0c9f8ee1baa23b7e7903357083c60cf04bae4e0f3d4eaba76c26b0dc6f5c637e

Sharing

Copy URL Twitter E-mail

General

Target
0c9f8ee1baa23b7e7903357083c60cf04bae4e0f3d4eaba76c26b0dc6f5c637e
Size 4.5MB
Sample260916-xpd84sch22
SHA256 0c9f8ee1baa23b7e7903357083c60cf04bae4e0f3d4eaba76c26b0dc6f5c637e
MD5 7b46dd7d703be4a5b6072d8d93f4fb3a
SHA1 649a123a5d85ed89aa86fa50580de30fc522984c
SHA512 61465020af8fc2c6d51296498008ece5362481e1d2ba220fa1ed0cc930b0d67c46ae4fce241f9a30a587bf1c5a64f96a1cee9f8697bc2a1bd354e2bba317fd94
SSDEEP 98304:uz4ZRDceVaG1/rO6InNLmhyw7JpeyjnUTj3J5Ai5PzzyM4QAGWbuIuRCPYu1LDV:u8ZRD3LRInohn7Jp5jUTAiFyMVhWbu/K
TLSH
T18F263344E1018C1EEDB89CF51F36C5792A8EEECB7257B58263D03A94BDDC9C54B6CA08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
0c9f8ee1baa23b7e7903357083c60cf04bae4e0f3d4eaba76c26b0dc6f5c637e
unpack001/$PLUGINSDIR/NSISFastLib.dll
unpack001/$PLUGINSDIR/ShellExecAsUser.dll
unpack001/$PLUGINSDIR/SimpleSC.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsJSON.dll

File Explorer

0c9f8ee1baa23b7e7903357083c60cf04bae4e0f3d4eaba76c26b0dc6f5c637e

.exe 4.5MB
$PLUGINSDIR/AutoUpdater.exe

.exe 1.1MB
$PLUGINSDIR/NSISFastLib.dll

.dll 797KB
$PLUGINSDIR/PCAppStore.exe

.exe 5.3MB
$PLUGINSDIR/PCAppStoreSRV.exe

.exe 599KB
$PLUGINSDIR/ShellExecAsUser.dll

.dll 43KB
$PLUGINSDIR/SimpleSC.dll

.dll 1.1MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/UAC.dll

.dll 14KB
$PLUGINSDIR/UserInfo.dll

.dll 4KB
$PLUGINSDIR/Watchdog.exe

.exe 800KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsJSON.dll

.dll 23KB
$PLUGINSDIR/wimage.bmp

25KB
ReadMe.txt

146B
pcappstore.ico

16KB

0c9f8ee1baa23b7e7903357083c60cf04bae4e0f3d4eaba76c26b0dc6f5c637e

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 0c9f8ee1baa23b7e7903357083c60cf04bae4e0f3d4eaba76c26b0dc6f5c637e
MD5 7b46dd7d703be4a5b6072d8d93f4fb3a
SHA1 649a123a5d85ed89aa86fa50580de30fc522984c
SHA512 61465020af8fc2c6d51296498008ece5362481e1d2ba220fa1ed0cc930b0d67c46ae4fce241f9a30a587bf1c5a64f96a1cee9f8697bc2a1bd354e2bba317fd94
SSDEEP 98304:uz4ZRDceVaG1/rO6InNLmhyw7JpeyjnUTj3J5Ai5PzzyM4QAGWbuIuRCPYu1LDV:u8ZRD3LRInohn7Jp5jUTAiFyMVhWbu/K
TLSH
T18F263344E1018C1EEDB89CF51F36C5792A8EEECB7257B58263D03A94BDDC9C54B6CA08
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/AutoUpdater.exe

