FPSDoctor_1[.]5[.]0_x64-setup[.]exe

Resubmissions

27/08/2026, 09:26

260827-leabma1vgv

27/08/2026, 09:23

260827-lcpcrssdnc6

Sharing

Copy URL Twitter E-mail

General

Target
FPSDoctor_1.5.0_x64-setup.exe
Size 39.1MB
Sample260827-leabma1vgv
SHA256 83fe4c49d89576b276e9d41191b23dc8f7d2a21438581bd278f710f9a797859a
MD5 70ce43b7ad247060d535c9b5decb51f4
SHA1 f343f882e174a715e02a542ecd428641698b63e8
SHA512 14f44cb80e2fda4df82bd521b0887d6b60d5e18c079d425faa36e6b4cf9801ae0d4854418b627febd6506fa017e0739735ae5637220c48be069c827dae8e650f
SSDEEP 786432:pa6P88H+gEyfHMhUXFSABl/lPW8rHOqccQDyy+5Ghj0TkTKc/PwUsOZnQq1khG:p4qgyfHM6Xz/NW8r5qyy0i0T1cFXnpko
TLSH
T16C9733E3C797866FC130E5B80E01F23A36A99F9254355AEED231BA5CCC9599F10F3252
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

File Explorer

FPSDoctor_1.5.0_x64-setup.exe

.exe 39.1MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/UserInfo.dll

.dll 4KB
$PLUGINSDIR/modern-wizard.bmp

150KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsExec.dll

.dll 7KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 48KB
FPSDoctor.exe

.exe 31.0MB
fps-doctor-capture.exe

.exe 474KB
fps-doctor-hardware.exe

.exe 75.9MB
fps-doctor-sidecar.exe

.exe 1.0MB
resources/PawnIO_setup.exe

.exe 3.3MB

FPSDoctor_1.5.0_x64-setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 83fe4c49d89576b276e9d41191b23dc8f7d2a21438581bd278f710f9a797859a
MD5 70ce43b7ad247060d535c9b5decb51f4
SHA1 f343f882e174a715e02a542ecd428641698b63e8
SHA512 14f44cb80e2fda4df82bd521b0887d6b60d5e18c079d425faa36e6b4cf9801ae0d4854418b627febd6506fa017e0739735ae5637220c48be069c827dae8e650f
SSDEEP 786432:pa6P88H+gEyfHMhUXFSABl/lPW8rHOqccQDyy+5Ghj0TkTKc/PwUsOZnQq1khG:p4qgyfHM6Xz/NW8r5qyy0i0T1cFXnpko
TLSH
T16C9733E3C797866FC130E5B80E01F23A36A99F9254355AEED231BA5CCC9599F10F3252
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

b3:0c:54:22:cb:69:84:dd:60:62:d5:5f:c0:35:28:68:a3:14:ff:ef:06:bd:f1:15:3e:19:9d:01:4e:b8:49:3b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 14, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:bc:81:38:25:89:a8:d1:0b:2f:2d:00:00:00:04:bc:81

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2026 - Aug 16, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:65:cd:eb:3f:a1:d7:fc:d2:00:00:00:00:00:58

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 68e847ed6763e00454edac87b3abd95a
SHA256 e0dc3112796dbaa37f25ab54b7fac2fbf791cbc6e36a84fc61c6423b84a3677b
MD5 e6f30908abfc6f53b7c3c36daec4586d
SHA1 a9ce4ceb9121c0f4375010438359f564f77506e3
SHA512 0161f510d894d7a85c7cc160ef1cbb694cd30580ffe537f82096f4ce966cf3f6a9fec4929dd93ba2b133eb23a0230e53969792ad647c3b0f5f2e5517d9970a09
TLSH
T1A78173BB92E00CF3D0A44BB780A71CE362B5DD301752001F4A478AA92590B67EE7EB15
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 784d0cd844774fe0b0102c8e10efffea6e8c561ce521d7d7104cf90a6af9c3f9
MD5 6e77212cf0415fad293420adc6bdc8c8
SHA1 e3e953baa8ab4ab6567966776369cd28598316c6
SHA512 8203d84511d6abba67bd89666d7ea782020de12133efaa0064510dbd634f5942cabf269f1851794908f151b7beb2b1c91b48d78f3279525652b1c6cdb86115f8
SSDEEP 1536:WwODZzTrAV5Oevq4DtXHVGNCFCDf93Y1fIY/evt:Wwwy0gqaXHMQo+WB
TLSH
T186238E8CFDC56967E7CF59701084CAAF693FCA061504C96BA3B26E92C5823B2DFD411E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

