c32b3b170f6c4cc9e4effe8b5e7e56e9d37d86cd020678da87d03509605c901a

Analysis

max time kernel
70s
max time network
77s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Paragon Tweaking Utility.exe
Size 67.2MB
Sample260823-d837ssxtdx
SHA256 c32b3b170f6c4cc9e4effe8b5e7e56e9d37d86cd020678da87d03509605c901a
MD5 39944e0f38d09434f858d3f0c97b2b55
SHA1 22dc7f0384896752aaf9a44be5e3a55d9c85815c
SHA512 fb119966f1dc10cb66908d5f2cc4a2bed72e68976e2f795f020783cc587ac58264c4a416adfb017fa4200887d7608a09ac72c7b5763c9628db3f6ee794623052
SSDEEP 393216:7AlD+NuEPwLGO6KpRUhMC5714fdWykz146Mb5vrfwR4NaaW/EOZXrS3mLGDh4d67:7AlDKOPRUhT57kdWyOkmReaE2X4uby
TLSH
T178F7AD17FAA920E9C2AEC131C4775612FB717C49072023D76B64BA252F73BE06E7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence trojan

Malware Config

Signatures

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Power Settings 1 TTPs 3 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4616	powercfg.exe
5012	powercfg.exe
344	powercfg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	LibreHardwareMonitor.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b1cc2cb8-2b0b-0d4c-8b41-a9af9c24c743}\pawnio.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a92d2610b0f4c4c8\pawnio.PNF	PawnIO_setup.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b1cc2cb8-2b0b-0d4c-8b41-a9af9c24c743}\SETB418.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b1cc2cb8-2b0b-0d4c-8b41-a9af9c24c743}\PawnIO.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b1cc2cb8-2b0b-0d4c-8b41-a9af9c24c743}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b1cc2cb8-2b0b-0d4c-8b41-a9af9c24c743}\SETB429.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b1cc2cb8-2b0b-0d4c-8b41-a9af9c24c743}\PawnIO.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b1cc2cb8-2b0b-0d4c-8b41-a9af9c24c743}\SETB42A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a92d2610b0f4c4c8\PawnIO.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a92d2610b0f4c4c8\pawnio.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b1cc2cb8-2b0b-0d4c-8b41-a9af9c24c743}\SETB418.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{b1cc2cb8-2b0b-0d4c-8b41-a9af9c24c743}\SETB429.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{b1cc2cb8-2b0b-0d4c-8b41-a9af9c24c743}\SETB42A.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\pawnio.inf_amd64_a92d2610b0f4c4c8\PawnIO.cat	DrvInst.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.dll	PawnIO_setup.exe
File opened for modification	C:\Program Files\PawnIO\PawnIOUtil.exe	PawnIO_setup.exe
File created	C:\Program Files\PawnIO\uninstall.exe	PawnIO_setup.exe
File opened for modification	C:\Program Files\PawnIO\PawnIOLib.h	PawnIO_setup.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	PawnIO_setup.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 2 IoCs

