FPSDoctor_1[.]4[.]7_x64-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
FPSDoctor_1.4.7_x64-setup.exe
Size 38.9MB
Sample260804-t7fywavfkd
SHA256 94d5750d2908998cb7a03c0428e34472652ed9a190dcc5bb8485f993e7ede43c
MD5 a4d5b21d16710221fdc3bedbae8f18a1
SHA1 6c120288e772bf7c492c4a36f22cff8544c7c1c6
SHA512 880df3c87b34bee6804dc3f4f99a5dd3e690ad950bce89317922705c91dcd2b790462e1c70050d43f9291e984428e3d8f63e02c8f2a87217923cda73f83c8f6e
SSDEEP 786432:paIc8qVXeLEwM/QUzqUJMBc0xib09l4i+oGoOeOhWboiJ/udtnNgLj7Jbz2pEp+N:p5qVXKEx/QU9T0xZlxVEWbvJ4tNgX7t8
TLSH
T1609733ABD9AB14BBE131E5740606D6F5362CAF87283495EAFB78344E8C560DF14FE012
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

File Explorer

FPSDoctor_1.4.7_x64-setup.exe

.exe 38.9MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/UserInfo.dll

.dll 4KB
$PLUGINSDIR/modern-wizard.bmp

150KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsExec.dll

.dll 7KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 48KB
FPSDoctor.exe

.exe 30.3MB
fps-doctor-capture.exe

.exe 473KB
fps-doctor-hardware.exe

.exe 75.9MB
fps-doctor-sidecar.exe

.exe 1.0MB
resources/PawnIO_setup.exe

.exe 3.3MB

FPSDoctor_1.4.7_x64-setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 94d5750d2908998cb7a03c0428e34472652ed9a190dcc5bb8485f993e7ede43c
MD5 a4d5b21d16710221fdc3bedbae8f18a1
SHA1 6c120288e772bf7c492c4a36f22cff8544c7c1c6
SHA512 880df3c87b34bee6804dc3f4f99a5dd3e690ad950bce89317922705c91dcd2b790462e1c70050d43f9291e984428e3d8f63e02c8f2a87217923cda73f83c8f6e
SSDEEP 786432:paIc8qVXeLEwM/QUzqUJMBc0xib09l4i+oGoOeOhWboiJ/udtnNgLj7Jbz2pEp+N:p5qVXKEx/QU9T0xZlxVEWbvJ4tNgX7t8
TLSH
T1609733ABD9AB14BBE131E5740606D6F5362CAF87283495EAFB78344E8C560DF14FE012
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

31:f7:b2:6b:19:ce:db:d0:37:e9:8a:73:05:58:53:f1:e3:0f:fb:e7:73:b3:1b:5f:dc:6a:93:f3:ac:52:95:3d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 3, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:2d:f2:4c:ba:91:4a:39:96:b3:5e:00:00:00:04:2d:f2

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2026 - Aug 5, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:56:7e:8f:9d:58:08:8e:e9:60:00:00:00:00:00:56

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 68e847ed6763e00454edac87b3abd95a
SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
MD5 e6f30908abfc6f53b7c3c36daec4586d
SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
TLSH
T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 99d938c5e6defd524296bd4190335921793e7adc6c70c3e8f031c4da78a1a95f
MD5 f9c656155e59a9a6873678cabcf2a428
SHA1 e8b2d4758608a02a6d3f108a97ded6c42c9cd892
SHA512 cc063f97e25487ac3168b05fde838c844195d85fbc8ac43aeb0a4fa8fac26fa23be3c1101c271c0c9bb173a2d1a71c198167b55a2f00ca827b961754e089a1d1
SSDEEP 1536:fwODZzTrAV5Oevq4DtXHVG0mNf9RfIY9IR:fwwy0gqaXHM8z
TLSH
T11D238E8CFDC56967E7CF19711088C9AFAA3FC7061500C967A2726E92C9863B2DFD411E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

83:3a:0c:a6:a9:ea:fe:42:8b:8c:66:14:d5:bb:78:4d:6e:28:98:d1:44:45:77:45:9c:98:93:7f:05:54:8f:4a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 3, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:2d:f2:4c:ba:91:4a:39:96:b3:5e:00:00:00:04:2d:f2

