemetry_Out_57001 dir=out action=allow protocol=TCP localport=57001
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              PID:4284
                                                            • C:\Windows\system32\netsh.exe
                                                              "netsh" advfirewall firewall add rule name=Telemetry_In_57002 dir=in action=allow protocol=TCP localport=57002
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              PID:3960
                                                            • C:\Windows\system32\netsh.exe
                                                              "netsh" advfirewall firewall add rule name=Telemetry_Out_57002 dir=out action=allow protocol=TCP localport=57002
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              PID:4740
                                                            • C:\Windows\system32\netsh.exe
                                                              "netsh" advfirewall firewall add rule name=Telemetry_In_56001 dir=in action=allow protocol=TCP localport=56001
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              PID:1976
                                                            • C:\Windows\system32\netsh.exe
                                                              "netsh" advfirewall firewall add rule name=Telemetry_Out_56001 dir=out action=allow protocol=TCP localport=56001
                                                              3⤵
                                                              • Modifies Windows Firewall
                                                              PID:3988
                                                          • C:\Users\Public\Documents\UpdateMonitor\NetworkDriver\WinHealhCare.exe
                                                            "C:\Users\Public\Documents\UpdateMonitor\NetworkDriver\WinHealhCare.exe"
                                                            2⤵
                                                              PID:5540
                                                              • C:\Windows\system32\ipconfig.exe
                                                                "ipconfig"
                                                                3⤵
                                                                • Gathers network information
                                                                PID:5440
                                                              • C:\Windows\system32\getmac.exe
                                                                "getmac" /FO CSV /NH
                                                                3⤵
                                                                  PID:6128
                                                                • C:\Windows\system32\schtasks.exe
                                                                  "schtasks" /Query /TN GoogleUpdateHost
                                                                  3⤵
                                                                    PID:4580
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    "schtasks" /Create /TN GoogleUpdateHost /TR C:\ProgramData\Adobe\AdobeCloudSync.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART
                                                                    3⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:2916
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    "schtasks" /Query /TN EdgeUpdateHelper
                                                                    3⤵
                                                                      PID:5052
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      "schtasks" /Create /TN EdgeUpdateHelper /TR C:\ProgramData\Google\ChromeSyncHost.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART /DELAY 0001:00
                                                                      3⤵
                                                                      • Scheduled Task/Job: Scheduled Task
                                                                      PID:6992
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "powershell" -NoProfile -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\OneDriveSync.lnk'); $Shortcut.TargetPath = 'C:\Users\Public\OneDriveSync.exe'; $Shortcut.Save()"
                                                                      3⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      PID:4472
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      "schtasks" /Query /TN DriverUpdateSvc
                                                                      3⤵
                                                                        PID:7140
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        "schtasks" /Create /TN DriverUpdateSvc /TR C:\ProgramData\Intel\IntelGraphicsHost.exe /F /RL HIGHEST /RU SYSTEM /SC DAILY
                                                                        3⤵
                                                                        • Scheduled Task/Job: Scheduled Task
                                                                        PID:4076
                                                                    • C:\Users\Public\Videos\MonitorHost\MonitorUpdater\autodate.exe
                                                                      "C:\Users\Public\Videos\MonitorHost\MonitorUpdater\autodate.exe"
                                                                      2⤵
                                                                        PID:3780
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless
                                                                          3⤵
                                                                            PID:6544
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless
                                                                            3⤵
                                                                              PID:3272
                                                                        • C:\Users\Admin\AppData\Roaming\Roaming\Data\Config\manager.exe
                                                                          C:\Users\Admin\AppData\Roaming\Roaming\Data\Config\manager.exe
                                                                          1⤵
                                                                            PID:5664
                                                                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                            1⤵
                                                                              PID:900
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                              1⤵
                                                                                PID:6744
                                                                              • C:\Users\Public\Documents\UpdateMonitor\NetworkDriver\WinHealhCare.exe
                                                                                C:\Users\Public\Documents\UpdateMonitor\NetworkDriver\WinHealhCare.exe
                                                                                1⤵
                                                                                  PID:2036
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                  1⤵
                                                                                    PID:6564
                                                                                  • C:\ProgramData\Adobe\AdobeCloudSync.exe
                                                                                    C:\ProgramData\Adobe\AdobeCloudSync.exe
                                                                                    1⤵
                                                                                      PID:6396
                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                      1⤵
                                                                                        PID:1176
                                                                                      • C:\ProgramData\Microsoft\EdgeUpdateSvc.exe
                                                                                        C:\ProgramData\Microsoft\EdgeUpdateSvc.exe
                                                                                        1⤵
                                                                                          PID:4376
                                                                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                          1⤵
                                                                                            PID:6552
                                                                                          • C:\ProgramData\Google\ChromeSyncHost.exe
                                                                                            C:\ProgramData\Google\ChromeSyncHost.exe
                                                                                            1⤵
                                                                                              PID:6344
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                              1⤵
                                                                                                PID:4568
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:6356
                                                                                                • C:\Users\Public\OneDriveSync.exe
                                                                                                  C:\Users\Public\ONEDRI~1.EXE
                                                                                                  1⤵
                                                                                                    PID:6224
                                                                                                  • C:\ProgramData\Intel\IntelGraphicsHost.exe
                                                                                                    C:\ProgramData\Intel\IntelGraphicsHost.exe
                                                                                                    1⤵
                                                                                                      PID:1088