83:3a:0c:a6:a9:ea:fe:42:8b:8c:66:14:d5:bb:78:4d:6e:28:98:d1:44:45:77:45:9c:98:93:7f:05:54:8f:4a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 14, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:bc:81:38:25:89:a8:d1:0b:2f:2d:00:00:00:04:bc:81

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2026 - Aug 16, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:65:cd:eb:3f:a1:d7:fc:d2:00:00:00:00:00:58

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

FPSDoctor.exe

IMPHASH c5771f08a48214bb38e08c3db0956184
SHA256 9758f72669bb7fdf21b50df071ecf453db25285ae5db9385001b037d8efd2634
MD5 ffe0f8a6a40552b981a03c1ad1963d38
SHA1 498146ff91dde04638b05df1c39b31e7229e89b3
SHA512 93b634b5ddd06bceca0e20c7cc74469d51b9e4fda3e73718f7d13dd7acf2238b4b9d76a42076b7d12c71d42492932f23b07984eae0e1942589f7de0a36b8123e
SSDEEP 786432:+9yqAzCtuM/ng7ei0/T+kElKyFyMu+ltrjec:sJAzCtuM/ng7ei0/T+lNFyB+ltJ
TLSH
T1C86729257A9A9968D09BC47483478A724A3034DB1B35BAFF44D492383F7DBF56F38218
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

c7:4a:fe:6a:d0:c9:ec:08:a9:f9:7f:97:5e:14:ba:b1:9d:5e:6c:e8:87:3c:58:80:6a:22:1d:8a:3a:5d:d0:4e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 14, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:bc:81:38:25:89:a8:d1:0b:2f:2d:00:00:00:04:bc:81

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2026 - Aug 16, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:24:d3:95:e0:a2:e9:c9:31:00:00:00:00:00:57

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

19089676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

FPSDoctor.pdb

kernel32

LoadLibraryW HeapCompact HeapDestroy GetCurrentProcessId WideCharToMultiByte GetSystemTime FormatMessageA MapViewOfFile GetTickCount HeapReAlloc GetNativeSystemInfo GetSystemInfo GetUserPreferredUILanguages GetCurrentThreadId WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW MultiByteToWideChar GetSystemFirmwareTable GetSystemTimeAsFileTime TerminateProcess SetPriorityClass LCIDToLocaleName HeapSize HeapValidate LocalFree FreeLibrary LoadLibraryA OutputDebugStringA ReleaseMutex IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive GetModuleHandleW QueryFullProcessImageNameW WaitForMultipleObjects OpenProcess UnregisterWaitEx DuplicateHandle RegisterWaitForSingleObject SetHandleInformation ResetEvent SetEvent GetModuleFileNameW LoadLibraryExW OpenEventW HeapCreate GetConsoleMode WakeAllConditionVariable GetFileInformationByHandle GetQueuedCompletionStatusEx CancelIoEx PostQueuedCompletionStatus GetOverlappedResult SetFileCompletionNotificationModes CreateIoCompletionPort CreatePipe SleepConditionVariableSRW AreFileApisANSI ReadFile GetFullPathNameW GetComputerNameExW WriteFile GetDiskFreeSpaceW LockFile SetFilePointer GetFullPathNameA SetEndOfFile GetCurrentProcess RaiseException lstrlenW WaitForSingleObject GetUserDefaultUILanguage UnlockFileEx CreateEventW GetTempPathW IsDebuggerPresent CreateMutexW GetDriveTypeW Sleep GetModuleHandleA GetProcAddress RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue LoadLibraryExA FormatMessageW GetLastError TlsSetValue CreateProcessW TlsFree GetFileAttributesW MoveFileExW CreateFileW SetNamedPipeHandleState GetTimeZoneInformationForYear SystemTimeToFileTime SystemTimeToTzSpecificLocalTime HeapAlloc HeapFree GetProcessHeap CloseHandle UnmapViewOfFile FlushFileBuffers GetFileSize LockFileEx UnlockFile DeleteFileW DeleteFileA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA WriteConsoleW FindNextFileW RtlUnwindEx SetEnvironmentVariableW SetWaitableTimer CreateWaitableTimerExW InitializeSListHead DeviceIoControl CreateSymbolicLinkW GetFinalPathNameByHandleW SetUnhandledExceptionFilter UnhandledExceptionFilter CreateMutexA InitializeCriticalSectionAndSpinCount SwitchToThread ExitProcess FindClose FindFirstFileExW CopyFileExW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetStdHandle GetEnvironmentStringsW GetProcessId GetExitCodeProcess GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx QueryPerformanceCounter CreateFileMappingW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext ReadFileEx CreateThread QueryPerformanceFrequency RtlVirtualUnwind GetEnvironmentVariableW SetFileTime SetFileInformationByHandle SetLastError GetConsoleOutputCP SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal

advapi32

CreateProcessWithTokenW RegCreateKeyExW RegDeleteTreeW RegQueryValueExW RegDeleteValueW RegSetValueExW RegCreateKeyTransactedW RegOpenKeyExW RegCloseKey GetTokenInformation RegEnumKeyExW RegGetValueW OpenProcessToken DuplicateTokenEx AdjustTokenPrivileges RegOpenKeyTransactedW LookupPrivilegeValueW RegEnumValueW EventRegister EventSetInformation EventWriteTransfer EventUnregister SystemFunction036

oleaut32

SysFreeString SysStringLen GetErrorInfo SetErrorInfo

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtOpenFile NtWriteFile NtReadFile NtCreateFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateNamedPipeFile RtlGetVersion

shell32

Shell_NotifyIconW SHOpenFolderAndSelectItems ILCreateFromPathW ILFree SHCreateItemFromParsingName SHEmptyRecycleBinW ShellExecuteExW Shell_NotifyIconGetRect ShellExecuteW SHGetKnownFolderPath DragQueryFileW DragFinish SHAppBarMessage

user32

OffsetRect GetMenuBarInfo DrawIconEx DrawMenuBar SetMenu GetMenuItemInfoW SetTimer TrackPopupMenu KillTimer ChangeWindowMessageFilterEx RegisterClassW DrawTextW ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState SystemParametersInfoA SetPropW SendInput SetForegroundWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowLongW CreateMenu GetSystemMenu DestroyIcon SetWindowDisplayAffinity GetRawInputData GetMenu ShowCursor ClipCursor GetClipCursor IsWindowVisible EnumDisplayMonitors MonitorFromPoint CreateIcon ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx CreatePopupMenu RegisterRawInputDevices RegisterWindowMessageA GetWindow SetParent MapWindowPoints SetFocus ShowWindow DestroyAcceleratorTable CreateAcceleratorTableW ReleaseDC GetParent FindWindowExW SetWindowRgn EnableWindow IsWindowEnabled IsProcessDPIAware GetDC SetMenuItemInfoW CheckMenuItem TranslateAcceleratorW InsertMenuW GetForegroundWindow GetWindowRect AppendMenuW MonitorFromWindow GetMonitorInfoW RemoveMenu GetWindowThreadProcessId AdjustWindowRect RedrawWindow PostQuitMessage SetWindowPos GetMessageA DestroyMenu SendMessageW GetWindowDC FindWindowW DestroyWindow SetWindowLongPtrW GetWindowLongPtrW DefWindowProcW GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect MonitorFromRect GetCursorPos GetClientRect GetWindowLongW ScreenToClient GetUpdateRect MapVirtualKeyW ValidateRect PostThreadMessageW PeekMessageW LoadCursorW FlashWindowEx DispatchMessageW GetMessageW CreateWindowExW RegisterTouchWindow GetSystemMetrics IsWindow AdjustWindowRectEx RegisterClassExW GetShellWindow EnumWindows GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn ClientToScreen AllowSetForegroundWindow MessageBoxW EnableMenuItem PostMessageW IsIconic EnumChildWindows DispatchMessageA TranslateMessage

ole32

CoIncrementMTAUsage OleInitialize CoTaskMemFree CoInitialize CoUninitialize RegisterDragDrop RevokeDragDrop CoCreateFreeThreadedMarshaler CoInitializeEx CoTaskMemAlloc CoCreateInstance

