Overview
overview
6Static
static
3FPSDoctor_...up.exe
windows10-2004-x64
6FPSDoctor_...up.exe
windows11-ltsc_2024-x64
5$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3FPSDoctor.exe
windows10-2004-x64
6FPSDoctor.exe
windows11-ltsc_2024-x64
6fps-doctor...re.exe
windows10-2004-x64
1fps-doctor...re.exe
windows11-ltsc_2024-x64
1fps-doctor...re.exe
windows10-2004-x64
4fps-doctor...re.exe
windows11-ltsc_2024-x64
4fps-doctor...ar.exe
windows10-2004-x64
1fps-doctor...ar.exe
windows11-ltsc_2024-x64
1resources/...up.exe
windows10-2004-x64
1resources/...up.exe
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
158s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 16:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FPSDoctor_1.4.7_x64-setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
FPSDoctor_1.4.7_x64-setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
FPSDoctor.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral20
Sample
FPSDoctor.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
Behavioral task
behavioral21
Sample
fps-doctor-capture.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
fps-doctor-capture.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
fps-doctor-hardware.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
fps-doctor-hardware.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
fps-doctor-sidecar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
fps-doctor-sidecar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
resources/PawnIO_setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
resources/PawnIO_setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target FPSDoctor.exe
- Size 30.3MB
- Sample260804-t7fywavfkd
- SHA256 220b34b60d775b8ec609a6b3aefe2fde7decd0959089cb9634b7a409b6f070be
- MD5 fbf243f812ef61b1ab10a6da86d3f427
- SHA1 e8c1dfb414c077b56da01a1ffd9dff4da71c0131
- SHA512 21033e79bbbc960c45150e6e13df00af9698c822040765b6b29a2a0cf817f6968954eb50270a95fbd8c90ceb3a4cfd2f4c8854968467981e8bfddadfb2a09686
- SSDEEP 786432:Xldr8utKn9itWEcQrnuw/zms22fcrwppIU7:Xldr8utKn9itWEcQrnbbmsffcc
- TLSH T1ED6728257A5A9968D09BC47483478AB24E3134DB0B39B9FF44D492393F6DBF52F38218
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: fps-doctor-hardware.exe File opened (read-only) \??\R: fps-doctor-hardware.exe File opened (read-only) \??\S: fps-doctor-hardware.exe File opened (read-only) \??\W: fps-doctor-hardware.exe File opened (read-only) \??\Y: fps-doctor-hardware.exe File opened (read-only) \??\M: fps-doctor-hardware.exe File opened (read-only) \??\B: fps-doctor-hardware.exe File opened (read-only) \??\G: fps-doctor-hardware.exe File opened (read-only) \??\H: fps-doctor-hardware.exe File opened (read-only) \??\T: fps-doctor-hardware.exe File opened (read-only) \??\V: fps-doctor-hardware.exe File opened (read-only) \??\D: fps-doctor-hardware.exe File opened (read-only) \??\U: fps-doctor-hardware.exe File opened (read-only) \??\X: fps-doctor-hardware.exe File opened (read-only) \??\Z: fps-doctor-hardware.exe File opened (read-only) \??\L: fps-doctor-hardware.exe File opened (read-only) \??\N: fps-doctor-hardware.exe File opened (read-only) \??\A: fps-doctor-hardware.exe File opened (read-only) \??\E: fps-doctor-hardware.exe File opened (read-only) \??\F: fps-doctor-hardware.exe File opened (read-only) \??\I: fps-doctor-hardware.exe File opened (read-only) \??\K: fps-doctor-hardware.exe File opened (read-only) \??\Q: fps-doctor-hardware.exe File opened (read-only) \??\J: fps-doctor-hardware.exe File opened (read-only) \??\O: fps-doctor-hardware.exe - Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{e3edfcda-3c87-5248-8769-c26af6e4de65}\SETBB29.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3edfcda-3c87-5248-8769-c26af6e4de65}\SETBB2A.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{e3edfcda-3c87-5248-8769-c26af6e4de65}\SETBB29.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3edfcda-3c87-5248-8769-c26af6e4de65}\PawnIO.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{e3edfcda-3c87-5248-8769-c26af6e4de65}\SETBB2A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3edfcda-3c87-5248-8769-c26af6e4de65}\SETBB19.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\PawnIO.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.PNF PawnIO_setup.exe File created C:\Windows\System32\DriverStore\Temp\{e3edfcda-3c87-5248-8769-c26af6e4de65}\SETBB19.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3edfcda-3c87-5248-8769-c26af6e4de65}\PawnIO.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3edfcda-3c87-5248-8769-c26af6e4de65}\pawnio.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{e3edfcda-3c87-5248-8769-c26af6e4de65} DrvInst.