Overview
overview
6Static
static
3FPSDoctor_...up.exe
windows10-2004-x64
6FPSDoctor_...up.exe
windows11-ltsc_2024-x64
5$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3FPSDoctor.exe
windows10-2004-x64
6FPSDoctor.exe
windows11-ltsc_2024-x64
6fps-doctor...re.exe
windows10-2004-x64
1fps-doctor...re.exe
windows11-ltsc_2024-x64
1fps-doctor...re.exe
windows10-2004-x64
4fps-doctor...re.exe
windows11-ltsc_2024-x64
4fps-doctor...ar.exe
windows10-2004-x64
1fps-doctor...ar.exe
windows11-ltsc_2024-x64
1resources/...up.exe
windows10-2004-x64
1resources/...up.exe
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 16:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FPSDoctor_1.4.7_x64-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
FPSDoctor_1.4.7_x64-setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
FPSDoctor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral20
Sample
FPSDoctor.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
Behavioral task
behavioral21
Sample
fps-doctor-capture.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
fps-doctor-capture.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
fps-doctor-hardware.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
fps-doctor-hardware.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
fps-doctor-sidecar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
fps-doctor-sidecar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/PawnIO_setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/PawnIO_setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target FPSDoctor.exe
- Size 30.3MB
- Sample260804-t7fywavfkd
- SHA256 220b34b60d775b8ec609a6b3aefe2fde7decd0959089cb9634b7a409b6f070be
- MD5 fbf243f812ef61b1ab10a6da86d3f427
- SHA1 e8c1dfb414c077b56da01a1ffd9dff4da71c0131
- SHA512 21033e79bbbc960c45150e6e13df00af9698c822040765b6b29a2a0cf817f6968954eb50270a95fbd8c90ceb3a4cfd2f4c8854968467981e8bfddadfb2a09686
- SSDEEP 786432:Xldr8utKn9itWEcQrnuw/zms22fcrwppIU7:Xldr8utKn9itWEcQrnbbmsffcc
- TLSH T1ED6728257A5A9968D09BC47483478AB24E3134DB0B39B9FF44D492393F6DBF52F38218
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: fps-doctor-hardware.exe File opened (read-only) \??\E: fps-doctor-hardware.exe File opened (read-only) \??\F: fps-doctor-hardware.exe File opened (read-only) \??\G: fps-doctor-hardware.exe File opened (read-only) \??\N: fps-doctor-hardware.exe File opened (read-only) \??\P: fps-doctor-hardware.exe File opened (read-only) \??\R: fps-doctor-hardware.exe File opened (read-only) \??\S: fps-doctor-hardware.exe File opened (read-only) \??\A: fps-doctor-hardware.exe File opened (read-only) \??\K: fps-doctor-hardware.exe File opened (read-only) \??\L: fps-doctor-hardware.exe File opened (read-only) \??\Q: fps-doctor-hardware.exe File opened (read-only) \??\T: fps-doctor-hardware.exe File opened (read-only) \??\U: fps-doctor-hardware.exe File opened (read-only) \??\W: fps-doctor-hardware.exe File opened (read-only) \??\O: fps-doctor-hardware.exe File opened (read-only) \??\B: fps-doctor-hardware.exe File opened (read-only) \??\I: fps-doctor-hardware.exe File opened (read-only) \??\M: fps-doctor-hardware.exe File opened (read-only) \??\X: fps-doctor-hardware.exe File opened (read-only) \??\Z: fps-doctor-hardware.exe File opened (read-only) \??\H: fps-doctor-hardware.exe File opened (read-only) \??\J: fps-doctor-hardware.exe File opened (read-only) \??\V: fps-doctor-hardware.exe File opened (read-only) \??\Y: fps-doctor-hardware.exe - Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{83169c68-cdc9-8b41-a7d8-e3322e28c419}\pawnio.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{83169c68-cdc9-8b41-a7d8-e3322e28c419}\SET8DE3.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{83169c68-cdc9-8b41-a7d8-e3322e28c419}\PawnIO.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{83169c68-cdc9-8b41-a7d8-e3322e28c419} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{83169c68-cdc9-8b41-a7d8-e3322e28c419}\SET8DE3.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{83169c68-cdc9-8b41-a7d8-e3322e28c419}\SET8DE4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{83169c68-cdc9-8b41-a7d8-e3322e28c419}\PawnIO.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{83169c68-cdc9-8b41-a7d8-e3322e28c419}\SET8DE5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{83169c68-cdc9-8b41-a7d8-e3322e28c419}\SET8DE5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.PNF PawnIO_setup.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{83169c68-cdc9-8b41-a7d8-e3322e28c419}\SET8DE4.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe - Drops file in Program Files directory 61 IoCs