IMPHASH 71761021aeb9edabe30d7f41a538e55d
SHA256 7e5aa44326e478d3ec6fae5b4a3ac22493f23483a759e403c88654815912e68f
MD5 942c0af4669e4e8e03748e76f29ab5dd
SHA1 c3b7137a3c65e9e3c87338c5d846699ff69e84c7
SHA512 2eabbb3571f9a88d527ce8b5563238d0a03fba8283f3b1d8725696edda338f70c8f15dcfe917a8873dac5053ad65804d92b812973682cbc05562b1c749f8b391
SSDEEP 24576:AZX/mqqKt47mw4bekdd5B9RL7zSh0lhSMXlGUTBT:AZXeqqSiu1H3PhB
TLSH
T104357E5AABA402F4C0B6D178C657651AF9717C86837167CB0781BB621F376E0AF3E702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

1f:56:1a:f7:f0:af:b7:f6:19:7b:a9:4e:1a:d4:c1:c3:b8:e7:2b:34:bb:2d:95:7a:e2:6b:6e:ac:a9:03:b2:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Apr 7, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

537352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2043_D20260407T165704\fa_rss\Release\AutoUpdater.pdb

ws2_32

shutdown closesocket WSACleanup WSAStartup WSAConnectByNameW send socket recv WSAGetLastError

winhttp

WinHttpOpenRequest WinHttpConnect WinHttpQueryHeaders WinHttpSetTimeouts WinHttpSendRequest WinHttpReadData WinHttpSetOption WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpCloseHandle WinHttpOpen

secur32

EncryptMessage DeleteSecurityContext DecryptMessage FreeContextBuffer FreeCredentialsHandle AcquireCredentialsHandleW ApplyControlToken InitializeSecurityContextW QueryContextAttributesW

advapi32

RegCreateKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

CommandLineToArgvW

ole32

CoInitializeEx CoCreateInstance CoUninitialize

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

kernel32

GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetCommandLineA FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect GetProcessHeap SetStdHandle HeapSize CreateFileW WriteConsoleW SetEndOfFile GetConsoleOutputCP QueryPerformanceCounter FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc WriteFile GetStdHandle ExitProcess GetEnvironmentStringsW FreeEnvironmentStringsW CloseHandle SetEvent WaitForSingleObject CreateEventW OpenEventW TerminateProcess GetExitCodeProcess CreateProcessW GetTickCount64 CopyFileW DecodePointer GetLastError InitializeCriticalSectionEx DeleteCriticalSection FreeLibrary GetProcAddress LoadLibraryW MultiByteToWideChar WideCharToMultiByte GetSystemFirmwareTable Sleep DeleteFileW CreateDirectoryW FindFirstFileW FindFirstFileExW FindNextFileW ExpandEnvironmentStringsW RemoveDirectoryW GetModuleFileNameW FindClose GetFileAttributesW SetEnvironmentVariableW GetCommandLineW LocalFree FormatMessageW GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RtlPcToFileHeader RaiseException OutputDebugStringW GetCurrentProcess GetStringTypeW RtlUnwind QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread SleepConditionVariableSRW WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

bcrypt

BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptGenRandom BCryptHashData BCryptFinishHash BCryptOpenAlgorithmProvider BCryptCreateHash

Name

.text

Size

726KB

Virtual Size

725KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

281KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/NSISFastLib.dll

IMPHASH 2f0b757f2ae49d3065dd7d71242e7c9f
SHA256 43880442ecd1d9d4bad5b8ac1c8e638578555410d0eebcead5283b853941f1ec
MD5 3607da60855c994ad3a9df5d9e54ab6b
SHA1 c120f20813269ae32288c576a15d6ccf02697306
SHA512 7b110cf8e4bc346f068f7d1e5065ee980f6497be69fa5cc4e41f4efed0f5ddd3fabb05d5514b008b14215894206747d4cc548d304ea6438168e20abd49bcc782
SSDEEP 12288:1+Oy1TV5BSQTsrrqt4BZzjqr+tMOs0jCVV40fKX9Nc81qXg4I3PRq:0RZV5Lsat4BZzjdMOkV40fKX7B1Qg4e
TLSH
T18D056C343A46C43AD96B05B2ADAEEEDB12BC76700B70D4D7B7841EADE6750819723313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

