d26985eef4c5540c59d807b3155abf54fdc2615705b4a331a114144acd2254a0

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FPSDoctor_OPTI_EXPRESS.rar
Size 3.8MB
Sample260824-v71tqa1fkd
SHA256 d26985eef4c5540c59d807b3155abf54fdc2615705b4a331a114144acd2254a0
MD5 8a5535ff64ee7d7a2f8619d54ac12572
SHA1 8a4dbcb051741b95dfb447053220f61034cc7fed
SHA512 0da29c142fe85f91d3f7d20feaac9aeba6c61b4fe4f41cb31c8fa799d904fddf38d0ace8d01215688b67e8b45f564366f9bb80069d3d9ec5e139849980f5ebe9
SSDEEP 98304:kKpmkhT74LtrHzHAhAWQYUixBl5jVDixFkkpZkY:nmQTwtrHzHa8Azl5jVoFkkpZkY
TLSH
T1E41633E0DE45D0EC88B380AEFA1E6E3B7352D5DDB71C56E6842C4E1C6459BE044983FA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 17 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3500	cmd.exe
2364	cmd.exe
3248	cmd.exe
4196	cmd.exe
2772	cmd.exe
4800	cmd.exe
3100	cmd.exe
3508	cmd.exe
4072	cmd.exe
3224	cmd.exe
4080	cmd.exe
1072	cmd.exe
1700	cmd.exe
2652	cmd.exe
3280	cmd.exe
1796	cmd.exe
636	cmd.exe