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\PawnIO\PawnIOLib.h PawnIO_setup.exe File opened for modification C:\Program Files\PawnIO\PawnIOLib.dll PawnIO_setup.exe File opened for modification C:\Program Files\PawnIO\PawnIOUtil.exe PawnIO_setup.exe File created C:\Program Files\PawnIO\uninstall.exe PawnIO_setup.exe - Drops file in Windows directory 20 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_899103776\metadata.pb msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_899103776\_metadata\verified_contents.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_813815021\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_813815021\english_wikipedia.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_813815021\male_names.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_813815021\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_813815021\passwords.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_813815021\surnames.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_813815021\test.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_813815021\us_tv_and_film.txt msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_813815021\female_names.txt msedgewebview2.exe File opened for modification C:\Windows\inf\oem1.inf DrvInst.exe File created C:\Windows\inf\oem1.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_899103776\manifest.json msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_899103776\manifest.fingerprint msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_813815021\ranked_dicts msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5620_813815021\model.markov msedgewebview2.exe File opened for modification C:\Windows\INF\setupapi.dev.log PawnIO_setup.exe - Loads dropped DLL 29 IoCs
pid Process 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe 5824 fps-doctor-hardware.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FPSDoctor.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 FPSDoctor.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 fps-doctor-hardware.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs PawnIO_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName fps-doctor-hardware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc fps-doctor-hardware.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID fps-doctor-hardware.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags PawnIO_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs PawnIO_setup.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\FPSDoctor\shell\open\command FPSDoctor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\FPSDoctor\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\FPSDoctor.exe\" \"%1\"" FPSDoctor.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\FPSDoctor FPSDoctor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\FPSDoctor\ = "URL:FPSDoctor protocol" FPSDoctor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\FPSDoctor\URL Protocol FPSDoctor.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\FPSDoctor\DefaultIcon FPSDoctor.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\FPSDoctor\shell FPSDoctor.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\FPSDoctor\shell\open FPSDoctor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\FPSDoctor\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FPSDoctor.exe,0" FPSDoctor.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 2028 reg.exe 4152 reg.exe - Modifies system certificate store 2 TTPs 6 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000006b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 FPSDoctor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 6b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa26b00000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12702000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 FPSDoctor.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4768 schtasks.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2624 msedgewebview2.exe 2624 msedgewebview2.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 5620 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeLoadDriverPrivilege 3180 PawnIO_setup.exe Token: SeLoadDriverPrivilege 2316 DrvInst.exe Token: SeLoadDriverPrivilege 2316 DrvInst.exe Token: SeLoadDriverPrivilege 2316 DrvInst.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5232 FPSDoctor.exe 5232 FPSDoctor.