Overview
overview
6Static
static
3FPSDoctor_...up.exe
windows10-2004-x64
6FPSDoctor_...up.exe
windows11-ltsc_2024-x64
5$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3FPSDoctor.exe
windows10-2004-x64
6FPSDoctor.exe
windows11-ltsc_2024-x64
6fps-doctor...re.exe
windows10-2004-x64
1fps-doctor...re.exe
windows11-ltsc_2024-x64
1fps-doctor...re.exe
windows10-2004-x64
4fps-doctor...re.exe
windows11-ltsc_2024-x64
4fps-doctor...ar.exe
windows10-2004-x64
1fps-doctor...ar.exe
windows11-ltsc_2024-x64
1resources/...up.exe
windows10-2004-x64
1resources/...up.exe
windows11-ltsc_2024-x64
1Analysis
- user interaction
yes - max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 16:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FPSDoctor_1.4.7_x64-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
FPSDoctor_1.4.7_x64-setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
FPSDoctor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral20
Sample
FPSDoctor.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
Behavioral task
behavioral21
Sample
fps-doctor-capture.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
fps-doctor-capture.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
fps-doctor-hardware.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
fps-doctor-hardware.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
fps-doctor-sidecar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
fps-doctor-sidecar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/PawnIO_setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/PawnIO_setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target FPSDoctor_1.4.7_x64-setup.exe
- Size 38.9MB
- Sample260804-t7fywavfkd
- SHA256 94d5750d2908998cb7a03c0428e34472652ed9a190dcc5bb8485f993e7ede43c
- MD5 a4d5b21d16710221fdc3bedbae8f18a1
- SHA1 6c120288e772bf7c492c4a36f22cff8544c7c1c6
- SHA512 880df3c87b34bee6804dc3f4f99a5dd3e690ad950bce89317922705c91dcd2b790462e1c70050d43f9291e984428e3d8f63e02c8f2a87217923cda73f83c8f6e
- SSDEEP 786432:paIc8qVXeLEwM/QUzqUJMBc0xib09l4i+oGoOeOhWboiJ/udtnNgLj7Jbz2pEp+N:p5qVXKEx/QU9T0xZlxVEWbvJ4tNgX7t8
- TLSH T1609733ABD9AB14BBE131E5740606D6F5362CAF87283495EAFB78344E8C560DF14FE012
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: fps-doctor-hardware.exe File opened (read-only) \??\Y: fps-doctor-hardware.exe File opened (read-only) \??\J: fps-doctor-hardware.exe File opened (read-only) \??\N: fps-doctor-hardware.exe File opened (read-only) \??\W: fps-doctor-hardware.exe File opened (read-only) \??\X: fps-doctor-hardware.exe File opened (read-only) \??\Z: fps-doctor-hardware.exe File opened (read-only) \??\H: fps-doctor-hardware.exe File opened (read-only) \??\R: fps-doctor-hardware.exe File opened (read-only) \??\U: fps-doctor-hardware.exe File opened (read-only) \??\V: fps-doctor-hardware.exe File opened (read-only) \??\A: fps-doctor-hardware.exe File opened (read-only) \??\D: fps-doctor-hardware.exe File opened (read-only) \??\E: fps-doctor-hardware.exe File opened (read-only) \??\F: fps-doctor-hardware.exe File opened (read-only) \??\K: fps-doctor-hardware.exe File opened (read-only) \??\L: fps-doctor-hardware.exe File opened (read-only) \??\M: fps-doctor-hardware.exe File opened (read-only) \??\O: fps-doctor-hardware.exe File opened (read-only) \??\B: fps-doctor-hardware.exe File opened (read-only) \??\G: fps-doctor-hardware.exe File opened (read-only) \??\I: fps-doctor-hardware.exe File opened (read-only) \??\P: fps-doctor-hardware.exe File opened (read-only) \??\Q: fps-doctor-hardware.exe File opened (read-only) \??\S: fps-doctor-hardware.exe - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{7b3bb1ea-2104-aa4a-a963-47e0472c0216}\SETC33B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7b3bb1ea-2104-aa4a-a963-47e0472c0216}\PawnIO.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7b3bb1ea-2104-aa4a-a963-47e0472c0216}\SETC34C.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7b3bb1ea-2104-aa4a-a963-47e0472c0216}\PawnIO.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7b3bb1ea-2104-aa4a-a963-47e0472c0216}\SETC34D.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7b3bb1ea-2104-aa4a-a963-47e0472c0216} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.PNF PawnIO_setup.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7b3bb1ea-2104-aa4a-a963-47e0472c0216}\pawnio.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7b3bb1ea-2104-aa4a-a963-47e0472c0216}\SETC33B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{7b3bb1ea-2104-aa4a-a963-47e0472c0216}\SETC34C.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{7b3bb1ea-2104-aa4a-a963-47e0472c0216}\SETC34D.tmp DrvInst.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 19 IoCs
