293ce2f598314e1aa63558dccc50b3bbafda940d173e2f0302ea81454599c87c

Sharing

Copy URL Twitter E-mail

General

Target
293ce2f598314e1aa63558dccc50b3bbafda940d173e2f0302ea81454599c87c
Size 4.1MB
Sample260916-2ydfdswflf
SHA256 293ce2f598314e1aa63558dccc50b3bbafda940d173e2f0302ea81454599c87c
MD5 ac5ace985f707186a510c2517a61e1e5
SHA1 8ad685e0c52495e14cffad810348ca4e351d2942
SHA512 bd4a405e0617b28b9c11b1e612c78162f1572cdcb15cda0a2ff63ee1104fe75b5c3db04f435f90126330b27431a9c7e085f5640ea9d242b0e8d9a726a812998a
SSDEEP 98304:fLglSMiYtdcGc2ijFhIwnogPBkUba3vuhcWbjvgLOHnD6:fLglSOSjFheWpcWbjvgSHD6
TLSH
T1B41633A16DDA2C1ECD3FADF5D625C3765615C7FBC159B936E28A31B2A0D81408A3CB0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
293ce2f598314e1aa63558dccc50b3bbafda940d173e2f0302ea81454599c87c
unpack001/$PLUGINSDIR/Math.dll
unpack001/$PLUGINSDIR/NSISFastLib.dll
unpack001/$PLUGINSDIR/ShellExecAsUser.dll
unpack001/$PLUGINSDIR/SimpleSC.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsJSON.dll

File Explorer

293ce2f598314e1aa63558dccc50b3bbafda940d173e2f0302ea81454599c87c

.exe 4.1MB
$PLUGINSDIR/AutoUpdater.exe

.exe 915KB
$PLUGINSDIR/Math.dll

.dll 67KB
$PLUGINSDIR/NSISFastLib.dll

.dll 767KB
$PLUGINSDIR/PCAppStore.exe

.exe 5.2MB
$PLUGINSDIR/PCAppStoreSRV.exe

.exe 258KB
$PLUGINSDIR/ShellExecAsUser.dll

.dll 43KB
$PLUGINSDIR/SimpleSC.dll

.dll 1.1MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/UAC.dll

.dll 14KB
$PLUGINSDIR/UserInfo.dll

.dll 4KB
$PLUGINSDIR/Watchdog.exe

.exe 321KB
$PLUGINSDIR/inetc.dll

.dll 38KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsJSON.dll

.dll 23KB
$PLUGINSDIR/wimage.bmp

25KB
ReadMe.txt

146B
pcappstore.ico

31KB

293ce2f598314e1aa63558dccc50b3bbafda940d173e2f0302ea81454599c87c

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 293ce2f598314e1aa63558dccc50b3bbafda940d173e2f0302ea81454599c87c
MD5 ac5ace985f707186a510c2517a61e1e5
SHA1 8ad685e0c52495e14cffad810348ca4e351d2942
SHA512 bd4a405e0617b28b9c11b1e612c78162f1572cdcb15cda0a2ff63ee1104fe75b5c3db04f435f90126330b27431a9c7e085f5640ea9d242b0e8d9a726a812998a
SSDEEP 98304:fLglSMiYtdcGc2ijFhIwnogPBkUba3vuhcWbjvgLOHnD6:fLglSOSjFheWpcWbjvgSHD6
TLSH
T1B41633A16DDA2C1ECD3FADF5D625C3765615C7FBC159B936E28A31B2A0D81408A3CB0C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/AutoUpdater.exe

IMPHASH cbc539a50cd7367f282684d851a5a9a5
SHA256 81bbaba8a71a66ead9e6a9289293d47933234c30d5f91e698bac537880f51732
MD5 571e9c38b9eece59ed4a9005196a9233
SHA1 d456e4ea57ecd840cb704100369f5796920492a5
SHA512 51e268d36bd2277f6b7bfb2054300d32980a2ad7177077ab03c4783fb744c2209b949db35e91f6d8fd9959b7f9eac23d8a4c01faf493c4db981414550ca5dd84
SSDEEP 12288:SxhBec51alq+09HngMmP4zUKLxf36tRg6BJPBy/WeatX+a:S/B+4Ys76zPByra1+a
TLSH
T12A154A5FA6A901E5D0BAD1388582A11BFAB074AB4330A7C753D25A573F73AF09D3E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