288599

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap LocalFree WideCharToMultiByte ExpandEnvironmentStringsA TerminateProcess WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle lstrcpynW MultiByteToWideChar GlobalAlloc GlobalFree lstrcpyW GetUserDefaultUILanguage LCIDToLocaleName GetCurrentProcessId QueryFullProcessImageNameW HeapAlloc GetSystemFirmwareTable CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwind FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetFileSizeEx SetFilePointerEx FindResourceW LoadResource FindResourceExW HeapReAlloc LockResource GetLastError HeapSize InitializeCriticalSectionEx HeapFree GetStdHandle GetFileType GetCurrentThreadId FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect SetEndOfFile WriteConsoleW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW SizeofResource FindClose FindFirstFileExW CreateFileW SetStdHandle GetTimeZoneInformation SetEnvironmentVariableW FindNextFileW IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetACP GetCommandLineW GetOEMCP GetCommandLineA ExitThread

user32

ScreenToClient wsprintfW GetMessageW CallNextHookEx WindowFromPoint IsWindow DispatchMessageW SetThreadDpiAwarenessContext MonitorFromPoint GetThreadDpiAwarenessContext GetCursorPos IsChild GetForegroundWindow TranslateMessage PostThreadMessageW SetWindowsHookExW UnhookWindowsHookEx

advapi32

RegQueryValueExW GetNamedSecurityInfoW RegCloseKey RegEnumKeyExW RegOpenKeyExW ConvertStringSidToSidW GetAce EqualSid

ole32

CoSetProxyBlanket CoInitializeSecurity CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysStringLen VariantClear VariantInit SetErrorInfo GetErrorInfo SysFreeString SysAllocString

shlwapi

PathFindFileNameW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

winhttp

WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpCloseHandle WinHttpSendRequest WinHttpReceiveResponse

sspicli

GetUserNameExW

iphlpapi

GetAdaptersInfo

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive ReleaseSRWLockExclusive EnterCriticalSection LeaveCriticalSection TryAcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW WakeAllConditionVariable

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess GetStartupInfoW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetProcAddress

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-localization-l1-2-0

GetCPInfo LCMapStringEx GetLocaleInfoEx

api-ms-win-core-string-l1-1-0

CompareStringEx GetStringTypeW

api-ms-win-core-util-l1-1-0

EncodePointer

wininet

InternetCloseHandle InternetOpenUrlW InternetReadFile HttpOpenRequestW InternetConnectW HttpSendRequestW InternetOpenW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-memory-l1-1-0

VirtualQuery

Name

.text

Size

651KB

Virtual Size

651KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/PCAppStore.exe

IMPHASH dd39d42f21dd61e1d677629e70403bf9
SHA256 fec3b0844b6680f01bf26131f8fa39b6685bf115f727c42ef0f194ab194f1b12
MD5 966f445280e10a6e419bb816df42835a
SHA1 03d64da0aa9ab3e249cd3de5ad493df015d65067
SHA512 bc5a1b69de436abd73ae8c895b1f0fab329ee0311b0b1b9e0fe980dda28c518d4c10ff4a5b8683497db232dfd3d66d7ad0ed0363781ff13cca86e85c99b1b235
SSDEEP 49152:1OxM1d4pOmocch395QIlbOwymtuZ8Mya/BgF3TQpt:15deIFlC
TLSH
T10146E85ADAB641E5D4FAD1398627722BFC713C5EC130A707A780AB175B36B60E63E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

95:d3:56:9a:9a:db:75:c6:a2:92:cb:42:3f:9d:2b:7d:52:ef:be:a0:0b:71:aa:55:ad:89:6d:a6:72:a2:37:8e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Apr 7, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3419624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2043_D20260407T165704\fa_rss\Release\PCAppStore.pdb

urlmon

URLDownloadToFileW CreateUri

ws2_32

send WSAConnectByNameW recv WSAGetLastError shutdown WSAStartup socket closesocket WSACleanup