description ioc Process File created C:\Program Files\FPSDoctor\FPSDoctor.exe FPSDoctor_1.4.7_x64-setup.exe File created C:\Program Files\FPSDoctor\resources\PawnIO_setup.exe FPSDoctor_1.4.7_x64-setup.exe File created C:\Program Files\FPSDoctor\fps-doctor-capture.exe FPSDoctor_1.4.7_x64-setup.exe File created C:\Program Files\FPSDoctor\fps-doctor-hardware.exe FPSDoctor_1.4.7_x64-setup.exe File opened for modification C:\Program Files\PawnIO\PawnIOLib.h PawnIO_setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3968_15913296\manifest.json msedgewebview2.exe File opened for modification C:\Program Files\FPSDoctor\resources\PawnIO_setup.exe FPSDoctor_1.4.7_x64-setup.exe File opened for modification C:\Program Files\FPSDoctor\fps-doctor-hardware.exe FPSDoctor_1.4.7_x64-setup.exe File created C:\Program Files\FPSDoctor\uninstall.exe FPSDoctor_1.4.7_x64-setup.exe File created C:\Program Files\PawnIO\uninstall.exe PawnIO_setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3968_15913296\ct_config.pb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3968_15913296\manifest.fingerprint msedgewebview2.exe File opened for modification C:\Program Files\FPSDoctor\fps-doctor-capture.exe FPSDoctor_1.4.7_x64-setup.exe File opened for modification C:\Program Files\PawnIO\PawnIOLib.dll PawnIO_setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3968_15913296\crs.pb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3968_15913296\kp_pinslist.pb msedgewebview2.exe File created C:\Program Files\FPSDoctor\fps-doctor-sidecar.exe FPSDoctor_1.4.7_x64-setup.exe File opened for modification C:\Program Files\FPSDoctor\fps-doctor-sidecar.exe FPSDoctor_1.4.7_x64-setup.exe File opened for modification C:\Program Files\PawnIO\PawnIOUtil.exe PawnIO_setup.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log PawnIO_setup.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - Executes dropped EXE 4 IoCs
pid Process 3772 PawnIO_setup.exe 3668 FPSDoctor.exe 4764 FPSDoctor.exe 3236 fps-doctor-hardware.exe - Loads dropped DLL 40 IoCs
pid Process 4572 FPSDoctor_1.4.7_x64-setup.exe 4572 FPSDoctor_1.4.7_x64-setup.exe 4572 FPSDoctor_1.4.7_x64-setup.exe 4572 FPSDoctor_1.4.7_x64-setup.exe 4572 FPSDoctor_1.4.7_x64-setup.exe 4572 FPSDoctor_1.4.7_x64-setup.exe 4572 FPSDoctor_1.4.7_x64-setup.exe 4572 FPSDoctor_1.4.7_x64-setup.exe 4572 FPSDoctor_1.4.7_x64-setup.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe 3236 fps-doctor-hardware.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FPSDoctor.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 FPSDoctor.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FPSDoctor_1.4.7_x64-setup.exe - Checks SCSI registry key(s) 3 TTPs 46 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 fps-doctor-hardware.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName fps-doctor-hardware.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc fps-doctor-hardware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID fps-doctor-hardware.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID PawnIO_setup.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303355031314120" msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe - Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\FPSDoctor\URL Protocol FPSDoctor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\FPSDoctor\DefaultIcon\ = "C:\\Program Files\\FPSDoctor\\FPSDoctor.exe,0" FPSDoctor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FPSDoctor\DefaultIcon\ = "\"C:\\Program Files\\FPSDoctor\\FPSDoctor.exe\",0" FPSDoctor_1.4.7_x64-setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FPSDoctor FPSDoctor_1.4.7_x64-setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\FPSDoctor\shell\open\command\ = "\"C:\\Program Files\\FPSDoctor\\FPSDoctor.exe\" \"%1\"" FPSDoctor.exe Key created \REGISTRY\MACHINE\Software\Classes\FPSDoctor\shell\open\command FPSDoctor_1.4.7_x64-setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FPSDoctor\shell\open\command FPSDoctor_1.4.7_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\FPSDoctor\shell\open\command FPSDoctor.exe Key created \REGISTRY\MACHINE\Software\Classes\FPSDoctor FPSDoctor_1.4.7_x64-setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FPSDoctor\URL Protocol FPSDoctor_1.4.7_x64-setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FPSDoctor\shell\open FPSDoctor_1.4.7_x64-setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FPSDoctor\shell\open\command\ = "\"C:\\Program Files\\FPSDoctor\\FPSDoctor.exe\" \"%1\"" FPSDoctor_1.4.7_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\FPSDoctor\DefaultIcon FPSDoctor.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\FPSDoctor\shell FPSDoctor.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\FPSDoctor\shell\open FPSDoctor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FPSDoctor\ = "URL:FPSDoctor protocol" FPSDoctor_1.4.7_x64-setup.exe Key created \REGISTRY\MACHINE\Software\Classes\FPSDoctor\DefaultIcon FPSDoctor_1.4.7_x64-setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FPSDoctor\shell FPSDoctor_1.4.7_x64-setup.exe Key created \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\FPSDoctor FPSDoctor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\FPSDoctor\ = "URL:FPSDoctor protocol" FPSDoctor.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 1992 reg.exe 3252 reg.exe - Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 FPSDoctor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c000000010000000400000000100000040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1432 schtasks.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4572 FPSDoctor_1.4.7_x64-setup.exe 4572 FPSDoctor_1.4.7_x64-setup.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3968 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeAuditPrivilege 4516 svchost.exe Token: SeSecurityPrivilege 4516 svchost.exe Token: SeLoadDriverPrivilege 3772 PawnIO_setup.exe Token: SeLoadDriverPrivilege 1060 DrvInst.exe Token: SeLoadDriverPrivilege 1060 DrvInst.exe Token: SeLoadDriverPrivilege 1060 DrvInst.exe Token: SeImpersonatePrivilege 4572 FPSDoctor_1.4.7_x64-setup.exe Token: SeImpersonatePrivilege 4572 FPSDoctor_1.4.7_x64-setup.exe - Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe - Suspicious use of SendNotifyMessage 51 IoCs