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2026 - Aug 5, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:65:cd:eb:3f:a1:d7:fc:d2:00:00:00:00:00:58

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

FPSDoctor.exe

IMPHASH 3993a6b598ba77114a1d3b03239d6817
SHA256 220b34b60d775b8ec609a6b3aefe2fde7decd0959089cb9634b7a409b6f070be
MD5 fbf243f812ef61b1ab10a6da86d3f427
SHA1 e8c1dfb414c077b56da01a1ffd9dff4da71c0131
SHA512 21033e79bbbc960c45150e6e13df00af9698c822040765b6b29a2a0cf817f6968954eb50270a95fbd8c90ceb3a4cfd2f4c8854968467981e8bfddadfb2a09686
SSDEEP 786432:Xldr8utKn9itWEcQrnuw/zms22fcrwppIU7:Xldr8utKn9itWEcQrnbbmsffcc
TLSH
T1ED6728257A5A9968D09BC47483478AB24E3134DB0B39B9FF44D492393F6DBF52F38218
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

c3:41:ab:cf:a0:97:b7:db:54:09:7d:f6:49:07:09:22:7f:59:ad:0a:54:ab:4e:1a:7b:7d:5b:93:7b:f0:ed:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 3, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:2d:f2:4c:ba:91:4a:39:96:b3:5e:00:00:00:04:2d:f2

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2026 - Aug 5, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:56:7e:8f:9d:58:08:8e:e9:60:00:00:00:00:00:56

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

18635540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

FPSDoctor.pdb

kernel32

HeapReAlloc LoadLibraryW HeapCompact HeapDestroy GetCurrentProcessId WideCharToMultiByte GetSystemTime FormatMessageA MapViewOfFile GetTickCount GetNativeSystemInfo GetSystemInfo GetUserPreferredUILanguages LocalFree GetCurrentThreadId WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW MultiByteToWideChar TerminateProcess SetPriorityClass QueryFullProcessImageNameW WaitForMultipleObjects OpenProcess ResetEvent LCIDToLocaleName FreeLibrary LoadLibraryA HeapSize GetSystemFirmwareTable ReleaseMutex IsProcessorFeaturePresent GetModuleHandleW ReleaseSRWLockExclusive HeapValidate UnmapViewOfFile AcquireSRWLockExclusive UnregisterWaitEx DuplicateHandle RegisterWaitForSingleObject SetHandleInformation GetSystemTimeAsFileTime SetEvent GetModuleFileNameW LoadLibraryExW OpenEventW HeapCreate GetConsoleMode GetFileInformationByHandle GetQueuedCompletionStatusEx CancelIoEx PostQueuedCompletionStatus GetOverlappedResult SetFileCompletionNotificationModes CreateIoCompletionPort CreatePipe WakeAllConditionVariable AreFileApisANSI ReadFile GetFullPathNameW WriteFile GetComputerNameExW GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA SetEndOfFile SleepConditionVariableSRW GetCurrentProcess RaiseException lstrlenW WaitForSingleObject GetUserDefaultUILanguage UnlockFileEx CreateEventW GetTempPathW IsDebuggerPresent CreateMutexW Sleep GetModuleHandleA GetProcAddress RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue LoadLibraryExA FormatMessageW CreateProcessW GetLastError GetFileAttributesW GetDriveTypeW TlsSetValue TlsFree MoveFileExW CreateFileW SetNamedPipeHandleState GetTimeZoneInformationForYear SystemTimeToFileTime SystemTimeToTzSpecificLocalTime HeapAlloc HeapFree GetProcessHeap CloseHandle OutputDebugStringA FlushFileBuffers GetFileSize LockFileEx UnlockFile DeleteFileW DeleteFileA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA WriteConsoleW FindNextFileW RtlUnwindEx SetEnvironmentVariableW SetWaitableTimer CreateWaitableTimerExW InitializeSListHead DeviceIoControl CreateSymbolicLinkW SetUnhandledExceptionFilter UnhandledExceptionFilter GetFinalPathNameByHandleW InitializeCriticalSectionAndSpinCount CreateMutexA SwitchToThread ExitProcess FindClose FindFirstFileExW CopyFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetStdHandle GetEnvironmentStringsW GetProcessId GetExitCodeProcess GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx QueryPerformanceCounter CreateFileMappingW InitializeCriticalSection CancelIo GetSystemTimePreciseAsFileTime EnterCriticalSection RtlLookupFunctionEntry LeaveCriticalSection RtlCaptureContext ReadFileEx CreateThread QueryPerformanceFrequency SetFileTime TryEnterCriticalSection SetFileInformationByHandle DeleteCriticalSection GetConsoleOutputCP SetLastError SleepEx RtlVirtualUnwind WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW

advapi32

RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegSetValueExW RegDeleteValueW RegDeleteTreeW RegQueryValueExW RegCloseKey RegOpenKeyExW RegGetValueW RegEnumKeyExW RegEnumValueW OpenProcessToken GetTokenInformation DuplicateTokenEx CreateProcessWithTokenW AdjustTokenPrivileges LookupPrivilegeValueW EventRegister EventSetInformation EventWriteTransfer EventUnregister SystemFunction036

oleaut32

SysFreeString SysStringLen GetErrorInfo SetErrorInfo

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile NtReadFile NtOpenFile NtWriteFile NtCreateFile NtCancelIoFileEx NtDeviceIoControlFile RtlGetVersion RtlNtStatusToDosError

shell32

ILFree SHEmptyRecycleBinW ILCreateFromPathW ShellExecuteW SHOpenFolderAndSelectItems SHCreateItemFromParsingName ShellExecuteExW Shell_NotifyIconW SHGetKnownFolderPath DragQueryFileW DragFinish SHAppBarMessage Shell_NotifyIconGetRect

user32

DestroyAcceleratorTable CreatePopupMenu CreateMenu DrawMenuBar SetMenu GetMenuItemInfoW SetTimer TrackPopupMenu KillTimer ChangeWindowMessageFilterEx RegisterClassW CheckMenuItem ToUnicodeEx GetKeyboardLayout CreateIcon SetWindowLongW EnableMenuItem GetSystemMenu MapVirtualKeyExW GetKeyState DefWindowProcW GetKeyboardState DestroyIcon SystemParametersInfoA SetPropW SendInput SetForegroundWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW GetRawInputData GetMenu ShowCursor DrawIconEx CreateAcceleratorTableW IsWindowVisible EnumDisplayMonitors MonitorFromPoint SetWindowDisplayAffinity ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx InsertMenuW RegisterRawInputDevices RegisterWindowMessageA GetWindow SetParent MapWindowPoints SetFocus ShowWindow AppendMenuW RemoveMenu ReleaseDC GetWindowRect GetParent FindWindowExW SetWindowRgn EnableWindow IsWindowEnabled IsProcessDPIAware GetDC PostQuitMessage FindWindowW CreateWindowExW AdjustWindowRect RedrawWindow RegisterClassExW SetWindowPos EnumChildWindows SendMessageW IsIconic PostMessageW GetClipCursor DestroyMenu AllowSetForegroundWindow MessageBoxW GetMenuBarInfo OffsetRect GetWindowDC DrawTextW DestroyWindow SetMenuItemInfoW SetWindowLongPtrW GetWindowLongPtrW ClipCursor DispatchMessageA GetMessageA GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos GetClientRect GetWindowLongW ScreenToClient GetUpdateRect MapVirtualKeyW ValidateRect PostThreadMessageW PeekMessageW LoadCursorW FlashWindowEx DispatchMessageW TranslateMessage GetMessageW GetAsyncKeyState RegisterTouchWindow GetSystemMetrics IsWindow AdjustWindowRectEx TranslateAcceleratorW GetWindowThreadProcessId GetShellWindow EnumWindows GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn ClientToScreen

ole32

CoInitializeEx CoCreateInstance CoTaskMemFree CoUninitialize CoIncrementMTAUsage RevokeDragDrop RegisterDragDrop CoCreateFreeThreadedMarshaler CoInitialize CoTaskMemAlloc OleInitialize

shlwapi

SHCreateMemStream

comctl32

TaskDialogIndirect SetWindowSubclass DefSubclassProc RemoveWindowSubclass

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

gdi32

DeleteDC GetDeviceCaps CombineRgn BitBlt CreateCompatibleDC CreateSolidBrush DeleteObject CreateDIBSection CreateRectRgn SelectObject SetTextColor SetBkMode