pid	Process
212	LibreHardwareMonitor.exe
4856	PawnIO_setup.exe

Loads dropped DLL 4 IoCs

pid	Process
212	LibreHardwareMonitor.exe
212	LibreHardwareMonitor.exe
212	LibreHardwareMonitor.exe
212	LibreHardwareMonitor.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Paragon Tweaking Utility.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	PawnIO_setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	PawnIO_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319301958268826"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
964	Paragon Tweaking Utility.exe
964	Paragon Tweaking Utility.exe
964	Paragon Tweaking Utility.exe
964	Paragon Tweaking Utility.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
836	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5012	powercfg.exe
Token: SeCreatePagefilePrivilege	5012	powercfg.exe
Token: SeShutdownPrivilege	344	powercfg.exe
Token: SeCreatePagefilePrivilege	344	powercfg.exe
Token: SeAuditPrivilege	2880	svchost.exe
Token: SeSecurityPrivilege	2880	svchost.exe
Token: SeLoadDriverPrivilege	4856	PawnIO_setup.exe
Token: SeLoadDriverPrivilege	1176	DrvInst.exe
Token: SeLoadDriverPrivilege	1176	DrvInst.exe
Token: SeLoadDriverPrivilege	1176	DrvInst.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
212	LibreHardwareMonitor.exe
212	LibreHardwareMonitor.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
212	LibreHardwareMonitor.exe
212	LibreHardwareMonitor.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 836	964	Paragon Tweaking Utility.exe	84
PID 836 wrote to memory of 4956	836	msedgewebview2.exe	85
PID 836 wrote to memory of 1672	836	msedgewebview2.exe	86
PID 836 wrote to memory of 1672	836	msedgewebview2.exe	86
PID 836 wrote to memory of 1672	836	msedgewebview2.exe	86
PID 836 wrote to memory of 4768	836	msedgewebview2.exe	87
PID 836 wrote to memory of 4904	836	msedgewebview2.exe	88
PID 836 wrote to memory of 4904	836	msedgewebview2.exe	88
PID 836 wrote to memory of 4880	836	msedgewebview2.exe	89
PID 836 wrote to memory of 4880	836	msedgewebview2.exe	89
PID 836 wrote to memory of 4880	836	msedgewebview2.exe	89
PID 964 wrote to memory of 4616	964	Paragon Tweaking Utility.exe	91
PID 964 wrote to memory of 5012	964	Paragon Tweaking Utility.exe	93
PID 964 wrote to memory of 212	964	Paragon Tweaking Utility.exe	95
PID 964 wrote to memory of 344	964	Paragon Tweaking Utility.exe	96
PID 212 wrote to memory of 4856	212	LibreHardwareMonitor.exe	113
PID 2880 wrote to memory of 1040	2880	svchost.exe	117
PID 2880 wrote to memory of 1176	2880	svchost.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Paragon Tweaking Utility.exe
"C:\Users\Admin\AppData\Local\Temp\Paragon Tweaking Utility.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:964
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Paragon Tweaking Utility.exe" --webview-exe-version=4.4.3 --user-data-dir="C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=964.844.9327938094379902390
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x108,0x16c,0x7ffcedd0b078,0x7ffcedd0b084,0x7ffcedd0b090
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView" --webview-exe-name="Paragon Tweaking Utility.exe" --webview-exe-version=4.4.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1740,i,8665472300850478228,6437503541455716412,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView" --webview-exe-name="Paragon Tweaking Utility.exe" --webview-exe-version=4.4.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2052,i,8665472300850478228,6437503541455716412,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView" --webview-exe-name="Paragon Tweaking Utility.exe" --webview-exe-version=4.4.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1744,i,8665472300850478228,6437503541455716412,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView" --webview-exe-name="Paragon Tweaking Utility.exe" --webview-exe-version=4.4.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3628,i,8665472300850478228,6437503541455716412,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:4880
- C:\Windows\system32\powercfg.exe
  powercfg /getactivescheme
  2⤵
  - Power Settings
  PID:4616
- C:\Windows\system32\powercfg.exe
  powercfg /list
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5012
- C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\LibreHardwareMonitor.exe
  C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\LibreHardwareMonitor.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\PawnIO_setup.exe
    "C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\PawnIO_setup.exe" -install
    3⤵
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- C:\Windows\system32\powercfg.exe
  powercfg /getactivescheme
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3a615020-445b-1c47-9993-875b97f22340}\pawnio.inf" "9" "4c553107b" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\windows\temp\pawnio_17735080.tmp"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1040
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\PAWNIO\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:4d51782f23653f6e:PawnIO_Device:2.1.0.0:root\pawnio," "4c553107b" "0000000000000100"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tweak_snapshot_recovery.key.mirror.pending

Path C:\ProgramData\ParagonTweaks\TweakSnapshots\S-1-5-21-668679576-120646659-2289335452-1000\tweak_snapshot_recovery.key.mirror.pending
Size 32B
SHA256 4651f797beab7668e9e511ad9962473de420b1b1f9767195ea6ca09378cda457
MD5 3b59c055cb69022436224a1c8d731bde
SHA1 8bf7a69795cbc575f98483d3f95687419bb5d159
SHA512 feac46e025ff965c7ff0f495f610403327d043b39b66de9061d800eb8b6ac9ed5688ee4d1b15652192f8719b6509ddb438fda72f3d2e489eadc4ee86820a3bdb
MD5 SHA1 SHA512

Submit Download

tweak_snapshots.json

Path C:\ProgramData\ParagonTweaks\TweakSnapshots\S-1-5-21-668679576-120646659-2289335452-1000\tweak_snapshots.json
Size 353B
SHA256 b44a307a93d2351b2a23c99b004b6850f0692842923eba04bab78e65d9bf0777
MD5 e5247742edd0957fdd40fbe147092f82
SHA1 86ed2d6005491a24258f568853cf21dd16296e76
SHA512 0cbc258429d760c7580f7e80ea7bb6f33a47037506caf862a4d1e61cad08a095049377dde4f64158231070ace9e594ec3d4c0cec098fe40c0623754f6ca887b8
TLSH
T1BAE0C09FC940DFE00CB053CC31EC019F333C6497D62101376B053954E394E5C82605A0
MD5 SHA1 SHA512 TLSH

Submit Download

tweak_snapshots.json.replica.tmp-3576226189

Path C:\ProgramData\ParagonTweaks\TweakSnapshots\S-1-5-21-668679576-120646659-2289335452-1000\tweak_snapshots.json.replica.tmp-3576226189
Size 353B
SHA256 f67868be4178dc80cd5199df4dc575a4ab5311c929ee2eacfbdddb906d65a8a6
MD5 f304ec82262d8c099acba2bcf67762c6
SHA1 1fcb0ab6dee9018d441d2ada5cdfe2dd523d8371
SHA512 d1f6c7af80ef09c586a0b0c51b68dd4867fff9f13e5879b86bb6d562b5061f6ef3de08b6614db8996694fb830d630bdecfd4fc5ecdf49a0ba71bfc92d8b4721c
TLSH
T11FE0C0FE8120DFB00CDD63E9724E1016E2E922D2C5915C82FA4230890233C6C40625D2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 90c0a7d4914bab9c2f7205372b8d5c8f876c2f78b122fcea8d2c3e7e284868c3
MD5 d40e52c0825e625a29fcc962b91b0d3f
SHA1 09989cab1533b9a431f9da84d57c708bec4b7009
SHA512 1aaddeeb9210a49bd6eba24ba0851bcf3de4846cdd342a752f70b83932c81e8335b6a0fdf9a4539d6bfc9aec703b9d3281e6630f8d1c2c5faa9c4e94638acdaa
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7024e30a7d3948873aa6fe8f5b0372e3d28f40336ce1128c26424e3ccd0ef233
MD5 814cbb68a032c831bb8b7656cad3df50
SHA1 ba83733bd3ad39a19a24261205c22fa3be7ba648
SHA512 41fa24c04bba4e67588583db257ebff786b46e60df7d097df39d33e37eb2af6434e601e8c0d8b64623012974d76b6f99cfbcf62c1c3c3c8eeff49e318896f6d4
TLSH
T109D0121B320202B4C02034330403B24C0541C31B804640015439856D2A250500916442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