pid Process 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe 3668 FPSDoctor.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4572 wrote to memory of 3772 4572 FPSDoctor_1.4.7_x64-setup.exe 91 PID 4516 wrote to memory of 3260 4516 svchost.exe 93 PID 4516 wrote to memory of 1060 4516 svchost.exe 95 PID 3668 wrote to memory of 3968 3668 FPSDoctor.exe 105 PID 3968 wrote to memory of 3112 3968 msedgewebview2.exe 106 PID 3968 wrote to memory of 5056 3968 msedgewebview2.exe 108 PID 3968 wrote to memory of 5056 3968 msedgewebview2.exe 108 PID 3968 wrote to memory of 5056 3968 msedgewebview2.exe 108 PID 3968 wrote to memory of 3804 3968 msedgewebview2.exe 109 PID 3968 wrote to memory of 788 3968 msedgewebview2.exe 110 PID 3968 wrote to memory of 788 3968 msedgewebview2.exe 110 PID 3968 wrote to memory of 4848 3968 msedgewebview2.exe 111 PID 3968 wrote to memory of 4848 3968 msedgewebview2.exe 111 PID 3968 wrote to memory of 4848 3968 msedgewebview2.exe 111 PID 3668 wrote to memory of 1992 3668 FPSDoctor.exe 112 PID 3668 wrote to memory of 3252 3668 FPSDoctor.exe 114 PID 3668 wrote to memory of 5032 3668 FPSDoctor.exe 116 PID 3668 wrote to memory of 1432 3668 FPSDoctor.exe 118 PID 3668 wrote to memory of 3236 3668 FPSDoctor.exe 124 PID 3968 wrote to memory of 3404 3968 msedgewebview2.exe 132 PID 3968 wrote to memory of 3404 3968 msedgewebview2.exe 132 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FPSDoctor_1.4.7_x64-setup.exe"C:\Users\Admin\AppData\Local\Temp\FPSDoctor_1.4.7_x64-setup.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Program Files\FPSDoctor\resources\PawnIO_setup.exe"C:\Program Files\FPSDoctor\resources\PawnIO_setup.exe" -install -silent2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Program Files\FPSDoctor\FPSDoctor.exe"C:\Program Files\FPSDoctor\FPSDoctor.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3668.4660.108477000003693012293⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ffdf729b078,0x7ffdf729b084,0x7ffdf729b0904⤵PID:3112
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1896,i,8848569626761276368,5698594443103811542,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:24⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2132,i,8848569626761276368,5698594443103811542,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:34⤵PID:3804
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2136,i,8848569626761276368,5698594443103811542,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:84⤵PID:788
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3752,i,8848569626761276368,5698594443103811542,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1116,i,8848569626761276368,5698594443103811542,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:84⤵PID:3404
-
-
-
C:\Windows\system32\reg.exe"reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v FPSDoctor3⤵
- Modifies registry key
PID:1992
-
-
C:\Windows\system32\reg.exe"reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v FPSDoctor /f3⤵
- Modifies registry key
PID:3252
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Query /TN FPSDoctor /XML ONE3⤵PID:5032
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /SC ONLOGON /TN FPSDoctor /TR "\"C:\Program Files\FPSDoctor\FPSDoctor.exe\" --autostart" /RL HIGHEST /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:1432
-
-
C:\Program Files\FPSDoctor\fps-doctor-hardware.exe"\\?\C:\Program Files\FPSDoctor\fps-doctor-hardware.exe" graph_stream3⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:3236
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{13e0f610-5d87-974c-bd9d-915ac45e2d78}\pawnio.inf" "9" "4c553107b" "0000000000000138" "WinSta0\Default" "0000000000000150" "208" "c:\windows\temp\pawnio_1b27a99c.tmp"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3260
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\PAWNIO\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:4d51782f23653f6e:PawnIO_Device:2.2.0.0:root\pawnio," "4c553107b" "0000000000000138"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1060
-
-
C:\Program Files\FPSDoctor\FPSDoctor.exe"C:\Program Files\FPSDoctor\FPSDoctor.exe"1⤵
- Executes dropped EXE
PID:4764
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2428
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\FPSDoctor\FPSDoctor.exe
- Size 30.3MB
- SHA256 220b34b60d775b8ec609a6b3aefe2fde7decd0959089cb9634b7a409b6f070be
- MD5 fbf243f812ef61b1ab10a6da86d3f427
- SHA1 e8c1dfb414c077b56da01a1ffd9dff4da71c0131
- SHA512 21033e79bbbc960c45150e6e13df00af9698c822040765b6b29a2a0cf817f6968954eb50270a95fbd8c90ceb3a4cfd2f4c8854968467981e8bfddadfb2a09686
- SSDEEP 786432:Xldr8utKn9itWEcQrnuw/zms22fcrwppIU7:Xldr8utKn9itWEcQrnbbmsffcc
- TLSH T1ED6728257A5A9968D09BC47483478AB24E3134DB0B39B9FF44D492393F6DBF52F38218
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\FPSDoctor\resources\PawnIO_setup.exe