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

shlwapi

SHCreateMemStream

comctl32

TaskDialogIndirect DefSubclassProc RemoveWindowSubclass SetWindowSubclass

gdi32

GetDeviceCaps BitBlt CombineRgn CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject SetTextColor SetBkMode CreateRectRgn CreateDIBSection SelectObject

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

crypt32

CertFreeCertificateChainEngine CertGetCertificateChain CertCreateCertificateChainEngine CertOpenStore CertAddEncodedCertificateToStore CryptUnprotectData CryptProtectData CertGetNameStringW CertCloseStore CertSetCertificateContextProperty CryptMsgClose CertFreeCertificateContext CertFindCertificateInStore CryptMsgGetParam CertVerifyCertificateChainPolicy CertFreeCertificateChain CryptQueryObject

ws2_32

getaddrinfo WSAStartup WSACleanup getpeername freeaddrinfo WSAGetLastError socket WSAIoctl setsockopt shutdown listen bind WSASocketW send recv connect ioctlsocket WSASend accept getsockopt getsockname closesocket

bcrypt

BCryptGenRandom

iphlpapi

FlushIpNetTable2 GetIfTable2 FreeMibTable

psapi

EnumProcesses

dxgi

CreateDXGIFactory1

wintrust

WinVerifyTrust

api-ms-win-crt-math-l1-1-0

pow roundf trunc floor fmod log __setusermatherr round

api-ms-win-crt-string-l1-1-0

wcslen strlen wcsncmp strcmp strcspn strspn wcscmp strcpy_s _wcsicmp strncmp

api-ms-win-crt-heap-l1-1-0

calloc _msize realloc _callnewh _set_new_mode malloc free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _beginthreadex _crt_atexit _endthreadex _seh_filter_exe _set_app_type __p___argv _configure_narrow_argv terminate _initialize_onexit_table abort _cexit _register_thread_local_exe_atexit_callback exit __p___argc _initterm_e _exit _c_exit _initterm _initialize_narrow_environment _get_initial_narrow_environment

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

fps-doctor-capture.exe

IMPHASH 025aa1ff9f31c55d94ca372333feab0c
SHA256 bac3f3e62b03955a611ee8c38563caa43b96b277a11c005559e1fe18fbbfae4f
MD5 a428d6c48ab9b36eb1c7fde16f1bbcb8
SHA1 ecde8d8cdffdc31b313b82668c843b2dc6b247b3
SHA512 777b280b76087efae3f533dfe1c9bd384a058889cd3da8e2f814fcc9959c0755d80294688dd4e4ee2275767e762388876f2d560af3cfc37a0b8f1e53ce5e8a15
SSDEEP 6144:IBCsmZpA6ShEC/F9jx6GXVVE6RLo3qsqEjI06o5p8jfdvmjoe:nK9/FTzzLYqIjIjojElvMoe
TLSH
T16AA48E96B36C00F9F57B8138CA938906EA757C464760E6EF03A496B61F27EE04E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a0:e2:34:5d:28:d7:73:b9:a1:2c:f5:ad:e1:46:62:8c:14:6e:b1:f3:76:8e:e6:5f:8f:3d:1b:c0:dd:18:8c:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 14, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:bc:81:38:25:89:a8:d1:0b:2f:2d:00:00:00:04:bc:81

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2026 - Aug 16, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:56:7e:8f:9d:58:08:8e:e9:60:00:00:00:00:00:56

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

169756

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

StartTraceW ControlTraceW EnableTraceEx2 OpenTraceW CloseTrace ProcessTrace

tdh

TdhGetEventInformation TdhGetPropertySize

user32

GetForegroundWindow GetWindowThreadProcessId

kernel32

WriteConsoleW CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW CloseHandle WaitForSingleObject GetCurrentProcessId GetCurrentThread SetThreadPriority OpenProcess SetConsoleOutputCP CreateToolhelp32Snapshot Process32FirstW Process32NextW FileTimeToLocalFileTime GetLastError QueryPerformanceCounter GetSystemTimeAsFileTime FreeLibrary GetProcAddress LoadLibraryExA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime GetEnvironmentStringsW QueryPerformanceFrequency WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive SleepConditionVariableSRW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleW WakeAllConditionVariable EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc HeapSize HeapQueryInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP RtlUnwind

