0ac532d91c24fdcf849481786cfc8ae05938e3eb8f72e478b30668aaf5ff0ffb

Sharing

Copy URL Twitter E-mail

General

Target
0ac532d91c24fdcf849481786cfc8ae05938e3eb8f72e478b30668aaf5ff0ffb
Size 4.5MB
Sample260916-xf2ytavamd
SHA256 0ac532d91c24fdcf849481786cfc8ae05938e3eb8f72e478b30668aaf5ff0ffb
MD5 019ba4dd7faa2aba18074b1ec23b2dc8
SHA1 af1b2183271712f1e13c8630cdeb8db97ecda186
SHA512 d370faf21d96f15c023d3436abaf6918cb10659c0a109ebcb5aacc3bfae725103f4ad549f1927f9e44c3f2c03c6f72c63f9daf533b91013098e379451384bd73
SSDEEP 98304:qh4ZROqhOH/Ni6d3W/hP4bpEt2TEQccxWbyyQn/xW2ig7ADi:quZROxH/U6dG+JzxWby3nY2ixDi
TLSH
T12E263362D520CEABEC756CF01AFE0165229ECBD5A5093893B1A13F8D39C3516CB5CE4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
0ac532d91c24fdcf849481786cfc8ae05938e3eb8f72e478b30668aaf5ff0ffb
unpack001/$PLUGINSDIR/NSISFastLib.dll
unpack001/$PLUGINSDIR/ShellExecAsUser.dll
unpack001/$PLUGINSDIR/SimpleSC.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsJSON.dll

File Explorer

0ac532d91c24fdcf849481786cfc8ae05938e3eb8f72e478b30668aaf5ff0ffb

.exe 4.5MB
$PLUGINSDIR/AutoUpdater.exe

.exe 1.1MB
$PLUGINSDIR/NSISFastLib.dll

.dll 797KB
$PLUGINSDIR/PCAppStore.exe

.exe 5.3MB
$PLUGINSDIR/PCAppStoreSRV.exe

.exe 598KB
$PLUGINSDIR/ShellExecAsUser.dll

.dll 43KB
$PLUGINSDIR/SimpleSC.dll

.dll 1.1MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/UAC.dll

.dll 14KB
$PLUGINSDIR/UserInfo.dll

.dll 4KB
$PLUGINSDIR/Watchdog.exe

.exe 807KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsJSON.dll

.dll 23KB
$PLUGINSDIR/wimage.bmp

25KB
ReadMe.txt

146B
pcappstore.ico

16KB

0ac532d91c24fdcf849481786cfc8ae05938e3eb8f72e478b30668aaf5ff0ffb

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 0ac532d91c24fdcf849481786cfc8ae05938e3eb8f72e478b30668aaf5ff0ffb
MD5 019ba4dd7faa2aba18074b1ec23b2dc8
SHA1 af1b2183271712f1e13c8630cdeb8db97ecda186
SHA512 d370faf21d96f15c023d3436abaf6918cb10659c0a109ebcb5aacc3bfae725103f4ad549f1927f9e44c3f2c03c6f72c63f9daf533b91013098e379451384bd73
SSDEEP 98304:qh4ZROqhOH/Ni6d3W/hP4bpEt2TEQccxWbyyQn/xW2ig7ADi:quZROxH/U6dG+JzxWby3nY2ixDi
TLSH
T12E263362D520CEABEC756CF01AFE0165229ECBD5A5093893B1A13F8D39C3516CB5CE4B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/AutoUpdater.exe

IMPHASH e94a3b508e55004d0726da199f228c89
SHA256 5bcde7518a88bb7c805d5b84433e370209755337558f9c92f2b3ed7323d17ae5
MD5 f7bbbd0f01f809d83081060da1333580
SHA1 9a9b40229342bcd40c2054a3126692feb94ab719
SHA512 fd317431326553493e2cc71482fe0d09d29d914deb6ab6173ef93d1bc32d84a373bb37939f7333619f8a56c94088fb5cbfb179c110320ade7be2110417df55f4
SSDEEP 24576:g6Gs8trn4IOsbcClpyPf4syIeh0lhSMXlgQK:g6Gs8V4bClm4sbL
TLSH
T11E357D1AE7A802F9D0BAD178C657651AFD713C86837167C70780BA661F376E06E3E702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