                                                                                                    Network

                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                          Reconnaissance

                                                                                                          Resource Development

                                                                                                          Initial Access

                                                                                                          Execution

                                                                                                          Command and Scripting Interpreter

                                                                                                          2
                                                                                                          T1059

                                                                                                          PowerShell

                                                                                                          1
                                                                                                          T1059.001

                                                                                                          Scheduled Task/Job

                                                                                                          1
                                                                                                          T1053

                                                                                                          Scheduled Task

                                                                                                          1
                                                                                                          T1053.005

                                                                                                          Persistence

                                                                                                          Boot or Logon Autostart Execution

                                                                                                          1
                                                                                                          T1547

                                                                                                          Registry Run Keys / Startup Folder

                                                                                                          1
                                                                                                          T1547.001

                                                                                                          Create or Modify System Process

                                                                                                          1
                                                                                                          T1543

                                                                                                          Windows Service

                                                                                                          1
                                                                                                          T1543.003

                                                                                                          Scheduled Task/Job

                                                                                                          1
                                                                                                          T1053

                                                                                                          Scheduled Task

                                                                                                          1
                                                                                                          T1053.005

                                                                                                          Privilege Escalation

                                                                                                          Boot or Logon Autostart Execution

                                                                                                          1
                                                                                                          T1547

                                                                                                          Registry Run Keys / Startup Folder

                                                                                                          1
                                                                                                          T1547.001

                                                                                                          Create or Modify System Process

                                                                                                          1
                                                                                                          T1543

                                                                                                          Windows Service

                                                                                                          1
                                                                                                          T1543.003

                                                                                                          Scheduled Task/Job

                                                                                                          1
                                                                                                          T1053

                                                                                                          Scheduled Task

                                                                                                          1
                                                                                                          T1053.005

                                                                                                          Defense Evasion

                                                                                                          Impair Defenses

                                                                                                          1
                                                                                                          T1562

                                                                                                          Disable or Modify System Firewall

                                                                                                          1
                                                                                                          T1562.004

                                                                                                          Modify Registry

                                                                                                          1
                                                                                                          T1112

                                                                                                          Credential Access

                                                                                                          Discovery

                                                                                                          Query Registry

                                                                                                          5
                                                                                                          T1012