- Size 3.3MB
- SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
- MD5 956e73fc2a40945bc66af3a3ff963371
- SHA1 096660b9e3aeff0547dfc621c03953852afd4629
- SHA512 9415a97341dfc69d34c4f7f5081e70782ba712d8ea7d0c2ea2b44a0e90b1567cd53e400b3d29562b723d3763e0ff00116e97e2072d3fefc3a1821413aa937afd
- SSDEEP 98304:kvJ5ux3qNj0iINNFe4TBGOzq2j29hGny1xdb+16w:kvrux3m0iGcqjljCo4d6Uw
- TLSH T12EF51233D2E1B198CD95C7F0D6285DA25CEEBC45CBE57CEBC783A3292666AD09130706
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3968_15913296\crs.pb
- Size 233KB
- SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
- MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
- SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
- SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
- SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
- TLSH T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3968_15913296\manifest.json
- Size 102B
- SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
- MD5 19322c8a94f1ac01a70f8c58cdbbc720
- SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
- SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
- TLSH T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 7dabcf4754e4dfc94342e6ef59d5733ad6f807b422b979ff325b634d3b738604
- MD5 81ea744458b7901e6638a0c643eae19f
- SHA1 c208011abdb1df999b3144a99dbe3310a6922e33
- SHA512 c5e7c1215f985a9353ea216aa9c4ddd103f4940c030f58eec337311702090a5e8bf0df86a9ac368128fa707aa1f770e34d8eaadc70b21b1d9d9230270578365e
- TLSH T134D0045771730113C110343F0110575001C54D44C0410311345DD0D4054040DD005000
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 44ff10c6e4db45cf1db84bec05b33bed54b938c00a52eaf9c01c39d1a9cf7d92
- MD5 831a1fb5fc6a662a6067c3e04b8a705c
- SHA1 afd600ccbd29847758afa81fe85e6d94048cd710
- SHA512 03b0359c67828ed4372d4c5b81a3af7765d92d7b519903a1aaac3b936d374cfe39d1fc0f0b2bac93be3d5e519083fcd95321d5baf6c356f6f16da0af65542551
- TLSH T14CD0121732630236C02034370102764804C1C60FC0454201782DD5AD1B044585906441
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 8d8044ceab4f5b8b8c15640f33140beb4a09b124ce8b2ff3e2306a95ffa46f6d
- MD5 8b837bac0465a07b2b6af95760767a4b
- SHA1 9b34502f44ca5df21351fabc7a0204eaccd6b67c
- SHA512 917bd409b721bd7d32edf553a70b5e5a275289fc2c2a0b9ab5966ebec635df96c6955f5c65b3f05bd498fa33c7a50324eaa0f507816fa77b124d0571d7c7c0c0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 504B
- SHA256 55f6461b3bd4b06d1623161158e4e10e2238b32c24039bbf604afa3dda4e1c63
- MD5 c14a970f3226b5b711af5416eba22a03
- SHA1 4aeb709aa6251f31b19ef3d44d0f902ba6630f7c
- SHA512 8f5516b4b7d383aba814767ba07c1b5204eff628702234d3196ecc78137ab8af53517c7ef41709bbb3a059454a19beb72a5ec671559099fc700a46c1bb83c08d
- TLSH T196F08CE04970B1A9C38596B3B2FB022675BA1714821B0EFC586707F4B4E2F6C52029CB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Network\Network Persistent State~RFe5a4d46.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Network\TransportSecurity
- Size 188B
- SHA256 f22be37f7109db70037d7f978bbf4a2282cadede7adaff813502e12182e7564d
- MD5 42908d1758848c17bdac7e63d21e1451
- SHA1 59cbab8e798dc48b9590517fd1fc95ea916c6f73
- SHA512 7de41384b02988dd2e5368fdc2e15ce994a372133dc3726f8e2df3af630ea1a17bfc90fa282276b3c4d9a23e68fe2f0ede2b05f8bcbe2c6aa8ba730807095b77
- TLSH T15AC0C0E2443DE03B203B053329847F005F3BF030824054F8DA42013CF100076A503003
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Network\TransportSecurity~RFe59d25a.TMP
- Size 188B
- SHA256 bbf5b90eb5c8019284536572848fb0e1c59ceb735e7c771e937705b962d7aaf7
- MD5 1df2ed01d0ca4982c92b493944dbe9d4
- SHA1 c7dd7e4e3c0d9371cb55e17f95bffc5f42e15f4b
- SHA512 9a967e360052d4a29ce703ad159f1c10af2bae26c65a5553d470e57fd8671a5bed9ca2718afb6d3e99f123c1e2927fa6f71aa6d8c8cf53feaa6585bcec482ec4
- TLSH T1E1C0C0E3413DE1B220380D3109847D085F3BF034018054F8DA4205BDF1001F68103003
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Preferences
- Size 6KB
- SHA256 6c70445ea255e73cb4fcc23da3a4bef983d88f8daf735d452e9944a0d5701559
- MD5 e419f2c02e35cd9c5bca1c607af2c818
- SHA1 cce94faf98bf2744b6c0f54624a6549bdb69289e
- SHA512 cf05fa9203e8393772b40f2edb17196ae4be8aa1045f12bdf015e5888ef23f12beaa0368363bf2943d3674eecb1a8fd860ab094224f068608d6a62550f24ddae
- SSDEEP 96:stU05wtUS2b9Dff8Z8i0vhESktplm/7qx+WVHMSm+uecJImMFHdQj9+gHh8lMOB:stU0GofEZ8paxy/S+WiTImqdkHOMC
- TLSH T1FBE1CA029F6879774CCBF6197A35BB52E2F6606265D40E58EBFC861C04E66CD230790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Preferences~RFe59b7ae.TMP
- Size 6KB
- SHA256 e982325d90659de8807837a2bfa1a7bde7c33474ccf2a935b996d198b1a7f6da
- MD5 5fa0fae5e2693504ac056faca5feaee2
- SHA1 7950bff043c80f7da3b07616ca75ff566fe1d24a
- SHA512 192f88309684b04b1d0f26951574fdf688e22b226224e2453bc39ba8c57c687375612ae1cf39fecbd61a39915b9ea589fcd851331c980483a7620b2c16fa05bb
- SSDEEP 96:stU05wtUS2b9Nff8Z8i0vhESktplm/7qx+WVHMSm+uecJDR1idQj9+gq8lMEB:stU0GafEZ8paxy/S+WiTDRwdkIOM8
- TLSH T1D5D1B8025E7879774CCBE61A7A36BB52D2FA606265D41E5CEBFC851C08E66CC230790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 16KB
- SHA256 5ec34ded73cf53b59eef3e96c534716ea8f1bbc33b0ffbdc2d1863476c0a8713
- MD5 98bbd8d1e09bf319a5f558b443dda73e
- SHA1 a8bcc236c3732277b0a87b5a83dec3e6cb505d8f
- SHA512 5e9f739f8971b06478aec261e6b69339a65cb80e21bafe711219e47b00f21f1514f63959a878548b2cdc7f7a0f95bd0f71086fd0f6fc9e104538fb2af9270682