45:ae:85:84:09:49:f0:34:2f:2f:7b:0b:e4:c6:04:db:82:3a:0b:67:55:55:b1:9c:80:8f:0d:56:b5:66:bb:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Apr 3, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

546204

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2042d_D20260403T104826\fa_rss\Release\AutoUpdater.pdb

ws2_32

WSACleanup closesocket shutdown WSAStartup WSAConnectByNameW send socket recv WSAGetLastError

winhttp

WinHttpConnect WinHttpQueryHeaders WinHttpReadData WinHttpSetOption WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts

secur32

FreeContextBuffer QueryContextAttributesW AcquireCredentialsHandleW FreeCredentialsHandle DecryptMessage ApplyControlToken EncryptMessage DeleteSecurityContext InitializeSecurityContextW

advapi32

RegCreateKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

CommandLineToArgvW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

kernel32

GetConsoleMode SetEndOfFile GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW ReadFile VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc WriteFile GetStdHandle ExitProcess GetModuleHandleExW GetFileSizeEx SetFilePointerEx ReadConsoleW IsValidCodePage RtlUnwind FreeLibraryAndExitThread WriteConsoleW CreateFileW SetStdHandle GetCommandLineA ExitThread CreateThread LoadLibraryExW TlsFree GetEnvironmentStringsW FreeEnvironmentStringsW DecodePointer CloseHandle GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection SetEvent WaitForSingleObject CreateEventW OpenEventW TerminateProcess GetExitCodeProcess CreateProcessW GetTickCount64 CopyFileW FreeLibrary GetProcAddress LoadLibraryW SizeofResource LockResource FindResourceExW LoadResource FindResourceW MultiByteToWideChar WideCharToMultiByte GetSystemFirmwareTable Sleep DeleteFileW CreateDirectoryW FindFirstFileW FindFirstFileExW FindNextFileW ExpandEnvironmentStringsW RemoveDirectoryW GetModuleFileNameW FindClose GetFileAttributesW SetEnvironmentVariableW GetCommandLineW LocalFree FormatMessageW TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GetACP RtlUnwindEx RtlPcToFileHeader GetOEMCP GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread SleepConditionVariableSRW WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetCurrentProcess

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

Name

.text

Size

736KB

Virtual Size

735KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

285KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/NSISFastLib.dll

IMPHASH 2f0b757f2ae49d3065dd7d71242e7c9f
SHA256 43880442ecd1d9d4bad5b8ac1c8e638578555410d0eebcead5283b853941f1ec
MD5 3607da60855c994ad3a9df5d9e54ab6b
SHA1 c120f20813269ae32288c576a15d6ccf02697306
SHA512 7b110cf8e4bc346f068f7d1e5065ee980f6497be69fa5cc4e41f4efed0f5ddd3fabb05d5514b008b14215894206747d4cc548d304ea6438168e20abd49bcc782
SSDEEP 12288:1+Oy1TV5BSQTsrrqt4BZzjqr+tMOs0jCVV40fKX9Nc81qXg4I3PRq:0RZV5Lsat4BZzjdMOkV40fKX7B1Qg4e
TLSH
T18D056C343A46C43AD96B05B2ADAEEEDB12BC76700B70D4D7B7841EADE6750819723313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

288599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap LocalFree WideCharToMultiByte ExpandEnvironmentStringsA TerminateProcess WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle lstrcpynW MultiByteToWideChar GlobalAlloc GlobalFree lstrcpyW GetUserDefaultUILanguage LCIDToLocaleName GetCurrentProcessId QueryFullProcessImageNameW HeapAlloc GetSystemFirmwareTable CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwind FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetFileSizeEx SetFilePointerEx FindResourceW LoadResource FindResourceExW HeapReAlloc LockResource GetLastError HeapSize InitializeCriticalSectionEx HeapFree GetStdHandle GetFileType GetCurrentThreadId FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect SetEndOfFile WriteConsoleW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW SizeofResource FindClose FindFirstFileExW CreateFileW SetStdHandle GetTimeZoneInformation SetEnvironmentVariableW FindNextFileW IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetACP GetCommandLineW GetOEMCP GetCommandLineA ExitThread