                                                                                                          System Information Discovery

                                                                                                          5
                                                                                                          T1082

                                                                                                          System Time Discovery

                                                                                                          1
                                                                                                          T1124

                                                                                                          Lateral Movement

                                                                                                          Collection

                                                                                                          Command and Control

                                                                                                          Web Service

                                                                                                          1
                                                                                                          T1102

                                                                                                          Exfiltration

                                                                                                          Impact

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          BookmarkMergedSurfaceOrdering
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                          • Size 6B
                                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          BrowsingTopicsState
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                          • Size 414B
                                                                                                          • SHA256 753c27af9813ae13b5f3cfc9f9075be2a18fe016fe81ab03d8b4c7c23c6ed306
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          data_0
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
                                                                                                          • Size 44KB
                                                                                                          • SHA256 51fe19ebdc736757e5782b8132c76feb1dc5ff7fcd2823a0ea708294031693b0
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          data_1
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
                                                                                                          • Size 264KB
                                                                                                          • SHA256 76f29c8c850454c37d55a43014aba8625d8b312ab07e55ee08e7004409a56076
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          data_3
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
                                                                                                          • Size 4.0MB
                                                                                                          • SHA256 1807ce40d876286258720e70fb730d4b1170d54202c151ecbcc99c654298561f
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          SCT Auditing Pending Reports
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                          • Size 2B
                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          Preferences
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                          • Size 11KB
                                                                                                          • SHA256 bba53f4120cff25e5d84fa9e3c9f31c4c953035284f5cf163b296592338942e8
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Secure Preferences
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                          • Size 14KB
                                                                                                          • SHA256 f54392cfe23c918ce98faf0755c3ea0fd17b9345de948489edbc6a6dd2325938
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          CURRENT
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
                                                                                                          • Size 16B
                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          MANIFEST-000001
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
                                                                                                          • Size 41B
                                                                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          Web Data
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                                                          • Size 138KB
                                                                                                          • SHA256 cb6af025afa079aacc429a4d29c897d6acae34445451f03b7f07daf6a9c9e0b4
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Last Browser
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Browser
                                                                                                          • Size 106B
                                                                                                          • SHA256 3615498fbef408a96bf30e01c318dac2d5451b054998119080e7faac5995f590
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          Last Version
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                                          • Size 13B
                                                                                                          • SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                          • Size 91KB
                                                                                                          • SHA256 2e904b1ddece8101bae82090dc634dffda73b9155ac67b4300fd2536cdd1b727
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                          • Size 91KB
                                                                                                          • SHA256 391295ac9eb82c614beec7fd0631d66ede41b2392d48d9ae5418f12009c81e8a
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                          • Size 90KB
                                                                                                          • SHA256 cae569fb6bf9fd3c014c5547c210599684c606b40fa421f5c4b7f76b2712ebd0
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          settings.dat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                          • Size 280B
                                                                                                          • SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          settings.dat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                          • Size 280B
                                                                                                          • SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          Cookies
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
                                                                                                          • Size 20KB
                                                                                                          • SHA256 abc1d907c48055ae0003d3decc76421d227131531d108d3fd76d476224bd5ab9
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Sdch Dictionaries
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                          • Size 40B
                                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          Preferences
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                          • Size 13KB
                                                                                                          • SHA256 df12ce3937f07fd6d53c45deb40377c714b48c9ae883d8e70d6897fd326e2022