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 5232 FPSDoctor.exe - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 5232 wrote to memory of 5620 5232 FPSDoctor.exe 89 PID 5620 wrote to memory of 1332 5620 msedgewebview2.exe 90 PID 5620 wrote to memory of 3176 5620 msedgewebview2.exe 91 PID 5620 wrote to memory of 3176 5620 msedgewebview2.exe 91 PID 5620 wrote to memory of 3176 5620 msedgewebview2.exe 91 PID 5620 wrote to memory of 3176 5620 msedgewebview2.exe 91 PID 5620 wrote to memory of 5004 5620 msedgewebview2.exe 92 PID 5620 wrote to memory of 3032 5620 msedgewebview2.exe 93 PID 5620 wrote to memory of 3032 5620 msedgewebview2.exe 93 PID 5620 wrote to memory of 3032 5620 msedgewebview2.exe 93 PID 5620 wrote to memory of 4524 5620 msedgewebview2.exe 94 PID 5620 wrote to memory of 4524 5620 msedgewebview2.exe 94 PID 5620 wrote to memory of 4524 5620 msedgewebview2.exe 94 PID 5620 wrote to memory of 4524 5620 msedgewebview2.exe 94 PID 5620 wrote to memory of 4524 5620 msedgewebview2.exe 94 PID 5232 wrote to memory of 2028 5232 FPSDoctor.exe 95 PID 5232 wrote to memory of 4152 5232 FPSDoctor.exe 97 PID 5232 wrote to memory of 3332 5232 FPSDoctor.exe 99 PID 5232 wrote to memory of 4768 5232 FPSDoctor.exe 101 PID 5232 wrote to memory of 3180 5232 FPSDoctor.exe 105 PID 5232 wrote to memory of 5824 5232 FPSDoctor.exe 111 PID 5620 wrote to memory of 4756 5620 msedgewebview2.exe 120 PID 5620 wrote to memory of 4756 5620 msedgewebview2.exe 120 PID 5620 wrote to memory of 4756 5620 msedgewebview2.exe 120 PID 5620 wrote to memory of 2624 5620 msedgewebview2.exe 121 PID 5620 wrote to memory of 1352 5620 msedgewebview2.exe 122 PID 5620 wrote to memory of 1352 5620 msedgewebview2.exe 122 PID 5620 wrote to memory of 1352 5620 msedgewebview2.exe 122 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\FPSDoctor.exe"C:\Users\Admin\AppData\Local\Temp\FPSDoctor.exe"1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5232 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5232.2256.9024488533395308948 /pfhostedapp:942a4a298d2d5ef1a052ea2383a2c232f152dbb62⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView /prefetch:4 /pfhostedapp:942a4a298d2d5ef1a052ea2383a2c232f152dbb6 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x110,0x7ffe9c2d5fd8,0x7ffe9c2d5fe4,0x7ffe9c2d5ff03⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1792,i,2336214091880342030,16312884066375262184,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:942a4a298d2d5ef1a052ea2383a2c232f152dbb63⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2200 --field-trial-handle=1792,i,2336214091880342030,16312884066375262184,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:942a4a298d2d5ef1a052ea2383a2c232f152dbb63⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=1792,i,2336214091880342030,16312884066375262184,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:942a4a298d2d5ef1a052ea2383a2c232f152dbb63⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3540 --field-trial-handle=1792,i,2336214091880342030,16312884066375262184,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:942a4a298d2d5ef1a052ea2383a2c232f152dbb6 /prefetch:13⤵PID:4524
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4084 --field-trial-handle=1792,i,2336214091880342030,16312884066375262184,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:942a4a298d2d5ef1a052ea2383a2c232f152dbb63⤵PID:4756
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4604 --field-trial-handle=1792,i,2336214091880342030,16312884066375262184,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:942a4a298d2d5ef1a052ea2383a2c232f152dbb63⤵
- Suspicious behavior: EnumeratesProcesses
PID:2624
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView" --webview-exe-name=FPSDoctor.exe --webview-exe-version=1.4.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2072 --field-trial-handle=1792,i,2336214091880342030,16312884066375262184,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:942a4a298d2d5ef1a052ea2383a2c232f152dbb63⤵PID:1352
-
-
-
C:\Windows\system32\reg.exe"reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v FPSDoctor2⤵
- Modifies registry key
PID:2028
-
-
C:\Windows\system32\reg.exe"reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v FPSDoctor /f2⤵
- Modifies registry key
PID:4152
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Query /TN FPSDoctor /XML ONE2⤵PID:3332
-
-
C:\Windows\system32\schtasks.exe"schtasks" /Create /SC ONLOGON /TN FPSDoctor /TR "\"C:\Users\Admin\AppData\Local\Temp\FPSDoctor.exe\" --autostart" /RL HIGHEST /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:4768
-
-
C:\Users\Admin\AppData\Local\Temp\resources\PawnIO_setup.exe"\\?\C:\Users\Admin\AppData\Local\Temp\resources\PawnIO_setup.exe" -install -silent2⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3180
-
-