- SSDEEP 384:zL+aQikB+z/xvxjg/qhE8NbWQqn42Umt9z0:e/UxvxjgC+a+42UuF0
- TLSH T1E7729E2B54693E2369F3E905795D1B5BDBB594A290C12FB849FD6F0D02DB3D80342C17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 1KB
- SHA256 1ecd6f9f2d8984874cdc0f13f1acb6b78a762e8f70c4333029125acc2bd44efd
- MD5 71d1259ece33757f93c80810b5589c47
- SHA1 1276ade666b386c3790fb461058f6a6d93d7f25c
- SHA512 9bfcd7d7000f5d94efedd98e938c4f8b9720070e3dfb935d5cf3b45196eab943b555c130079f95107da52bd489bf1e86120e1a1702b5844b75856249c30e670d
- TLSH T18A31A73294903F737D92E54771863F972E315176D0115E9851DD8B1C01EB5CC9A16C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 2KB
- SHA256 63b14fe9af28a7522709417b79c5c37b9405f14c5fad5cee602470e7c9a69bdc
- MD5 7cc11a70155f9f1834f6e134324a301e
- SHA1 e2dd649b01e643103724997b9c46cb27d85f70a0
- SHA512 0f67cff0f1ad0cd6879b32ced7e9a276104a70097014bd9b1ec3e9496d40036c64dc0d99a771dd773fccb5ed408cd2155960de79a3401db5cdfb995971e45bb6
- TLSH T1F351E8336C446B374DE38945798B3F13AE36A161A9612FA499DD0F1C01DB58C2702C3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 16KB
- SHA256 179dbfb0d77de83ceaec113372685b28cd23ded7982391af14cc8d06dadfc7dc
- MD5 2acf642f060777d85ed3b9215f27c99f
- SHA1 928df9042bacc9cc743cb2a6f33e6474a11f4069
- SHA512 fd1c481ce6736b9eb19318bf37c777f21309da117f53f96f0909233cef4d1f282aedb066a9b893daf7d82406a394ea143c1d649376bb7b950d8ab6d121a9b029
- SSDEEP 384:z2+aQikB+z/xvxjg/qhEMNbZQqn42Umt9z0:9/UxvxjgC+7+42UuF0
- TLSH T1F5729D2B54693E2369F3E9057A5D1B5BDBB994B290C12FB889ED6F0D02DB3D80342C17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 3KB
- SHA256 36cb8244a232206f994bfb241a6e8cda5dc12a887527ebff3a566e6a009164e2
- MD5 064bdf539aa586f859053718a2cc20b5
- SHA1 8d800cf25215def28df3e6f4f5ad30afdf7c2d69
- SHA512 82bd4969d18e7af0150b00dd6fb52be80e53fca96b22b1c0b3f6a8fac6f8e9c5b8374be5ebdd7b381ff6a2bbaf0665217597d409a4cc141a8deb59a933d0c748
- TLSH T17D71B93659A4AA374EE3D945B8C63B16BBA55137E4953FA9C9EC0F0C01DB3C81342C1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State~RFe5921e6.TMP
- Size 1KB
- SHA256 468134de297f9f1398c900da0a1e795179ba33b7087f33954020dbbf3a675dc1
- MD5 4344be43fc8b1a94ba4b394b8ae38a3e
- SHA1 5f6d0739beb53c7dfc0f9b0e01be9c708e516543
- SHA512 634baf86e6b641e8121d84a3e58836889d59e9a8a9046eb6c3fc2923192369f38c8bece25635b4db590da081bb297f084236de119f448ba40b9ac27087529800
- TLSH T17821B433C4842F777E82984772563F8B3E6092B6A0205E5D91DD871C02EB9CC8B66C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
- Size 16KB
- SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
- MD5 ca6e253c3fc7718b4455493460053be3
- SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
- SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
- SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
- TLSH T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
- Size 10KB
- SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
- MD5 8061c7027f406f3e20ea5d26969f00bd
- SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
- SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
- SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
- TLSH T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\HardwareWrapper.dll
- Size 82KB
- SHA256 523d481c7f85a2f1165b664aa7ed35f94ec2a825aea44e56fb2c8e72a24e44ef
- MD5 e02a8f43dec73982ba62a2ca97b5ce70
- SHA1 a543b447fd293fdadcf07106824e8bf85e8582cb
- SHA512 a11dbe1c9a1206b29437516463b69eda1059ae4fe155b31b500da19d4e6524c8f4260d17663db63f350bb9e16ad3ac29cab0ad105caa02ce907470332336d080
- SSDEEP 1536:ob5h3oZSP+D4rqYL72om996/ETwI7BE0ub1Nz:ob55qSP+D4rqq7296K7BE0uRd
- TLSH T18B831A5173DD9210FEEDBFB49177A68942B5F9837612EF4C0E8634EA1B23380365075A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\LibreHardwareMonitorLib.dll
- Size 1.1MB
- SHA256 1ebcd7e09f11a4f2a56da626eb4c510dbff1ee03fcef8ac5af7b533423581052
- MD5 472293cf3cdf47233dfc83d7ec428e44
- SHA1 ea6128376014d0c695e2cf3a216bd18d38075350
- SHA512 aa3f3d52de3e2be8da16da42c2c20bc8a0d6a50c67b9d96ac75407cf320424030eb4686956ebe15ab3ec2ec4b35f1bfa96213140300aab11948159917dc0bbd5
- SSDEEP 12288:xiFjcE7FXRuVL2eHnTs8JAoBcCRr+5yBbJLc819/eTD1pEv1Gy7:ct7FXRuVL2eHEoTqYNcY/s
- TLSH T166450814B9DC4F3EC95A0E7738745945ABB8BC03CA98B72BB0AC774E19BB7446D04392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\Microsoft.Win32.Registry.dll
- Size 113KB
- SHA256 eb249fb10eb8687d3505fd9276480fb9a0c13dc975ce6bcc35e2e2e723e8d559
- MD5 139423d055cf754b2aeb589fb31864a2
- SHA1 e1ecdeee268572f7118b92914a26c91297bb6104
- SHA512 1731ac3d48ccc29b465589e59683f71bc31dae15d418c486f18989311d16a21a7ca03de65b1fcbd081438f8a5a02702e5c982c25816dd117f28a7ed21ae4b6ed
- SSDEEP 3072:g8wrd0FyC+tFYMK3aJSvEdy7IVi1Dv5QatHe+jD:W0DaK3aJSvEdEJRa+v
- TLSH T171B35B10BBC8810BEA7E45B99D634846E272F5CA5701ABDF42C5C09E2F637C2F672572
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Collections.Concurrent.dll
- Size 225KB
- SHA256 5a4b728246443eb3b4c0a16d9b3d04bc0bce60b7a1998fa4a75716358cc572ff
- MD5 7f5a6ed730126348f298285d83102c26
- SHA1 e9f583e45355273ec7d78bd7c62005137a9faee4
- SHA512 00d9db1f4fee5ed307928569a1933ba72fa717c641bfbd182fc8da7532a57056e5ce7c0a10324bf2b94a4aa27bc238920478d8783445bba21c67e0c0aaf20415
- SSDEEP 3072:i8Lq9jhKz6tVDNKTs4Vzof/HQLvB76qSa2ymYQraEN7Azg902iTmsPxNnUnZGAjp:Nq9jo6LUTs4eQV76qOc2mNnUnZGAJL