description ioc Process File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-nl.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-sv.hyb msedgewebview2.exe File opened for modification C:\Program Files\PawnIO\PawnIOLib.h PawnIO_setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-en-gb.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-gl.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-gu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-ml.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-nb.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-sq.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-uk.hyb msedgewebview2.exe File created C:\Program Files\PawnIO\uninstall.exe PawnIO_setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-cu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-en-us.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-sl.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-und-ethi.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\manifest.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-eu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-fr.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-or.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-pa.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_869454109\manifest.fingerprint msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-ga.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-sk.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-hr.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-la.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-lv.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-mn-cyrl.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-mr.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-mul-ethi.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\manifest.fingerprint msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-af.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-bg.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-cy.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-it.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-ta.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-tk.hyb msedgewebview2.exe File opened for modification C:\Program Files\PawnIO\PawnIOUtil.exe PawnIO_setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-be.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-de-ch-1901.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-et.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-as.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-da.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-de-1996.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-hy.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-ru.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_869454109\manifest.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-kn.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-te.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\_metadata\verified_contents.json msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-de-1901.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-hi.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-lt.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-pt.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-el.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-hu.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-bn.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-ka.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-es.hyb msedgewebview2.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-nn.hyb msedgewebview2.exe File opened for modification C:\Program Files\PawnIO\PawnIOLib.dll PawnIO_setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-cs.hyb msedgewebview2.exe - Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log PawnIO_setup.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe - Loads dropped DLL 30 IoCs
pid Process 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe 1424 fps-doctor-hardware.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FPSDoctor.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 FPSDoctor.exe - Checks SCSI registry key(s) 3 TTPs 46 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 fps-doctor-hardware.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID fps-doctor-hardware.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc fps-doctor-hardware.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName fps-doctor-hardware.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe - Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303354453962540" msedgewebview2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe - Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FPSDoctor\ = "URL:FPSDoctor protocol" FPSDoctor.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FPSDoctor\DefaultIcon FPSDoctor.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FPSDoctor\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FPSDoctor.exe,0" FPSDoctor.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FPSDoctor\shell\open\command FPSDoctor.