C:\Users\Admin\AppData\Local\Temp\fps-doctor-hardware.exe"\\?\C:\Users\Admin\AppData\Local\Temp\fps-doctor-hardware.exe" graph_stream2⤵
- Enumerates connected drives
- Loads dropped DLL
- Checks SCSI registry key(s)
PID:5824
-
-
C:\Users\Admin\AppData\Local\Temp\FPSDoctor.exe"C:\Users\Admin\AppData\Local\Temp\FPSDoctor.exe"1⤵PID:4820
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c7543d1b-2407-654c-92db-d3625af36695}\pawnio.inf" "9" "4c553107b" "0000000000000174" "WinSta0\Default" "000000000000017C" "208" "c:\windows\temp\pawnio_abdeca46.tmp"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1820
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\PAWNIO\0000" "C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496\pawnio.inf" "oem1.inf:4d51782f23653f6e:PawnIO_Device:2.2.0.0:root\pawnio," "4c553107b" "0000000000000190" "6564"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 9b4445aec46753fea88a664115bc3e39c64a2062afef83605db5f1e39d0b4be7
- MD5 a0aadf45b5f68f5f21d63f9245aa89d4
- SHA1 21e1f2cd8048337125701285f3feae57edab023a
- SHA512 5d1e013f7e71163a729ccd546f306463d5ddb34c81ce844c3113a6fb72dd0686e6574ba4a0693b5537b6751836be7e5a7f3816116f3f9a1925f7c585afe4727f
- TLSH T184D0123332A10134C0203A330402E5480420D10B408A5100582C962F5B844980E02441
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 c42eb7dcd0d81b00f05ff49feb0b1bd77add82e6f895df97776b7cdfc0c08fa1
- MD5 07d1a6c78906a75b33bb0f4973ed319f
- SHA1 eec1f495c438c4f1e674c0d48b3a4f2832f43da0
- SHA512 b0dea87bba3f303554e84cca8f4c558a9d9ee5544d7b6969febf5433bd3178112990d2e7dc8c7c8d5fd805015f90f41e69e3f18e44badb76a26fca5da929c761
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\55ba6008-f55a-4cc1-92ee-32eabe351fa9.tmp
- Size 6KB
- SHA256 ba2616f8295a567c05b805ae0d1726e9a070fa74fb1bca1d149fcf3dacb37926
- MD5 1bc4e74c159c07c30094bad4021bb918
- SHA1 78d498633af9fd116f42206e1f2f02073475f1c4
- SHA512 5c433a5f33f2830ac237961785f16f78d4cc3dad85ff0895b77211b03a9b2ddd0d78cde7467b8f3bbbbe7728e817b074370c67d276dd747633c47f063f031a68
- SSDEEP 96:stK/d+LmDtb9fkvo5h16Z06s7/x+6MhmuecJL41ejeqK+gkD28XM1C7K:stycYgon6sV+FdL4Qj2oG6K
- TLSH T1E2D1B8025E64B97B4CC7E109BA79BB57E2FAA03265D11E58E7F8492C05DB6CC6307C0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 504B
- SHA256 2b20c4437729a0d2f55c07f85a1a3ee9560ee490ec2ece7ef01ccaaf4ce560d0
- MD5 387f137e25fc5000f7004fb4a40b3cbe
- SHA1 7889045b31e448de8dbe1e86fc352790d4848779
- SHA512 8c123ac9d43d8abb70ba4150064400d9b3cfb45743a494685948f83da258380281b4b0ff5c847b13b2d3f82f311e24d8826939f73b2fa2e75627b2eede616355
- TLSH T18DF08CE44884749AD7CA45B372E60976F9B9173CF2374EF485100BBBE8A1F26120E9C7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 452e6c6a8148f553fc9bfa23bbe8dda62dfe4e6a6b900836b72f0f1562984e46
- MD5 a03df582bc609901ade69e0f99e8b450
- SHA1 ee44ae39a6e58ee41a9e1c3ca65b096214d77450
- SHA512 28e0e2eddfa891c4a2e4345727a6e52b68c961d07d398a328e78443f5b742fb7e22388786a6d9086f720dd1a72acd2bebdaeceeb12bf9b1cb5cf09fd501de105
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Network\Network Persistent State~RFe5ad42a.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Preferences
- Size 6KB
- SHA256 795b4a4653bbb93e99f11ea8c9def342b25db55c845a7eba36503d42e1b76696
- MD5 e44cb8c0e0a919ad3732566e7514c70c
- SHA1 d9d44e51c3852638332c003f13b93d18dd9b6738
- SHA512 48c15c12dd615fa633cd01d5d17c6384ee16c79eb2dcbc6c166c81c3abd76467337725004752fdb0d026a294f02033b43e12caa0d6ebc36ccfc7304f00ce6c9c
- SSDEEP 96:stK/d+LmiGtb9fkvo5h16Z06s7/x+6MhmuecJL41ejeqK+g4228XM1C7K:stycmgon6sV+FdL4Qj2pG6K
- TLSH T154D1B8025E64797B4CC7E119BA79BB53E2F6A03261D01E58EBFC492C05DB6DC630780B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Site Characteristics Database\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\GrShaderCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\GrShaderCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\GrShaderCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 15KB
- SHA256 aa810178d2566f7fc06e6417d778a68be598cf41f178c0988ad56f4449f6527d
- MD5 eb451133e2bb96d225f03ae86af93363
- SHA1 0a9c0862d7ccf40bc14562c3d1217363c40062a2
- SHA512 d14e1cf5be9b92707b6d06cb08f4ee9436d8b007c4c1505af095f0748b65767ceebbc372e8004f2244ca14c2bb9f68ae0f1ceef917301fba4253a070a0185a57
- SSDEEP 384:7+aQikB+z/xvxjg/qhEmNBSPYdz0md6i49ze:a/UxvxjgC+W6e6bFe
- TLSH T15C729D2B99797E2395F7A905394A0B8BCBBD94B291C16EB84AE95F0D07873D81702C13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 15KB
- SHA256 8dc0ec96b34af2ce3ae94ac56a9d54546f996badc13a2435d430598dded96325
- MD5 8de0dbee4497d82ecaf93934af30f0e7
- SHA1 b6295d8748c959a16a725199385b0bcfe41a29bb