Name

.text

Size

320KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

fps-doctor-hardware.exe

IMPHASH 8a34d2e5912e3d13caec44729685a874
SHA256 db9b91eee08e7870fc2fc3d4a1bca060c4545256bb2b3bde0a62bce3b25c260b
MD5 a3d9186bd8d2a408d94dcb8ca5689b71
SHA1 782685e7d39df4959ef5af9dab82832a138f8bea
SHA512 da25f29d57a34bafd1bd29998b6e98a6070c707da8f35bc75712f1367e4982931571e8eba98faa5851efe9e89e6548dd7030aa50b55c2e8c7e3411ad65e24ec3
SSDEEP 786432:dbiIXE27FsKUXTjdJyFV1OH0n5fj5P14SnhA:dCuFsLGFVHZHZhA
TLSH
T14508AE15E3D84B16E67FC27CC1638512E7B1B8421361D7CF0498EA992F63BC1AB36762
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

dc:9e:25:fb:dc:d7:32:d5:03:1f:62:a4:f9:a2:74:89:ac:13:04:2f:8e:7d:a4:fb:5b:64:58:8f:7c:db:81:4c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 14, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:bc:81:38:25:89:a8:d1:0b:2f:2d:00:00:00:04:bc:81

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2026 - Aug 16, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:24:d3:95:e0:a2:e9:c9:31:00:00:00:00:00:57

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

6066544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\src\runtime\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

ActivateActCtx FindResourceW GetWindowsDirectoryW GetModuleHandleW LoadLibraryExW LoadLibraryExA RtlCaptureContext WideCharToMultiByte GetConsoleOutputCP MapViewOfFileEx SetLastError SetThreadErrorMode RaiseException SetConsoleCtrlHandler DebugBreak FlsAlloc FlsSetValue FlsGetValue GetLocaleInfoEx GetUserDefaultLocaleName FlushProcessWriteBuffers ReadFile CreateNamedPipeA GetCurrentProcess WriteFile WaitForMultipleObjects WaitForSingleObject DuplicateHandle DisconnectNamedPipe CreateEventW CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetEvent ResetEvent WaitForSingleObjectEx VirtualAlloc VirtualFree VirtualQuery VirtualProtect SleepEx SwitchToThread MultiByteToWideChar SuspendThread ResumeThread LCMapStringEx FormatMessageW LocalFree GetModuleFileNameW GetEnvironmentVariableW CreateFileW GetFullPathNameW HeapAlloc HeapFree CreateFileMappingW HeapCreate GetProcessHeap HeapDestroy VerSetConditionMask VerifyVersionInfoW QueueUserAPC SetThreadPriority GetThreadPriority TlsSetValue TlsAlloc WaitForMultipleObjectsEx SignalObjectAndWait RtlLookupFunctionEntry SetThreadStackGuarantee LocateXStateFeature SetErrorMode RaiseFailFastException GetExitCodeProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler GetThreadContext SetThreadContext GetEnabledXStateFeatures InitializeContext RtlRestoreContext SetXStateFeaturesMask CopyContext GetModuleHandleExW GetCommandLineW CreateProcessW GetCPInfo ExitProcess OutputDebugStringW RtlInstallFunctionTableCallback GetLogicalProcessorInformationEx SetThreadGroupAffinity GetThreadGroupAffinity UnmapViewOfFile GetProcessAffinityMask QueryInformationJobObject FlushInstructionCache RtlDeleteFunctionTable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock InitializeConditionVariable WakeAllConditionVariable AcquireSRWLockShared SleepConditionVariableSRW ReleaseSRWLockShared CreateMemoryResourceNotification WerRegisterRuntimeExceptionModule RtlUnwind CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer OpenEventW ExitThread HeapReAlloc TlsGetValue GetFileSize RtlAddFunctionTable CreateSemaphoreExW ReleaseSemaphore GetSystemDefaultLCID GetUserDefaultLCID OutputDebugStringA QueryThreadCycleTime SetFilePointer MapViewOfFile Sleep RemoveDirectoryW CreateDirectoryW GetEnvironmentStringsW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetCurrentProcessId GetProcAddress CreateThread GetSystemInfo CloseHandle GetActiveProcessorGroupCount GetCurrentThread GetLastError FreeEnvironmentStringsW GetCurrentThreadId CreateActCtxW GetStdHandle FindNextFileW EnterCriticalSection FindFirstFileExW GetFileSizeEx InitializeCriticalSection GetTempPathW FindClose GetFileAttributesW GetConsoleMode GetFileAttributesExW LoadLibraryA GetCurrentDirectoryW WriteConsoleW DeleteCriticalSection CreateFileMappingA LeaveCriticalSection GetTickCount64 QueryPerformanceFrequency QueryPerformanceCounter IsDebuggerPresent GetNumaHighestNodeNumber SetThreadAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx VirtualAllocExNuma GetNumaProcessorNodeEx VirtualUnlock GetLargePageMinimum IsProcessInJob K32GetProcessMemoryInfo GetLogicalProcessorInformation GlobalMemoryStatusEx RtlVirtualUnwind IsProcessorFeaturePresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer InitializeCriticalSectionAndSpinCount TlsFree TryAcquireSRWLockExclusive GetExitCodeThread GetStringTypeW InitializeCriticalSectionEx DecodePointer SetEnvironmentVariableW GetProcessGroupAffinity GetCurrentProcessorNumberEx