user32

ScreenToClient wsprintfW GetMessageW CallNextHookEx WindowFromPoint IsWindow DispatchMessageW SetThreadDpiAwarenessContext MonitorFromPoint GetThreadDpiAwarenessContext GetCursorPos IsChild GetForegroundWindow TranslateMessage PostThreadMessageW SetWindowsHookExW UnhookWindowsHookEx

advapi32

RegQueryValueExW GetNamedSecurityInfoW RegCloseKey RegEnumKeyExW RegOpenKeyExW ConvertStringSidToSidW GetAce EqualSid

ole32

CoSetProxyBlanket CoInitializeSecurity CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysStringLen VariantClear VariantInit SetErrorInfo GetErrorInfo SysFreeString SysAllocString

shlwapi

PathFindFileNameW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

winhttp

WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpCloseHandle WinHttpSendRequest WinHttpReceiveResponse

sspicli

GetUserNameExW

iphlpapi

GetAdaptersInfo

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive ReleaseSRWLockExclusive EnterCriticalSection LeaveCriticalSection TryAcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW WakeAllConditionVariable

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess GetStartupInfoW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetProcAddress

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-localization-l1-2-0

GetCPInfo LCMapStringEx GetLocaleInfoEx

api-ms-win-core-string-l1-1-0

CompareStringEx GetStringTypeW

api-ms-win-core-util-l1-1-0

EncodePointer

wininet

InternetCloseHandle InternetOpenUrlW InternetReadFile HttpOpenRequestW InternetConnectW HttpSendRequestW InternetOpenW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-memory-l1-1-0

VirtualQuery

Name

.text

Size

651KB

Virtual Size

651KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/PCAppStore.exe

IMPHASH b6435f1e27ea846380453fc948c5df41
SHA256 a587fd61eb3a166ad9ee17991349aaee468253e56d38c06debcf9db86fce9e17
MD5 0051c109667ad5007d408bbe8bf7d748
SHA1 3ae5fd3e69cd17bc2f28bb271bfc8321b12c390d
SHA512 4226739ca0f28cd9fbf05676b9ca62934d96b5910280fe6b7a5ea23564f4c1094e8d5be8c5aa6ae5acac36d5bf44320397d450c32a3fac3b2280ac6291d25fc1
SSDEEP 49152:vUKKU2CaIekbN6lXTi8cPu3LeUva1252Fxs8nU3TQpt:v1YljKMEZbkC
TLSH
T1A146F85AD67641E5D4FAD1798A67722BFC713C9EC130A707A780AB135B36720EA3E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

d2:08:15:46:ec:85:82:d5:af:d6:17:48:36:1f:86:02:91:83:77:b3:4d:67:11:86:b4:b0:9c:2b:a9:aa:80:0c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Apr 3, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3416200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2042d_D20260403T104826\fa_rss\Release\PCAppStore.pdb

urlmon

URLDownloadToFileW CreateUri

ws2_32

shutdown WSAGetLastError WSAStartup closesocket recv socket send WSACleanup WSAConnectByNameW

winhttp

WinHttpCloseHandle WinHttpOpenRequest WinHttpSetTimeouts WinHttpOpen WinHttpConnect WinHttpQueryDataAvailable WinHttpSetOption WinHttpReadData WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse

wininet

InternetSetOptionW InternetReadFile InternetConnectW InternetCloseHandle HttpSendRequestW HttpQueryInfoW InternetOpenW InternetQueryDataAvailable HttpOpenRequestW HttpAddRequestHeadersW

secur32

ApplyControlToken InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

shlwapi

PathFindFileNameW PathCreateFromUrlW PathAddBackslashW UrlCreateFromPathW AssocCreate SHCreateStreamOnFileEx PathRenameExtensionW