- SHA512 384968bb645cfcc86b8ecffd052fde89538bc520ba7987d706d1bdbcc9200f9d156c9f543d267fb806151ed30afe735dbbcab93bd19762da7c40badfb18aba63
- SSDEEP 384:5+aQikB+z/xvxjg/qhEmNBSHYdz0md6i49ze:k/UxvxjgC+q6e6bFe
- TLSH T1C2729E2B99797E2395F7A905794A0B8BCBB994B291C16EB84AE95F0C07873D81702813
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 2KB
- SHA256 cebb80edb3326903af04c8aafb61d83f32d73f63bd0e1f0e76caa62bff90bc83
- MD5 89b580cea693c6babbba868d22466d0b
- SHA1 9df4e710e88760d98c5bea89b42c683f74e3e868
- SHA512 45d81bdfea5799f1c402c7a501bb73d7f2868f0e6f58f73682cb6f8641d3582fb5a79ee17f6213c638d2d50915dcdefc300c260ff573270558dd5fda7b7a0e94
- TLSH T1525174736D10A6378AB64A197D8B2B53CE7EE062AA921F6495EC0F1C019769C1B02C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State
- Size 3KB
- SHA256 f379202e440e591649c9e7aaf1e5128b43800b3b7b4c466e434ea05b94af6195
- MD5 92192c461026a67b8380ddac582df2eb
- SHA1 c7447bbcccafd012508f25b214ba7eedfe73eb2b
- SHA512 8e85967865525dcc8250e3e32f5dc07df89de46f9109a72b9e3e6d94082edebe624601a3360bccab1ef74096bb9f47a025cd5c3c8638a83a532ff5eda13383dc
- TLSH T1D06184776970A5374EF79A0579872B02ABAA9023E9D13FA9C5EC0F1C01D73C81742C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\FPSDoctor\EBWebView\Local State~RFe59abd6.TMP
- Size 1KB
- SHA256 b779097925b4204d99f180495948443a3eb7c8c64c494aaebeb92b9b0c834e4e
- MD5 3c4cbfe35793657a5d39ff2d68d01db8
- SHA1 819d525b061ea244090ea46c093a1308c194ddfc
- SHA512 e3731429411a4d7f0e2227d2fbc79093359dc9a3dd0415c6704775a875d52ea5f47d02a6c5f85286f6d10b834a4810724a34c8428f5a2a1742a9c60a736592a2
- TLSH T1472187F3D5A01B339D96155736477B835F75A06B85504F1461ED4F1C07A61CC9A1BC33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\HardwareWrapper.dll
- Size 82KB
- SHA256 523d481c7f85a2f1165b664aa7ed35f94ec2a825aea44e56fb2c8e72a24e44ef
- MD5 e02a8f43dec73982ba62a2ca97b5ce70
- SHA1 a543b447fd293fdadcf07106824e8bf85e8582cb
- SHA512 a11dbe1c9a1206b29437516463b69eda1059ae4fe155b31b500da19d4e6524c8f4260d17663db63f350bb9e16ad3ac29cab0ad105caa02ce907470332336d080
- SSDEEP 1536:ob5h3oZSP+D4rqYL72om996/ETwI7BE0ub1Nz:ob55qSP+D4rqq7296K7BE0uRd
- TLSH T18B831A5173DD9210FEEDBFB49177A68942B5F9837612EF4C0E8634EA1B23380365075A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\LibreHardwareMonitorLib.dll
- Size 1.1MB
- SHA256 1ebcd7e09f11a4f2a56da626eb4c510dbff1ee03fcef8ac5af7b533423581052
- MD5 472293cf3cdf47233dfc83d7ec428e44
- SHA1 ea6128376014d0c695e2cf3a216bd18d38075350
- SHA512 aa3f3d52de3e2be8da16da42c2c20bc8a0d6a50c67b9d96ac75407cf320424030eb4686956ebe15ab3ec2ec4b35f1bfa96213140300aab11948159917dc0bbd5
- SSDEEP 12288:xiFjcE7FXRuVL2eHnTs8JAoBcCRr+5yBbJLc819/eTD1pEv1Gy7:ct7FXRuVL2eHEoTqYNcY/s
- TLSH T166450814B9DC4F3EC95A0E7738745945ABB8BC03CA98B72BB0AC774E19BB7446D04392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\Microsoft.Win32.Registry.dll
- Size 113KB
- SHA256 eb249fb10eb8687d3505fd9276480fb9a0c13dc975ce6bcc35e2e2e723e8d559
- MD5 139423d055cf754b2aeb589fb31864a2
- SHA1 e1ecdeee268572f7118b92914a26c91297bb6104
- SHA512 1731ac3d48ccc29b465589e59683f71bc31dae15d418c486f18989311d16a21a7ca03de65b1fcbd081438f8a5a02702e5c982c25816dd117f28a7ed21ae4b6ed
- SSDEEP 3072:g8wrd0FyC+tFYMK3aJSvEdy7IVi1Dv5QatHe+jD:W0DaK3aJSvEdEJRa+v
- TLSH T171B35B10BBC8810BEA7E45B99D634846E272F5CA5701ABDF42C5C09E2F637C2F672572
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Collections.Concurrent.dll
- Size 225KB
- SHA256 5a4b728246443eb3b4c0a16d9b3d04bc0bce60b7a1998fa4a75716358cc572ff
- MD5 7f5a6ed730126348f298285d83102c26
- SHA1 e9f583e45355273ec7d78bd7c62005137a9faee4
- SHA512 00d9db1f4fee5ed307928569a1933ba72fa717c641bfbd182fc8da7532a57056e5ce7c0a10324bf2b94a4aa27bc238920478d8783445bba21c67e0c0aaf20415
- SSDEEP 3072:i8Lq9jhKz6tVDNKTs4Vzof/HQLvB76qSa2ymYQraEN7Azg902iTmsPxNnUnZGAjp:Nq9jo6LUTs4eQV76qOc2mNnUnZGAJL
- TLSH T13E344A16638C0B93F5AF463D95A3C5039633A55B1312D3EF13E8A5841EA7BC1BEBB112
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Collections.Specialized.dll
- Size 101KB
- SHA256 8a1cf61a6cd079444ae790123ffc90bcd8d369ec5aed0f2f95d159a6479690b3
- MD5 d327af20fb99b0511d8e490f02095ca4
- SHA1 f5a9898919ed2887a2a0d6ad3dcebe8c0675f13d
- SHA512 f15d1a84751d121cd5cb5b946c91ec338b7c21eb39ef0196b11f115bd07d582e568e502ccce7da6a41a79ee175ad70742131368d3d53b0615e6d4eb7a32a15af
- SSDEEP 1536:/9DJyipoBcR72GUFFDE3A0giv9EywNwjNYGDWrBXzWBzC:/9bpomR9U3MM4jNYGDWrBXwO
- TLSH T1CDA34A28738C8B20CB7A82FC91A38942E774F2D31752D6CF5D4895496E977C0867B26F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Collections.dll
- Size 289KB
- SHA256 fc52be0abceac360478ffffce876c99997b4af56fc36fbf07cfc38ac5b7fdd7f
- MD5 08074fb9a496eee036facaa78aa19ab3
- SHA1 1b022e56e060f802c4a5b3e4e730da6e53b81fd3