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

crypt32

CertSetCertificateContextProperty CertGetCertificateChain CertFindCertificateInStore CertOpenStore CertAddEncodedCertificateToStore CertFreeCertificateContext CertVerifyCertificateChainPolicy CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptUnprotectData CryptProtectData CryptMsgClose CertGetNameStringW CryptMsgGetParam CertCloseStore CertFreeCertificateChain CryptQueryObject

ws2_32

getaddrinfo WSAStartup WSACleanup getpeername freeaddrinfo WSAGetLastError socket WSAIoctl setsockopt shutdown listen bind WSASocketW send recv connect ioctlsocket WSASend accept getsockopt getsockname closesocket

bcrypt

BCryptGenRandom

iphlpapi

FlushIpNetTable2 GetIfTable2 FreeMibTable

psapi

EnumProcesses

dxgi

CreateDXGIFactory1

wintrust

WinVerifyTrust

api-ms-win-crt-math-l1-1-0

roundf __setusermatherr pow log trunc floor round fmod

api-ms-win-crt-string-l1-1-0

wcscmp strlen strcspn strncmp strspn strcmp wcslen wcsncmp _wcsicmp strcpy_s

api-ms-win-crt-heap-l1-1-0

_msize free realloc _set_new_mode calloc _callnewh malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _crt_atexit _beginthreadex _seh_filter_exe _endthreadex _set_app_type _register_onexit_function _initialize_onexit_table _exit _cexit __p___argv _configure_narrow_argv __p___argc terminate _c_exit exit _initialize_narrow_environment _get_initial_narrow_environment _initterm_e _initterm abort

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

fps-doctor-capture.exe

IMPHASH 025aa1ff9f31c55d94ca372333feab0c
SHA256 198cc989d8685284e57a65b28a0fd51aedbda7334e9cd448832120f31d8e0a60
MD5 ba706a2087184d0a3fb1b4ba17fe8fea
SHA1 bad7ad1e60b27f59801e4eb13addb6e3e54d0d2a
SHA512 c1bdf322ad140d12f1d5943da6ee284b329f2e1f624268816ab6b981740d8c3b6d49e95e57c27c54c7dd1dcf9cfee8fb77f0fdf08158917a677e0ec6a45296ec
SSDEEP 6144:TuGUv8ZbVEc07JBc8RDZ5p1xiFEuMlrVTyo5eiAW2TQa:SsbE+8v5nATMD+onUTQa
TLSH
T11BA47D56B2A800F9F177813CCA938942FA757C464760E6DF03A496B61F27EE05E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

1d:79:44:2d:ec:00:1c:92:8e:4f:cf:32:3d:4f:79:03:7a:69:43:8c:9c:99:48:d9:57:3b:09:da:ad:50:33:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 3, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:2d:f2:4c:ba:91:4a:39:96:b3:5e:00:00:00:04:2d:f2

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2026 - Aug 5, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:65:cd:eb:3f:a1:d7:fc:d2:00:00:00:00:00:58

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

169388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

StartTraceW ControlTraceW EnableTraceEx2 OpenTraceW CloseTrace ProcessTrace

tdh

TdhGetEventInformation TdhGetPropertySize

user32

GetForegroundWindow GetWindowThreadProcessId

kernel32

WriteConsoleW CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW CloseHandle WaitForSingleObject GetCurrentProcessId GetCurrentThread SetThreadPriority OpenProcess SetConsoleOutputCP CreateToolhelp32Snapshot Process32FirstW Process32NextW FileTimeToLocalFileTime GetLastError QueryPerformanceCounter GetSystemTimeAsFileTime FreeLibrary GetProcAddress LoadLibraryExA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetEnvironmentStringsW QueryPerformanceFrequency WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive SleepConditionVariableSRW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleW WakeAllConditionVariable EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc HeapSize HeapQueryInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP RtlUnwind