Runs .reg file with regedit 54 IoCs

pid	Process
3568	regedit.exe
3196	regedit.exe
4932	regedit.exe
4920	regedit.exe
4732	regedit.exe
652	regedit.exe
1784	regedit.exe
4188	regedit.exe
2152	regedit.exe
4112	regedit.exe
900	regedit.exe
4460	regedit.exe
3384	regedit.exe
4228	regedit.exe
1832	regedit.exe
2928	regedit.exe
4712	regedit.exe
1636	regedit.exe
440	regedit.exe
4684	regedit.exe
2480	regedit.exe
1544	regedit.exe
4564	regedit.exe
1312	regedit.exe
2332	regedit.exe
1504	regedit.exe
1576	regedit.exe
4000	regedit.exe
1900	regedit.exe
4916	regedit.exe
2760	regedit.exe
4492	regedit.exe
4944	regedit.exe
4248	regedit.exe
4880	regedit.exe
4156	regedit.exe
408	regedit.exe
3316	regedit.exe
3444	regedit.exe
3964	regedit.exe
2596	regedit.exe
2184	regedit.exe
1888	regedit.exe
2796	regedit.exe
3680	regedit.exe
1780	regedit.exe
1384	regedit.exe
2348	regedit.exe
3676	regedit.exe
4524	regedit.exe
2732	regedit.exe
2596	regedit.exe
4100	regedit.exe
4656	regedit.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
880	7zFM.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeRestorePrivilege	880	7zFM.exe
Token: 35	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe
Token: SeSecurityPrivilege	880	7zFM.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe
880	7zFM.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 3100	880	7zFM.exe	102
PID 3100 wrote to memory of 1900	3100	cmd.exe	105
PID 3100 wrote to memory of 1888	3100	cmd.exe	106
PID 3100 wrote to memory of 4916	3100	cmd.exe	107
PID 3100 wrote to memory of 2928	3100	cmd.exe	108
PID 3100 wrote to memory of 2760	3100	cmd.exe	109
PID 3100 wrote to memory of 2480	3100	cmd.exe	110
PID 880 wrote to memory of 3508	880	7zFM.exe	112
PID 880 wrote to memory of 1072	880	7zFM.exe	114
PID 880 wrote to memory of 4072	880	7zFM.exe	116
PID 1072 wrote to memory of 1544	1072	cmd.exe	118
PID 880 wrote to memory of 1796	880	7zFM.exe	119
PID 880 wrote to memory of 2364	880	7zFM.exe	121
PID 2364 wrote to memory of 4492	2364	cmd.exe	123
PID 2364 wrote to memory of 4944	2364	cmd.exe	124
PID 2364 wrote to memory of 4732	2364	cmd.exe	125
PID 2364 wrote to memory of 4248	2364	cmd.exe	126
PID 2364 wrote to memory of 4228	2364	cmd.exe	127
PID 2364 wrote to memory of 1832	2364	cmd.exe	128
PID 1796 wrote to memory of 2732	1796	cmd.exe	129
PID 1796 wrote to memory of 4712	1796	cmd.exe	130
PID 1796 wrote to memory of 2796	1796	cmd.exe	131
PID 1796 wrote to memory of 3568	1796	cmd.exe	132
PID 1796 wrote to memory of 4564	1796	cmd.exe	133
PID 1796 wrote to memory of 3680	1796	cmd.exe	134
PID 4072 wrote to memory of 1312	4072	cmd.exe	135
PID 4072 wrote to memory of 652	4072	cmd.exe	136
PID 4072 wrote to memory of 3196	4072	cmd.exe	137
PID 4072 wrote to memory of 1780	4072	cmd.exe	138
PID 4072 wrote to memory of 3384	4072	cmd.exe	139
PID 4072 wrote to memory of 2596	4072	cmd.exe	140
PID 1072 wrote to memory of 1784	1072	cmd.exe	141
PID 1072 wrote to memory of 408	1072	cmd.exe	142
PID 1072 wrote to memory of 4188	1072	cmd.exe	143
PID 1072 wrote to memory of 1384	1072	cmd.exe	144
PID 1072 wrote to memory of 2332	1072	cmd.exe	145
PID 880 wrote to memory of 3248	880	7zFM.exe	146
PID 880 wrote to memory of 4196	880	7zFM.exe	148
PID 3248 wrote to memory of 2348	3248	cmd.exe	150
PID 3248 wrote to memory of 3676	3248	cmd.exe	151
PID 3248 wrote to memory of 2152	3248	cmd.exe	152
PID 3248 wrote to memory of 1504	3248	cmd.exe	153
PID 3248 wrote to memory of 1636	3248	cmd.exe	154
PID 3248 wrote to memory of 4112	3248	cmd.exe	155
PID 880 wrote to memory of 3224	880	7zFM.exe	156
PID 880 wrote to memory of 636	880	7zFM.exe	158
PID 3224 wrote to memory of 3316	3224	cmd.exe	160
PID 3224 wrote to memory of 4100	3224	cmd.exe	161
PID 3224 wrote to memory of 4932	3224	cmd.exe	162
PID 3224 wrote to memory of 900	3224	cmd.exe	163
PID 3224 wrote to memory of 3444	3224	cmd.exe	164
PID 3224 wrote to memory of 4656	3224	cmd.exe	165
PID 880 wrote to memory of 1700	880	7zFM.exe	166
PID 1700 wrote to memory of 1576	1700	cmd.exe	168
PID 1700 wrote to memory of 4920	1700	cmd.exe	169
PID 1700 wrote to memory of 440	1700	cmd.exe	170
PID 1700 wrote to memory of 4000	1700	cmd.exe	171
PID 1700 wrote to memory of 4880	1700	cmd.exe	172
PID 1700 wrote to memory of 4156	1700	cmd.exe	173
PID 880 wrote to memory of 2772	880	7zFM.exe	174
PID 880 wrote to memory of 4800	880	7zFM.exe	176
PID 880 wrote to memory of 2652	880	7zFM.exe	178
PID 880 wrote to memory of 4080	880	7zFM.exe	180
PID 2652 wrote to memory of 4524	2652	cmd.exe	182