9981f242-cc23-4e09-8e51-070b92f2fe5f.tmp

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Default\9981f242-cc23-4e09-8e51-070b92f2fe5f.tmp
Size 6KB
SHA256 6badfd9c491a90e43e27dde576a0e96edfc8aed58dbdda161bc2d761a012d3b4
MD5 437227af277738c2a2c62566b4e58bd9
SHA1 3dc491ba2f9e5360c62776b125ed74a95850b6d8
SHA512 a825e7447b1df280bc58d7addff444ac644fc8dafefabbb9d86f4b23f05515149599a9d7510727fc606577405b09c28ae30db56234c750ad1910e1b9f05206d8
SSDEEP 96:stI05CWKFvb9dS1ff5Z8i0vhEjDkcHm/7qx+WVHMSm+uecSv81idQjt+g5we+MEB:stI0UC1fhZ8pabG/S+WiQv8wdkUe+M8
TLSH
T173D1C8029E2879774CC7F2197A36BB42E2FA506265D45E94EFFD851C08E66CC730B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8166daef38291afe6f7d19e0ae052eed98d65e8654d8098f5434f06e43bb204a
MD5 e904c3642a729ab89bb3f49854aed819
SHA1 4fae96c310eff639506cbbe8c96e4a12f43c6530
SHA512 9549cbf186d2483aa46a4c40ac631cb85edc9e8ce74a8043f4085be1ed24d2376a29461b118906848dbcbb8ced749a10936184e7692f6d4b48190a033a71eb00
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 31f20c49e9fb1f10bb3c0398245836c7b3b265947dc3d323c8793aa2b31a0d27
MD5 5f4a267f6fe3050db10f996f54d9c065
SHA1 5610174e6db0420abb9998b5a69df34b6ac0a886
SHA512 4764f1c4071368d2dcb1a5d4b1bd82a3dc3d493468facf7aad5dd09c586003d088eccb8c34ef1d30c482d149307cfd5ab22b35254c0446c5cae94a9eb91b8fb1
TLSH
T14B211004784EB5C3D7D80E3D10FE568338BA5816F5871F41A0069E70EB60FD9C91C259
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 026885949488be2f615733d1d3d90bcfeb51f597da6ab2434395f3fe99010da8
MD5 55563b82e18bc2ace543455d8f97fbd4
SHA1 2f65859c21043b95d5459e933d0e7f2be9afe09e
SHA512 147ce604b32e8ac97e44acc44a98c8c586a24b3a3ee1c049f6da484b6d280beb984d7df47a579b7361e82a87b46804b0fabba636cb9a4946c2a5c81c2cf98ea8
SSDEEP 96:stI05CWKFvb9d71ff5Z8i0vhEjDkcHm/7qx+WVHMSm+uecSv81idQjt+goO8e+MC:stI0Ur1fhZ8pabG/S+WiQv8wdkge+MC
TLSH
T155E1C7029E2869778CC7F2597A36BB52F2F6506261D45E94AFFC861C04E66CC730B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Local State
Size 16KB
SHA256 d9ff7b297e856c7d75c1ae08e0eb7096c911f7ff7fcb134fccb7eba27fef1400
MD5 4ece67ccdaf5e2d795673d25948ce53b
SHA1 a1230dbd102f923a834699de40b9019d9530b963
SHA512 ad79e26aed7a3920c622a4b70cb6ac7a68fa45eeedeef43a11ef8d0983ec534e48bda8ac99dcd9269e8bf79a46aad309f778b0a7258f4c639ea6a9ac3b632a4d
SSDEEP 192:zW7DFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4k0Nb5TufCx7ooDc:zG+aQikB+z/xvxjg/qhEwNb5RLv579zs
TLSH
T1E1729D2B55687E3399B3F904794C0B8BEBB584B280C56EA88EED5F0906C73981306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Local State
Size 1KB
SHA256 ad3ecf03fccd08262ccf4a945eb3770ccfeef75db8229b146ecb86c5ab99addd
MD5 7c3d433466e23777cd8ce6a8f28b0d8c
SHA1 90c9cda81249b68598300c5f680588c7269187dd
SHA512 fa741163952c1e1438ae61fe783002c9427b7a7076c544f2208595c5c3b6c29b5b5282602fdaed36c7ac51e3f138bc62bfa15d0119bc883324c2c225d2ab9c53
TLSH
T1AF3185B2D0906F376D92655070467A833D22906BC2669F84B1EE4F1C13E358CA62BD33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Local State
Size 2KB
SHA256 3c2bad19fcc47dbf0605c14cc66b4df2a1537ebd148871d29a39c7f7f32c7ebe
MD5 5564e20a42b05283fda749a90a15ec02
SHA1 b7627f8cb4da47559dd425cca75176b250109a3a
SHA512 5b33a8bc6f4ebe968197fd2a20a9ef8d4e36d886fa34bcaab838e9693bdfd6050a8dd72d02af517b552612e16ff986c15b071d7293c6d3019f6f3c45948e660e
TLSH
T1BE51A7736804AB3789E36944784A3F52BA36916696A63FD0A9ED0F0C02D7A5C3306C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Local State
Size 3KB
SHA256 98b7de35ed723c9fb61d5a198e5182f1f41e61abf8bf9326839c7bee06082b24
MD5 e0b1ec24b2abb3fe3ca0dccc3077852e
SHA1 921d9f21da8ea23975f1be13ef3c5cd1b1952ff3
SHA512 1efc4a45662dfbc5fd67462923cabe0186c25e2d4ec72f799bb308e14d247598189db4b2183320fc6af808e48e7a31504675d06e949a6d3d75a55da9faac5331
TLSH
T1EA71B7766964EA374EF3A940B88A3B02B7A29127D5D53FD4D9ED0F0C02D77982302C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Local State
Size 16KB
SHA256 75fc82230cdc401c2a5c0059efcfa10ab69e7bfefc8fc920c30a0ccd53531d21
MD5 31c41cdf0ebf14a5cc5ca64642fd9489
SHA1 60df9f979deb9f265bbe7c8117047cd35d966038
SHA512 ecec9c40e0a117ddcf41ece74d954e03d3b0945544985b7f255f77084924ecc0029c17ed1676ae006e3a712df87ba310054daba4078ca8b113d10e5188791c72
SSDEEP 192:zWQDFOKH/2/aQWjYhwZ00i+z/kNWIU6ZwNj1Jfo/iVQ45hgj4kBNb5TufC+7ooDc:zb+aQikB+z/xvxjg/qhE9NbWRLv579zs
TLSH
T192729D2B55687E3399B3F904794C1B8BEBB584B280C56EA88EED5F0902CB3D81306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe585e19.TMP