- TLSH T13E344A16638C0B93F5AF463D95A3C5039633A55B1312D3EF13E8A5841EA7BC1BEBB112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Collections.Specialized.dll
- Size 101KB
- SHA256 8a1cf61a6cd079444ae790123ffc90bcd8d369ec5aed0f2f95d159a6479690b3
- MD5 d327af20fb99b0511d8e490f02095ca4
- SHA1 f5a9898919ed2887a2a0d6ad3dcebe8c0675f13d
- SHA512 f15d1a84751d121cd5cb5b946c91ec338b7c21eb39ef0196b11f115bd07d582e568e502ccce7da6a41a79ee175ad70742131368d3d53b0615e6d4eb7a32a15af
- SSDEEP 1536:/9DJyipoBcR72GUFFDE3A0giv9EywNwjNYGDWrBXzWBzC:/9bpomR9U3MM4jNYGDWrBXwO
- TLSH T1CDA34A28738C8B20CB7A82FC91A38942E774F2D31752D6CF5D4895496E977C0867B26F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Collections.dll
- Size 289KB
- SHA256 fc52be0abceac360478ffffce876c99997b4af56fc36fbf07cfc38ac5b7fdd7f
- MD5 08074fb9a496eee036facaa78aa19ab3
- SHA1 1b022e56e060f802c4a5b3e4e730da6e53b81fd3
- SHA512 c3bd803dedd131ba4fc5294a83fca5af67c4d115fefef54c6488229b67ba8407439f2c50a2adcc4a424d6ff8c2a62f250e361ab9ebaccef140166f3d16a33a47
- SSDEEP 3072:MEUwvuGeTbqnDHdY81uFqzK4s2QMsf0r3p9dJ2SAmnp8SFK0gwsDi2BOLI6mFnW:90G4eDj1Fe4eL8ph2wC0awL+W
- TLSH T14254391873888725FDBF41BAE593C122E1B990938350A2CB47BDF6509FDFBD12AB6015
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.ComponentModel.Primitives.dll
- Size 77KB
- SHA256 52e0988e01955d09170339429cede1d578690418b8851e19ddbba7d22a6490f7
- MD5 2ad24d944e4d99652e80a0ac5e791bdb
- SHA1 2fd8e37b4d0c2bb3891d46a1e65e533775c062bf
- SHA512 a8cbadc9fa657645f86282573e288eb9793ffdc9cd144ff55b70d8ecfff44d276991d4654a396ff998b921d417c6c11abf8a8785b9a7b0815ff164038d60b298
- SSDEEP 1536:8SRphdlpWxFkIkSyypSM2VLIGOYu2nCW08tfzR1:8SLjlsxFJVy+hgLVO52CW04H
- TLSH T137734A1813EC0329EBAD567C96B399119570F5871323D9CF8590C95E2F8BBC1F271A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.ComponentModel.dll
- Size 29KB
- SHA256 23c6a24f67244c647a614af3249181dc68ad02acc3ebd3cdedf62b2df8da503a
- MD5 6564315ca3db43e0e2d8af8840ecd7cf
- SHA1 9623f304779a556c2816430eba45ad09758bb514
- SHA512 9595d75010762e43a5fb6ab65a9d0acad4c8d533152dca686e0102444040b8e8e3fe1960187a15060ff754af6a2afdf3b65a982a46a458f450f280db57c112a9
- SSDEEP 384:IWB1WvB0Su8Sk+J4fYcZlN6ldlKR9zhsF:nK/SrV9vs9z4
- TLSH T151D26CD6CB688227ECA75D70AAE8DA837D7DE3C58E0286670189F50D1C537C0E730538
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Console.dll
- Size 165KB
- SHA256 d6c46a682587937775464bb1a3850a9d3e11408440731fefb07d298cd6d7a99c
- MD5 cdf39fef9130164848978f5fa74bc3bb
- SHA1 dbc018077a65a7d040db7c36d0988b3ffadf4b2e
- SHA512 1b38ac592fa0519367663ca65a15ec928067d604a90d616c9f6fbd9856517ff9e104796fb1aa79bb561e8ba7c9d7ea75ed7e5ce8851e9f917f465f316c77a6a4
- SSDEEP 3072:MhK8LvmZrfHk4xul4nhu7v9QglfFRc47jwN:4yZrfDxu82Akju
- TLSH T164F37C2A97DD6527D77F86B845930301D737B8A60306E6EB418588881F93BC3FB716A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.IO.Compression.dll
- Size 409KB
- SHA256 fcc979a99b747680a81f5eaf71add66f3876588e59c90edf826c37e525d4f0b2
- MD5 e7da08754b8013602d83aeb20daf5e76
- SHA1 806e530338b70f4e32a5d3e56969cffb7531c02a
- SHA512 24de8c5f422d23bc59dde8f78bea21a8420c334b5ad226f3b43e9e8c2eb90f90766fc4d0a3e7a4b7c151207462aff62081838a43b7fa1ec48d191f48b1cc72ab
- SSDEEP 6144:f1q+7bb02wr9NJWPA5onxP3DviHrzAxidsvAWOB5R/dl0diU:0+7EXV5o93TiHuPBaR8dp
- TLSH T14A947C3463C44713EFAFC6B882568002D27066A617C6E7CBCA4DEDD8BE1E7C19A75217
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.IO.Pipelines.dll
- Size 185KB
- SHA256 427b8641bbcce1e355c8b72415bd8ef10c91eb4171c77fae001674df495cb5f8
- MD5 6b7bcdff5b7011e9bf5d9e5ec730b403
- SHA1 51f9238ac469ad70c90da81353bb5aeedbc182ad
- SHA512 58b784b0942f8cee3ed39fe8daeda2bf61b6e1603a7823302ac5b839b1b99fb96e35da7dac70d9d9fb1e7a6d3218206d158c788d8564a324b635c4044bbda384
- SSDEEP 3072:CIq60XKM6cR3RilUubgU33bltX4bgN0xmRBewipNfh/pvlxW2xAfKV83b:a3KM6aRigSewab7xW2xgKV8r
- TLSH T120048C6AD39C0713D65F85BCC1A346529BF394E65702F2CB048AE8842E977C1FE3E562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Linq.dll
- Size 681KB
- SHA256 4a5d41332ed37f7e195503ebd3f478da2ad0008cb8a9f85739b53d2df7d33d46
- MD5 0a5d406238bb9ba7195660911c1d4c25
- SHA1 df11f118d81b9d1635a54b6429e03f5fc327a76e
- SHA512 53272819d6a393d7f11b0c4d01e6102058e36583eb9cd7fc96c8c96b2b5afa5165aba6309618c4fc7e89959453684c8b97cdf07f546aadb380197f367649c683
- SSDEEP 12288:l0Gw7qPJLv73KQkvIRR/ZHC6p/XCy3esO:l0dOLzKQkvIRRJBF3esO
- TLSH T176E46D29D38C4A22CAEF467A95235161D2A195D243D2C8DB844EFD442FF3BC1677EB38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Memory.dll
- Size 157KB
- SHA256 03c2fe17dbd4e1cd709f6da1ff221eafaf3f076d23f8fc62ddff5302c152e97d
- MD5 56599786643afdaacc1f3cf4e3ac6777
- SHA1 cac3e33d65645795092c7daaf85fcb18e7934dae
- SHA512 c133000793ecc8a8532ae3dca1c49272d64c1d969656cb6e81924efdb70b4f9935a9548de1b7f58b636b4c205ecbd3f346a609b9dc7f763220497a4d7998773a
- SSDEEP 3072:8TbIW4QJ8tT49EggVul1co8s2pwaGrpXDXPjT/hR7g4:4oMhpV6waGrdPH5R7d
- TLSH T103F34A1BC3980227E92FC6BA8B6AC602EF337515D30191CB44D4DA486F53BE1BF76562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Net.NetworkInformation.dll
- Size 153KB
- SHA256 7a520cbc73fab570bc069717d0b73efc03cc100196ff42137dba24066eeedb83
- MD5 d91159b26903efb85f1f6c3a85a2ba2d
- SHA1 e249be9dc0d2cb752c80b785db1188089c50216c
- SHA512 be8ec6500a764dc83d1086ec16f50e8c284fe059ec9df45fbb9043b12fbd946d44e33e64cb934430d55461e7930da6f2e95773a125a111902db6a478fb589976