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FPSDoctor\shell FPSDoctor.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FPSDoctor\shell\open FPSDoctor.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FPSDoctor\URL Protocol FPSDoctor.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FPSDoctor\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\FPSDoctor.exe\" \"%1\"" FPSDoctor.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\FPSDoctor FPSDoctor.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 1420 reg.exe 968 reg.exe - Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c000000010000000400000000100000040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 FPSDoctor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2696 schtasks.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1896 msedgewebview2.exe 1896 msedgewebview2.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3792 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeAuditPrivilege 1160 svchost.exe Token: SeSecurityPrivilege 1160 svchost.exe Token: SeLoadDriverPrivilege 4404 PawnIO_setup.exe Token: SeLoadDriverPrivilege 1080 DrvInst.exe Token: SeLoadDriverPrivilege 1080 DrvInst.exe Token: SeLoadDriverPrivilege 1080 DrvInst.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4300 FPSDoctor.exe 4300 FPSDoctor.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4300 FPSDoctor.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4300 wrote to memory of 3792 4300 FPSDoctor.exe 85 PID 3792 wrote to memory of 4308 3792 msedgewebview2.exe 86 PID 3792 wrote to memory of 1996 3792 msedgewebview2.exe 87 PID 3792 wrote to memory of 1996 3792 msedgewebview2.exe 87 PID 3792 wrote to memory of 1996 3792 msedgewebview2.exe 87 PID 3792 wrote to memory of 3012 3792 msedgewebview2.exe 88 PID 3792 wrote to memory of 2136 3792 msedgewebview2.exe 89 PID 3792 wrote to memory of 2136 3792 msedgewebview2.exe 89 PID 3792 wrote to memory of 3432 3792 msedgewebview2.exe 90 PID 3792 wrote to memory of 3432 3792 msedgewebview2.exe 90 PID 3792 wrote to memory of 3432 3792 msedgewebview2.exe 90 PID 4300 wrote to memory of 1420 4300 FPSDoctor.exe 93 PID 4300 wrote to memory of 968 4300 FPSDoctor.exe 95 PID 4300 wrote to memory of 2728 4300 FPSDoctor.exe 97 PID 4300 wrote to memory of 2696 4300 FPSDoctor.exe 99 PID 4300 wrote to memory of 4404 4300 FPSDoctor.exe 101 PID 1160 wrote to memory of 2056 1160 svchost.exe 105 PID 1160 wrote to memory of 1080 1160 svchost.exe 108 PID 4300 wrote to memory of 1424 4300 FPSDoctor.exe 117 PID 3792 wrote to memory of 4532 3792 msedgewebview2.exe 124 PID 3792 wrote to memory of 4532 3792 msedgewebview2.exe 124 PID 3792 wrote to memory of 1896 3792 msedgewebview2.exe 125 PID 3792 wrote to memory of 4008 3792 msedgewebview2.exe 126 PID 3792 wrote to memory of 4008 3792 msedgewebview2.exe 126 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FPSDoctor.exe"C:\Users\Admin\AppData\Local\Temp\FPSDoctor.exe"1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4300.376.92091771138162472782⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdc88fb078,0x7ffdc88fb084,0x7ffdc88fb0903⤵PID:4308
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,3604566387112864589,762497608658018229,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1744 /prefetch:23⤵PID:1996
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,3604566387112864589,762497608658018229,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:33⤵PID:3012
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2364,i,3604566387112864589,762497608658018229,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:83⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3608,i,3604566387112864589,762497608658018229,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:13⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=760,i,3604566387112864589,762497608658018229,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:83⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4348,i,3604566387112864589,762497608658018229,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:1896
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4352,i,3604566387112864589,762497608658018229,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:83⤵PID:4008
-
-
-
C:\Windows\system32\reg.exe"reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v FPSDoctor2⤵
- Modifies registry key
PID:1420
-
-
C:\Windows\system32\reg.exe"reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v FPSDoctor /f2⤵
- Modifies registry key
PID:968
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Query /TN FPSDoctor /XML ONE2⤵PID:2728
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /SC ONLOGON /TN FPSDoctor /TR "\"C:\Users\Admin\AppData\Local\Temp\FPSDoctor.exe\" --autostart" /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\resources\PawnIO_setup.exe"\\?\C:\Users\Admin\AppData\Local\Temp\resources\PawnIO_setup.exe" -install -silent2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4404