advapi32

LookupPrivilegeValueW RegGetValueW SetKernelObjectSecurity RegQueryValueExW RegOpenKeyExW GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken RegCloseKey SetThreadToken RevertToSelf OpenThreadToken EventWrite EventRegister EventWriteTransfer DeregisterEventSource RegisterEventSourceW ReportEventW AdjustTokenPrivileges

ole32

CLSIDFromProgID CoCreateGuid CoTaskMemAlloc CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CoCreateFreeThreadedMarshaler CoGetClassObject CoGetContextToken CoGetObjectContext CoReleaseMarshalData CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoRevokeInitializeSpy CoTaskMemFree

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen CreateErrorInfo QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType SysAllocString LoadRegTypeLi SysAllocStringLen VariantClear VariantInit VarCyFromDec SafeArrayDestroy SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SysStringByteLen SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement SafeArrayGetDim SafeArrayGetLBound

user32

MessageBoxW LoadStringW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

iswspace strncpy iswascii _strnicmp iswupper strncmp strncpy_s towlower wcscat_s _wcsdup wcscpy_s wcsncpy_s isalpha strnlen wcsncat_s strncat_s towupper strcpy_s strcmp _stricmp strcat_s isspace tolower wcsncmp _strdup strtok_s wcsnlen strlen _wcsnicmp _wcsicmp isdigit

api-ms-win-crt-heap-l1-1-0

_callnewh realloc _aligned_malloc malloc _set_new_mode free calloc _aligned_free

api-ms-win-crt-convert-l1-1-0

atoi atol _wcstoui64 strtol _wtoi _ltow_s strtoull strtoul wcstoul _atoi64

api-ms-win-crt-stdio-l1-1-0

fputwc __stdio_common_vsprintf_s _set_fmode __stdio_common_vfprintf __acrt_iob_func __p__commode ftell fseek __stdio_common_vsprintf fopen __stdio_common_vfwprintf setvbuf _setmode _dup _fileno fclose __stdio_common_vswprintf _flushall fwrite __stdio_common_vsnwprintf_s __stdio_common_vsnprintf_s _wfsopen _write __stdio_common_vsscanf fgets fflush fputs _wfopen

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _invalid_parameter_noinfo _wcserror_s _beginthreadex abort _register_thread_local_exe_atexit_callback _c_exit __p___wargv __p___argc _errno _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table terminate _controlfp_s

api-ms-win-crt-filesystem-l1-1-0

_wremove _wrename

api-ms-win-crt-math-l1-1-0

truncf ilogbf copysignf copysign ceilf round asinh cbrt cos acosh atanh modf acoshf cbrtf atanhf modff asinhf _fdopen fmodf fmod tanhf fmaf fma floorf __setusermatherr acos acosf asin asinf atan atan2 atan2f log10 log10f log2 log2f logf floor expf pow log powf exp coshf roundf cosh sin sinf cosf sinh sinhf trunc sqrt sqrtf tan tanf tanh atanf ceil

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64 wcsftime

api-ms-win-crt-locale-l1-1-0

_create_locale __pctype_func ___mb_cur_max_func ___lc_codepage_func _configthreadlocale setlocale _lock_locales _unlock_locales _free_locale ___lc_locale_name_func