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Secure Preferences
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                          • Size 31KB
                                                                                                          • SHA256 98d92f5e7a8404d18ec70a9e6a6aeabc0444d3f0671346d229274e87bbcb96ac
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Web Data
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
                                                                                                          • Size 224KB
                                                                                                          • SHA256 e5753d368406c25e089b5b75cbb5fc1244e6016d4e7086da833f87d525db824a
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Last Version
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                                                          • Size 14B
                                                                                                          • SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 27KB
                                                                                                          • SHA256 7fc82111a92f2dfcd30b83c9ad729a3942f98e76b6488239cee40c32d7d3cdbc
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 26KB
                                                                                                          • SHA256 c579d0cd0173baefdb3548648f0b4c54d65ec864c45414640225b7bdc61d39f1
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          Local State
                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                          • Size 27KB
                                                                                                          • SHA256 56d1a282144ece0dad2f4604e92c86a678e22287d82fb89e88d5b186c24d8dec
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          0DSQymzBF8so8UfV4XY
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\0DSQymzBF8so8UfV4XY
                                                                                                          • Size 32B
                                                                                                          • SHA256 b636f2d86b60b14af9c0e6411265ec894a44bf9c6dae1872653253b6b4ce87bc
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          6cTTjdxlwE2Q9hVHwFy7m4N7L7
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\6cTTjdxlwE2Q9hVHwFy7m4N7L7
                                                                                                          • Size 640B
                                                                                                          • SHA256 91f4f4821d326f0f5ae28e5410baa370bae3532884df3c1c0761bcabb8aa19a8
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          GiQgL4R4K4JBc2xEQRhJ0FlIZ77Vri6
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\GiQgL4R4K4JBc2xEQRhJ0FlIZ77Vri6
                                                                                                          • Size 32B
                                                                                                          • SHA256 0d2cd34c2cee9088aa49f0b39db310b9846c2610bd3bf4045dbfb8ae7cbea9d3
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          settings.dat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4624240782203\Crashpad\settings.dat
                                                                                                          • Size 280B
                                                                                                          • SHA256 c46e75dc4c2c13ce78e5e1e6470f4a257d8d96c4d98e8a9cefa442ae648e11cc
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          throttle_store.dat
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\HeadlessEdge4624240782203\Crashpad\throttle_store.dat
                                                                                                          • Size 20B
                                                                                                          • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          __PSScriptPolicyTest_kbltmwpl.yee.ps1
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kbltmwpl.yee.ps1
                                                                                                          • Size 60B
                                                                                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          1e06ea7c
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\b275a020\1e06ea7c
                                                                                                          • Size 224KB
                                                                                                          • SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          43718e28
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\b275a020\43718e28
                                                                                                          • Size 96KB
                                                                                                          • SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          5da49ac3
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\b275a020\5da49ac3
                                                                                                          • Size 160KB
                                                                                                          • SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          67572b69
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\b275a020\67572b69
                                                                                                          • Size 40KB
                                                                                                          • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          87a1fea0
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\b275a020\87a1fea0
                                                                                                          • Size 204KB
                                                                                                          • SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          b536c70f
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\b275a020\b536c70f
                                                                                                          • Size 56KB
                                                                                                          • SHA256 f6dd954d4ffd30161e6ef3c3242d3576a739366f9b73f396e45583af8829d178
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          b9d85e4a
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\b275a020\b9d85e4a
                                                                                                          • Size 288KB
                                                                                                          • SHA256 c577333ad48b49cc4ec4e2c40b81f22d59d2281e4894a1b40f2b2f481563de55
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          c387656a
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\b275a020\c387656a
                                                                                                          • Size 5.0MB
                                                                                                          • SHA256 001033e527d8a1a046ed444c645eef53ec92e1cd892c102d539b581b1bcf01b7
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          nySlJxrK5AtHivrP7qrcbnBzMx2Y7q9B
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\nySlJxrK5AtHivrP7qrcbnBzMx2Y7q9B
                                                                                                          • Size 578B
                                                                                                          • SHA256 f4e9caac1237b0bbc00ea00f81cd1fc027c3ea296188929026cf5dae1b4457a8
                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                          Submit Download