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

msi

ord92 ord45 ord32 ord118 ord8 ord160 ord159 ord70

kernel32

RtlUnwindEx InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree TerminateProcess CreateThread ExitThread RtlUnwind RtlLookupFunctionEntry RtlPcToFileHeader WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx DeleteFileW IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte LoadResource LockResource SizeofResource FindResourceW SetEnvironmentVariableW SetEvent ResetEvent CreateEventW Sleep WaitForMultipleObjects GetModuleFileNameW CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW CreateMutexW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW GetEnvironmentVariableW GetTickCount64 SetCurrentDirectoryW ReadFile CreateProcessW GetLocaleInfoEx GetConsoleOutputCP CopyFileA OpenProcess IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetStdHandle GetEnvironmentVariableA IsProcessorFeaturePresent FindFirstFileW RtlCaptureContext GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFree lstrcmpA FileTimeToSystemTime FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock LoadLibraryExW CreateDirectoryW FindFirstFileExW FindNextFileW RemoveDirectoryW GetUserDefaultUILanguage LCIDToLocaleName VerSetConditionMask VerifyVersionInfoW GetSystemFirmwareTable GetCommandLineW FindResourceExW OpenFileMappingW OpenMutexW FreeEnvironmentStringsW K32GetModuleBaseNameW K32EnumProcessModules GetEnvironmentStringsW GetStartupInfoW SetUnhandledExceptionFilter FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime InitializeSListHead RaiseException GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW UnhandledExceptionFilter FindClose FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RtlVirtualUnwind EncodePointer LCMapStringEx CompareStringEx GetCurrentProcess GetCPInfo

user32

SetCursorPos GetWindowTextW SetWindowPos GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx keybd_event GetForegroundWindow UnhookWinEvent FindWindowExW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow BeginPaint EndPaint InvalidateRect SetWindowsHookExW EnumChildWindows WindowFromPoint PtInRect GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext EnumDisplayMonitors EnumWindows EqualRect IntersectRect GetMonitorInfoW SetCapture GetCapture TrackMouseEvent ChangeWindowMessageFilterEx LoadIconW TrackPopupMenu RemoveMenu AppendMenuW MonitorFromRect MonitorFromPoint GetWindowThreadProcessId GetClassNameW ReleaseDC GetDC SendInput EndDialog IsWindowVisible DialogBoxParamW SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer SetForegroundWindow SetFocus IsIconic ShowWindow IsWindow ReleaseCapture InsertMenuW GetMenuItemCount DestroyMenu PostMessageW CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW RegisterWindowMessageW GetWindow LoadCursorW UnregisterClassW GetWindowPlacement IsZoomed SetWindowTextW GetClientRect AdjustWindowRectEx UpdateWindow GetWindowLongPtrW SetWindowLongW GetShellWindow SetWindowLongPtrW SetWindowPlacement OpenIcon EmptyClipboard SetClipboardData CloseClipboard OpenClipboard FindWindowW SetClassLongPtrW SetRectEmpty FillRect ScreenToClient MapWindowPoints GetWindowRect MonitorFromWindow

gdi32

DeleteObject SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateSolidBrush

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW RegNotifyChangeKeyValue GetUserNameW RegGetValueW EventUnregister RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW EventRegister EventSetInformation EventWriteTransfer

shell32

ShellExecuteW SHAppBarMessage SHGetKnownFolderPath SHQueryRecycleBinW SHEmptyRecycleBinW SHGetFolderPathW ShellExecuteExW CommandLineToArgvW Shell_NotifyIconW

ole32

RegisterDragDrop OleRun CoTaskMemFree CoUninitialize CoCreateInstance CoInitialize CoInitializeSecurity OleInitialize CoSetProxyBlanket CoTaskMemAlloc RevokeDragDrop CoAllowSetForegroundWindow CoInitializeEx OleUninitialize CoCreateFreeThreadedMarshaler

oleaut32

SysFreeString VariantClear VariantInit VariantChangeType SysStringLen SysAllocString SetErrorInfo GetErrorInfo

iphlpapi

IcmpCreateFile IcmpCloseHandle

crypt32

CryptDecodeObjectEx CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertCloseStore CertOpenStore CryptDecodeObject CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam

ext-ms-win-networking-wlanapi-l1-1-0

WlanFreeMemory WlanOpenHandle WlanGetAvailableNetworkList WlanCloseHandle WlanEnumInterfaces