Name

.text

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

215B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

229KB

Virtual Size

228KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

fps-doctor-sidecar.exe

IMPHASH e6c6de5c83e8f14f199f096f4cfd9f39
SHA256 1fae166a7c6dc70f474b35a45e8f71cc4a6519f05cdd4f1e21d4ef6b83a72c66
MD5 701fd0479a45e2f70941606356ac77f9
SHA1 9fb90ba505322756eb05db9212b169c6ace77337
SHA512 e5b8a9ec99e60cc98c78629c908ed58d81bac36301e556315270f4ab446365fa5fb21e9ae93347775ddcdc44c4f489ad697d48bf8a6dd94d46797c3b92fbc46d
SSDEEP 12288:xrcCTpiOjAO+ykgeeEYkJcx3J+R+JV22dfpwrGG8doc:5cCTpzkfgeeEJavP23r+
TLSH
T195356C37529806ACE1EAC07D8F868C46D7B1781A03E19DDF0B9056625F3B6E45E3EB13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

8a:6c:2c:d9:dc:59:4d:14:df:6d:6d:9f:e1:7b:f8:12:48:d8:5f:e3:f2:cc:14:39:52:05:ef:be:1e:2c:17:82

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Chains

Aug 14, 2026

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=B&R DIGITAL,O=B&R DIGITAL,L=PARIS,C=FR

Serial Number

33:00:04:bc:81:38:25:89:a8:d1:0b:2f:2d:00:00:00:04:bc:81

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2026 - Aug 16, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:55:d9:dd:69:26:28:f9:f8:e2:00:00:00:00:00:55

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

612860

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetDriveTypeW GetLogicalDriveStringsW GetVolumeInformationW DeviceIoControl GetSystemTimes GetSystemInfo GetLogicalProcessorInformation GetNativeSystemInfo GetModuleHandleW FreeLibrary LoadLibraryExA OutputDebugStringW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection LocalAlloc GetSystemDirectoryW GetFileAttributesW GetModuleFileNameW SetLastError LoadLibraryExW GetModuleFileNameA VerifyVersionInfoW VerSetConditionMask GetFullPathNameW SetEndOfFile WriteConsoleW GetDiskFreeSpaceExW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW CreateFileW WideCharToMultiByte GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc DeleteFileW ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers MultiByteToWideChar LocalFree Sleep GetTempPathA CreatePipe SetHandleInformation ReadFile GetFileAttributesA CreateProcessA GetExitCodeProcess WaitForSingleObject CloseHandle LoadLibraryA GetProcAddress GetModuleHandleA GetLastError SetConsoleOutputCP GetSystemFirmwareTable GlobalMemoryStatusEx SetEnvironmentVariableA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree HeapSize GetEnvironmentVariableA FlsSetValue FlsGetValue FlsAlloc GetFileType HeapFree HeapAlloc FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId GetStringTypeW InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo WakeAllConditionVariable GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW RtlUnwind

user32

SendMessageTimeoutA SystemParametersInfoA ChangeDisplaySettingsExW EnumDisplaySettingsExW EnumDisplayDevicesW

gdi32

D3DKMTQueryStatistics

ole32

CoInitializeSecurity CoSetProxyBlanket PropVariantClear CoInitialize CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantClear SysStringLen VariantInit

advapi32

ControlService RegCloseKey RegQueryValueExW RegOpenKeyExW RegDeleteTreeA RegEnumKeyExA StartServiceA QueryServiceStatusEx QueryServiceConfigA OpenServiceA OpenSCManagerA RegCreateKeyExA CloseServiceHandle ChangeServiceConfigA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegDeleteValueA RegGetValueA

powrprof

PowerReadFriendlyName PowerSetActiveScheme PowerGetActiveScheme PowerWriteDCValueIndex PowerWriteACValueIndex PowerWriteFriendlyName PowerWriteDescription PowerDuplicateScheme PowerDeleteScheme PowerEnumerate