                                                                                                          system_log.txt
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\system_log.txt
                                                                                                          • Size 20B
                                                                                                          • SHA256 efc321a20e2a68dd58d4725c09cde20341e4cbe88bcfe8addb995d78902c1313
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          ~update.tmp.exe
                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\~update.tmp.exe
                                                                                                          • Size 3.3MB
                                                                                                          • SHA256 4fcfcb83145223cca6db85e7c840876ec8a56d78efba856ab70287b0e5c8a696
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          WinHealhCare.exe
                                                                                                          • Path C:\Users\Public\Documents\UpdateMonitor\NetworkDriver\WinHealhCare.exe
                                                                                                          • Size 3.3MB
                                                                                                          • SHA256 fd67063ffb0bcde44dca5fea09cc0913150161d7cb13cffc2a001a0894f12690
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          .test_write_access
                                                                                                          • Path C:\Users\Public\Pictures\.test_write_access
                                                                                                          • Size 4B
                                                                                                          • SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
                                                                                                          • MD5 SHA1 SHA512
                                                                                                          Submit Download

                                                                                                          onedrive_sync.exe
                                                                                                          • Path C:\Users\Public\Videos\AudioSupport\USBService\onedrive_sync.exe
                                                                                                          • Size 12.6MB
                                                                                                          • SHA256 6ae9f9cfa8e638e933ad8b06de7434c395ec68ee9cc4e735069bfb64646bb180
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          vicloud.exe
                                                                                                          • Path C:\Users\Public\Videos\DisplayAdapter\UpdateManager\vicloud.exe
                                                                                                          • Size 1.3MB
                                                                                                          • SHA256 787a28aff72f2ecd2f5e75baf284e61bda9ab8dd3905822c6f620cce809952e8
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          OneSync.exe
                                                                                                          • Path C:\Users\Public\Videos\DisplayAgent\GraphicsUpdater\OneSync.exe
                                                                                                          • Size 3.3MB
                                                                                                          • SHA256 d5dffba463beae207aee339f88a18cfcd2ea2cd3e36e98d27297d819a1809846
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          autodate.exe
                                                                                                          • Path C:\Users\Public\Videos\MonitorHost\MonitorUpdater\autodate.exe
                                                                                                          • Size 2.2MB
                                                                                                          • SHA256 c68421ad5c81dfcdcc6a2a87d2824143d97818771c4cb593df065ee0de5deeca
                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                          Submit Download

                                                                                                          memory/1856-93-0x0000024270980000-0x00000242709CC000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1856-90-0x00000242707F0000-0x0000024270866000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1856-89-0x000002426FE60000-0x000002426FEEC000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1856-91-0x0000024270870000-0x000002427093A000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1856-356-0x000002426FEF0000-0x000002426FF02000-memory.dmp
                                                                                                          Download

                                                                                                          memory/1856-92-0x000002426FFD0000-0x0000024270002000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2580-5-0x000002DFED320000-0x000002DFED332000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2580-1623-0x000002DFCD3C0000-0x000002DFCD3CC000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2580-0-0x000002DFD10E0000-0x000002DFD10E1000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2580-3-0x000002DFCD3C0000-0x000002DFCD3CC000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2580-1-0x000002DFD10E0000-0x000002DFD10E1000-memory.dmp
                                                                                                          Download

                                                                                                          memory/2580-2-0x000002DFD10E0000-0x000002DFD10E1000-memory.dmp
                                                                                                          Download

                                                                                                          memory/3780-1019-0x0000000140000000-0x00000001400C0000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4472-1607-0x000001DAE2180000-0x000001DAE21A2000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4472-1629-0x000001DAC9B60000-0x000001DAC9B6C000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4472-1630-0x000001DAC9BA0000-0x000001DAC9BB2000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-626-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-63-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1076-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1059-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1078-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1475-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1484-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-55-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1488-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1491-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1490-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1495-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-54-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-53-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-59-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-61-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-47-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1540-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1138-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1137-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-64-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-57-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-659-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-65-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-42-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-66-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1018-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-1043-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-597-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-660-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-604-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-625-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-507-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-129-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-261-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-279-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-136-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-139-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-149-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-128-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download

                                                                                                          memory/4512-122-0x0000000140000000-0x00000001404D7000-memory.dmp
                                                                                                          Download