-
-
C:\Users\Admin\AppData\Local\Temp\fps-doctor-hardware.exe"\\?\C:\Users\Admin\AppData\Local\Temp\fps-doctor-hardware.exe" graph_stream2⤵
- Enumerates connected drives
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:1424
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{fec1e574-077c-dc40-87f6-3b20d182aa11}\pawnio.inf" "9" "4c553107b" "0000000000000144" "WinSta0\Default" "0000000000000154" "208" "c:\windows\temp\pawnio_dff779cd.tmp"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2056
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\PAWNIO\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:4d51782f23653f6e:PawnIO_Device:2.2.0.0:root\pawnio," "4c553107b" "0000000000000144"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
-
C:\Users\Admin\AppData\Local\Temp\FPSDoctor.exe"C:\Users\Admin\AppData\Local\Temp\FPSDoctor.exe"1⤵PID:2760
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:5116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-af.hyb
- Size 70KB
- SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
- MD5 ffa9db945f0f0c15b8bba75a6e064880
- SHA1 49217a9d5bb7a868464403b4e3c82e80df53456c
- SHA512 cc67b2dfbbb009dd3fdb999fe86410425455613c12dac755a3cded435cd25ca4363782d70f3b7bb7c0fdd63e2eb649ae6a4053d929f463b646b43d7dbfda79c0
- SSDEEP 1536:dH4Yzf/r1T2bhKC+wQ/MJ4tpBMfWDMxFaye3yrGZ3vGV9YODhX3yKfhGt:dxLr1qFKpNpufWIqye3KgGVnDxe
- TLSH T1D56329C3C62BDF90CC6419F4594D0AA811D816C6E7C039BE9B6C54797A27CB82BC13EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-as.hyb
- Size 703B
- SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
- MD5 8961fdd3db036dd43002659a4e4a7365
- SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
- SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
- TLSH T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-hi.hyb
- Size 687B
- SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
- MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
- SHA1 d0914fb069469d47a36d339ca70164253fccf022
- SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
- TLSH T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\hyph-nb.hyb
- Size 141KB
- SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
- MD5 677edd1a17d50f0bd11783f58725d0e7
- SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
- SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
- SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
- TLSH T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3792_1000481533\manifest.json
- Size 82B
- SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
- MD5 2617c38bed67a4190fc499142b6f2867
- SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
- SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
- TLSH T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping3792_869454109\manifest.json
- Size 43B
- SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
- MD5 af3a9104ca46f35bb5f6123d89c25966
- SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
- SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 2cc2b0052cb9cbe7fb1d7a00bc3bb67aa38c7f372a0f1d94feb8914552eb7ed3
- MD5 caf67d62726f250c6fd15cf9d5494e77
- SHA1 3bdf255c0782cd06629b7f773ff93c41ced77295
- SHA512 4a475fcf2ad180d609b1f87a19a570b0aba23d0b37637b2e9ee3d97ca4f96adea13281a518e5e0c4a4a4ba5a3433f28fdd14a11b1b2d9da8afe318685bbbed17
- TLSH T174D0122236014234C110B53303027D080681C21F4109404094298D2D5B0C0500D12441
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 0a993bd15b52b811d171e6d9c41443ff12abf24ecdea5f7e1fae241a6d34cfd2
- MD5 ee69acbfa4f2d764ecb8595388d12207
- SHA1 866ebe7e432bd7ce454e458bde3c9b2d473e11a3
- SHA512 c5d9dd526371da5d7c6a0aa465b176a2c25ed8ff001882b52d07a22a489bc5c66df7f40ac4bea9a5e93eb0fca965ba8df8005e957b000b03739b92a9628490c5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 1041b815ce337c522566f17b2ebe46fe6c62e98d5fe85ca4a04c0f200ca4f695
- MD5 77a5b731a6b39ca5236530321ae8b3ec
- SHA1 be9c29718265ed8a6773d2bdd9f3a255c87362e6
- SHA512 97d39659bc7c6cbd30403a7142b4c08a39e7fd09498caf8c3011df6885b87b0ca594d68dd6bf980a40ff47d6067237ce170731e7d16d0a5189a2eec81fe33860
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 504B
- SHA256 bd7943e7ca6bf9652fa5c950a11f45cfd4465b428dc1548e5990fc41657175be
- MD5 25c3f00f6921e50a3a5c39086eb716d4
- SHA1 eaa5a340e3631670c86027b19fadfb6125f67dbc
- SHA512 54b8fb9cf6fb0ae1e4258423f2326a9171bb0ba21b687563ed6a27f4979801fe343e4b69fabbb36f63d840975889056efc02fe3ef1e0de9bf8dacc4ec2a26bd8
- TLSH T1A1F0C2F4488860AAC34656F3B3DA013137B64714F21B4EF0892023B8A776F59D2969CA
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Network\Network Persistent State~RFe59a908.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Preferences
- Size 6KB
- SHA256 3e8dfd8463a1347a2b00ab5e11abbd80fa0a6059e5b4833469bbb0ddf3e29f47
- MD5 41e3e1685a628b427fd79f0e825e3140
- SHA1 d55d18cfab28e23c067238a0658f34bc9f62a53e