34:33:2c:46:45:1e:7d:99:11:4a:7b:81:59:86:50:17:c0:c6:17:98:04:32:e3:d6:2f:48:0e:0e:c2:c4:3c:5e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Feb 26, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

489484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2027c_D20260226T114902\fa_rss\Release\AutoUpdater.pdb

kernel32

HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection SetEvent WaitForSingleObject CreateEventW OpenEventW TerminateProcess HeapDestroy CreateProcessW GetTickCount64 FindResourceExW LoadResource LockResource SizeofResource FindResourceW CopyFileW FreeLibrary GetProcAddress LoadLibraryW MultiByteToWideChar HeapAlloc GetLastError CloseHandle DecodePointer GetCurrentDirectoryW FreeEnvironmentStringsW GetExitCodeProcess GetEnvironmentStringsW SetEndOfFile WriteConsoleW CreateFileW SetStdHandle GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW DeleteFileW FindFirstFileW GetModuleFileNameW GetFileAttributesW CreateDirectoryW FindClose FindNextFileW RemoveDirectoryW GetCurrentProcessId GetCommandLineW SetEnvironmentVariableW WideCharToMultiByte GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId EnterCriticalSection LeaveCriticalSection LocalFree GetLocaleInfoEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW CompareStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW RtlUnwind

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

winhttp

WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpOpenRequest WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpReadData

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

wininet

HttpQueryInfoW InternetCloseHandle InternetOpenUrlW InternetOpenW InternetReadFile InternetCheckConnectionW

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx CoSetProxyBlanket CoInitializeSecurity CoCreateInstance

oleaut32

SysFreeString VariantClear VariantInit SysAllocString

Name

.text

Size

673KB

Virtual Size

672KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/Math.dll

IMPHASH 82274a6f12e4098899c6a675f5ce59d0
SHA256 8d9a23dd2004b68c0d2e64e6c6ad330d0c648bffe2b9f619a1e9760ef978207a
MD5 85428cf1f140e5023f4c9d179b704702
SHA1 1b51213ddbaedfffb7e7f098f172f1d4e5c9efba
SHA512 dfe7f9f3030485caf30ec631424120030c3985df778993342a371bf1724fa84aa885b4e466c6f6b356d99cc24e564b9c702c7bcdd33052172e0794c2fdecce59
SSDEEP 1536:GUZ9QC7V7IGMp2ZmtSX5p9IeJXlSM2tS:T97WSth5lwt
TLSH
T174639D2276E480F2D09E81B125955F1B9B7CA63087E64DD35F622C86AE30EE1F237707
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISFastLib.dll

IMPHASH 146663ca875b0a7793e3d7db9fd274e6
SHA256 e05789721d4115a14bfa28fafdcad1c34d9c56fb5f9d28558ac86a2137d5f739
MD5 0d7ab8b5e790b5f0830fd6f573f14c5a
SHA1 cb8fa4aa470656c4008d81df524fb5ef418a6821
SHA512 1f5ee23c85cb3005e0acd0b95df66dbbe14dbe86a60bf51d4154449a51b71f52cccf0529e86bc7f6609df57c08352079e5879f1b2cd1b7a7f4fd462eeb9dd06c
SSDEEP 12288:BobF5LGf+EFY9L5rvg/BcWENEroPmNAnjPrOl4NEvaUniKlHnI:S6GEF+F7g/BcWEHuAnjPrOyCiUiKt
TLSH
T1C9F47D313685C43AD96B05B27DAEDBDA52BC7A700B70D4CBB3841E9EEB751819726303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

275806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FindResourceW HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap LocalFree WideCharToMultiByte ExpandEnvironmentStringsA TerminateProcess WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle lstrcpynW MultiByteToWideChar GlobalAlloc GlobalFree lstrcpyW GetUserDefaultUILanguage LCIDToLocaleName LoadResource QueryFullProcessImageNameW GetCurrentThreadId CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwind FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetFileSizeEx SetFilePointerEx GetStdHandle FindResourceExW HeapReAlloc LockResource GetLastError HeapSize InitializeCriticalSectionEx HeapFree GetCurrentProcessId SizeofResource GetFileType FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW SetEndOfFile WriteConsoleW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW FindClose CreateFileW SetStdHandle GetTimeZoneInformation SetEnvironmentVariableW FindFirstFileExW FindNextFileW FreeEnvironmentStringsW GetEnvironmentStringsW IsValidCodePage GetCommandLineW GetACP GetCommandLineA GetOEMCP ExitThread

user32

CallNextHookEx UnhookWindowsHookEx GetForegroundWindow IsChild DispatchMessageW IsWindow SetWindowsHookExW PostThreadMessageW WindowFromPoint wsprintfW PostQuitMessage ScreenToClient GetMessageW TranslateMessage GetCursorPos GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext MonitorFromPoint