iphlpapi

GetAdaptersAddresses

dxgi

CreateDXGIFactory1

wlanapi

WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanOpenHandle

Name

.text

Size

809KB

Virtual Size

809KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

188KB

Virtual Size

187KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

resources/PawnIO_setup.exe

IMPHASH 2dc7f4df09d86c9712fe5fb25a98b9c0
SHA256 1f519a22e47187f70a1379a48ca604981c4fcf694f4e65b734aaa74a9fba3032
MD5 956e73fc2a40945bc66af3a3ff963371
SHA1 096660b9e3aeff0547dfc621c03953852afd4629
SHA512 9415a97341dfc69d34c4f7f5081e70782ba712d8ea7d0c2ea2b44a0e90b1567cd53e400b3d29562b723d3763e0ff00116e97e2072d3fefc3a1821413aa937afd
SSDEEP 98304:kvJ5ux3qNj0iINNFe4TBGOzq2j29hGny1xdb+16w:kvrux3m0iGcqjljCo4d6Uw
TLSH
T12EF51233D2E1B198CD95C7F0D6285DA25CEEBC45CBE57CEBC783A3292666AD09130706
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Digest

53:30:8f:04:43:5b:2d:9d:d5:b0:0c:37:89:dd:2c:61:59:09:23:88:2d:26:52:25:9b:dc:32:2d:77:2e:6c:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=namazso.eu,O=namazso,L=Debrecen,C=HU,1.2.840.113549.1.9.1=#0c1061646d696e406e616d617a736f2e6575

Chains

Mar 15, 2026

CN=namazso.eu,O=namazso,L=Debrecen,C=HU,1.2.840.113549.1.9.1=#0c1061646d696e406e616d617a736f2e6575

CN=GLOBALTRUST 2015 CODESIGNING 1,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

CN=GLOBALTRUST 2015,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Subject

CN=namazso.eu,O=namazso,L=Debrecen,C=HU,1.2.840.113549.1.9.1=#0c1061646d696e406e616d617a736f2e6575

Serial Number

4f:3d:79:e2:3f:36:fc:99:9c:b6:22

Issuer

CN=GLOBALTRUST 2015 CODESIGNING 1,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageKeyEncipherment, KeyUsageDataEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 2, 2024 - Aug 5, 2027

Subject

CN=GLOBALTRUST 2015 CODESIGNING 1,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Serial Number

01:f9:c5:34:2a:d3:cb:20:65:93:e4:ce:56

Issuer

CN=GLOBALTRUST 2015,OU=GLOBALTRUST Certification Service,O=e-commerce monitoring GmbH,L=Wien,ST=Wien,C=AT

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 25, 2016 - Jun 10, 2040

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:7A1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5b:4a:b5:8d:41:32:6d:dc:74:00:00:00:00:00:5b

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 8, 2026 - Jan 7, 2027

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

LdrAccessResource LdrFindResource_U LdrGetDllHandle LdrGetProcedureAddress LdrLoadDll NtClose NtCreateFile NtCreateKey NtDeleteKey NtOpenFile NtOpenKey NtQueryDirectoryFile NtQueryInformationFile NtQueryValueKey NtReadFile NtSetInformationFile NtSetValueKey NtTerminateProcess NtWriteFile RtlAllocateHeap RtlAppendUnicodeStringToString RtlExpandEnvironmentStrings_U RtlFreeHeap RtlNtStatusToDosError RtlRandomEx __chkstk _snprintf _snwprintf _vsnwprintf _wcsicmp iswspace memcpy memmove memset sscanf wcscmp wcscpy wcslen wcsncpy wcsstr

comctl32

ord413 InitCommonControlsEx ord410

setupapi

SetupDiCallClassInstaller SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceRegistryPropertyW

newdev

UpdateDriverForPlugAndPlayDevicesW

user32

BeginPaint CreateWindowExW DefWindowProcW DialogBoxParamW DispatchMessageW EndDialog EndPaint GetDC GetDlgItem GetMessageW GetWindowLongPtrW GetWindowRect InvalidateRect LoadCursorW LoadIconW MessageBoxW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageW SetWindowLongPtrW ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UpdateWindow

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreateDIBitmap DeleteDC DeleteObject GdiAlphaBlend GetBitmapBits GetObjectW SelectObject

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

FPSDoctor_1.5.0_x64-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UserInfo.dll

advapi32

kernel32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

FPSDoctor.exe

kernel32

advapi32

oleaut32

bcryptprimitives

ntdll

shell32

user32

ole32

api-ms-win-core-synch-l1-2-0

shlwapi

comctl32

gdi32

dwmapi

api-ms-win-core-winrt-l1-1-0

crypt32

ws2_32

bcrypt

iphlpapi

psapi

dxgi

wintrust

api-ms-win-crt-math-l1-1-0