Path C:\Users\Admin\AppData\Roaming\Paragon Tweaking Utility.exe\EBWebView\Local State~RFe585e19.TMP
Size 1KB
SHA256 31e8eeed0eeba58f1ffa0e764e9b94b2610abe6bc11bbc8309b0763d1b582035
MD5 cd07fbc29e3a532a575b5e1d1f1f2cfc
SHA1 0a9b599070566ab57ca758aab7039b4a2d50af4a
SHA512 94585f15e41b7e894d04f261679fcb0c43aa02878409243444335584e6c4247f1bc78d44e66d9278bb265a5a84d3a37db68e8779753c47e4ca7561aa8246b8ea
TLSH
T157218773C094AE77AD515850B001BB873D61916B82699F88F1EE471C13E359C963BC33
MD5 SHA1 SHA512 TLSH

Submit Download

user_preferences.json

Path C:\Users\Admin\AppData\Roaming\ParagonTweaks\user_preferences.json
Size 1KB
SHA256 0b4343caffb86d08e455ede5ca0cdf96c669d199a7eaf7bd5d488fddd4552357
MD5 bc1f066970b571273f6b868aace67a95
SHA1 76207d19c8b12b3d442465e9fcde9ab0ed1b213b
SHA512 90cc690b44d3be73c82dfe27a63079f0416f319d53ce566b11ebae7f583317c67e597f78a1b79d9e45a37a462de7db84604630bfaf5c7dddd0b6c79286477c1b
TLSH
T15521D77B10136BF545F362CF30ACA493138D4AF975AD82DA9D13344B0612A2C8FAA1AC
MD5 SHA1 SHA512 TLSH

Submit Download

user_preferences.json.key

Path C:\Users\Admin\AppData\Roaming\ParagonTweaks\user_preferences.json.key
Size 262B
SHA256 c63eea572b68c9b282e062b2cc9a830d8f1d6139038558fa4afb65d930884750
MD5 e7c718bdf68bbcd2d29665533913ed92
SHA1 1d6592eb12ed89210b3d0a2a4fa2e87c124e3bca
SHA512 c7f12dd1fb4ba955b5dde122c22291ff118d0f4bcf0357c4ff527c6428173e62491b16f3551bf4027411ce491ae736f3a8f1c715f6bcc11ae218ea1c296d54ac
TLSH
T105D097C651851401D22433FD7D8F6E020282A43397AFE2CA4A9C66B5C9CBB0B8C14926
MD5 SHA1 SHA512 TLSH

Submit Download

user_preferences.json.key.mirror

Path C:\Users\Admin\AppData\Roaming\ParagonTweaks\user_preferences.json.key.mirror
Size 262B
SHA256 2107bf96f6e30252a9338bd88bc09ccba0687800b9426a37e024aaf517ca2294
MD5 924584b390b4d10474e03f5de677651d
SHA1 1fc2d4095e255fc091f3291d4fe77a0efa67106d
SHA512 9c330dd7828d1bbb0a0eb8db8b1e75befeae5044c4ed1a65026e5bf8c3279ace0c24ea9b63bf79a1e6cbf47ded7c82898c4da8bb5c4555b475346c074bc91acd
TLSH
T1BBD02B6411050C81EC251B7055DFA4202CC22A3068714B0461909CB6591AD861355D42
MD5 SHA1 SHA512 TLSH

