Overview
overview
6Static
static
3FPSDoctor_...up.exe
windows10-2004-x64
6FPSDoctor_...up.exe
windows11-ltsc_2024-x64
5$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-ltsc_2024-x64
3FPSDoctor.exe
windows10-2004-x64
6FPSDoctor.exe
windows11-ltsc_2024-x64
6fps-doctor...re.exe
windows10-2004-x64
1fps-doctor...re.exe
windows11-ltsc_2024-x64
1fps-doctor...re.exe
windows10-2004-x64
4fps-doctor...re.exe
windows11-ltsc_2024-x64
4fps-doctor...ar.exe
windows10-2004-x64
1fps-doctor...ar.exe
windows11-ltsc_2024-x64
1resources/...up.exe
windows10-2004-x64
1resources/...up.exe
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 16:41
Static task
static1
Behavioral task
behavioral1
Sample
FPSDoctor_1.4.7_x64-setup.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
FPSDoctor_1.4.7_x64-setup.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis_tauri_utils.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
FPSDoctor.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
FPSDoctor.exe
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral21
Sample
fps-doctor-capture.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
fps-doctor-capture.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
fps-doctor-hardware.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
fps-doctor-hardware.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
fps-doctor-sidecar.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
fps-doctor-sidecar.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
resources/PawnIO_setup.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
resources/PawnIO_setup.exe
Resource
win11ltsc2024-20260710-en
General
- Target fps-doctor-hardware.exe
- Size 75.9MB
- Sample260804-t7fywavfkd
- SHA256 40926ced0f1198486669945221efce3be46ecca127ef925e2d09d71017d8741d
- MD5 2cf18a5b44bae5b99c580cca9a66aeba
- SHA1 95516857f5dd02f21535ff8bd336a19de796115c
- SHA512 44a4c2737e8dcc93d427507cf394f54c565d01b476f0198e6f0cc874d509637074051d7c0312e2a6b2608715ccfb3f8cb69a5d0ca87fdfa08c9bd6a332a2090e
- SSDEEP 786432:AGztzsFd+U4DVOK33ZiSOH0q4DlpFcz7y/b:Ak4FdX0Zi0yS/b
- TLSH T19408AE14E3D84B16E67FC2BDC1638512E6B1B8521361D7CF0498DE992F63BC1AB36362
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 7 IoCs
pid Process 3360 fps-doctor-hardware.exe 3360 fps-doctor-hardware.exe 3360 fps-doctor-hardware.exe 3360 fps-doctor-hardware.exe 3360 fps-doctor-hardware.exe 3360 fps-doctor-hardware.exe 3360 fps-doctor-hardware.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\HardwareWrapper.dll
- Size 82KB
- SHA256 523d481c7f85a2f1165b664aa7ed35f94ec2a825aea44e56fb2c8e72a24e44ef
- MD5 e02a8f43dec73982ba62a2ca97b5ce70
- SHA1 a543b447fd293fdadcf07106824e8bf85e8582cb
- SHA512 a11dbe1c9a1206b29437516463b69eda1059ae4fe155b31b500da19d4e6524c8f4260d17663db63f350bb9e16ad3ac29cab0ad105caa02ce907470332336d080
- SSDEEP 1536:ob5h3oZSP+D4rqYL72om996/ETwI7BE0ub1Nz:ob55qSP+D4rqq7296K7BE0uRd