- SSDEEP 3072:9RKFGKtvFXRmLv3m1P6ncvmALVXyVwa9eT9V5xlMH+k:fYvDEYMz2PlI
- TLSH T1B8F36D1153945216EBAFC23AA1E76A03913BE5C25323E6C716C8ACDC1DB3BD1B731792
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Net.Primitives.dll
- Size 205KB
- SHA256 e0be3d784a346ffa419a5b4f6aba91d20a909a122b01ce331c4ac1560bf93c3c
- MD5 88d16beae403d4a73b3817a445d63e6f
- SHA1 14c9af8fa961e20a02252ad517771dd0d5a698d5
- SHA512 8db91adaddfdf60a227c033c54e60a95ee421f7a6b6c0cfee2f5eb830c854a2496cfd358541af894643711d3ca1abec561636566288695da735fd161508d6597
- SSDEEP 3072:yk9vXV0t5RAn/8QTvt4BBpupZAcMXBN9CbWCcjtzZUAx3Z4IbpFg6ABhlttQ8JVK:JU5SKpupZAcumbwzJ3KGYxjlHJVK
- TLSH T1F8246D2963884607F76F85788B53CA11D3B3A4839309D6DB0A94A9C53FB77C0BF72592
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Net.Sockets.dll
- Size 517KB
- SHA256 53811a06f50f436db22d1279e5a209220ff363154e7c8981c8248d38f4c7798b
- MD5 dc8b5550139e63f6c8531681459773a0
- SHA1 4992c392fc5c499080561456e3fb7c92f95faa47
- SHA512 96e6f95bdf80185c4f8b7aabeece0971cad3d6e42ec87dde6fb765936766bb58e19b8bc04c10e093ab7f45c8e32e994097b9a5092b1da43534f7763d830e93f5
- SSDEEP 6144:xyIh5VpoAH6hnmMFZpfDkR+7EyBsX4NfbGctRWf5XdSs4f+uoJZ2xIxN1TyRxRSW:pp7UjpfY+7EIyqyyeJZ2yN3ZZ8MFKHn
- TLSH T1B2B47C1A73D80F05E62ECBBCC4560182D3F0A6D71795E7CB80C8DD952F93BC5A6366A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Private.CoreLib.dll
- Size 15.3MB
- SHA256 76a49f17e83f613bc8a5b55fc98830b764e7838265aacbdbcc8f46707f80a3c9
- MD5 a49b53f149f536e90bcc05658d87aebc
- SHA1 3b05684dd5dcd813ebd6a0f6cf72092e560f5ccf
- SHA512 3eddf059079cf26974cc487affba6583e6e5302377d20f1c673845e09d85076d790b20015b06a9ecded24da88a1b65bcf70e54feae4222e6187edf8292e0638f
- SSDEEP 196608:d+P37OUBwZf3DKM3KxPrH1uk0hzOH0KrO04ddwSw0TZFyd0:d+iUBwZr73Kt1uk4OH0Kr/4DlpFp
- TLSH T153F69D20E3C98F46E13EB2BD81638629D970F8526327D6C70558DA493F23FD5633B6A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Private.Uri.dll
- Size 249KB
- SHA256 27b93d6e754d7d2e538333e3c1d520c64d7eb012dde1705e776177b273662b7d
- MD5 b1a06b4c3c0f6d03087d7a8bf045101c
- SHA1 bf7e2aeccca3645f9ebdacf6bcbef418c6e77947
- SHA512 2dac84a72556a82e6df7fe630de0fd5e3e081659dbb98013d736683c5a6cd6745ca5eddb2afd4b66fe671c171460207bbc39db84f7b2a2174cf9eb51bda694a1
- SSDEEP 6144:mjEjhVSYgnYGFr76LGZxJyjMjPhArX+AVSP3m/3tpeB9pSzF17K3O2djHMYYMpSS:mqVuhtBXl2+HtGo
- TLSH T178446D2BE3D80D2AFB2EC27D8993C152E272B5955705E7DB06BC90913F133D09A39593
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Runtime.InteropServices.dll
- Size 109KB
- SHA256 627a86a918f6669f94cf8db6ce064a4b2207b852ba6a4fecaccad7bb07859b4f
- MD5 b18883afbc4f8ec15db5ee296a446ad0
- SHA1 56edac2d32ce838750d2b07284e1017a38ed6b72
- SHA512 169bab4218970bcd4b8206ef9be98dbc609200cf5b27cda8a61d321cdba865415232fc910b2aa0794105b263756e2bb4b1b5c67500459c898783c672c5058b97
- SSDEEP 1536:xOCC7EAttQMxvPQtvC+zucKb2EW4udNY/w2yVvO0ugu94RHPXF20gf1zX:xOCoEStQMZ4vg2E5udNY42ypNu0Pcf1z
- TLSH T144B337207B98863ADA5A873C9C736D00CDB3FAC65322A6CF4184849D0FD77C567727A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Runtime.Numerics.dll
- Size 345KB
- SHA256 8c715e55c80a4ab31d086b5e51261d691b52b867b1c1f5d99c344ea4faa27f4b
- MD5 1730af6d773918de04115bfb1367440d
- SHA1 882f23dd4dafa944a34115efbc9d79e350ddd4db
- SHA512 3476785464d08b2ac3fe15eef8efb279ff9acfd5e5918cd8d615373df2d026a61d9b2e968b1f03aaf700c1afa74f4fcce0668a0846472729817322397d2c5945
- SSDEEP 6144:A+ESgPg0Tkbw6hE9e8Of6iQz4OCJrTrl7vZAhafL45NK:A+ENPg0obwcE9TOhTrlVAhM45NK
- TLSH T118747A1CF786C2E2DE3ED078E52B4102DA74768383C9E3D7549989A16E177D1A23A1F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Security.AccessControl.dll
- Size 221KB
- SHA256 0ce0621ed9cf8fde8aa78be726f7e4ba7b9e321c86ff1faa282a8e8ca1a62e86
- MD5 ccfd41fce34d598c9442a866ad43bec4
- SHA1 95e274a8dd532828fc8f121135787e96674db529
- SHA512 333235db5d62a045922ee3fa5b58731d9f76ac9d748e2a476a4dffcf83b9db562ac0f77399f5b56fe9240a0e67f30a3abff206b25109fdcbad177fb6ea6857a5
- SSDEEP 3072:A3x6DZkTetpMQTrIaQNGs2jshJUpjFLxko7uCnQ95F+8k9k/7V2moCSvqq3anB:zt2eYQG2jsh2Gq8Ek/7b8vqqUB
- TLSH T1C7248C2AB38C8D27F6AE8678D4A7C901E6B378931356D7DB0690D4542F13BC1BE73162
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Security.Principal.Windows.dll
- Size 173KB
- SHA256 b04ee5bd519137cc929b355221af2d9649f149aca7808768a0cb99e423ff8668
- MD5 d8ffc2864e10cf8ce19b637dd24309f3
- SHA1 589e48a9303b6c510408d16bc87d6255bf7e69be
- SHA512 911031dce0f9e07ca9c755847fe17c4bdcf6d4fa3cfbadece79ddba856311b7db41f81df0c231621993940a00c7fe6ab28d27434194d84609c7386bfb5e24b17
- SSDEEP 3072:9w0q/aoxoUL89AUNjsGNyxmbZ4rd1SnJXpWws68S:G0qy1ULY0mbZ8Qlh
- TLSH T1A4046D1293C84657E7AF863CC1E36205D7B3A45747419ACB5590C8A92F97BC2FF3222B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Text.Encodings.Web.dll
- Size 121KB
- SHA256 775eab42196bf9466a69e9fc86e47b8da620b7652aa4b8a62245449131ce885d
- MD5 9db84b78782a4aa1dd421b8bc6036a31
- SHA1 7e9759a9bd81395f6b733152d93682ae85459052
- SHA512 90bbd339d4e007ca3966da86ff35fb5e601c89ffb38750e00badf7a7c9424a6536dc29efd9d5da14aa4205d28a81796a5ef8061843eda79fe2152b3057b201c4
- SSDEEP 1536:R7FRA0FaMPHcO+NP/LNss/5XwY7qSA1ehJ98zVKXknG4/szX:R7LXFlr+dNsKry1ejkK0G4EL
- TLSH T132C31810B388D689C3694374D6938572DAB9BFF1035296CB09A8351A1FF27E9AF3D143
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Text.Json.dll
- Size 1.8MB