- SHA512 1491ebe1ae7c6978e2fd24702f7039cf6f357a58a24782788d0f81fe8651311abe350aa5166211740a49a89f5fd09e99aa25459018d075b4176de7eaad395b2f
- SSDEEP 96:stv05wy9hb9q1ffdZ8i0vhEQkttm/7qx+WVHMSm+uecJw31idQjx+gXjMOB:stv0G31f1Z8pabQ/S+WiTw3wdMRjMC
- TLSH T1A2D1C9525E2879774CCBF2097A35BB52E2F6606266D00EA8FBFCC61C04D66CD230790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Preferences~RFe592188.TMP
- Size 6KB
- SHA256 f1ea4a193eb49576ecbdea532d0936c0fd37049867f14203474a3365eb1d731f
- MD5 31b18abe93e0842356409e8fb66c56ab
- SHA1 c89a7f7350e181340271ee16e5c5df2a1cfcc043
- SHA512 25257958bb0124684da0bdcaf7ade77d7e087e390cb44105e7f071b1008e22b1ff41ceb524fcbfc44144deb24c15b2a4cd05e9b993b532f8e612204ca6b990ec
- SSDEEP 96:stv05wy9hb9I1ffdZ8i0vhEQkttm/7qx+WVHMSm+uecJw31idQjx+gMjMEB:stv0GV1f1Z8pabQ/S+WiTw3wdMijM8
- TLSH T15FD1B9435E2879774CCBE21A7A35BB52D2F6606166D40DA8EBFCC51C08D66CC630790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 1KB
- SHA256 89fb0552957b7ad53c08ded48bb11d271e5b24021917e2041e7ddec02ba5c488
- MD5 70e01957030ab1b47946163b77018a89
- SHA1 b28acaedeff21eaa702549d974e65732cb3e981d
- SHA512 904a9c48e7231c2d99c4d6059ec7f7029a1e04fad86a9fe876500161bcd2085c040fa45cb03116be3a0543cf325c938f0be695f1a5d508053686ddccb1b5dc06
- TLSH T1493165B3D4642A765C8EA945F1857B975F21A076C0984E58A1DD0B0C01E728C5629D37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 2KB
- SHA256 b09d2a8955af2474c2a42aac540b9a870101bd28189c5d32bd9c8421f613f2a4
- MD5 cfea98fd681243a9d5f09ba535971a55
- SHA1 2451ce9c42664bdb7a68b86b4a9c0043749f519a
- SHA512 a53311844441bdd47125c038d4bdb85c25c958c2261832c8ab248d131098cdb745d7a223e52c5475f0048e158ff656521e17cd3ba8069191c2d7a1b9ac802f0d
- TLSH T13D51D773AC186A7789EB9A44B98A3F13EE36A162C5A51F6495DD0F0C01DB69C1302C2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 3KB
- SHA256 0627dca104279059778c2e67dc852b08b05668aa74f1ddc6efa4218d907f171f
- MD5 1e0e8c3b6ede723d160ef41a6ea255f3
- SHA1 4ad82d3eda1aa3d03f4efb0de728325843f4d1b8
- SHA512 68e1643608a700ff00dd3fb3a827a50d9e0dc0ed7a65366ea7a1a33dbc79253bf04bb2c08d2f015b7bb6210a562bbb01585d482d7c688c828533a272650d57da
- TLSH T1C37174739964A9374DEB9D45B9C92B16B7669133D0D52FA8D5ED0F0C01DB3981301C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 16KB
- SHA256 d1f9f842ba3d512cc5e8f4620935baefec92d39f215c0accad8a07da28a14866
- MD5 8055dd5c60bb92a6e14fe5b35d9f3fa3
- SHA1 f0fc7cd94c1f0ae193a3f6ff0509c727c4e766ad
- SHA512 c49bae7dbc8e90c4df7d94585a95a8085d0c02afdb002460e93d7ca23c07073347e759ecf8d00c7f0fa94cca68be882eda1e3c579024f9394901f4c478c2084a
- SSDEEP 384:zo+aQikB+z/xvxjg/qhEDNbQ0Y6rt2UL9zX:b/UxvxjgC+HHt2ULFX
- TLSH T169727D3B54793E2758F7E905799D0B4BDBB594B280C16EB889EA1F0D06DB3D81702C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State~RFe58826a.TMP
- Size 1KB
- SHA256 d98cca279386d2b11189f337c84e5bb3450bf4a833dd41daa103b57687401183
- MD5 ac0cceb590cac841c6d6c65baa4a9ca2
- SHA1 3c22b43c77f7b0e8ea45863bfe997eda98855a7c
- SHA512 12633b17aab75b00f1b792374949410adf698135b5b5b8212fe31d23bc024ac662c2f6495d487a8f4790355eb84daab697f1aacad7240ce48f3c46f737d42367
- TLSH T1532172B3C4A82A75988E5941F146BB875E109076C0988F18E0CE0B0C16DB6DC4736C33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\HardwareWrapper.dll
- Size 82KB
- SHA256 523d481c7f85a2f1165b664aa7ed35f94ec2a825aea44e56fb2c8e72a24e44ef
- MD5 e02a8f43dec73982ba62a2ca97b5ce70
- SHA1 a543b447fd293fdadcf07106824e8bf85e8582cb
- SHA512 a11dbe1c9a1206b29437516463b69eda1059ae4fe155b31b500da19d4e6524c8f4260d17663db63f350bb9e16ad3ac29cab0ad105caa02ce907470332336d080
- SSDEEP 1536:ob5h3oZSP+D4rqYL72om996/ETwI7BE0ub1Nz:ob55qSP+D4rqq7296K7BE0uRd
- TLSH T18B831A5173DD9210FEEDBFB49177A68942B5F9837612EF4C0E8634EA1B23380365075A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\LibreHardwareMonitorLib.dll
- Size 1.1MB
- SHA256 1ebcd7e09f11a4f2a56da626eb4c510dbff1ee03fcef8ac5af7b533423581052
- MD5 472293cf3cdf47233dfc83d7ec428e44
- SHA1 ea6128376014d0c695e2cf3a216bd18d38075350
- SHA512 aa3f3d52de3e2be8da16da42c2c20bc8a0d6a50c67b9d96ac75407cf320424030eb4686956ebe15ab3ec2ec4b35f1bfa96213140300aab11948159917dc0bbd5
- SSDEEP 12288:xiFjcE7FXRuVL2eHnTs8JAoBcCRr+5yBbJLc819/eTD1pEv1Gy7:ct7FXRuVL2eHEoTqYNcY/s
- TLSH T166450814B9DC4F3EC95A0E7738745945ABB8BC03CA98B72BB0AC774E19BB7446D04392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\Microsoft.Win32.Registry.dll
- Size 113KB
- SHA256 eb249fb10eb8687d3505fd9276480fb9a0c13dc975ce6bcc35e2e2e723e8d559
- MD5 139423d055cf754b2aeb589fb31864a2
- SHA1 e1ecdeee268572f7118b92914a26c91297bb6104
- SHA512 1731ac3d48ccc29b465589e59683f71bc31dae15d418c486f18989311d16a21a7ca03de65b1fcbd081438f8a5a02702e5c982c25816dd117f28a7ed21ae4b6ed
- SSDEEP 3072:g8wrd0FyC+tFYMK3aJSvEdy7IVi1Dv5QatHe+jD:W0DaK3aJSvEdEJRa+v
- TLSH T171B35B10BBC8810BEA7E45B99D634846E272F5CA5701ABDF42C5C09E2F637C2F672572
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Collections.Concurrent.dll
- Size 225KB