- TLSH T18B831A5173DD9210FEEDBFB49177A68942B5F9837612EF4C0E8634EA1B23380365075A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Console.dll
- Size 165KB
- SHA256 d6c46a682587937775464bb1a3850a9d3e11408440731fefb07d298cd6d7a99c
- MD5 cdf39fef9130164848978f5fa74bc3bb
- SHA1 dbc018077a65a7d040db7c36d0988b3ffadf4b2e
- SHA512 1b38ac592fa0519367663ca65a15ec928067d604a90d616c9f6fbd9856517ff9e104796fb1aa79bb561e8ba7c9d7ea75ed7e5ce8851e9f917f465f316c77a6a4
- SSDEEP 3072:MhK8LvmZrfHk4xul4nhu7v9QglfFRc47jwN:4yZrfDxu82Akju
- TLSH T164F37C2A97DD6527D77F86B845930301D737B8A60306E6EB418588881F93BC3FB716A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Private.CoreLib.dll
- Size 15.3MB
- SHA256 76a49f17e83f613bc8a5b55fc98830b764e7838265aacbdbcc8f46707f80a3c9
- MD5 a49b53f149f536e90bcc05658d87aebc
- SHA1 3b05684dd5dcd813ebd6a0f6cf72092e560f5ccf
- SHA512 3eddf059079cf26974cc487affba6583e6e5302377d20f1c673845e09d85076d790b20015b06a9ecded24da88a1b65bcf70e54feae4222e6187edf8292e0638f
- SSDEEP 196608:d+P37OUBwZf3DKM3KxPrH1uk0hzOH0KrO04ddwSw0TZFyd0:d+iUBwZr73Kt1uk4OH0Kr/4DlpFp
- TLSH T153F69D20E3C98F46E13EB2BD81638629D970F8526327D6C70558DA493F23FD5633B6A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Runtime.InteropServices.dll
- Size 109KB
- SHA256 627a86a918f6669f94cf8db6ce064a4b2207b852ba6a4fecaccad7bb07859b4f
- MD5 b18883afbc4f8ec15db5ee296a446ad0
- SHA1 56edac2d32ce838750d2b07284e1017a38ed6b72
- SHA512 169bab4218970bcd4b8206ef9be98dbc609200cf5b27cda8a61d321cdba865415232fc910b2aa0794105b263756e2bb4b1b5c67500459c898783c672c5058b97
- SSDEEP 1536:xOCC7EAttQMxvPQtvC+zucKb2EW4udNY/w2yVvO0ugu94RHPXF20gf1zX:xOCoEStQMZ4vg2E5udNY42ypNu0Pcf1z
- TLSH T144B337207B98863ADA5A873C9C736D00CDB3FAC65322A6CF4184849D0FD77C567727A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Text.Json.dll
- Size 1.8MB
- SHA256 6945c5fc52f811e32b13597b0d2a14d365227245e21bf7daebc6986f729b25fa
- MD5 e508c206f60d3359cad70a349fe581ad
- SHA1 9d5cadee8824db16b6dd849470ffc5df4113ddcc
- SHA512 b231752cd8c4640ff543283a48721985bcc9ddb7993226573efa68b35be8bfea15be8d4ef09a1387df1d7a6f1f4723e5d35d70957364e2056dcabe5b14121c20
- SSDEEP 49152:c4a9OE7kEkWCwr8QsUJwwLBpbp95Cifbfr:G9fZsUJTzCiff
- TLSH T199957C11E3EC5227C96ED2BA80138122D671A1025312D6CBAC58FD8A7F43BD1D776DBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\fps-doctor-hardware\Tg9Q9j2gHCAo\System.Threading.dll
- Size 81KB
- SHA256 96ef32e315217f24b6b701fc182cac464966cad1da94dd25a3609fe2d9f5a6ca
- MD5 ddccafbb8be31d3205273fcea7824420
- SHA1 403e6242b314445e067102d0d48c13ae35818518
- SHA512 c8d32d7b79fee789f398d45cc0c91357a7a612e27a7dedf81821aa5d4160cf0497d75861ee04b206def6eae49f4c2c84b96eba41fb561ac2154f1c212579ac6f
- SSDEEP 1536:AialBo2hUTogxqwXAXXG9Rvd5bFF9o6sionbz5:ADlBoAUkgIwXeW9RvHBF9o6Lonbl
- TLSH T106835A11B3E8091AF7BB47B9DAB36905C172FED21B11D2CF405A910D1FA7BC486B21A7
- MD5 SHA1 SHA512 SSDEEP TLSH