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpSetOption WinHttpReadData WinHttpQueryHeaders

wininet

InternetConnectW InternetCloseHandle HttpSendRequestW HttpQueryInfoW InternetOpenW InternetQueryDataAvailable HttpOpenRequestW InternetSetOptionW InternetReadFile HttpAddRequestHeadersW

secur32

ApplyControlToken InitializeSecurityContextW DecryptMessage FreeCredentialsHandle AcquireCredentialsHandleW QueryContextAttributesW DeleteSecurityContext EncryptMessage FreeContextBuffer

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

shlwapi

PathFindFileNameW PathCreateFromUrlW PathAddBackslashW UrlCreateFromPathW AssocCreate SHCreateStreamOnFileEx PathRenameExtensionW

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

msi

ord92 ord45 ord32 ord118 ord8 ord160 ord159 ord70

kernel32

EncodePointer LCMapStringEx CompareStringEx GetStartupInfoW InterlockedPushEntrySList RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo RtlUnwind CreateThread WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle ReadConsoleW SetFilePointerEx GetFileSizeEx DeleteFileW IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW WideCharToMultiByte LoadResource LockResource SizeofResource FindResourceW SetEnvironmentVariableW SetEvent ResetEvent CreateEventW Sleep WaitForMultipleObjects GetModuleFileNameW CreateFileW OpenEventW GetOverlappedResult ReadDirectoryChangesW CreateMutexW FreeLibrary LoadLibraryW ExpandEnvironmentStringsW GetEnvironmentVariableW GetTickCount64 SetCurrentDirectoryW ReadFile CreateProcessW GetLocaleInfoEx GetConsoleOutputCP CopyFileA OpenProcess IsProcessCritical QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcesses K32GetModuleFileNameExW GetTempPathW GetExitCodeProcess GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetStdHandle GetEnvironmentVariableA FindFirstFileW SetUnhandledExceptionFilter GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFree lstrcmpA FileTimeToSystemTime FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileA LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection DecodePointer InitializeCriticalSectionEx GlobalAlloc GlobalUnlock GlobalLock GlobalFree LoadLibraryExW CreateDirectoryW FindFirstFileExW FindNextFileW RemoveDirectoryW GetUserDefaultUILanguage LCIDToLocaleName VerSetConditionMask VerifyVersionInfoW GetSystemFirmwareTable GetCommandLineW OpenFileMappingW OpenMutexW FreeEnvironmentStringsW K32GetModuleBaseNameW K32EnumProcessModules GetEnvironmentStringsW RtlPcToFileHeader ExitThread FreeLibraryAndExitThread ExitProcess GetDriveTypeW GetFileType SleepConditionVariableSRW WakeAllConditionVariable UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead TerminateProcess PeekNamedPipe FindClose SystemTimeToTzSpecificLocalTime FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode RaiseException GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW GetFileInformationByHandle SetFileInformationByHandle GetFileInformationByHandleEx IsProcessorFeaturePresent GetStringTypeW InitOnceBeginInitialize InitOnceComplete QueryPerformanceFrequency GetCurrentProcess WakeConditionVariable