Submit Download

user_preferences.json.replica

Path C:\Users\Admin\AppData\Roaming\ParagonTweaks\user_preferences.json.replica
Size 1KB
SHA256 4a3e617f1c60c2da8268d80e0fd9bafbf96cb9ce2c69f384df5febb47d959952
MD5 fa4fd15f36f6d9308a2010e8225cc5ff
SHA1 7113d7823181d79a0f364d99b68771382d06a453
SHA512 4b42beb541aea6744f53bde9afb54ef1e3815af6f96cd87917fe337315c409ae142b1595d3908e5bb9ebf7cc7e3f05cc65bbebf2f0db8ba783ca8dd5f1129c96
TLSH
T10521A7C981D23B819ABA2364620452A72E39DEA008394B5DD2E23C8DA320FBA07075B5
MD5 SHA1 SHA512 TLSH

Submit Download

PawnIO.inf

Path C:\Windows\Temp\PawnIO_17735080.tmp\PawnIO.inf
Size 1KB
SHA256 13615792a75f85191bc3f2d19055a0292e47a1cc65f0d12b8631bcc0292b0e7f
MD5 3049628e73bf1273aae54ca37e45f96f
SHA1 87c3aaeb27ac688c897fad1f6250914284bb18a6
SHA512 49f5fe0c30dcc53c4d6998d379040f6cc21458fdd9821e38cbf94d808e9f504ab85d3a1c65c7cd2702bc8eaa3a7f10e8fb5781c980f1457418ba680a68f5f17f
TLSH
T15B11CE094EC74F7C6857E1652A6B03C3F6D161002098550CB3DCBFB94BADD5C932E165
MD5 SHA1 SHA512 TLSH

Submit Download

PawnIO.sys

Path C:\Windows\Temp\PawnIO_17735080.tmp\PawnIO.sys
Size 133KB
SHA256 f92de04e5a02256e86ffa1b4252fe669282198b7329227f40e51bca9267d133d
MD5 9afa83ca785e2181abe24f6d0ebfb465
SHA1 b3dfdfc341a85a1da41695c7aefaad9529687914
SHA512 9ae862002291f212a34ce0d072c1b31d3838a0de9e3e0847fc35df54f631de9fee513175c28f03362aefa7d0cadf2281ef73e2006fecfb9376c715fd9d61460c
SSDEEP 1536:vQb0g9yGtX0xHS9fy6ZFTd0BGUDWW0SkzGaU+6UcfIn8HVWAzz:oYg9yZt6ZFTd0BGUyX/zHU+58L/
TLSH
T1FFD3FA9EBF2D24C9D57BE17C935A171AE531B89C37209BD741A8A8482F216FE9F34340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pawnio.cat

Path C:\Windows\Temp\PawnIO_17735080.tmp\pawnio.cat
Size 11KB
SHA256 b053f9301280b840a400a65a6f91eaa71f50cd74062ec17aa95f8968076ea9ee
MD5 14bd3b91df5a38dbe892c87084c86c5d
SHA1 e22d77f31958e9314dedc9ede95e5c650d7bab39
SHA512 94871183075c7be5059cede4fd2c2141c024c29028f2ba1baf4bf38c4161e84d6fa579647884d7682286f27b629f6c1df91a47df4b021623189a53a06f1f842b
SSDEEP 192:tdT1JT2TxTcE3JCUPXWEwGJhYCZ2QcNpcspKLX01k9z3A+b1NNt:Ljy9PFP3h3zscmeR9z1Nt
TLSH
T1533229D241AC4082DD97AC7053E4E95B7C3E77CB585055BA22EBF6141CA73C8F72826E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aga.Controls.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\Aga.Controls.dll
Size 154KB
SHA256 ef7d6de5c5ada88e4b3e939d8d282dbbbd13423d7cb40cfd18b1ebaacfac6275
MD5 465513e044cff84b037a2a31017a3045
SHA1 6745cc0a13758eff08be7a62f2e0f27b95d81b72
SHA512 22ebb009625bc618a710fe6728dbbe9b2de716d92d922381ce7142d158a8d7fa5542d0c2f6b9b7bf58f0ff1a0dd673f7fce02a2763d083d4d2fca655528228b1
SSDEEP 3072:02VDmC2JeqfVzFAEosNC8u/vxAGSslsyvDibOepRb7N8Ve:VVIvfp0sw8mqGSsK4ibOwdN8Ve
TLSH
T16FF328212759C62ADBDE457DF0840875C7F8CF02B56AEBAF6D84B9FC24B33A11606427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlackSharp.Core.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\BlackSharp.Core.dll
Size 43KB
SHA256 97ca7a032a40c25be9119507f87d01b841c9f369f4551ec9eeda0a2dbab58461
MD5 44fd4e60d743059a54014b0acb8683f8
SHA1 a9ec7f3ad450d0b7bb30fef39288ce0cecf08c41
SHA512 7a75bd51d5d2f7a6e7a15076058212b13b749ff2ce2f40ef579f0542c4cb90a74d8c34c466d74e91363ac73474ad819a2ac9461a65b960e1bdfa7001a180256c
SSDEEP 768:Bc4f44voYXoCA1lPKLXSIptrxH7iryQgbmefLPGdGD0I7riiDmNs3AmbLD:1voBL1lPEXSe1xGgbm2+d8PDmNAV7
TLSH
T1E7137C4263885733DF8E49B8F4E002624BB2C3A2BA63F74769D895E65C537910B113FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LibreHardwareMonitor.config