- SHA256 5a4b728246443eb3b4c0a16d9b3d04bc0bce60b7a1998fa4a75716358cc572ff
- MD5 7f5a6ed730126348f298285d83102c26
- SHA1 e9f583e45355273ec7d78bd7c62005137a9faee4
- SHA512 00d9db1f4fee5ed307928569a1933ba72fa717c641bfbd182fc8da7532a57056e5ce7c0a10324bf2b94a4aa27bc238920478d8783445bba21c67e0c0aaf20415
- SSDEEP 3072:i8Lq9jhKz6tVDNKTs4Vzof/HQLvB76qSa2ymYQraEN7Azg902iTmsPxNnUnZGAjp:Nq9jo6LUTs4eQV76qOc2mNnUnZGAJL
- TLSH T13E344A16638C0B93F5AF463D95A3C5039633A55B1312D3EF13E8A5841EA7BC1BEBB112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Collections.Specialized.dll
- Size 101KB
- SHA256 8a1cf61a6cd079444ae790123ffc90bcd8d369ec5aed0f2f95d159a6479690b3
- MD5 d327af20fb99b0511d8e490f02095ca4
- SHA1 f5a9898919ed2887a2a0d6ad3dcebe8c0675f13d
- SHA512 f15d1a84751d121cd5cb5b946c91ec338b7c21eb39ef0196b11f115bd07d582e568e502ccce7da6a41a79ee175ad70742131368d3d53b0615e6d4eb7a32a15af
- SSDEEP 1536:/9DJyipoBcR72GUFFDE3A0giv9EywNwjNYGDWrBXzWBzC:/9bpomR9U3MM4jNYGDWrBXwO
- TLSH T1CDA34A28738C8B20CB7A82FC91A38942E774F2D31752D6CF5D4895496E977C0867B26F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Collections.dll
- Size 289KB
- SHA256 fc52be0abceac360478ffffce876c99997b4af56fc36fbf07cfc38ac5b7fdd7f
- MD5 08074fb9a496eee036facaa78aa19ab3
- SHA1 1b022e56e060f802c4a5b3e4e730da6e53b81fd3
- SHA512 c3bd803dedd131ba4fc5294a83fca5af67c4d115fefef54c6488229b67ba8407439f2c50a2adcc4a424d6ff8c2a62f250e361ab9ebaccef140166f3d16a33a47
- SSDEEP 3072:MEUwvuGeTbqnDHdY81uFqzK4s2QMsf0r3p9dJ2SAmnp8SFK0gwsDi2BOLI6mFnW:90G4eDj1Fe4eL8ph2wC0awL+W
- TLSH T14254391873888725FDBF41BAE593C122E1B990938350A2CB47BDF6509FDFBD12AB6015
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.ComponentModel.Primitives.dll
- Size 77KB
- SHA256 52e0988e01955d09170339429cede1d578690418b8851e19ddbba7d22a6490f7
- MD5 2ad24d944e4d99652e80a0ac5e791bdb
- SHA1 2fd8e37b4d0c2bb3891d46a1e65e533775c062bf
- SHA512 a8cbadc9fa657645f86282573e288eb9793ffdc9cd144ff55b70d8ecfff44d276991d4654a396ff998b921d417c6c11abf8a8785b9a7b0815ff164038d60b298
- SSDEEP 1536:8SRphdlpWxFkIkSyypSM2VLIGOYu2nCW08tfzR1:8SLjlsxFJVy+hgLVO52CW04H
- TLSH T137734A1813EC0329EBAD567C96B399119570F5871323D9CF8590C95E2F8BBC1F271A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.ComponentModel.dll
- Size 29KB
- SHA256 23c6a24f67244c647a614af3249181dc68ad02acc3ebd3cdedf62b2df8da503a
- MD5 6564315ca3db43e0e2d8af8840ecd7cf
- SHA1 9623f304779a556c2816430eba45ad09758bb514
- SHA512 9595d75010762e43a5fb6ab65a9d0acad4c8d533152dca686e0102444040b8e8e3fe1960187a15060ff754af6a2afdf3b65a982a46a458f450f280db57c112a9
- SSDEEP 384:IWB1WvB0Su8Sk+J4fYcZlN6ldlKR9zhsF:nK/SrV9vs9z4
- TLSH T151D26CD6CB688227ECA75D70AAE8DA837D7DE3C58E0286670189F50D1C537C0E730538
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Console.dll
- Size 165KB
- SHA256 d6c46a682587937775464bb1a3850a9d3e11408440731fefb07d298cd6d7a99c
- MD5 cdf39fef9130164848978f5fa74bc3bb
- SHA1 dbc018077a65a7d040db7c36d0988b3ffadf4b2e
- SHA512 1b38ac592fa0519367663ca65a15ec928067d604a90d616c9f6fbd9856517ff9e104796fb1aa79bb561e8ba7c9d7ea75ed7e5ce8851e9f917f465f316c77a6a4
- SSDEEP 3072:MhK8LvmZrfHk4xul4nhu7v9QglfFRc47jwN:4yZrfDxu82Akju
- TLSH T164F37C2A97DD6527D77F86B845930301D737B8A60306E6EB418588881F93BC3FB716A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.IO.Compression.dll
- Size 409KB
- SHA256 fcc979a99b747680a81f5eaf71add66f3876588e59c90edf826c37e525d4f0b2
- MD5 e7da08754b8013602d83aeb20daf5e76
- SHA1 806e530338b70f4e32a5d3e56969cffb7531c02a
- SHA512 24de8c5f422d23bc59dde8f78bea21a8420c334b5ad226f3b43e9e8c2eb90f90766fc4d0a3e7a4b7c151207462aff62081838a43b7fa1ec48d191f48b1cc72ab
- SSDEEP 6144:f1q+7bb02wr9NJWPA5onxP3DviHrzAxidsvAWOB5R/dl0diU:0+7EXV5o93TiHuPBaR8dp
- TLSH T14A947C3463C44713EFAFC6B882568002D27066A617C6E7CBCA4DEDD8BE1E7C19A75217
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.IO.Pipelines.dll
- Size 185KB
- SHA256 427b8641bbcce1e355c8b72415bd8ef10c91eb4171c77fae001674df495cb5f8
- MD5 6b7bcdff5b7011e9bf5d9e5ec730b403
- SHA1 51f9238ac469ad70c90da81353bb5aeedbc182ad
- SHA512 58b784b0942f8cee3ed39fe8daeda2bf61b6e1603a7823302ac5b839b1b99fb96e35da7dac70d9d9fb1e7a6d3218206d158c788d8564a324b635c4044bbda384
- SSDEEP 3072:CIq60XKM6cR3RilUubgU33bltX4bgN0xmRBewipNfh/pvlxW2xAfKV83b:a3KM6aRigSewab7xW2xgKV8r
- TLSH T120048C6AD39C0713D65F85BCC1A346529BF394E65702F2CB048AE8842E977C1FE3E562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Linq.dll
- Size 681KB
- SHA256 4a5d41332ed37f7e195503ebd3f478da2ad0008cb8a9f85739b53d2df7d33d46
- MD5 0a5d406238bb9ba7195660911c1d4c25
- SHA1 df11f118d81b9d1635a54b6429e03f5fc327a76e
- SHA512 53272819d6a393d7f11b0c4d01e6102058e36583eb9cd7fc96c8c96b2b5afa5165aba6309618c4fc7e89959453684c8b97cdf07f546aadb380197f367649c683
- SSDEEP 12288:l0Gw7qPJLv73KQkvIRR/ZHC6p/XCy3esO:l0dOLzKQkvIRRJBF3esO
- TLSH T176E46D29D38C4A22CAEF467A95235161D2A195D243D2C8DB844EFD442FF3BC1677EB38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Memory.dll
- Size 157KB