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryValueExW GetAce EqualSid GetNamedSecurityInfoW ConvertStringSidToSidW RegCloseKey

ole32

CoSetProxyBlanket CoInitializeSecurity CoInitialize CoCreateInstance CoUninitialize

oleaut32

VariantInit SysStringLen SetErrorInfo GetErrorInfo SysFreeString VariantClear SysAllocString

shlwapi

PathFindFileNameW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpOpen WinHttpSendRequest

sspicli

GetUserNameExW

api-ms-win-core-synch-l1-1-0

TryAcquireSRWLockExclusive ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetCurrentProcess

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-localization-l1-2-0

LCMapStringEx GetCPInfo GetLocaleInfoEx

api-ms-win-core-string-l1-1-0

CompareStringEx GetStringTypeW

api-ms-win-core-util-l1-1-0

EncodePointer

wininet

HttpSendRequestW InternetOpenW InternetCloseHandle HttpOpenRequestW InternetConnectW InternetOpenUrlW InternetReadFile

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-memory-l1-1-0

VirtualQuery

Name

.text

Size

624KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/PCAppStore.exe

IMPHASH 80b47e87db0df52795ff4b375d587fd0
SHA256 4c91f971d692d1264a5f77dbc27bf9263ff78f1e12d7e8f5a96988020798ba55
MD5 7e3f1e056c8d6627b3ea9df0928bd6f9
SHA1 5af0f0499b2c2f1c91afb14672aef2dc83400461
SHA512 0c5bbe75a27ffa07b567a3de76e822559426699a867e396078dbec6c50b445d9e40c219d5bb3546d05a31453bdf5bec6f9cbded64e7600ac1f879f7c4021a2d7
SSDEEP 49152:WzB6w4sPZsJv6M3TBGSfGNBJWHYQ1OyBzz3TQptW:Syg4OJWC
TLSH
T10146C55AEA6541E1C4F9C03DC593622FF87138A68330A7D7A681AB175B337E4E93E740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

b0:42:80:d1:11:f6:12:2a:fc:25:db:3f:cc:34:be:09:e1:9a:07:35:a3:a2:fc:81:75:14:7f:18:fe:82:81:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Feb 26, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3253144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2027c_D20260226T114902\fa_rss\Release\PCAppStore.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

urlmon

CreateUri URLDownloadToFileW

kernel32

CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW LocalFree CreateDirectoryW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW HeapDestroy HeapReAlloc HeapSize GetTickCount64 FindResourceExW VerSetConditionMask FindClose FindFirstFileExW FindNextFileW GetFileAttributesW ReadFile RemoveDirectoryW CreateProcessW OpenProcess VerifyVersionInfoW LCIDToLocaleName GetUserDefaultUILanguage GetLocaleInfoEx GetConsoleOutputCP K32EnumProcessModules K32GetModuleBaseNameW GetStartupInfoW GetTickCount CopyFileA IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenMutexW OpenFileMappingW MapViewOfFile GetStdHandle GetEnvironmentVariableA SetCurrentDirectoryW FindFirstFileW GetCurrentProcess GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime lstrcmpA FileTimeToSystemTime FlushFileBuffers QueryPerformanceCounter CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapCompact GetSystemInfo DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI SetEnvironmentVariableW WaitForMultipleObjects LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock LoadLibraryExW GetEnvironmentVariableW GetCommandLineA GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter Sleep SetUnhandledExceptionFilter IsProcessorFeaturePresent TerminateProcess RtlPcToFileHeader GetCommandLineW RtlUnwindEx GetModuleFileNameW CreateEventW ResetEvent InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread GetEnvironmentStringsW FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FindResourceW SizeofResource LockResource LoadResource WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId FlsAlloc FlsGetValue FlsSetValue GetProcessHeap FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetEvent ReadConsoleW SetFilePointerEx GetFileSizeEx CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex InitializeCriticalSection ReleaseSemaphore WriteConsoleW FreeEnvironmentStringsW HeapAlloc HeapFree SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent DeleteFileW GetOEMCP GetACP IsValidCodePage RtlUnwind RaiseException GetConsoleMode SetStdHandle EnterCriticalSection EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetTimeZoneInformation

user32

RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW UpdateWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty FillRect AdjustWindowRectEx GetClientRect SetWindowTextW GetWindowPlacement UnregisterClassW CreatePopupMenu TrackMouseEvent DestroyMenu GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu TrackPopupMenu LoadIconW MonitorFromWindow LoadCursorW EqualRect InvalidateRect EndPaint BeginPaint ShowWindow DestroyWindow CreateWindowExW RegisterClassW PostQuitMessage EmptyClipboard FindWindowExW UnhookWinEvent GetClassInfoExW GetForegroundWindow keybd_event GetCapture SetCapture PtInRect SetClipboardData SetClassLongPtrW OpenClipboard CloseClipboard ChangeWindowMessageFilterEx GetShellWindow SetCursorPos GetWindowTextW SetWindowPos GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows WindowFromPoint ScreenToClient GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect DialogBoxParamW MonitorFromPoint SystemParametersInfoW GetWindow GetWindowThreadProcessId GetClassNameW EnumWindows ReleaseDC GetDC SendInput EndDialog IsWindowVisible SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer IsIconic SetForegroundWindow SetFocus IsWindow GetWindowRect ReleaseCapture PostMessageW OpenIcon SetWindowPlacement SetWindowLongPtrW DefWindowProcW IsZoomed

gdi32

CreateCompatibleBitmap CreateCompatibleDC DeleteDC SelectObject DeleteObject CreateSolidBrush BitBlt

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

EventUnregister RegGetValueW EventWriteTransfer EventSetInformation EventRegister RegNotifyChangeKeyValue RegCreateKeyExW GetUserNameW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey

shell32

SHEmptyRecycleBinW SHQueryRecycleBinW SHGetFolderPathW SHGetKnownFolderPath SHAppBarMessage ShellExecuteW ShellExecuteExW Shell_NotifyIconW CommandLineToArgvW

ole32

RevokeDragDrop CoTaskMemAlloc OleInitialize CoSetProxyBlanket CoInitializeSecurity OleRun CoInitialize CoCreateInstance RegisterDragDrop CoInitializeEx CoTaskMemFree CoUninitialize CoCreateFreeThreadedMarshaler CoAllowSetForegroundWindow

oleaut32

VariantInit VariantChangeType SysFreeString SysAllocString SysStringLen VariantClear GetErrorInfo SetErrorInfo

iphlpapi

IcmpCloseHandle IcmpCreateFile

winhttp

WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSetOption WinHttpQueryHeaders WinHttpReceiveResponse

crypt32

CryptMsgClose CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptDecodeObjectEx CryptDecodeObject CryptMsgOpenToDecode CryptMsgUpdate CryptMsgGetParam

ws2_32

WSAConnectByNameW closesocket recv send shutdown socket WSAStartup WSACleanup WSAGetLastError

sspicli

QueryContextAttributesW DecryptMessage EncryptMessage FreeContextBuffer FreeCredentialsHandle ApplyControlToken DeleteSecurityContext InitializeSecurityContextW AcquireCredentialsHandleW

ext-ms-win-networking-wlanapi-l1-1-0

WlanCloseHandle WlanFreeMemory WlanGetAvailableNetworkList WlanEnumInterfaces WlanOpenHandle

wlanapi

WlanScan WlanRegisterNotification WlanAllocateMemory

shlwapi

PathCreateFromUrlW PathFindFileNameW AssocCreate PathAddBackslashW SHCreateStreamOnFileEx UrlCreateFromPathW PathRenameExtensionW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

gdiplus

GdipCreateMatrix GdipCloneBrush GdipSetStringFormatAlign GdipDeleteStringFormat GdipDeleteBrush GdipCreateSolidFill GdipDisposeImage GdipCreateBitmapFromHBITMAP GdiplusStartup GdipCreateStringFormat GdiplusShutdown GdipDrawString GdipAlloc GdipCloneImage GdipFree GdipFlush GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDeleteMatrix

msi

ord70 ord45 ord92 ord8 ord32 ord159 ord160 ord118

wininet

InternetCloseHandle InternetConnectW InternetReadFile InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetCheckConnectionW InternetOpenW

setupapi

SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

839KB

Virtual Size

839KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

185KB

Virtual Size

317KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/PCAppStoreSRV.exe

IMPHASH ac7c0c6bb9aca484a889d798afa78638
SHA256 7cb70c6eb089ac8bd3e5a126d656bbd421b476fa289347979ab4c3f897305f25
MD5 0f372242fcbf6dbb726cafbd2397cb69
SHA1 9c3fb8cbefccff07ede6cb21f2f91413f6a27321
SHA512 462bf6033ed47093795d62e7b632ff88073a993cbbc7f138a9f57d32d684dca67827b1624823e3b3f04cc6da1cf6cf998f485a07f01ca691afec5f4fa3159963
SSDEEP 3072:JLWxTWOzlSMRGc09gsXRKAsqRDtC2UpyZysX5mflgHP0oB0sWAn:slWOgwZ09gEs63iKPasHn
TLSH
T145448C5AB2940CEDCE3B94B1D8124596E732B8ED8780F9CF53E522B65E935E05E3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

4f:5f:ce:94:62:82:10:3c:28:87:00:35:09:da:95:dd:b1:91:a6:54:09:ca:81:5a:c9:d8:02:e8:bb:8c:f7:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Feb 26, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

42148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2027c_D20260226T114902\fa_rss\Release\AppStoreSRV.pdb

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

kernel32

GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetFileAttributesW DeleteFileW FindFirstFileW FindClose FindNextFileW RemoveDirectoryW CopyFileW MultiByteToWideChar HeapAlloc ReleaseMutex CreateMutexW CreateEventW CreateFileMappingW MapViewOfFile WaitForMultipleObjects UnmapViewOfFile InitializeCriticalSectionEx DeleteCriticalSection GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapFree HeapReAlloc HeapSize HeapDestroy LocalAlloc GetCurrentProcess WaitForSingleObject CloseHandle GetExitCodeProcess TerminateProcess LocalFree GetCommandLineW GetLastError CreateFileW WriteConsoleW SetEvent GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx Sleep GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency SleepConditionVariableSRW WakeAllConditionVariable GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte

user32

wsprintfW

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW CreateProcessAsUserW GetLengthSid SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx RegCloseKey RegQueryValueExW RegOpenKeyExW ConvertSidToStringSidW GetTokenInformation

shell32

CommandLineToArgvW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/ShellExecAsUser.dll

IMPHASH 2302ef28d4d10b9da0f914a5921f3f3e
SHA256 1f17e4d5ffe7b2c9a396ee9932ac5198f0c050241e5f9ccd3a56e576613d8a29
MD5 552cba3c6c9987e01be178e1ee22d36b
SHA1 4c0ab0127453b0b53aeb27e407859bccb229ea1b
SHA512 9bcf47b62ca8ffa578751008cae523d279cdb1699fd916754491899c31ace99f18007ed0e2cbe9902abf132d516259b5fb283379d2fead37c76b19e2e835e95a
SSDEEP 768:SA49ATJ9ONLkh9J5lDYDzG8yVAf7hiJFkkAqnTEDlV4vihdk:SA4CJ9OFpXf0AfNiTkIMrhdk
TLSH
T19B135A0072A184B6E577553459B497A24B6EBD016AF4808B3FBE13BE5FB16C09B3C363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

OutputDebugStringW GetModuleHandleW GetVersionExW lstrcpynW lstrcmpW RaiseException GetProcAddress CreateEventW CloseHandle GlobalFree lstrcpyW WideCharToMultiByte SetEvent GetStringTypeW LCMapStringW HeapSize HeapReAlloc RtlUnwind GetModuleFileNameW WriteFile LoadLibraryW WaitForSingleObject MultiByteToWideChar GetCurrentProcess IsValidCodePage GetOEMCP GetACP GetCPInfo EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter ExitThread GetCurrentThreadId GetLastError CreateThread DecodePointer GetCommandLineA HeapFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement ExitProcess Sleep IsProcessorFeaturePresent HeapAlloc SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy

user32

wsprintfW DispatchMessageW DefWindowProcW CreateWindowExW DestroyWindow GetMessageW PostQuitMessage PostMessageW TranslateMessage RegisterClassExW GetWindowLongW SetWindowLongW

advapi32

OpenProcessToken GetTokenInformation

shell32

ShellExecuteW

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

shlwapi

ord176

$PLUGINSDIR/SimpleSC.dll

IMPHASH a9546246ff97b887a4072a24f9106617
SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
MD5 7b89329c6d8693fb2f6a4330100490a0
SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
TLSH
T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