Name

.text

Size

320KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

fps-doctor-hardware.exe

IMPHASH 8a34d2e5912e3d13caec44729685a874
SHA256 40926ced0f1198486669945221efce3be46ecca127ef925e2d09d71017d8741d
MD5 2cf18a5b44bae5b99c580cca9a66aeba
SHA1 95516857f5dd02f21535ff8bd336a19de796115c
SHA512 44a4c2737e8dcc93d427507cf394f54c565d01b476f0198e6f0cc874d509637074051d7c0312e2a6b2608715ccfb3f8cb69a5d0ca87fdfa08c9bd6a332a2090e
SSDEEP 786432:AGztzsFd+U4DVOK33ZiSOH0q4DlpFcz7y/b:Ak4FdX0Zi0yS/b
TLSH
T19408AE14E3D84B16E67FC2BDC1638512E6B1B8521361D7CF0498DE992F63BC1AB36362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

48:07:d5:fd:b3:12:21:42:71:c8:54:9e:e5:cd:55:fe:50:43:f6:76:5b:54:24:bb:bc:4c:52:5d:21:ee:17:67

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 3, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:2d:f2:4c:ba:91:4a:39:96:b3:5e:00:00:00:04:2d:f2

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2026 - Aug 5, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:65:cd:eb:3f:a1:d7:fc:d2:00:00:00:00:00:58

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

6060720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

ActivateActCtx FindResourceW GetWindowsDirectoryW GetModuleHandleW LoadLibraryExW LoadLibraryExA RtlCaptureContext WideCharToMultiByte GetConsoleOutputCP MapViewOfFileEx SetLastError SetThreadErrorMode RaiseException SetConsoleCtrlHandler DebugBreak FlsAlloc FlsSetValue FlsGetValue GetLocaleInfoEx GetUserDefaultLocaleName FlushProcessWriteBuffers ReadFile CreateNamedPipeA GetCurrentProcess WriteFile WaitForMultipleObjects WaitForSingleObject DuplicateHandle DisconnectNamedPipe CreateEventW CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetEvent ResetEvent WaitForSingleObjectEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect SleepEx SwitchToThread MultiByteToWideChar SuspendThread ResumeThread LCMapStringEx FormatMessageW LocalFree GetModuleFileNameW GetEnvironmentVariableW CreateFileW GetFullPathNameW HeapAlloc HeapFree CreateFileMappingW HeapCreate GetProcessHeap HeapDestroy VerSetConditionMask VerifyVersionInfoW QueueUserAPC SetThreadPriority GetThreadPriority TlsSetValue TlsAlloc WaitForMultipleObjectsEx SignalObjectAndWait RtlLookupFunctionEntry SetThreadStackGuarantee LocateXStateFeature SetErrorMode RaiseFailFastException GetExitCodeProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler GetThreadContext SetThreadContext GetEnabledXStateFeatures InitializeContext RtlRestoreContext SetXStateFeaturesMask CopyContext GetModuleHandleExW GetCommandLineW CreateProcessW GetCPInfo ExitProcess OutputDebugStringW RtlInstallFunctionTableCallback GetLogicalProcessorInformationEx SetThreadGroupAffinity GetThreadGroupAffinity UnmapViewOfFile GetProcessAffinityMask QueryInformationJobObject FlushInstructionCache RtlDeleteFunctionTable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeConditionVariable WakeAllConditionVariable AcquireSRWLockShared SleepConditionVariableSRW ReleaseSRWLockShared CreateMemoryResourceNotification WerRegisterRuntimeExceptionModule RtlUnwind CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer OpenEventW ExitThread HeapReAlloc TlsGetValue GetFileSize RtlAddFunctionTable CreateSemaphoreExW ReleaseSemaphore GetSystemDefaultLCID GetUserDefaultLCID OutputDebugStringA QueryThreadCycleTime SetFilePointer MapViewOfFile Sleep RemoveDirectoryW CreateDirectoryW GetEnvironmentStringsW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetCurrentProcessId GetProcAddress CreateThread GetSystemInfo CloseHandle GetActiveProcessorGroupCount GetCurrentThread GetLastError FreeEnvironmentStringsW GetCurrentThreadId CreateActCtxW GetStdHandle FindNextFileW EnterCriticalSection FindFirstFileExW GetFileSizeEx InitializeCriticalSection GetTempPathW FindClose GetFileAttributesW GetConsoleMode GetFileAttributesExW LoadLibraryA GetCurrentDirectoryW WriteConsoleW DeleteCriticalSection CreateFileMappingA LeaveCriticalSection GetTickCount64 QueryPerformanceFrequency QueryPerformanceCounter IsDebuggerPresent GetNumaHighestNodeNumber SetThreadAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx VirtualAllocExNuma GetNumaProcessorNodeEx VirtualUnlock GetLargePageMinimum IsProcessInJob K32GetProcessMemoryInfo GetLogicalProcessorInformation GlobalMemoryStatusEx RtlVirtualUnwind IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer InitializeCriticalSectionAndSpinCount TlsFree TryAcquireSRWLockExclusive GetExitCodeThread GetStringTypeW InitializeCriticalSectionEx DecodePointer SetEnvironmentVariableW GetProcessGroupAffinity GetCurrentProcessorNumberEx