- SHA256 03c2fe17dbd4e1cd709f6da1ff221eafaf3f076d23f8fc62ddff5302c152e97d
- MD5 56599786643afdaacc1f3cf4e3ac6777
- SHA1 cac3e33d65645795092c7daaf85fcb18e7934dae
- SHA512 c133000793ecc8a8532ae3dca1c49272d64c1d969656cb6e81924efdb70b4f9935a9548de1b7f58b636b4c205ecbd3f346a609b9dc7f763220497a4d7998773a
- SSDEEP 3072:8TbIW4QJ8tT49EggVul1co8s2pwaGrpXDXPjT/hR7g4:4oMhpV6waGrdPH5R7d
- TLSH T103F34A1BC3980227E92FC6BA8B6AC602EF337515D30191CB44D4DA486F53BE1BF76562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Net.NetworkInformation.dll
- Size 153KB
- SHA256 7a520cbc73fab570bc069717d0b73efc03cc100196ff42137dba24066eeedb83
- MD5 d91159b26903efb85f1f6c3a85a2ba2d
- SHA1 e249be9dc0d2cb752c80b785db1188089c50216c
- SHA512 be8ec6500a764dc83d1086ec16f50e8c284fe059ec9df45fbb9043b12fbd946d44e33e64cb934430d55461e7930da6f2e95773a125a111902db6a478fb589976
- SSDEEP 3072:9RKFGKtvFXRmLv3m1P6ncvmALVXyVwa9eT9V5xlMH+k:fYvDEYMz2PlI
- TLSH T1B8F36D1153945216EBAFC23AA1E76A03913BE5C25323E6C716C8ACDC1DB3BD1B731792
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Net.Primitives.dll
- Size 205KB
- SHA256 e0be3d784a346ffa419a5b4f6aba91d20a909a122b01ce331c4ac1560bf93c3c
- MD5 88d16beae403d4a73b3817a445d63e6f
- SHA1 14c9af8fa961e20a02252ad517771dd0d5a698d5
- SHA512 8db91adaddfdf60a227c033c54e60a95ee421f7a6b6c0cfee2f5eb830c854a2496cfd358541af894643711d3ca1abec561636566288695da735fd161508d6597
- SSDEEP 3072:yk9vXV0t5RAn/8QTvt4BBpupZAcMXBN9CbWCcjtzZUAx3Z4IbpFg6ABhlttQ8JVK:JU5SKpupZAcumbwzJ3KGYxjlHJVK
- TLSH T1F8246D2963884607F76F85788B53CA11D3B3A4839309D6DB0A94A9C53FB77C0BF72592
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Net.Sockets.dll
- Size 517KB
- SHA256 53811a06f50f436db22d1279e5a209220ff363154e7c8981c8248d38f4c7798b
- MD5 dc8b5550139e63f6c8531681459773a0
- SHA1 4992c392fc5c499080561456e3fb7c92f95faa47
- SHA512 96e6f95bdf80185c4f8b7aabeece0971cad3d6e42ec87dde6fb765936766bb58e19b8bc04c10e093ab7f45c8e32e994097b9a5092b1da43534f7763d830e93f5
- SSDEEP 6144:xyIh5VpoAH6hnmMFZpfDkR+7EyBsX4NfbGctRWf5XdSs4f+uoJZ2xIxN1TyRxRSW:pp7UjpfY+7EIyqyyeJZ2yN3ZZ8MFKHn
- TLSH T1B2B47C1A73D80F05E62ECBBCC4560182D3F0A6D71795E7CB80C8DD952F93BC5A6366A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Private.CoreLib.dll
- Size 15.3MB
- SHA256 76a49f17e83f613bc8a5b55fc98830b764e7838265aacbdbcc8f46707f80a3c9
- MD5 a49b53f149f536e90bcc05658d87aebc
- SHA1 3b05684dd5dcd813ebd6a0f6cf72092e560f5ccf
- SHA512 3eddf059079cf26974cc487affba6583e6e5302377d20f1c673845e09d85076d790b20015b06a9ecded24da88a1b65bcf70e54feae4222e6187edf8292e0638f
- SSDEEP 196608:d+P37OUBwZf3DKM3KxPrH1uk0hzOH0KrO04ddwSw0TZFyd0:d+iUBwZr73Kt1uk4OH0Kr/4DlpFp
- TLSH T153F69D20E3C98F46E13EB2BD81638629D970F8526327D6C70558DA493F23FD5633B6A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Private.Uri.dll
- Size 249KB
- SHA256 27b93d6e754d7d2e538333e3c1d520c64d7eb012dde1705e776177b273662b7d
- MD5 b1a06b4c3c0f6d03087d7a8bf045101c
- SHA1 bf7e2aeccca3645f9ebdacf6bcbef418c6e77947
- SHA512 2dac84a72556a82e6df7fe630de0fd5e3e081659dbb98013d736683c5a6cd6745ca5eddb2afd4b66fe671c171460207bbc39db84f7b2a2174cf9eb51bda694a1
- SSDEEP 6144:mjEjhVSYgnYGFr76LGZxJyjMjPhArX+AVSP3m/3tpeB9pSzF17K3O2djHMYYMpSS:mqVuhtBXl2+HtGo
- TLSH T178446D2BE3D80D2AFB2EC27D8993C152E272B5955705E7DB06BC90913F133D09A39593
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Runtime.InteropServices.dll
- Size 109KB
- SHA256 627a86a918f6669f94cf8db6ce064a4b2207b852ba6a4fecaccad7bb07859b4f
- MD5 b18883afbc4f8ec15db5ee296a446ad0
- SHA1 56edac2d32ce838750d2b07284e1017a38ed6b72
- SHA512 169bab4218970bcd4b8206ef9be98dbc609200cf5b27cda8a61d321cdba865415232fc910b2aa0794105b263756e2bb4b1b5c67500459c898783c672c5058b97
- SSDEEP 1536:xOCC7EAttQMxvPQtvC+zucKb2EW4udNY/w2yVvO0ugu94RHPXF20gf1zX:xOCoEStQMZ4vg2E5udNY42ypNu0Pcf1z
- TLSH T144B337207B98863ADA5A873C9C736D00CDB3FAC65322A6CF4184849D0FD77C567727A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Runtime.Numerics.dll
- Size 345KB
- SHA256 8c715e55c80a4ab31d086b5e51261d691b52b867b1c1f5d99c344ea4faa27f4b
- MD5 1730af6d773918de04115bfb1367440d
- SHA1 882f23dd4dafa944a34115efbc9d79e350ddd4db
- SHA512 3476785464d08b2ac3fe15eef8efb279ff9acfd5e5918cd8d615373df2d026a61d9b2e968b1f03aaf700c1afa74f4fcce0668a0846472729817322397d2c5945
- SSDEEP 6144:A+ESgPg0Tkbw6hE9e8Of6iQz4OCJrTrl7vZAhafL45NK:A+ENPg0obwcE9TOhTrlVAhM45NK
- TLSH T118747A1CF786C2E2DE3ED078E52B4102DA74768383C9E3D7549989A16E177D1A23A1F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Security.AccessControl.dll
- Size 221KB
- SHA256 0ce0621ed9cf8fde8aa78be726f7e4ba7b9e321c86ff1faa282a8e8ca1a62e86
- MD5 ccfd41fce34d598c9442a866ad43bec4
- SHA1 95e274a8dd532828fc8f121135787e96674db529
- SHA512 333235db5d62a045922ee3fa5b58731d9f76ac9d748e2a476a4dffcf83b9db562ac0f77399f5b56fe9240a0e67f30a3abff206b25109fdcbad177fb6ea6857a5
- SSDEEP 3072:A3x6DZkTetpMQTrIaQNGs2jshJUpjFLxko7uCnQ95F+8k9k/7V2moCSvqq3anB:zt2eYQG2jsh2Gq8Ek/7b8vqqUB
- TLSH T1C7248C2AB38C8D27F6AE8678D4A7C901E6B378931356D7DB0690D4542F13BC1BE73162