wlanapi

WlanAllocateMemory WlanRegisterNotification WlanScan

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

gdiplus

GdipTranslateWorldTransform GdipSetWorldTransform GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipFlush GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipCloneImage GdipFillEllipse GdipDeleteBrush GdipCloneBrush GdipDeleteMatrix GdipCreateMatrix GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipDrawImageI GdipCreateFontFamilyFromName GdipScaleWorldTransform GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipSetStringFormatAlign GdipCreateStringFormat GdipDeleteStringFormat GdipCreateSolidFill

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo

version

GetFileVersionInfoSizeW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

869KB

Virtual Size

868KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

190KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

211KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

313KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/PCAppStoreSRV.exe

IMPHASH 14d0c7ea580037c344b5907e698d40b1
SHA256 99ccbcdf194dddf11fbb045df9724950957201ccd80757bac32756153105a9c2
MD5 0f4a0911186b21b6e9eaf8085b292c68
SHA1 03a287180c09b9a886b60abac15e98c9c1cb689c
SHA512 ffb48cbd08bc9ece040fec7ad1cb7d218b9f3510fd22ba37283e2fa20ff92ed69fc25a3e12e9841068d8990e22296814bbcb2183adda4bf94a1023fe8483f1da
SSDEEP 12288:8dOGYTD21avr5kR6713Nvph0lhSMXl+I0zbcqZ:+ONv21QryR2rhh0lhSMXlX05Z
TLSH
T1F8D47B1AB7E841F8E5BAC1788892562AFA737C96439067CB13907A571F736E04F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

54:15:9b:13:bd:ca:e8:8a:05:00:62:c8:16:d5:55:45:ec:24:aa:e4:35:9d:9f:00:e8:b1:3c:9d:70:e7:7e:5e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Apr 3, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

174044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2042d_D20260403T104826\fa_rss\Release\AppStoreSRV.pdb

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

kernel32

GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc DecodePointer CopyFileW LocalFree LocalAlloc GetExitCodeProcess GetCurrentProcess WaitForSingleObject CloseHandle TerminateProcess GetLastError DeleteCriticalSection InitializeCriticalSectionEx SetEndOfFile WriteConsoleW CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc MultiByteToWideChar WideCharToMultiByte GetCommandLineW WaitForMultipleObjects CreateMutexW ReleaseMutex UnmapViewOfFile CreateEventW SetEvent CreateFileMappingW MapViewOfFile FindFirstFileExW FindNextFileW RemoveDirectoryW GetModuleFileNameW FindClose GetFileAttributesW Sleep DeleteFileW GetSystemFirmwareTable GetProcAddress FreeLibrary WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetStringTypeW QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle WriteFile GetCommandLineA

advapi32

RegOpenKeyExW SetSecurityDescriptorDacl StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW ConvertStringSidToSidW ConvertSidToStringSidW RegQueryValueExW SetTokenInformation GetTokenInformation GetLengthSid DuplicateTokenEx CreateProcessAsUserW RegCloseKey InitializeSecurityDescriptor RegCreateKeyExW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shell32

CommandLineToArgvW

Name

.text

Size

308KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

231KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/ShellExecAsUser.dll

IMPHASH 2302ef28d4d10b9da0f914a5921f3f3e
SHA256 1f17e4d5ffe7b2c9a396ee9932ac5198f0c050241e5f9ccd3a56e576613d8a29
MD5 552cba3c6c9987e01be178e1ee22d36b
SHA1 4c0ab0127453b0b53aeb27e407859bccb229ea1b
SHA512 9bcf47b62ca8ffa578751008cae523d279cdb1699fd916754491899c31ace99f18007ed0e2cbe9902abf132d516259b5fb283379d2fead37c76b19e2e835e95a
SSDEEP 768:SA49ATJ9ONLkh9J5lDYDzG8yVAf7hiJFkkAqnTEDlV4vihdk:SA4CJ9OFpXf0AfNiTkIMrhdk
TLSH
T19B135A0072A184B6E577553459B497A24B6EBD016AF4808B3FBE13BE5FB16C09B3C363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