989260

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

EnterCriticalSection SetFilePointer GetACP CloseHandle LocalFree SuspendThread VirtualProtect TlsAlloc GetTickCount IsDebuggerPresent GetFullPathNameW VirtualFree HeapAlloc GetStartupInfoW ExitProcess GetFileAttributesW InitializeCriticalSection GetCPInfoExW GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc RtlUnwind GetCPInfo GetCommandLineW GetSystemInfo ResumeThread GetProcAddress LeaveCriticalSection EnumSystemLocalesW GetStdHandle GetVersionExW VerifyVersionInfoW GetModuleHandleW FreeLibrary HeapCreate HeapDestroy ReadFile GetDiskFreeSpaceW VerSetConditionMask GetUserDefaultUILanguage FindFirstFileW TlsFree HeapSize lstrcpynW SetLastError GetModuleFileNameW GetLastError GlobalAlloc lstrlenW SetEndOfFile CompareStringW CreateThread HeapFree WideCharToMultiByte MultiByteToWideChar FindClose LoadLibraryA ResetEvent SetEvent CreateFileW GetLocaleInfoW GetVersion RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetLocalTime WaitForSingleObject GetCurrentThread WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue IsValidLocale TlsSetValue LoadLibraryExW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetCurrentThreadId UnhandledExceptionFilter VirtualQuery CreateEventW GlobalFree VirtualQueryEx GetThreadLocale Sleep SetThreadLocale

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

user32

CharUpperBuffW CharNextW MsgWaitForMultipleObjects FindWindowExW CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics MessageBoxW

oleaut32

SysAllocStringLen SafeArrayPtrOfIndex VariantCopy SafeArrayGetLBound SafeArrayGetUBound VariantInit VariantClear SysFreeString SysReAllocStringLen VariantChangeType SafeArrayCreate

netapi32

NetWkstaGetInfo NetApiBufferFree

advapi32

CloseServiceHandle ControlService CreateServiceW LookupAccountNameW DeleteService LsaAddAccountRights StartServiceW UnlockServiceDatabase GetServiceKeyNameW GetServiceDisplayNameW ChangeServiceConfigW LsaClose LockServiceDatabase OpenServiceW ChangeServiceConfig2W EnumDependentServicesW QueryServiceConfig2W LsaRemoveAccountRights QueryServiceStatus AdjustTokenPrivileges QueryServiceConfigW LookupPrivilegeValueW OpenSCManagerW LsaOpenPolicy OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey

Name

.text

Size

956KB

Virtual Size

956KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

490B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/UserInfo.dll

IMPHASH 5e62e8e248e7364886b604bd1fcf4c13
SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
MD5 2f69afa9d17a5245ec9b5bb03d56f63c
SHA1 e0a133222136b3d4783e965513a690c23826aec9
SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
TLSH
T1818162BB93B00CF3D0A44B7B44A71CE762B6DD301762001F4A478AA92591B67EE7EB15
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Watchdog.exe

IMPHASH 00428d82fc45512e4dbbb854af072e4a
SHA256 2faa61fe990870af8104b26832801c4882902d9bcd7725700c57b33fb1a3928b
MD5 80c697bee1e0c52329e1571f0575a5b1
SHA1 f99a8855f01e2d9bb47600ffe7caa3a9a464102f
SHA512 82ffa2b284177ed8994c9cf149ec104376504909303588b6b8caaf3ac0060db08bc4e12fa30c00c0f5531ed82ad93c7f25c655f0b82597517a1797ad35695149
SSDEEP 3072:yK6EwyF5+wnyIv+mWOX4SVeyJ8Jnovk0s2GSOIAI/5ODuKsJEGFiDl4/t5ipqH0u:HE8Gosx2GSH/vpTHas//
TLSH
T16B644B4BAAA408F5CDBBD07DD942101AF97178E68360E7CB9391195B1F63BE4AD3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