advapi32

LookupPrivilegeValueW RegGetValueW SetKernelObjectSecurity RegQueryValueExW RegOpenKeyExW GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken RegCloseKey SetThreadToken RevertToSelf OpenThreadToken EventWrite EventRegister EventWriteTransfer DeregisterEventSource RegisterEventSourceW ReportEventW AdjustTokenPrivileges

ole32

CLSIDFromProgID CoCreateGuid CoTaskMemAlloc CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CoCreateFreeThreadedMarshaler CoGetClassObject CoGetContextToken CoGetObjectContext CoReleaseMarshalData CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoRevokeInitializeSpy CoTaskMemFree

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen CreateErrorInfo QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType SysAllocString LoadRegTypeLi SysAllocStringLen VariantClear VariantInit VarCyFromDec SafeArrayDestroy SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SysStringByteLen SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement SafeArrayGetDim SafeArrayGetLBound

user32

MessageBoxW LoadStringW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

iswspace strncpy iswascii _strnicmp iswupper strncmp strncpy_s towlower wcscat_s _wcsdup wcscpy_s wcsncpy_s isalpha strnlen wcsncat_s strncat_s towupper strcpy_s strcmp _stricmp strcat_s isspace tolower wcsncmp _strdup strtok_s wcsnlen strlen _wcsnicmp _wcsicmp isdigit

api-ms-win-crt-heap-l1-1-0

_callnewh realloc _aligned_malloc malloc _set_new_mode free calloc _aligned_free

api-ms-win-crt-convert-l1-1-0

atoi atol _wcstoui64 strtol _wtoi _ltow_s strtoull strtoul wcstoul _atoi64

api-ms-win-crt-stdio-l1-1-0

fputwc __stdio_common_vsprintf_s _set_fmode __stdio_common_vfprintf __acrt_iob_func __p__commode ftell fseek __stdio_common_vsprintf fopen __stdio_common_vfwprintf setvbuf _setmode _dup _fileno fclose __stdio_common_vswprintf _flushall fwrite __stdio_common_vsnwprintf_s __stdio_common_vsnprintf_s _wfsopen _write __stdio_common_vsscanf fgets fflush fputs _wfopen

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _invalid_parameter_noinfo _wcserror_s _beginthreadex abort _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _errno _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table terminate _controlfp_s

api-ms-win-crt-filesystem-l1-1-0

_wremove _wrename

api-ms-win-crt-math-l1-1-0

truncf ilogbf copysignf copysign ceilf round asinh cbrt cos acosh atanh modf acoshf cbrtf atanhf modff asinhf _fdopen fmodf fmod tanhf fmaf fma floorf __setusermatherr acos acosf asin asinf atan atan2 atan2f log10 log10f log2 log2f logf floor expf pow log powf exp coshf roundf cosh sin sinf cosf sinh sinhf trunc sqrt sqrtf tan tanf tanh atanf ceil