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\LibreHardwareMonitor.config
Size 1KB
SHA256 7040483af801f00260501f4a57c9231c6c632770859050d2fed48998f7a18c19
MD5 55182330297008bbfb1f4be30732e85c
SHA1 8e1fcab96c153c9b17c8bd3b85ec2cfe017126a1
SHA512 c4e694e4e789873709ecfb057a0bddc567be1d9bf981069f6b84ce86139067ddb3e86793b0a0b1924f359315ce7ccdab3cbe744a46666e910aad047304c6e8e0
TLSH
T1AC218D226D82D9DBEF74591E9D728A2D892CC89BA55405ADF034009B2F7F89041777F3
MD5 SHA1 SHA512 TLSH

Submit Download

LibreHardwareMonitor.exe

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\LibreHardwareMonitor.exe
Size 4.3MB
SHA256 75160899e8dc909494cf477423f00805663911919018b80c38dcf52227b48a7d
MD5 3030f10f8eafefc3ae9b57ae4d9f40ab
SHA1 2e6d202a32458b1a99ec68c8ca128c27316c040c
SHA512 e885c9feaeca7bb1abc20aca658557e4f1fc6c5247547b3f6597325013eb71668e4044b127f3803e417e5ea4a356ef5c92b9c4b42fe5da18b13828fdb2df5a86
SSDEEP 98304:q4fdWhcAMd7QmNUHepGw9vdKml5AM6K23Yf:q4fdWhcAQpGzHs
TLSH
T1B226F171739A3109CAB7A3F0D0360545EA7CF82282D4B5DAF78D8B5C1BB05D08276F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LibreHardwareMonitor.exe.config

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\LibreHardwareMonitor.exe.config
Size 544B
SHA256 523c8c67b67a68d9a51d2339b64bff1e04f65b2ef39a895cc0fe260b46e48778
MD5 7d892d7b8f2c5ddc0e4a3f1151ab3404
SHA1 34138bb476b7d169b2cc37895ef2554abb4cca8b
SHA512 1c38b4cb77ba2a945d132dcd84ff8facd9f266e3251d27e5afdff0af216f69c9055b18857b2257ba4edf249ece2811307bb0bde5dfd1b71a5b848c03eaa3056d
TLSH
T1F5F0592154C8BF658F324AA33E679064CB7943B3285C048CB4EFAA974B3169D4207233
MD5 SHA1 SHA512 TLSH

Submit Download

LibreHardwareMonitorLib.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\LibreHardwareMonitorLib.dll
Size 1.2MB
SHA256 5144b2fa8317189773386797bc11d9ad8b3ba5cad490645aee63b0b61451ce38
MD5 4b77140ba502c6b166694eb7d6137e00
SHA1 9acd87eaa361431d917d2655194b084b5732a41d
SHA512 66dcdcedeeb5ebdfa268aabd29f69fa56258d5f5defe6da18e485c62d8efe8ff6b7961ece07a277a7ff257c97c7c1b7504951d54fd903d0c8ceca11aee9a7baf
SSDEEP 12288:bULSvX11MU8+ylPuOvUnp5U5y2Cobblutpd6d3BEv1Gy74xVg+:bWSktWpw/lgdmxxVg+
TLSH
T16245290176DC6E76C49E0A7A28705D0293B4BD53E729B71F70ACBA4E0ABB7412F54393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Bcl.AsyncInterfaces.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\Microsoft.Bcl.AsyncInterfaces.dll
Size 27KB
SHA256 bda069b17261a50f36b3a79a88b0243d7b9f6508725598adf88d42471977720e
MD5 6b81ffcec37066c94500d0845f580e91
SHA1 795e193099214a767cb642c2b48022ef3e59e63d
SHA512 9213cd310664c429c4d1981b530639c33104b9d17ed8121304af6ec48ee6c3095f4d78365ad7d6141b2a18a0acfaabfa63211420248c0d891c6078dfb2608c45
SSDEEP 384:snuDmDZGXTmBxeg0ZrS2Yh0WXIdGl+IWY6FU2jWeT/WjjPDHRN77LDGTYAsR9zJn:suwIqBxEZ22LwJgFU23EvyMj9zGxji
TLSH
T125C26C55D36C4313CFAE2FB5E969C6822D74E38A3C33DA3E1248E6550C97788A63523D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Win32.TaskScheduler.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\Microsoft.Win32.TaskScheduler.dll
Size 337KB
SHA256 b32ef614f1708791703521c653e012111669c0c3e8425f4ad3b99335daee37c5
MD5 c5e2eead91e6a143e938f6f6ac160b10
SHA1 0e533b28a9b11bc7aca2bcbc7e068aff49496c66
SHA512 93c9761a3232f4c803625664fdcdb55c52afd11d3c4ba656cc43c4fcdb14012d90c6c4eaea576b766ee1090fbd30758dd2474a9d02628f16ad476e47feda5588
SSDEEP 6144:JHmDnklYTkoWHOg+De9ekXaUb6wgmNNVe:47klYTkouORkXNN5NVe
TLSH
T107744B1127FC8626EAFF4B79E0F0021187B9F446E56ADB0DA990A5ED1C23380D963777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OxyPlot.WindowsForms.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\OxyPlot.WindowsForms.dll
Size 43KB
SHA256 cec0033e7de1d21f7ddbacf93403495869d0231b13c25c9d09fa212e0188104e
MD5 aa9b68eeb72f93278bfcdb0f2e1a84d3
SHA1 afd322cc97aecd315ffef31ccedf8f50433f1374
SHA512 d46f8faad5f275eea3e0dac388c838dcb75831f3e22900b98a6b137a53735614b18d2d630750fe46a4ab270ff5e97fe5e31180ae7848ae508ec7e37ca4759b66
SSDEEP 768:CXIX0HO32phEI+9p+fq6gABT1vocBKbat51zNsw0q8AmbL5:ZX0Hm229puq6gABT1gcBoav1zNEVh
TLSH
T12F139E13373C8237CE8E8BB4B0D555160F7093272B63DB956DA894A9AD537942B083DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OxyPlot.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\OxyPlot.dll
Size 696KB
SHA256 d3d4dd86a6c8fd798a31e4b4d899773e2aee7bbf7805c862303cdb461ab92965
MD5 00a8cd9a9fe77842e105f3509052aef3
SHA1 1fce8f9bbdbf27a0a1a52182bcef59af707b5719
SHA512 cb4e5cf8d5870979642d374c4398463aa0c438ef0a619c5a22626de2d166ca80e7693fc2b90c2e80284c3deee15902964a6cdd91fd14acf4ce699286bf09ddeb
SSDEEP 12288:hf3ct+EtDf7QfKu0wlEyC/wN7DiNgrMYYq1zduWmVMo:NtE9D1L/wN7DiNKMZhWmV9
TLSH
T131E46D15777892AFCBCE4335E073C52E8AF1C01EE364BB5B851565DA3DAA3826D034A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PawnIO_setup.exe