OutputDebugStringW GetModuleHandleW GetVersionExW lstrcpynW lstrcmpW RaiseException GetProcAddress CreateEventW CloseHandle GlobalFree lstrcpyW WideCharToMultiByte SetEvent GetStringTypeW LCMapStringW HeapSize HeapReAlloc RtlUnwind GetModuleFileNameW WriteFile LoadLibraryW WaitForSingleObject MultiByteToWideChar GetCurrentProcess IsValidCodePage GetOEMCP GetACP GetCPInfo EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter ExitThread GetCurrentThreadId GetLastError CreateThread DecodePointer GetCommandLineA HeapFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement ExitProcess Sleep IsProcessorFeaturePresent HeapAlloc SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy

user32

wsprintfW DispatchMessageW DefWindowProcW CreateWindowExW DestroyWindow GetMessageW PostQuitMessage PostMessageW TranslateMessage RegisterClassExW GetWindowLongW SetWindowLongW

advapi32

OpenProcessToken GetTokenInformation

shell32

ShellExecuteW

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

shlwapi

ord176

$PLUGINSDIR/SimpleSC.dll

IMPHASH a9546246ff97b887a4072a24f9106617
SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
MD5 7b89329c6d8693fb2f6a4330100490a0
SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
TLSH
T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

989260

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

EnterCriticalSection SetFilePointer GetACP CloseHandle LocalFree SuspendThread VirtualProtect TlsAlloc GetTickCount IsDebuggerPresent GetFullPathNameW VirtualFree HeapAlloc GetStartupInfoW ExitProcess GetFileAttributesW InitializeCriticalSection GetCPInfoExW GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc RtlUnwind GetCPInfo GetCommandLineW GetSystemInfo ResumeThread GetProcAddress LeaveCriticalSection EnumSystemLocalesW GetStdHandle GetVersionExW VerifyVersionInfoW GetModuleHandleW FreeLibrary HeapCreate HeapDestroy ReadFile GetDiskFreeSpaceW VerSetConditionMask GetUserDefaultUILanguage FindFirstFileW TlsFree HeapSize lstrcpynW SetLastError GetModuleFileNameW GetLastError GlobalAlloc lstrlenW SetEndOfFile CompareStringW CreateThread HeapFree WideCharToMultiByte MultiByteToWideChar FindClose LoadLibraryA ResetEvent SetEvent CreateFileW GetLocaleInfoW GetVersion RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetLocalTime WaitForSingleObject GetCurrentThread WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue IsValidLocale TlsSetValue LoadLibraryExW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetCurrentThreadId UnhandledExceptionFilter VirtualQuery CreateEventW GlobalFree VirtualQueryEx GetThreadLocale Sleep SetThreadLocale

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

user32

CharUpperBuffW CharNextW MsgWaitForMultipleObjects FindWindowExW CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics MessageBoxW

oleaut32

SysAllocStringLen SafeArrayPtrOfIndex VariantCopy SafeArrayGetLBound SafeArrayGetUBound VariantInit VariantClear SysFreeString SysReAllocStringLen VariantChangeType SafeArrayCreate

netapi32

NetWkstaGetInfo NetApiBufferFree

advapi32

CloseServiceHandle ControlService CreateServiceW LookupAccountNameW DeleteService LsaAddAccountRights StartServiceW UnlockServiceDatabase GetServiceKeyNameW GetServiceDisplayNameW ChangeServiceConfigW LsaClose LockServiceDatabase OpenServiceW ChangeServiceConfig2W EnumDependentServicesW QueryServiceConfig2W LsaRemoveAccountRights QueryServiceStatus AdjustTokenPrivileges QueryServiceConfigW LookupPrivilegeValueW OpenSCManagerW LsaOpenPolicy OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey

Name

.text

Size

956KB

Virtual Size

956KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

490B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/UserInfo.dll

IMPHASH 5e62e8e248e7364886b604bd1fcf4c13
SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
MD5 2f69afa9d17a5245ec9b5bb03d56f63c
SHA1 e0a133222136b3d4783e965513a690c23826aec9
SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
TLSH
T1818162BB93B00CF3D0A44B7B44A71CE762B6DD301762001F4A478AA92591B67EE7EB15
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Watchdog.exe