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\FPSDoctor_OPTI_EXPRESS.rar"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO0735437A\FPSDoctorBoostMode.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Location_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:1900
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Telemetry_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:1888
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Tracking_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:4916
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Effets_Visuels_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:2928
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Tweaks_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:2760
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Updates_Delais_Intelligents_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO07365E7A\FPSDoctorBoostMode.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:3508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO0732B14A\FPSDoctorBoostMode.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Location_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:1544
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Telemetry_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:1784
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Tracking_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:408
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Effets_Visuels_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:4188
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Tweaks_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:1384
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Updates_Delais_Intelligents_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO073BA04A\FPSDoctorBoostMode.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Location_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:1312
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Telemetry_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:652
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Tracking_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:3196
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Effets_Visuels_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:1780
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Tweaks_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:3384
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Updates_Delais_Intelligents_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO0733434A\FPSDoctorBoostMode.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Location_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:2732
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Telemetry_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:4712
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Tracking_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:2796
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Effets_Visuels_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:3568
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Tweaks_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:4564
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Updates_Delais_Intelligents_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:3680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO073C324A\FPSDoctorBoostMode.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Location_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:4492
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Telemetry_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:4944
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Tracking_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:4732
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Effets_Visuels_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:4248
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Tweaks_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:4228
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Updates_Delais_Intelligents_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:1832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO073F645A\FPSDoctorBoostMode.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Location_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:2348
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Telemetry_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:3676
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Tracking_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:2152
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Effets_Visuels_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:1504
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Tweaks_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:1636
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Updates_Delais_Intelligents_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:4112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO073CE75A\FPSDoctorBoostMode.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO07316E5A\FPSDoctorBoostMode.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Location_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:3316
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Telemetry_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:4100
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Disable_Tracking_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:4932
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Effets_Visuels_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:900
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Tweaks_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:3444
- - C:\Windows\regedit.exe
    regedit /s Scripts_BoostMode\FPSDoctor_Updates_Delais_Intelligents_Advanced.reg
    3⤵
    - Runs .reg file with regedit
    PID:4656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO073EF1AA\FPSDoctorBoostMode.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO0734F5BA\FPSDoctorSafeMode.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Disable_ActivityHistory_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:1576
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Disable_GameDVR_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:4920
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Disable_StorageSense_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:440
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Disable_WifiSense_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:4000
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Effets_Visuels_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:4880
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Tweaks_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO07390BBA\FPSDoctorSafeMode.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:2772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO07354ABA\FPSDoctorSafeMode.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO07308DBA\FPSDoctorSafeMode.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Disable_ActivityHistory_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:4524
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Disable_GameDVR_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:4684
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Disable_StorageSense_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:3964
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Disable_WifiSense_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:4460
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Effets_Visuels_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:2596
- - C:\Windows\regedit.exe
    regedit /s Scripts_SafeMode\FPSDoctor_Tweaks_SafeMode.reg
    3⤵
    - Runs .reg file with regedit
    PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO073BBCBA\FPSDoctorSafeMode.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:4080
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO0733228A\FPSDoctorSafeMode.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:3280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7zO0730B58A\FPSDoctorSafeMode.bat" "
  2⤵
  - Executes a command shell one-liner
  PID:3500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FPSDoctorSafeMode.bat

Path C:\Users\Admin\AppData\Local\Temp\7zO0734F5BA\FPSDoctorSafeMode.bat
Size 1KB
SHA256 53c4f15816c704a4ae7cb221b099813da3a5bf650923a4ce1f0ed8ca3f142666
MD5 dfcf8a13394063dc13eda1e625ae61a0
SHA1 81ff50c808d4127abe3862e9e138579041a73921
SHA512 67b11f7aac923f75e358d85c60bda0afd0cbcd7fdd9c8fd87bcc17425955f37eeb419e399c4801a675a5f5c22b7e6c6be2a4c1268d0fa258126cea0d1074ce95
TLSH
T1E4319ECFA40DA1750C451153391E50CC3A9664F290E8F86CF75A0CA82F1DFD4BB5EE6A
MD5 SHA1 SHA512 TLSH

Submit Download

FPSDoctorBoostMode.bat

Path C:\Users\Admin\AppData\Local\Temp\7zO0735437A\FPSDoctorBoostMode.bat
Size 1KB
SHA256 34df62897f22bfc1dfcbf965a986e9dddee35d23f856dcdeb06acbda395d96d8
MD5 03d58af5e1156bbdc516362ac0b98e85
SHA1 34963fdb4b17aff5fa68a761839345c38bb1faf6
SHA512 eec5fa33a4f73883dd283e6e5df41bb2332ed5e50d7d6b57f9d1fdc6d6033ae9c58872f813ddebb2c494868069d0c3f05d0ad05d7a9b49d5e1e020ea974ccfc7
TLSH
T10241AACB76497076084210132D3E419C2659A4C7E2DCFD647A9E8C686E4CFD47BD9B72
MD5 SHA1 SHA512 TLSH

Submit Download