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\PawnIO_setup.exe
Size 3.1MB
SHA256 a3a46226c5e2824f4cdd42be0eecbabfc672c86f7889710f5ab1e6ad385b47a0
MD5 9e1a77fd232800d2e5479cd04708fda1
SHA1 3720a97ad396dd340381be51b4b276749c0f4551
SHA512 21ac94df4e384cb5f15ec14fbe54d4c359d380d87ef63d566db8b118dffef0f92c31c652fbb6efdc7262989ca8fbbad5fef1ffbbe0e397eb25a015262d16f11d
SSDEEP 49152:9oTI40WXBdJe9damQqtNgbxHed/GpuH9vd4PmdNV5QDM6K2ZM4YN:WcAMd7QmNUHepGw9vdKml5AM6K23YN
TLSH
T177E5113295F07088EC96CBF1D1492DA36DED7C498BE17DEBD793A72829636D09630306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RAMSPDToolkit-NDD.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\RAMSPDToolkit-NDD.dll
Size 239KB
SHA256 b1a92efa290566784348bf5cf5ca18d239a15fe7e027129802a88a0d37345ae5
MD5 5f5e71b942b7e60524497d38da257ce1
SHA1 e47baff6b93200f50ddbca0bc2af483c7b910ac5
SHA512 a969bd39008305bc78ffc514ae1f8b9a115b9afa74e2794a00b497042d0ed0f763761c46ff9539635cfb1876d982e5a842d26a32e27c1e53f7d882cc999cce36
SSDEEP 3072:9SIMqma7GgOgBfLH6tuiaHG7TYpIc7cxoCoYe3KpMQ38kpoASwM4ROGNzV9:9hMqlGgOgdLMuiaHG7ECwcosvNzV9
TLSH
T10E340E6833F9694EF1F6FB78587641214F36FDAB6831C14E2A10998E5971EA09D30B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Buffers.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\System.Buffers.dll
Size 23KB
SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
MD5 902760412abffbd10be14842e83f0c09
SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
TLSH
T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IO.Pipelines.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\System.IO.Pipelines.dll
Size 83KB
SHA256 52a813c62932462d8f070f001acd1f264c0766a11a78c6d3c4f81ee3b1d67223
MD5 b7dd6fbeff686894a361817672d9126c
SHA1 4e8a701a4d567e45c3b33c059fd5d703883ae03e
SHA512 a30384bbe371c01ebbade5ad887963477f020fa3b8cea1170bd439f90640b6050492a6d912c60cd777ce33ebce22d399c034e00b52e39eaec2dd8b69155f7ab3
SSDEEP 1536:QEqfoDX1DK6+ZXWKJF4uONj3QRJY/4bgN0xIRgevBjM8D2q9fgJVCyLzr:qglUZGQFEN3QXY/4bgN0xIRgevBjM8zu
TLSH
T111836BA893AC0B1BDF8E1ABDA57452121FF2DB257907E75A958DF8D908837C046243F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\System.Memory.dll
Size 141KB
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Numerics.Vectors.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\System.Numerics.Vectors.dll
Size 107KB
SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
MD5 a57f205ce75d4e4a19020e8b627469c4
SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
TLSH
T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Resources.Extensions.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\System.Resources.Extensions.dll
Size 113KB
SHA256 c3748f17d2f5209cc795a88ad4946c12c3f6ef73b3015dc92c43f932a342b17c
MD5 d6faf75851a85958a9f2c69b54a6a956
SHA1 71f52a40d041f7c79d72333e175b11c73c8d3600
SHA512 d3d968576ab686d9bb572da1480eb72d0aaacc2eafc8dc6fccd9792809336b3fb8a2ddae8ff523bac9d50cfa8a02dec5e5019e0ef334b8be6d3821aef14e5947
SSDEEP 1536:glEGrd+4ykkst1GyBTViHRpCSVIp91TbUcM6gThlH3zN:glNx+dkk0sETipQ06WXR
TLSH
T1B0B3070273FC575AF6FB1F75A9B450104F367EA6A936D75E488010EE09F2B808A70B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Encodings.Web.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\System.Text.Encodings.Web.dll
Size 85KB
SHA256 43e6dfb4aa333848be5066dcb3d490afc417d0f896aada2f17b5db5fcbb819fc
MD5 2886fb6ea404d600f7fcf34dc4f7b3b8
SHA1 e54eb962cb3ac8e778b2648b8f5670eb9b1915b5
SHA512 e05347c2abb577ddf217b8b6b71cd1ec7084164b5ae920a420fc937888e4b972ae49111c069c61e03dcb5593d0b3f674229273251f82ee73c22ad7d0c96d9791
SSDEEP 1536:wYQU6qF6FmUroWpn5qTQlyydbrkSycICopK65B21MvI7za:wYcqwTrfgQlTBrWclopTm+
TLSH
T1AB836C12EF9C862AFE5E013A5CE090659B74EF971133EBD73859792916333C4620DAE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Text.Json.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\System.Text.Json.dll
Size 760KB
SHA256 7a7f2e0b942782739551b37546efc842f53c7fce3a8f0f56ad45a5cf78e2c214
MD5 82044c0f69679b28bb06c97ae31f31b5
SHA1 551f618624a09680a11ba5217f63d719499d2610
SHA512 528c99ae147bd76f51f01242c96dfb0791180f7332365c5e07c9e463cee4bcb08fca16e36ded00052c151b57f1b4f1153ce4050619284f9f44218f2ee71ea7ce
SSDEEP 6144:mUijbPJXV/2IdelcQTy6fKdHfibTxbsjaq/dliUL5ZFPDnkVOzxQx6aUYMFlsjwR:mVbxFO7lcQTJKd/805/dlcVO+x6tlUS
TLSH
T19CF46B20B7E8D72BD6DF4B71B03089148BB1F61967AAE78F618846ED1C927809C453F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Windows\Temp\ptu_lhm_0b5ea2da2beefe1c1cbae8a3503bae67\System.Threading.Tasks.Extensions.dll
Size 27KB
SHA256 af4e13ef418fd89b432de20cd1dfb7fa10a7179c8dd049c9856316e50c5949ca
MD5 0fff41795a1107691ec1e5054211c04a
SHA1 3439da9b7918fa0c17836acbe1fa4e05c40119ec
SHA512 1333847b76025af23a4a4dd421707732078673c96dcdb726a38b477c51606395002574fbcdbf224fd0ae5b80e8da8b2f02dd4972d88f31c36c3dcbf595510e90
SSDEEP 384:F7PVBSE/ug12sib05JCw0p8CUQefpnQKwU3RymGWuXWJwnHRN7rpGR9z04RI:9PV0iug12TY+bUKmGfXrY9z1
TLSH
T15FC28D6183B85113CF6F8E77D2A9CC175F74A3466A02E7391AECF2D40C5338A8A31275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-420-0x00000201ADD20000-0x00000201ADD48000-memory.dmp