36:cf:0a:28:91:1c:b6:07:68:d3:5c:61:0c:af:d7:9d:22:50:86:f4:6c:4c:f5:df:b4:6f:da:9c:58:40:8f:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Feb 26, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

93308

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2027c_D20260226T114902\fa_rss\Release\Watchdog.pdb

urlmon

URLDownloadToFileW

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect

kernel32

GetConsoleOutputCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW CreateFileW GetFileSize ReadFile CloseHandle GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetConsoleMode DeleteCriticalSection SetEvent CreateEventW OpenEventW FindResourceExW GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW LocalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW WaitForSingleObject Sleep GetCommandLineA GetOEMCP GetACP WriteConsoleW InitializeCriticalSectionEx AcquireSRWLockExclusive IsValidCodePage SetFilePointerEx GetStringTypeW LCMapStringW QueryPerformanceCounter QueryPerformanceFrequency FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId GetSystemTimeAsFileTime IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RtlUnwindEx SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW SetEnvironmentVariableW GetCPInfo ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket

oleaut32

VariantClear SysFreeString SysAllocString

Name

.text

Size

179KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/inetc.dll

IMPHASH a6901edc54b2da8c27f3fbfe82670720
SHA256 a793929232afb78b1c5b2f45d82094098bcf01523159fad1032147d8d5f9c4df
MD5 a35cdc9cf1d17216c0ab8c5282488ead
SHA1 ed8e8091a924343ad8791d85e2733c14839f0d36
SHA512 0f15b00d0bf2aabd194302e599d69962147b4b3ef99e5a5f8d5797a7a56fd75dd9db0a667cfba9c758e6f0dab9ced126a9b43948935fe37fc31d96278a842bdf
SSDEEP 384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
TLSH
T17903E7419BE8456BF7F61638B0B99A53896D7C304769C8DB87134F8918A23C7EE34323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4191

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb

wininet

FtpOpenFileW InternetErrorDlg HttpQueryInfoW HttpEndRequestW HttpSendRequestExW HttpSendRequestW HttpAddRequestHeadersW HttpAddRequestHeadersA HttpOpenRequestW FtpCreateDirectoryW InternetCrackUrlW InternetGetLastResponseInfoW InternetSetOptionW InternetQueryOptionW InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectW InternetCloseHandle InternetOpenW

comctl32

ord17

kernel32

GlobalAlloc WideCharToMultiByte MultiByteToWideChar lstrlenW lstrlenA lstrcatW lstrcpyW lstrcpynW lstrcmpW GlobalFree LocalFree LocalAlloc LoadLibraryA GetProcAddress GetModuleHandleW GetTickCount TerminateThread CreateThread SleepEx MulDiv lstrcmpiW CreateFileA CreateFileW DeleteFileW GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError WaitForSingleObject

user32

SetDlgItemTextW SendDlgItemMessageW SetTimer KillTimer EnableWindow UpdateWindow RedrawWindow SetWindowTextW GetWindowTextW GetClientRect IsWindowVisible GetWindowRect MessageBoxW GetWindowLongW SetWindowLongW GetParent FindWindowExW LoadIconW IsDialogMessageW SystemParametersInfoW GetDlgItem wsprintfA wsprintfW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW IsWindow DestroyWindow ShowWindow SetWindowPos CreateDialogParamW

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsJSON.dll

IMPHASH 674631b5b86309caa1d0df66c91a50f2
SHA256 64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb
MD5 f4d89d9a2a3e2f164aea3e93864905c9
SHA1 4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a
SHA512 dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2
SSDEEP 384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
TLSH
T1D4B21746A6B054F4F57B55BAB4322E232E7EBD08286095EFC73319196860913BB3D333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11845

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

293ce2f598314e1aa63558dccc50b3bbafda940d173e2f0302ea81454599c87c

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/AutoUpdater.exe

kernel32

rpcrt4

winhttp

version

wininet

advapi32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/Math.dll

kernel32

generic

$PLUGINSDIR/NSISFastLib.dll

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

api-ms-win-shcore-scaling-l1-1-1

winhttp

sspicli

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

wininet

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-memory-l1-1-0

generic

$PLUGINSDIR/PCAppStore.exe

version

urlmon

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

winhttp

crypt32

ws2_32

sspicli

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

shlwapi

api-ms-win-shcore-scaling-l1-1-1

dwmapi

wtsapi32

gdiplus