- SHA512 c3bd803dedd131ba4fc5294a83fca5af67c4d115fefef54c6488229b67ba8407439f2c50a2adcc4a424d6ff8c2a62f250e361ab9ebaccef140166f3d16a33a47
- SSDEEP 3072:MEUwvuGeTbqnDHdY81uFqzK4s2QMsf0r3p9dJ2SAmnp8SFK0gwsDi2BOLI6mFnW:90G4eDj1Fe4eL8ph2wC0awL+W
- TLSH T14254391873888725FDBF41BAE593C122E1B990938350A2CB47BDF6509FDFBD12AB6015
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.ComponentModel.Primitives.dll
- Size 77KB
- SHA256 52e0988e01955d09170339429cede1d578690418b8851e19ddbba7d22a6490f7
- MD5 2ad24d944e4d99652e80a0ac5e791bdb
- SHA1 2fd8e37b4d0c2bb3891d46a1e65e533775c062bf
- SHA512 a8cbadc9fa657645f86282573e288eb9793ffdc9cd144ff55b70d8ecfff44d276991d4654a396ff998b921d417c6c11abf8a8785b9a7b0815ff164038d60b298
- SSDEEP 1536:8SRphdlpWxFkIkSyypSM2VLIGOYu2nCW08tfzR1:8SLjlsxFJVy+hgLVO52CW04H
- TLSH T137734A1813EC0329EBAD567C96B399119570F5871323D9CF8590C95E2F8BBC1F271A2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.ComponentModel.dll
- Size 29KB
- SHA256 23c6a24f67244c647a614af3249181dc68ad02acc3ebd3cdedf62b2df8da503a
- MD5 6564315ca3db43e0e2d8af8840ecd7cf
- SHA1 9623f304779a556c2816430eba45ad09758bb514
- SHA512 9595d75010762e43a5fb6ab65a9d0acad4c8d533152dca686e0102444040b8e8e3fe1960187a15060ff754af6a2afdf3b65a982a46a458f450f280db57c112a9
- SSDEEP 384:IWB1WvB0Su8Sk+J4fYcZlN6ldlKR9zhsF:nK/SrV9vs9z4
- TLSH T151D26CD6CB688227ECA75D70AAE8DA837D7DE3C58E0286670189F50D1C537C0E730538
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Console.dll
- Size 165KB
- SHA256 d6c46a682587937775464bb1a3850a9d3e11408440731fefb07d298cd6d7a99c
- MD5 cdf39fef9130164848978f5fa74bc3bb
- SHA1 dbc018077a65a7d040db7c36d0988b3ffadf4b2e
- SHA512 1b38ac592fa0519367663ca65a15ec928067d604a90d616c9f6fbd9856517ff9e104796fb1aa79bb561e8ba7c9d7ea75ed7e5ce8851e9f917f465f316c77a6a4
- SSDEEP 3072:MhK8LvmZrfHk4xul4nhu7v9QglfFRc47jwN:4yZrfDxu82Akju
- TLSH T164F37C2A97DD6527D77F86B845930301D737B8A60306E6EB418588881F93BC3FB716A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.IO.Compression.dll
- Size 409KB
- SHA256 fcc979a99b747680a81f5eaf71add66f3876588e59c90edf826c37e525d4f0b2
- MD5 e7da08754b8013602d83aeb20daf5e76
- SHA1 806e530338b70f4e32a5d3e56969cffb7531c02a
- SHA512 24de8c5f422d23bc59dde8f78bea21a8420c334b5ad226f3b43e9e8c2eb90f90766fc4d0a3e7a4b7c151207462aff62081838a43b7fa1ec48d191f48b1cc72ab
- SSDEEP 6144:f1q+7bb02wr9NJWPA5onxP3DviHrzAxidsvAWOB5R/dl0diU:0+7EXV5o93TiHuPBaR8dp
- TLSH T14A947C3463C44713EFAFC6B882568002D27066A617C6E7CBCA4DEDD8BE1E7C19A75217
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.IO.Pipelines.dll
- Size 185KB
- SHA256 427b8641bbcce1e355c8b72415bd8ef10c91eb4171c77fae001674df495cb5f8
- MD5 6b7bcdff5b7011e9bf5d9e5ec730b403
- SHA1 51f9238ac469ad70c90da81353bb5aeedbc182ad
- SHA512 58b784b0942f8cee3ed39fe8daeda2bf61b6e1603a7823302ac5b839b1b99fb96e35da7dac70d9d9fb1e7a6d3218206d158c788d8564a324b635c4044bbda384
- SSDEEP 3072:CIq60XKM6cR3RilUubgU33bltX4bgN0xmRBewipNfh/pvlxW2xAfKV83b:a3KM6aRigSewab7xW2xgKV8r
- TLSH T120048C6AD39C0713D65F85BCC1A346529BF394E65702F2CB048AE8842E977C1FE3E562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Linq.dll
- Size 681KB
- SHA256 4a5d41332ed37f7e195503ebd3f478da2ad0008cb8a9f85739b53d2df7d33d46
- MD5 0a5d406238bb9ba7195660911c1d4c25
- SHA1 df11f118d81b9d1635a54b6429e03f5fc327a76e
- SHA512 53272819d6a393d7f11b0c4d01e6102058e36583eb9cd7fc96c8c96b2b5afa5165aba6309618c4fc7e89959453684c8b97cdf07f546aadb380197f367649c683
- SSDEEP 12288:l0Gw7qPJLv73KQkvIRR/ZHC6p/XCy3esO:l0dOLzKQkvIRRJBF3esO
- TLSH T176E46D29D38C4A22CAEF467A95235161D2A195D243D2C8DB844EFD442FF3BC1677EB38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Memory.dll
- Size 157KB
- SHA256 03c2fe17dbd4e1cd709f6da1ff221eafaf3f076d23f8fc62ddff5302c152e97d
- MD5 56599786643afdaacc1f3cf4e3ac6777
- SHA1 cac3e33d65645795092c7daaf85fcb18e7934dae
- SHA512 c133000793ecc8a8532ae3dca1c49272d64c1d969656cb6e81924efdb70b4f9935a9548de1b7f58b636b4c205ecbd3f346a609b9dc7f763220497a4d7998773a
- SSDEEP 3072:8TbIW4QJ8tT49EggVul1co8s2pwaGrpXDXPjT/hR7g4:4oMhpV6waGrdPH5R7d
- TLSH T103F34A1BC3980227E92FC6BA8B6AC602EF337515D30191CB44D4DA486F53BE1BF76562
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Net.NetworkInformation.dll
- Size 153KB
- SHA256 7a520cbc73fab570bc069717d0b73efc03cc100196ff42137dba24066eeedb83
- MD5 d91159b26903efb85f1f6c3a85a2ba2d
- SHA1 e249be9dc0d2cb752c80b785db1188089c50216c
- SHA512 be8ec6500a764dc83d1086ec16f50e8c284fe059ec9df45fbb9043b12fbd946d44e33e64cb934430d55461e7930da6f2e95773a125a111902db6a478fb589976
- SSDEEP 3072:9RKFGKtvFXRmLv3m1P6ncvmALVXyVwa9eT9V5xlMH+k:fYvDEYMz2PlI
- TLSH T1B8F36D1153945216EBAFC23AA1E76A03913BE5C25323E6C716C8ACDC1DB3BD1B731792