user32

GetShellWindow SetCursorPos GetWindowTextW SetWindowPos GetPhysicalCursorPos GetSystemMetrics GetAsyncKeyState CallNextHookEx UnhookWindowsHookEx GetForegroundWindow UnhookWinEvent FindWindowExW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow BeginPaint EndPaint InvalidateRect EqualRect SetWindowsHookExW EnumChildWindows WindowFromPoint SetCapture GetCursorPos IsChild PostThreadMessageW SendMessageW GetMessageW GetThreadDpiAwarenessContext SetThreadDpiAwarenessContext GetWindow EnumWindows FindWindowW IntersectRect GetMonitorInfoW MonitorFromRect GetCapture TrackMouseEvent ChangeWindowMessageFilterEx LoadIconW TrackPopupMenu RemoveMenu AppendMenuW InsertMenuW MonitorFromPoint GetWindowThreadProcessId GetClassNameW ReleaseDC GetDC SendInput EndDialog IsWindowVisible DialogBoxParamW SetWinEventHook PeekMessageW DispatchMessageW TranslateMessage KillTimer SetTimer SetForegroundWindow SetFocus IsIconic ShowWindow IsWindow ReleaseCapture PostMessageW GetMenuItemCount DestroyMenu CreatePopupMenu GetClassInfoExW RegisterClassExW AttachThreadInput SendMessageTimeoutW LoadCursorW MonitorFromWindow UnregisterClassW GetWindowPlacement IsZoomed SetWindowTextW AdjustWindowRectEx SetWindowLongPtrW keybd_event SetWindowPlacement RegisterWindowMessageW OpenIcon EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetClassLongPtrW EnumDisplayMonitors PtInRect UpdateWindow GetDpiForWindow GetWindowLongPtrW SetWindowLongW SetRectEmpty FillRect ScreenToClient MapWindowPoints GetWindowRect GetClientRect

gdi32

DeleteObject SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateSolidBrush

winspool.drv

EnumPrintersW

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW RegNotifyChangeKeyValue GetUserNameW RegGetValueW EventUnregister RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW EventRegister EventSetInformation EventWriteTransfer

shell32

ShellExecuteW SHAppBarMessage SHGetKnownFolderPath SHQueryRecycleBinW SHEmptyRecycleBinW SHGetFolderPathW ShellExecuteExW CommandLineToArgvW Shell_NotifyIconW

ole32

CoCreateInstance RegisterDragDrop CoInitializeSecurity CoTaskMemFree CoUninitialize CoInitialize OleRun CoSetProxyBlanket OleInitialize CreateStreamOnHGlobal CoTaskMemAlloc RevokeDragDrop CoAllowSetForegroundWindow CoInitializeEx OleUninitialize CoCreateFreeThreadedMarshaler

oleaut32

VariantClear VariantInit SysFreeString SysAllocString GetErrorInfo VariantChangeType SetErrorInfo SysStringLen

iphlpapi

IcmpCreateFile IcmpCloseHandle

bcrypt

BCryptGenRandom BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider

crypt32

CryptDecodeObjectEx CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptQueryObject CertCloseStore CertOpenStore CryptDecodeObject CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam

ext-ms-win-networking-wlanapi-l1-1-0

WlanOpenHandle WlanCloseHandle WlanEnumInterfaces WlanFreeMemory WlanGetAvailableNetworkList

wlanapi

WlanAllocateMemory WlanRegisterNotification WlanScan

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

gdiplus

GdipCloneImage GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteMatrix GdipCreateBitmapFromHBITMAP GdipFree GdipAlloc GdiplusShutdown GdiplusStartup GdipFlush GdipCreateFromHDC GdipDisposeImage GdipDeleteGraphics GdipSetSmoothingMode GdipSetWorldTransform GdipTranslateWorldTransform GdipScaleWorldTransform GdipFillEllipse GdipDrawImageI GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipSetStringFormatAlign GdipCreateFont GdipDeleteFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipCreateMatrix

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo

version

GetFileVersionInfoSizeW

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

874KB

Virtual Size

873KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

190KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

211KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

313KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/PCAppStoreSRV.exe

IMPHASH 0ef837c81fbbac1ab950b1d08da44869
SHA256 6955bdb7e395be3fc474cd7a61d068930b0be5090cfefcb5ac9f35d86903ba50
MD5 58b9f4719a500f398c38796cf4661c97
SHA1 c4ff2d2d422d824bb16954bc6d394a1f327719f3
SHA512 b730da8f064431a787f653947d76d332101d5c06c7eb6964d050bcbc9d05f0c879fa1caf321b24c3ccbf7431a29c1eb3359b79f9675df8b18ca92ebd132e2e61
SSDEEP 12288:DP0U5fN4TIxZAdXMlLw3Vph0lhSMXl+KPDclV:DblN/KdXMiXh0lhSMXllPDclV
TLSH
T1D9D48C1AB7E541F8E4BAC1788992162AFA737C9643A067CB13907A531F736E05F3E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