IMPHASH d9edaf05b5a3d062e255c5ef6b81363d
SHA256 90e5575bb09fda04692fba9ed1203223824414c394da04ed52fc59f884cc7484
MD5 a853011dfda99821fb0d17263b8f7393
SHA1 3391c631120557c8972a57ea8ad61f1fe28f4c8f
SHA512 7e0991d10fdb3a158fee142184f5ca1d4e492cc7815be5be0e08c7b56c74b240e8bf374df1c869c18a6bbec12509abd0817af6a26199b05643a965ea94886b21
SSDEEP 12288:eO4vI5TH5MihmGwNz4TNSeznBfevIChdph0lhSMXl+eUT:v4v6ZMiYpNz4TNSeNegOh0lhSMXlxUT
TLSH
T189059D1AEAE842ECD17AC17E8466264AF7B17C4A47556ACF039235AB1F735E00E3F301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

c0:b9:48:30:1c:8c:87:85:04:8e:bf:6c:d3:16:ba:a5:4d:52:e9:94:58:ad:c0:cc:1e:c7:66:2f:fe:c5:9b:82

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Apr 3, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

335484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2042d_D20260403T104826\fa_rss\Release\Watchdog.pdb

winhttp

WinHttpReceiveResponse WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpOpen WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpOpenRequest

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW

shell32

SHGetFolderPathW CommandLineToArgvW

kernel32

GetOEMCP GetCommandLineA IsValidCodePage GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW SetEndOfFile GetACP ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx CreateFileW GetFileSize ReadFile CloseHandle SetEvent CreateEventW OpenEventW OpenProcess lstrcmpiW K32EnumProcesses K32EnumProcessModules K32GetModuleBaseNameW WaitForSingleObject Sleep GetCommandLineW LocalFree HeapFree InitializeCriticalSectionEx HeapSize MultiByteToWideChar GetLastError HeapReAlloc HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap WideCharToMultiByte FindFirstFileW FindFirstFileExW FindNextFileW ExpandEnvironmentStringsW GetModuleFileNameW FindClose GetFileAttributesW GetSystemFirmwareTable GetTickCount64 SizeofResource LockResource LoadLibraryW FindResourceExW LoadResource FindResourceW GetProcAddress FreeLibrary FormatMessageW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread RtlUnwind WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection EncodePointer GetSystemTimeAsFileTime LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead OutputDebugStringW RaiseException GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc WriteFile GetStdHandle ExitProcess GetModuleHandleExW LoadLibraryExW RtlPcToFileHeader RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

secur32

FreeContextBuffer ApplyControlToken EncryptMessage InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext

ws2_32

send WSACleanup WSAGetLastError recv socket shutdown WSAConnectByNameW WSAStartup closesocket

Name

.text

Size

485KB

Virtual Size

484KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsJSON.dll

IMPHASH 674631b5b86309caa1d0df66c91a50f2
SHA256 64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb
MD5 f4d89d9a2a3e2f164aea3e93864905c9
SHA1 4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a
SHA512 dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2
SSDEEP 384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
TLSH
T1D4B21746A6B054F4F57B55BAB4322E232E7EBD08286095EFC73319196860913BB3D333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11845

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

0ac532d91c24fdcf849481786cfc8ae05938e3eb8f72e478b30668aaf5ff0ffb

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/AutoUpdater.exe

ws2_32

winhttp

secur32

advapi32

shell32

ole32

version

kernel32

rpcrt4

generic

$PLUGINSDIR/NSISFastLib.dll

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

api-ms-win-shcore-scaling-l1-1-1

winhttp

sspicli

iphlpapi

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

wininet

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-memory-l1-1-0

generic

$PLUGINSDIR/PCAppStore.exe

urlmon

ws2_32

winhttp

wininet

secur32

wtsapi32

shlwapi

dwmapi

api-ms-win-shcore-scaling-l1-1-1

msi

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

crypt32

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

api-ms-win-core-version-l1-1-0

api-ms-win-core-version-l1-1-1