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Net.Primitives.dll
- Size 205KB
- SHA256 e0be3d784a346ffa419a5b4f6aba91d20a909a122b01ce331c4ac1560bf93c3c
- MD5 88d16beae403d4a73b3817a445d63e6f
- SHA1 14c9af8fa961e20a02252ad517771dd0d5a698d5
- SHA512 8db91adaddfdf60a227c033c54e60a95ee421f7a6b6c0cfee2f5eb830c854a2496cfd358541af894643711d3ca1abec561636566288695da735fd161508d6597
- SSDEEP 3072:yk9vXV0t5RAn/8QTvt4BBpupZAcMXBN9CbWCcjtzZUAx3Z4IbpFg6ABhlttQ8JVK:JU5SKpupZAcumbwzJ3KGYxjlHJVK
- TLSH T1F8246D2963884607F76F85788B53CA11D3B3A4839309D6DB0A94A9C53FB77C0BF72592
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Net.Sockets.dll
- Size 517KB
- SHA256 53811a06f50f436db22d1279e5a209220ff363154e7c8981c8248d38f4c7798b
- MD5 dc8b5550139e63f6c8531681459773a0
- SHA1 4992c392fc5c499080561456e3fb7c92f95faa47
- SHA512 96e6f95bdf80185c4f8b7aabeece0971cad3d6e42ec87dde6fb765936766bb58e19b8bc04c10e093ab7f45c8e32e994097b9a5092b1da43534f7763d830e93f5
- SSDEEP 6144:xyIh5VpoAH6hnmMFZpfDkR+7EyBsX4NfbGctRWf5XdSs4f+uoJZ2xIxN1TyRxRSW:pp7UjpfY+7EIyqyyeJZ2yN3ZZ8MFKHn
- TLSH T1B2B47C1A73D80F05E62ECBBCC4560182D3F0A6D71795E7CB80C8DD952F93BC5A6366A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Private.CoreLib.dll
- Size 15.3MB
- SHA256 76a49f17e83f613bc8a5b55fc98830b764e7838265aacbdbcc8f46707f80a3c9
- MD5 a49b53f149f536e90bcc05658d87aebc
- SHA1 3b05684dd5dcd813ebd6a0f6cf72092e560f5ccf
- SHA512 3eddf059079cf26974cc487affba6583e6e5302377d20f1c673845e09d85076d790b20015b06a9ecded24da88a1b65bcf70e54feae4222e6187edf8292e0638f
- SSDEEP 196608:d+P37OUBwZf3DKM3KxPrH1uk0hzOH0KrO04ddwSw0TZFyd0:d+iUBwZr73Kt1uk4OH0Kr/4DlpFp
- TLSH T153F69D20E3C98F46E13EB2BD81638629D970F8526327D6C70558DA493F23FD5633B6A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Private.Uri.dll
- Size 249KB
- SHA256 27b93d6e754d7d2e538333e3c1d520c64d7eb012dde1705e776177b273662b7d
- MD5 b1a06b4c3c0f6d03087d7a8bf045101c
- SHA1 bf7e2aeccca3645f9ebdacf6bcbef418c6e77947
- SHA512 2dac84a72556a82e6df7fe630de0fd5e3e081659dbb98013d736683c5a6cd6745ca5eddb2afd4b66fe671c171460207bbc39db84f7b2a2174cf9eb51bda694a1
- SSDEEP 6144:mjEjhVSYgnYGFr76LGZxJyjMjPhArX+AVSP3m/3tpeB9pSzF17K3O2djHMYYMpSS:mqVuhtBXl2+HtGo
- TLSH T178446D2BE3D80D2AFB2EC27D8993C152E272B5955705E7DB06BC90913F133D09A39593
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Runtime.InteropServices.dll
- Size 109KB
- SHA256 627a86a918f6669f94cf8db6ce064a4b2207b852ba6a4fecaccad7bb07859b4f
- MD5 b18883afbc4f8ec15db5ee296a446ad0
- SHA1 56edac2d32ce838750d2b07284e1017a38ed6b72
- SHA512 169bab4218970bcd4b8206ef9be98dbc609200cf5b27cda8a61d321cdba865415232fc910b2aa0794105b263756e2bb4b1b5c67500459c898783c672c5058b97
- SSDEEP 1536:xOCC7EAttQMxvPQtvC+zucKb2EW4udNY/w2yVvO0ugu94RHPXF20gf1zX:xOCoEStQMZ4vg2E5udNY42ypNu0Pcf1z
- TLSH T144B337207B98863ADA5A873C9C736D00CDB3FAC65322A6CF4184849D0FD77C567727A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Runtime.Numerics.dll
- Size 345KB
- SHA256 8c715e55c80a4ab31d086b5e51261d691b52b867b1c1f5d99c344ea4faa27f4b
- MD5 1730af6d773918de04115bfb1367440d
- SHA1 882f23dd4dafa944a34115efbc9d79e350ddd4db
- SHA512 3476785464d08b2ac3fe15eef8efb279ff9acfd5e5918cd8d615373df2d026a61d9b2e968b1f03aaf700c1afa74f4fcce0668a0846472729817322397d2c5945
- SSDEEP 6144:A+ESgPg0Tkbw6hE9e8Of6iQz4OCJrTrl7vZAhafL45NK:A+ENPg0obwcE9TOhTrlVAhM45NK
- TLSH T118747A1CF786C2E2DE3ED078E52B4102DA74768383C9E3D7549989A16E177D1A23A1F3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Security.AccessControl.dll
- Size 221KB
- SHA256 0ce0621ed9cf8fde8aa78be726f7e4ba7b9e321c86ff1faa282a8e8ca1a62e86
- MD5 ccfd41fce34d598c9442a866ad43bec4
- SHA1 95e274a8dd532828fc8f121135787e96674db529
- SHA512 333235db5d62a045922ee3fa5b58731d9f76ac9d748e2a476a4dffcf83b9db562ac0f77399f5b56fe9240a0e67f30a3abff206b25109fdcbad177fb6ea6857a5
- SSDEEP 3072:A3x6DZkTetpMQTrIaQNGs2jshJUpjFLxko7uCnQ95F+8k9k/7V2moCSvqq3anB:zt2eYQG2jsh2Gq8Ek/7b8vqqUB
- TLSH T1C7248C2AB38C8D27F6AE8678D4A7C901E6B378931356D7DB0690D4542F13BC1BE73162
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Security.Principal.Windows.dll
- Size 173KB
- SHA256 b04ee5bd519137cc929b355221af2d9649f149aca7808768a0cb99e423ff8668
- MD5 d8ffc2864e10cf8ce19b637dd24309f3
- SHA1 589e48a9303b6c510408d16bc87d6255bf7e69be
- SHA512 911031dce0f9e07ca9c755847fe17c4bdcf6d4fa3cfbadece79ddba856311b7db41f81df0c231621993940a00c7fe6ab28d27434194d84609c7386bfb5e24b17
- SSDEEP 3072:9w0q/aoxoUL89AUNjsGNyxmbZ4rd1SnJXpWws68S:G0qy1ULY0mbZ8Qlh
- TLSH T1A4046D1293C84657E7AF863CC1E36205D7B3A45747419ACB5590C8A92F97BC2FF3222B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Text.Encodings.Web.dll
- Size 121KB
- SHA256 775eab42196bf9466a69e9fc86e47b8da620b7652aa4b8a62245449131ce885d