66:0f:7f:e2:b0:a7:51:77:29:06:68:7c:95:9e:b4:50:b0:2a:f2:55:ac:8a:8e:7b:f3:eb:65:f5:5d:20:50:9c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Apr 7, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

174076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2043_D20260407T165704\fa_rss\Release\AppStoreSRV.pdb

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory

kernel32

GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc DecodePointer CopyFileW LocalFree LocalAlloc GetExitCodeProcess GetCurrentProcess WaitForSingleObject CloseHandle TerminateProcess GetLastError DeleteCriticalSection InitializeCriticalSectionEx GetExitCodeThread SetEndOfFile WriteConsoleW CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineA WriteFile GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread MultiByteToWideChar WideCharToMultiByte GetCommandLineW WaitForMultipleObjects CreateMutexW ReleaseMutex UnmapViewOfFile CreateEventW SetEvent CreateFileMappingW MapViewOfFile FindFirstFileExW FindNextFileW RemoveDirectoryW GetModuleFileNameW FindClose GetFileAttributesW Sleep DeleteFileW GetSystemFirmwareTable GetProcAddress FreeLibrary WaitForSingleObjectEx GetCurrentThreadId RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetStringTypeW QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread

advapi32

RegOpenKeyExW SetSecurityDescriptorDacl StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW ConvertStringSidToSidW ConvertSidToStringSidW RegQueryValueExW SetTokenInformation GetTokenInformation GetLengthSid DuplicateTokenEx CreateProcessAsUserW RegCloseKey InitializeSecurityDescriptor RegCreateKeyExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shell32

CommandLineToArgvW

Name

.text

Size

308KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

231KB

Virtual Size

231KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/ShellExecAsUser.dll

IMPHASH 2302ef28d4d10b9da0f914a5921f3f3e
SHA256 1f17e4d5ffe7b2c9a396ee9932ac5198f0c050241e5f9ccd3a56e576613d8a29
MD5 552cba3c6c9987e01be178e1ee22d36b
SHA1 4c0ab0127453b0b53aeb27e407859bccb229ea1b
SHA512 9bcf47b62ca8ffa578751008cae523d279cdb1699fd916754491899c31ace99f18007ed0e2cbe9902abf132d516259b5fb283379d2fead37c76b19e2e835e95a
SSDEEP 768:SA49ATJ9ONLkh9J5lDYDzG8yVAf7hiJFkkAqnTEDlV4vihdk:SA4CJ9OFpXf0AfNiTkIMrhdk
TLSH
T19B135A0072A184B6E577553459B497A24B6EBD016AF4808B3FBE13BE5FB16C09B3C363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

OutputDebugStringW GetModuleHandleW GetVersionExW lstrcpynW lstrcmpW RaiseException GetProcAddress CreateEventW CloseHandle GlobalFree lstrcpyW WideCharToMultiByte SetEvent GetStringTypeW LCMapStringW HeapSize HeapReAlloc RtlUnwind GetModuleFileNameW WriteFile LoadLibraryW WaitForSingleObject MultiByteToWideChar GetCurrentProcess IsValidCodePage GetOEMCP GetACP GetCPInfo EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter ExitThread GetCurrentThreadId GetLastError CreateThread DecodePointer GetCommandLineA HeapFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement ExitProcess Sleep IsProcessorFeaturePresent HeapAlloc SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy

user32

wsprintfW DispatchMessageW DefWindowProcW CreateWindowExW DestroyWindow GetMessageW PostQuitMessage PostMessageW TranslateMessage RegisterClassExW GetWindowLongW SetWindowLongW

advapi32

OpenProcessToken GetTokenInformation

shell32

ShellExecuteW

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

shlwapi

ord176

$PLUGINSDIR/SimpleSC.dll

IMPHASH a9546246ff97b887a4072a24f9106617
SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
MD5 7b89329c6d8693fb2f6a4330100490a0
SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
TLSH
T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