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 wcsftime

api-ms-win-crt-locale-l1-1-0

_create_locale __pctype_func ___mb_cur_max_func ___lc_codepage_func _configthreadlocale setlocale _lock_locales _unlock_locales _free_locale ___lc_locale_name_func

Name

.text

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

215B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

fps-doctor-sidecar.exe

IMPHASH ece1db0cb86d368399ca3b18c6ab2922
SHA256 8e5357a5e42da652ce5b9bd7f0ead4189ffb1d4493caaad44e92bc2624fdfafd
MD5 4b1772418e9983c34de402b3fa2ec923
SHA1 5838c7ea0b3c840e19499929da40f66a13fe7506
SHA512 5f83c7b5ddcab04b12ee544ec8e8ae93a7abeb1f173d733a8481cce1bf50e471c3a9eef4c62c5c9be8e0e751c0848e466744d2c8b29f9495ccf0ccaa04972f7a
SSDEEP 12288:TMzq8XePys7yjdqA6SWcO7QScGekIV8OaKrtN2PQSG:TMzBX2PQqA5WcO7jc1teONMQX
TLSH
T161357D3756A406ACE1EBC07D8F864C86D7B1781A03E15DDF0B9059626E2B5F41E3EB23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

29:e9:63:2b:28:b7:2f:f8:17:ff:04:c1:06:ea:f8:fd:4d:99:d2:e3:26:e4:12:59:fc:69:ef:9f:a5:43:d0:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 3, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:2d:f2:4c:ba:91:4a:39:96:b3:5e:00:00:00:04:2d:f2

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2026 - Aug 5, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:65:cd:eb:3f:a1:d7:fc:d2:00:00:00:00:00:58

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

609840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDriveStringsW GetVolumeInformationW DeviceIoControl GetSystemTimes GetSystemInfo GetLogicalProcessorInformation GetNativeSystemInfo GetModuleHandleW FreeLibrary LoadLibraryExA OutputDebugStringW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection LocalAlloc GetSystemDirectoryW GetFileAttributesW GetModuleFileNameW SetLastError LoadLibraryExW GetModuleFileNameA VerifyVersionInfoW VerSetConditionMask GetFullPathNameW SetEndOfFile WriteConsoleW CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc DeleteFileW ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers LocalFree Sleep GetTempPathA CreatePipe SetHandleInformation ReadFile GetFileAttributesA CreateProcessA GetExitCodeProcess WaitForSingleObject CloseHandle LoadLibraryA GetProcAddress GetModuleHandleA GetLastError SetConsoleOutputCP GetSystemFirmwareTable GlobalMemoryStatusEx SetEnvironmentVariableA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree HeapSize GetEnvironmentVariableA FlsSetValue FlsGetValue FlsAlloc GetFileType HeapFree HeapAlloc FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo WakeAllConditionVariable GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW RtlUnwind

user32

SendMessageTimeoutA SystemParametersInfoA ChangeDisplaySettingsExW EnumDisplaySettingsExW EnumDisplayDevicesW

gdi32

D3DKMTQueryStatistics

ole32

CoInitializeSecurity CoSetProxyBlanket PropVariantClear CoInitialize CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantClear SysStringLen VariantInit

advapi32

ControlService RegCreateKeyExA RegQueryValueExW RegOpenKeyExW RegDeleteTreeA RegEnumKeyExA StartServiceA QueryServiceStatusEx QueryServiceConfigA OpenServiceA OpenSCManagerA RegDeleteValueA CloseServiceHandle ChangeServiceConfigA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey

powrprof

PowerReadFriendlyName PowerSetActiveScheme PowerGetActiveScheme PowerWriteDCValueIndex PowerWriteACValueIndex PowerWriteFriendlyName PowerWriteDescription PowerDuplicateScheme PowerDeleteScheme PowerEnumerate