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Security.Principal.Windows.dll
- Size 173KB
- SHA256 b04ee5bd519137cc929b355221af2d9649f149aca7808768a0cb99e423ff8668
- MD5 d8ffc2864e10cf8ce19b637dd24309f3
- SHA1 589e48a9303b6c510408d16bc87d6255bf7e69be
- SHA512 911031dce0f9e07ca9c755847fe17c4bdcf6d4fa3cfbadece79ddba856311b7db41f81df0c231621993940a00c7fe6ab28d27434194d84609c7386bfb5e24b17
- SSDEEP 3072:9w0q/aoxoUL89AUNjsGNyxmbZ4rd1SnJXpWws68S:G0qy1ULY0mbZ8Qlh
- TLSH T1A4046D1293C84657E7AF863CC1E36205D7B3A45747419ACB5590C8A92F97BC2FF3222B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Text.Encodings.Web.dll
- Size 121KB
- SHA256 775eab42196bf9466a69e9fc86e47b8da620b7652aa4b8a62245449131ce885d
- MD5 9db84b78782a4aa1dd421b8bc6036a31
- SHA1 7e9759a9bd81395f6b733152d93682ae85459052
- SHA512 90bbd339d4e007ca3966da86ff35fb5e601c89ffb38750e00badf7a7c9424a6536dc29efd9d5da14aa4205d28a81796a5ef8061843eda79fe2152b3057b201c4
- SSDEEP 1536:R7FRA0FaMPHcO+NP/LNss/5XwY7qSA1ehJ98zVKXknG4/szX:R7LXFlr+dNsKry1ejkK0G4EL
- TLSH T132C31810B388D689C3694374D6938572DAB9BFF1035296CB09A8351A1FF27E9AF3D143
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Text.Json.dll
- Size 1.8MB
- SHA256 6945c5fc52f811e32b13597b0d2a14d365227245e21bf7daebc6986f729b25fa
- MD5 e508c206f60d3359cad70a349fe581ad
- SHA1 9d5cadee8824db16b6dd849470ffc5df4113ddcc
- SHA512 b231752cd8c4640ff543283a48721985bcc9ddb7993226573efa68b35be8bfea15be8d4ef09a1387df1d7a6f1f4723e5d35d70957364e2056dcabe5b14121c20
- SSDEEP 49152:c4a9OE7kEkWCwr8QsUJwwLBpbp95Cifbfr:G9fZsUJTzCiff
- TLSH T199957C11E3EC5227C96ED2BA80138122D671A1025312D6CBAC58FD8A7F43BD1D776DBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Text.RegularExpressions.dll
- Size 1009KB
- SHA256 b1f6aec1ed431cf5956d8bc870fb0d47c43455438c5c0110433fd125183f190d
- MD5 db9d1ac8773c841e0af0c70096f3280e
- SHA1 e87ba9f573bf9cb5ede23fe1b8125927ccdc14f5
- SHA512 5c06d4ffad4bf419eb9f4d161e8380e69cb7738d4a2015e0afb18b6cc552a7dc94223bf9e53e403ae0c63877011c7b694f2ab5587bbbf0efb7cec45a895122c6
- SSDEEP 12288:64b2yXoK6ABRKm+aXmMxgvq1ig3RB5ocEEC9St7dBzy2qfE:64dYuBRAa2QgYZv3PC8t7jqfE
- TLSH T1A6258C2C93880361D76FB639C19AD211E6756D62436986CF4808F8BB2F777C2E6F6017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Threading.AccessControl.dll
- Size 73KB
- SHA256 14e0ec8285100d4a3259a899d9ffa5269797e8ae2e3c9e119783ece06ebc62c1
- MD5 a0a9c376bcc7ad3e43b5686a1d18a447
- SHA1 23e2b1a157c98498a28f2bed2bebe49b1a2941cb
- SHA512 4da3772f8bdc5ff5786a6d35762f10c897bd7786947715e2a5c94f38ab74bd3695b9d63cd37ae136039c582f76f0c4d08b784778d5a356e7bedad5683255ac2b
- SSDEEP 768:57zwGV3/WLTfJ39KSSxntNG6saXce4JI6/avnoJ/9zx2:RwGxUN3ISS865XcRW/ovzx2
- TLSH T1EF734B14D7D8462AEABA8ABC99B3C405E530F5C14B1187CF8486F41E1FA3BC1E773666
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Threading.dll
- Size 81KB
- SHA256 96ef32e315217f24b6b701fc182cac464966cad1da94dd25a3609fe2d9f5a6ca
- MD5 ddccafbb8be31d3205273fcea7824420
- SHA1 403e6242b314445e067102d0d48c13ae35818518
- SHA512 c8d32d7b79fee789f398d45cc0c91357a7a612e27a7dedf81821aa5d4160cf0497d75861ee04b206def6eae49f4c2c84b96eba41fb561ac2154f1c212579ac6f
- SSDEEP 1536:AialBo2hUTogxqwXAXXG9Rvd5bFF9o6sionbz5:ADlBoAUkgIwXeW9RvHBF9o6Lonbl
- TLSH T106835A11B3E8091AF7BB47B9DAB36905C172FED21B11D2CF405A910D1FA7BC486B21A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\PawnIO_DFF779CD.tmp\PawnIO.inf
- Size 1KB
- SHA256 7c1c203e13693531243fbee3cb87d7b79170eae89f5729b3f41387fe68a54f0b
- MD5 0a33770fb7ac5bdf673e6d1bb78adc61
- SHA1 8c7c31ddec6eb61741958df8924dba38606b907f
- SHA512 1f4cca9fc0698aa6213aafbe7182b8576ae89a37976a9f344248257e5fe40520cb05129033a06d4235f7db0c1e6d17ee9cd31a7d0f40116f058310cea94f97a5
- TLSH T1E321F00A4DDB8F7C2C56E1651A3B43C3FAD1A1002068550CB3DC7FB85B9DD9CA32E1A5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\PawnIO_DFF779CD.tmp\PawnIO.sys
- Size 133KB
- SHA256 fca6e7d58b0cf38dbb913a2b9e532f48629145d395f454b16a9f58e97b8d3940
- MD5 a9ebaa64ddefba4f4ad3b3071c582a24
- SHA1 8cf8f0aff8ef43b34ec247c8595b61c0eb9a8b90
- SHA512 b2f3358ae897c375fde806648bf4628f57202152e8b955ad0fe6dea4ff96b42275301f00a3fd891ead42235518a2b04c2867e75269399917281ff6f171d91eff
- SSDEEP 1536:QVg8JDpk29f/cUFTdcNK2ZhC64WmTKniUWfIHRo1L8z:qzZcUFTdccipmTKbxN
- TLSH T15DD3D95EBF1D28C9E877A37C935A071AE531759837609BC741A8E8581F216FEAF38340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\PawnIO_DFF779CD.tmp\pawnio.cat
- Size 11KB
- SHA256 a37d46840280efec92063d3a21014c803939e599b4c0da4a4d063b79eeca9446
- MD5 8045cc5d557423c7cef1ddc814abe8a3
- SHA1 f5ca9d0b9d21edfa62703503d28f2f83d522d599
- SHA512 0697b171ad02a4c7741e12b64b149e7327704b64d24af934a93bd07fb75761a56988da2898ed47548637f4c0bbd1bbbe7ce0452cebea7f6415ae0944f52c48df
- SSDEEP 192:TTQTaTJTVJCUPXWEwGJhYClFU34DcX01k9z3ADLyg4pe0oWA:nk+VVFP3h3DcDR9zMLyRzoJ
- TLSH T16F321BE345A841C2D9576C6093E4F5973C3D67CB982084F922EBFA145CA73C9F72816E
- MD5 SHA1 SHA512 SSDEEP TLSH