- SHA256 6945c5fc52f811e32b13597b0d2a14d365227245e21bf7daebc6986f729b25fa
- MD5 e508c206f60d3359cad70a349fe581ad
- SHA1 9d5cadee8824db16b6dd849470ffc5df4113ddcc
- SHA512 b231752cd8c4640ff543283a48721985bcc9ddb7993226573efa68b35be8bfea15be8d4ef09a1387df1d7a6f1f4723e5d35d70957364e2056dcabe5b14121c20
- SSDEEP 49152:c4a9OE7kEkWCwr8QsUJwwLBpbp95Cifbfr:G9fZsUJTzCiff
- TLSH T199957C11E3EC5227C96ED2BA80138122D671A1025312D6CBAC58FD8A7F43BD1D776DBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Text.RegularExpressions.dll
- Size 1009KB
- SHA256 b1f6aec1ed431cf5956d8bc870fb0d47c43455438c5c0110433fd125183f190d
- MD5 db9d1ac8773c841e0af0c70096f3280e
- SHA1 e87ba9f573bf9cb5ede23fe1b8125927ccdc14f5
- SHA512 5c06d4ffad4bf419eb9f4d161e8380e69cb7738d4a2015e0afb18b6cc552a7dc94223bf9e53e403ae0c63877011c7b694f2ab5587bbbf0efb7cec45a895122c6
- SSDEEP 12288:64b2yXoK6ABRKm+aXmMxgvq1ig3RB5ocEEC9St7dBzy2qfE:64dYuBRAa2QgYZv3PC8t7jqfE
- TLSH T1A6258C2C93880361D76FB639C19AD211E6756D62436986CF4808F8BB2F777C2E6F6017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Threading.AccessControl.dll
- Size 73KB
- SHA256 14e0ec8285100d4a3259a899d9ffa5269797e8ae2e3c9e119783ece06ebc62c1
- MD5 a0a9c376bcc7ad3e43b5686a1d18a447
- SHA1 23e2b1a157c98498a28f2bed2bebe49b1a2941cb
- SHA512 4da3772f8bdc5ff5786a6d35762f10c897bd7786947715e2a5c94f38ab74bd3695b9d63cd37ae136039c582f76f0c4d08b784778d5a356e7bedad5683255ac2b
- SSDEEP 768:57zwGV3/WLTfJ39KSSxntNG6saXce4JI6/avnoJ/9zx2:RwGxUN3ISS865XcRW/ovzx2
- TLSH T1EF734B14D7D8462AEABA8ABC99B3C405E530F5C14B1187CF8486F41E1FA3BC1E773666
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Threading.dll
- Size 81KB
- SHA256 96ef32e315217f24b6b701fc182cac464966cad1da94dd25a3609fe2d9f5a6ca
- MD5 ddccafbb8be31d3205273fcea7824420
- SHA1 403e6242b314445e067102d0d48c13ae35818518
- SHA512 c8d32d7b79fee789f398d45cc0c91357a7a612e27a7dedf81821aa5d4160cf0497d75861ee04b206def6eae49f4c2c84b96eba41fb561ac2154f1c212579ac6f
- SSDEEP 1536:AialBo2hUTogxqwXAXXG9Rvd5bFF9o6sionbz5:ADlBoAUkgIwXeW9RvHBF9o6Lonbl
- TLSH T106835A11B3E8091AF7BB47B9DAB36905C172FED21B11D2CF405A910D1FA7BC486B21A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm49B8.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm49B8.tmp\UserInfo.dll
- Size 4KB
- SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
- MD5 e6f30908abfc6f53b7c3c36daec4586d
- SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
- SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
- TLSH T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm49B8.tmp\modern-wizard.bmp
- Size 150KB
- SHA256 b595b9ab6b4d5aa72acf153c35017fe56fe7a68caedaa37da8c8fab273855216
- MD5 011cbb37be2ef192d3704e5053fbf7d3
- SHA1 02b94c3c9034fc4be973d7b240a9005f24e6abf1
- SHA512 bddc36c043c595a928db5ee7cf132c77d2abee413f1cb215828827d5d52e710c8c13a7f3bdd7af74d16abeb9981806acd9e855e0bbd7f5dea2dda5c29344f485
- SSDEEP 3072:89Nh/dahuqxlg7PZ2r6g8RcxXmNhlzcCafV3sV8MHM1h5H4PhYwY8FYws5b1oVkk:4h/SuqxGDC6gxAh5cCad3smMs1h5YPqS
- TLSH T1FBE3B07F45F694311EB790D12E5DD5BA278DE50C80843E046AFA9D0631CBE6C688BEDC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm49B8.tmp\nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm49B8.tmp\nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm49B8.tmp\nsis_tauri_utils.dll
- Size 48KB
- SHA256 99d938c5e6defd524296bd4190335921793e7adc6c70c3e8f031c4da78a1a95f
- MD5 f9c656155e59a9a6873678cabcf2a428
- SHA1 e8b2d4758608a02a6d3f108a97ded6c42c9cd892
- SHA512 cc063f97e25487ac3168b05fde838c844195d85fbc8ac43aeb0a4fa8fac26fa23be3c1101c271c0c9bb173a2d1a71c198167b55a2f00ca827b961754e089a1d1
- SSDEEP 1536:fwODZzTrAV5Oevq4DtXHVG0mNf9RfIY9IR:fwwy0gqaXHM8z
- TLSH T11D238E8CFDC56967E7CF19711088C9AFAA3FC7061500C967A2726E92C9863B2DFD411E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Windows\Temp\PawnIO_1B27A99C.tmp\PawnIO.inf
- Size 1KB
- SHA256 7c1c203e13693531243fbee3cb87d7b79170eae89f5729b3f41387fe68a54f0b
- MD5 0a33770fb7ac5bdf673e6d1bb78adc61
- SHA1 8c7c31ddec6eb61741958df8924dba38606b907f
- SHA512 1f4cca9fc0698aa6213aafbe7182b8576ae89a37976a9f344248257e5fe40520cb05129033a06d4235f7db0c1e6d17ee9cd31a7d0f40116f058310cea94f97a5
- TLSH T1E321F00A4DDB8F7C2C56E1651A3B43C3FAD1A1002068550CB3DC7FB85B9DD9CA32E1A5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\PawnIO_1B27A99C.tmp\PawnIO.sys
- Size 133KB
- SHA256 fca6e7d58b0cf38dbb913a2b9e532f48629145d395f454b16a9f58e97b8d3940
- MD5 a9ebaa64ddefba4f4ad3b3071c582a24
- SHA1 8cf8f0aff8ef43b34ec247c8595b61c0eb9a8b90
- SHA512 b2f3358ae897c375fde806648bf4628f57202152e8b955ad0fe6dea4ff96b42275301f00a3fd891ead42235518a2b04c2867e75269399917281ff6f171d91eff
- SSDEEP 1536:QVg8JDpk29f/cUFTdcNK2ZhC64WmTKniUWfIHRo1L8z:qzZcUFTdccipmTKbxN
- TLSH T15DD3D95EBF1D28C9E877A37C935A071AE531759837609BC741A8E8581F216FEAF38340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\PawnIO_1B27A99C.tmp\pawnio.cat
- Size 11KB
- SHA256 a37d46840280efec92063d3a21014c803939e599b4c0da4a4d063b79eeca9446
- MD5 8045cc5d557423c7cef1ddc814abe8a3
- SHA1 f5ca9d0b9d21edfa62703503d28f2f83d522d599
- SHA512 0697b171ad02a4c7741e12b64b149e7327704b64d24af934a93bd07fb75761a56988da2898ed47548637f4c0bbd1bbbe7ce0452cebea7f6415ae0944f52c48df
- SSDEEP 192:TTQTaTJTVJCUPXWEwGJhYClFU34DcX01k9z3ADLyg4pe0oWA:nk+VVFP3h3DcDR9zMLyRzoJ
- TLSH T16F321BE345A841C2D9576C6093E4F5973C3D67CB982084F922EBFA145CA73C9F72816E
- MD5 SHA1 SHA512 SSDEEP TLSH