iphlpapi

GetAdaptersAddresses

dxgi

CreateDXGIFactory1

wlanapi

WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanOpenHandle

Name

.text

Size

802KB

Virtual Size

801KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

187KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

resources/PawnIO_setup.exe

IMPHASH 2dc7f4df09d86c9712fe5fb25a98b9c0
SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
MD5 956e73fc2a40945bc66af3a3ff963371
SHA1 096660b9e3aeff0547dfc621c03953852afd4629
SHA512 9415a97341dfc69d34c4f7f5081e70782ba712d8ea7d0c2ea2b44a0e90b1567cd53e400b3d29562b723d3763e0ff00116e97e2072d3fefc3a1821413aa937afd
SSDEEP 98304:kvJ5ux3qNj0iINNFe4TBGOzq2j29hGny1xdb+16w:kvrux3m0iGcqjljCo4d6Uw
TLSH
T12EF51233D2E1B198CD95C7F0D6285DA25CEEBC45CBE57CEBC783A3292666AD09130706
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Digest

53:30:8f:04:43:5b:2d:9d:d5:b0:0c:37:89:dd:2c:61:59:09:23:88:2d:26:52:25:9b:dc:32:2d:77:2e:6c:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=namazso.eu,O=namazso,L=Debrecen,C=HU,1.2.840.113549.1.9.1=#0c1061646d696e406e616d617a736f2e6575

Chains

Mar 15, 2026

CN=namazso.eu,O=namazso,L=Debrecen,C=HU,1.2.840.113549.1.9.1=#0c1061646d696e406e616d617a736f2e6575

CN=GLOBALTRUST 2015 CODESIGNING 1,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

CN=GLOBALTRUST 2015,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Subject

CN=namazso.eu,O=namazso,L=Debrecen,C=HU,1.2.840.113549.1.9.1=#0c1061646d696e406e616d617a736f2e6575

Serial Number

4f:3d:79:e2:3f:36:fc:99:9c:b6:22

Issuer

CN=GLOBALTRUST 2015 CODESIGNING 1,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2024 - Aug 5, 2027

Subject

CN=GLOBALTRUST 2015 CODESIGNING 1,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Serial Number

01:f9:c5:34:2a:d3:cb:20:65:93:e4:ce:56

Issuer

CN=GLOBALTRUST 2015,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 25, 2016 - Jun 10, 2040

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5b:4a:b5:8d:41:32:6d:dc:74:00:00:00:00:00:5b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

LdrAccessResource LdrFindResource_U LdrGetDllHandle LdrGetProcedureAddress LdrLoadDll NtClose NtCreateFile NtCreateKey NtDeleteKey NtOpenFile NtOpenKey NtQueryDirectoryFile NtQueryInformationFile NtQueryValueKey NtReadFile NtSetInformationFile NtSetValueKey NtTerminateProcess NtWriteFile RtlAllocateHeap RtlAppendUnicodeStringToString RtlExpandEnvironmentStrings_U RtlFreeHeap RtlNtStatusToDosError RtlRandomEx __chkstk _snprintf _snwprintf _vsnwprintf _wcsicmp iswspace memcpy memmove memset sscanf wcscmp wcscpy wcslen wcsncpy wcsstr

comctl32

ord413 InitCommonControlsEx ord410

setupapi

SetupDiCallClassInstaller SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceRegistryPropertyW

newdev

UpdateDriverForPlugAndPlayDevicesW

user32

BeginPaint CreateWindowExW DefWindowProcW DialogBoxParamW DispatchMessageW EndDialog EndPaint GetDC GetDlgItem GetMessageW GetWindowLongPtrW GetWindowRect InvalidateRect LoadCursorW LoadIconW MessageBoxW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageW SetWindowLongPtrW ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UpdateWindow

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreateDIBitmap DeleteDC DeleteObject GdiAlphaBlend GetBitmapBits GetObjectW SelectObject

Sharing

General

Malware Config

Signatures

File Explorer

FPSDoctor_1.4.7_x64-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

FPSDoctor.exe

kernel32

advapi32

oleaut32

bcryptprimitives

ntdll

shell32

user32

ole32

shlwapi

comctl32

api-ms-win-core-synch-l1-2-0

gdi32

dwmapi

api-ms-win-core-winrt-l1-1-0

crypt32

ws2_32

bcrypt

iphlpapi

psapi

dxgi

wintrust

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0