- MD5 9db84b78782a4aa1dd421b8bc6036a31
- SHA1 7e9759a9bd81395f6b733152d93682ae85459052
- SHA512 90bbd339d4e007ca3966da86ff35fb5e601c89ffb38750e00badf7a7c9424a6536dc29efd9d5da14aa4205d28a81796a5ef8061843eda79fe2152b3057b201c4
- SSDEEP 1536:R7FRA0FaMPHcO+NP/LNss/5XwY7qSA1ehJ98zVKXknG4/szX:R7LXFlr+dNsKry1ejkK0G4EL
- TLSH T132C31810B388D689C3694374D6938572DAB9BFF1035296CB09A8351A1FF27E9AF3D143
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Text.Json.dll
- Size 1.8MB
- SHA256 6945c5fc52f811e32b13597b0d2a14d365227245e21bf7daebc6986f729b25fa
- MD5 e508c206f60d3359cad70a349fe581ad
- SHA1 9d5cadee8824db16b6dd849470ffc5df4113ddcc
- SHA512 b231752cd8c4640ff543283a48721985bcc9ddb7993226573efa68b35be8bfea15be8d4ef09a1387df1d7a6f1f4723e5d35d70957364e2056dcabe5b14121c20
- SSDEEP 49152:c4a9OE7kEkWCwr8QsUJwwLBpbp95Cifbfr:G9fZsUJTzCiff
- TLSH T199957C11E3EC5227C96ED2BA80138122D671A1025312D6CBAC58FD8A7F43BD1D776DBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Text.RegularExpressions.dll
- Size 1009KB
- SHA256 b1f6aec1ed431cf5956d8bc870fb0d47c43455438c5c0110433fd125183f190d
- MD5 db9d1ac8773c841e0af0c70096f3280e
- SHA1 e87ba9f573bf9cb5ede23fe1b8125927ccdc14f5
- SHA512 5c06d4ffad4bf419eb9f4d161e8380e69cb7738d4a2015e0afb18b6cc552a7dc94223bf9e53e403ae0c63877011c7b694f2ab5587bbbf0efb7cec45a895122c6
- SSDEEP 12288:64b2yXoK6ABRKm+aXmMxgvq1ig3RB5ocEEC9St7dBzy2qfE:64dYuBRAa2QgYZv3PC8t7jqfE
- TLSH T1A6258C2C93880361D76FB639C19AD211E6756D62436986CF4808F8BB2F777C2E6F6017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Threading.AccessControl.dll
- Size 73KB
- SHA256 14e0ec8285100d4a3259a899d9ffa5269797e8ae2e3c9e119783ece06ebc62c1
- MD5 a0a9c376bcc7ad3e43b5686a1d18a447
- SHA1 23e2b1a157c98498a28f2bed2bebe49b1a2941cb
- SHA512 4da3772f8bdc5ff5786a6d35762f10c897bd7786947715e2a5c94f38ab74bd3695b9d63cd37ae136039c582f76f0c4d08b784778d5a356e7bedad5683255ac2b
- SSDEEP 768:57zwGV3/WLTfJ39KSSxntNG6saXce4JI6/avnoJ/9zx2:RwGxUN3ISS865XcRW/ovzx2
- TLSH T1EF734B14D7D8462AEABA8ABC99B3C405E530F5C14B1187CF8486F41E1FA3BC1E773666
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Threading.dll
- Size 81KB
- SHA256 96ef32e315217f24b6b701fc182cac464966cad1da94dd25a3609fe2d9f5a6ca
- MD5 ddccafbb8be31d3205273fcea7824420
- SHA1 403e6242b314445e067102d0d48c13ae35818518
- SHA512 c8d32d7b79fee789f398d45cc0c91357a7a612e27a7dedf81821aa5d4160cf0497d75861ee04b206def6eae49f4c2c84b96eba41fb561ac2154f1c212579ac6f
- SSDEEP 1536:AialBo2hUTogxqwXAXXG9Rvd5bFF9o6sionbz5:ADlBoAUkgIwXeW9RvHBF9o6Lonbl
- TLSH T106835A11B3E8091AF7BB47B9DAB36905C172FED21B11D2CF405A910D1FA7BC486B21A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a72a2f969b8b7496.ini
- Size 413B
- SHA256 58c971b92752cccb02f08b40c364693997c9ee84ff4851bcce23cd3ea2db43ee
- MD5 e73147d4c1dd9e57a1cdc844fac3cebb
- SHA1 6563e844bb5448375d53b0cf8d0ef0715ad790e4
- SHA512 4c40d2d1793ae0663fcadd77e76fb8d5c50edb0ad7b853a202b6e3d3df0ae3e400d75d95c82e2039951f09cb3ef33ade8d128f84a1ef22a33e86ac0fc839add4
- TLSH T1BBE0E54200BE90DF590271C98E384BAA840EF20448631700F361DEA4AF829831DD6A6A
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\PawnIO_ABDECA46.tmp\PawnIO.inf
- Size 1KB
- SHA256 7c1c203e13693531243fbee3cb87d7b79170eae89f5729b3f41387fe68a54f0b
- MD5 0a33770fb7ac5bdf673e6d1bb78adc61
- SHA1 8c7c31ddec6eb61741958df8924dba38606b907f
- SHA512 1f4cca9fc0698aa6213aafbe7182b8576ae89a37976a9f344248257e5fe40520cb05129033a06d4235f7db0c1e6d17ee9cd31a7d0f40116f058310cea94f97a5
- TLSH T1E321F00A4DDB8F7C2C56E1651A3B43C3FAD1A1002068550CB3DC7FB85B9DD9CA32E1A5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\PawnIO_ABDECA46.tmp\PawnIO.sys
- Size 133KB
- SHA256 fca6e7d58b0cf38dbb913a2b9e532f48629145d395f454b16a9f58e97b8d3940
- MD5 a9ebaa64ddefba4f4ad3b3071c582a24
- SHA1 8cf8f0aff8ef43b34ec247c8595b61c0eb9a8b90
- SHA512 b2f3358ae897c375fde806648bf4628f57202152e8b955ad0fe6dea4ff96b42275301f00a3fd891ead42235518a2b04c2867e75269399917281ff6f171d91eff
- SSDEEP 1536:QVg8JDpk29f/cUFTdcNK2ZhC64WmTKniUWfIHRo1L8z:qzZcUFTdccipmTKbxN
- TLSH T15DD3D95EBF1D28C9E877A37C935A071AE531759837609BC741A8E8581F216FEAF38340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\PawnIO_ABDECA46.tmp\pawnio.cat
- Size 11KB
- SHA256 a37d46840280efec92063d3a21014c803939e599b4c0da4a4d063b79eeca9446
- MD5 8045cc5d557423c7cef1ddc814abe8a3
- SHA1 f5ca9d0b9d21edfa62703503d28f2f83d522d599
- SHA512 0697b171ad02a4c7741e12b64b149e7327704b64d24af934a93bd07fb75761a56988da2898ed47548637f4c0bbd1bbbe7ce0452cebea7f6415ae0944f52c48df
- SSDEEP 192:TTQTaTJTVJCUPXWEwGJhYClFU34DcX01k9z3ADLyg4pe0oWA:nk+VVFP3h3DcDR9zMLyRzoJ
- TLSH T16F321BE345A841C2D9576C6093E4F5973C3D67CB982084F922EBFA145CA73C9F72816E
- MD5 SHA1 SHA512 SSDEEP TLSH