Download

memory/212-443-0x00000201AF6C0000-0x00000201AF6E8000-memory.dmp

Download

memory/212-441-0x00000201AF590000-0x00000201AF5B0000-memory.dmp

Download

memory/212-415-0x00000201AD500000-0x00000201AD944000-memory.dmp

Download

memory/212-452-0x00000201AF700000-0x00000201AF70E000-memory.dmp

Download

memory/212-691-0x00000201CA570000-0x00000201CA5B0000-memory.dmp

Download

memory/212-693-0x00000201CA530000-0x00000201CA53E000-memory.dmp

Download

memory/212-439-0x00000201AF5B0000-0x00000201AF608000-memory.dmp

Download

memory/212-714-0x00000201CA790000-0x00000201CA7A8000-memory.dmp

Download

memory/212-424-0x00000201C9730000-0x00000201C985A000-memory.dmp

Download

memory/212-705-0x00000201CA560000-0x00000201CA56A000-memory.dmp

Download

memory/212-445-0x00000201AF570000-0x00000201AF578000-memory.dmp

Download

memory/212-703-0x00000201CA810000-0x00000201CA8D2000-memory.dmp

Download

memory/212-707-0x00000201CA740000-0x00000201CA75A000-memory.dmp

Download

memory/212-447-0x00000201AF610000-0x00000201AF62E000-memory.dmp

Download

memory/212-709-0x00000201CA550000-0x00000201CA55A000-memory.dmp

Download

memory/212-450-0x00000201CC150000-0x00000201CC202000-memory.dmp

Download

memory/212-710-0x00000201CA540000-0x00000201CA548000-memory.dmp

Download

memory/212-712-0x00000201CA760000-0x00000201CA76A000-memory.dmp

Download

memory/1672-25-0x00007FFD08880000-0x00007FFD08881000-memory.dmp

Download

memory/4880-146-0x00007FFD08880000-0x00007FFD08881000-memory.dmp

Download

memory/4904-78-0x00007FFD09330000-0x00007FFD09331000-memory.dmp

Download

memory/4904-82-0x00007FFD09C70000-0x00007FFD09C71000-memory.dmp

Download