989260

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

EnterCriticalSection SetFilePointer GetACP CloseHandle LocalFree SuspendThread VirtualProtect TlsAlloc GetTickCount IsDebuggerPresent GetFullPathNameW VirtualFree HeapAlloc GetStartupInfoW ExitProcess GetFileAttributesW InitializeCriticalSection GetCPInfoExW GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc RtlUnwind GetCPInfo GetCommandLineW GetSystemInfo ResumeThread GetProcAddress LeaveCriticalSection EnumSystemLocalesW GetStdHandle GetVersionExW VerifyVersionInfoW GetModuleHandleW FreeLibrary HeapCreate HeapDestroy ReadFile GetDiskFreeSpaceW VerSetConditionMask GetUserDefaultUILanguage FindFirstFileW TlsFree HeapSize lstrcpynW SetLastError GetModuleFileNameW GetLastError GlobalAlloc lstrlenW SetEndOfFile CompareStringW CreateThread HeapFree WideCharToMultiByte MultiByteToWideChar FindClose LoadLibraryA ResetEvent SetEvent CreateFileW GetLocaleInfoW GetVersion RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetLocalTime WaitForSingleObject GetCurrentThread WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue IsValidLocale TlsSetValue LoadLibraryExW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetCurrentThreadId UnhandledExceptionFilter VirtualQuery CreateEventW GlobalFree VirtualQueryEx GetThreadLocale Sleep SetThreadLocale

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

user32

CharUpperBuffW CharNextW MsgWaitForMultipleObjects FindWindowExW CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics MessageBoxW

oleaut32

SysAllocStringLen SafeArrayPtrOfIndex VariantCopy SafeArrayGetLBound SafeArrayGetUBound VariantInit VariantClear SysFreeString SysReAllocStringLen VariantChangeType SafeArrayCreate

netapi32

NetWkstaGetInfo NetApiBufferFree

advapi32

CloseServiceHandle ControlService CreateServiceW LookupAccountNameW DeleteService LsaAddAccountRights StartServiceW UnlockServiceDatabase GetServiceKeyNameW GetServiceDisplayNameW ChangeServiceConfigW LsaClose LockServiceDatabase OpenServiceW ChangeServiceConfig2W EnumDependentServicesW QueryServiceConfig2W LsaRemoveAccountRights QueryServiceStatus AdjustTokenPrivileges QueryServiceConfigW LookupPrivilegeValueW OpenSCManagerW LsaOpenPolicy OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey

Name

.text

Size

956KB

Virtual Size

956KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

490B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/UserInfo.dll

IMPHASH 5e62e8e248e7364886b604bd1fcf4c13
SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
MD5 2f69afa9d17a5245ec9b5bb03d56f63c
SHA1 e0a133222136b3d4783e965513a690c23826aec9
SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
TLSH
T1818162BB93B00CF3D0A44B7B44A71CE762B6DD301762001F4A478AA92591B67EE7EB15
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Watchdog.exe

IMPHASH b1ce494593c78bdb8afdb66584a2e79a
SHA256 bb0744bb3d8dd8efc7233dafa90436acc8b7bc5c26651d6b2359b7e214dc3c73
MD5 a84e45fecb75c942077fdc13cde8f86d
SHA1 6541070e227e474be36233af1932a847ebeadbe2
SHA512 f792efa2e681b55328d01ebc84302215e500b77216eb096438dd06d2e29cf314a13054c29bbc6bd7a08118d87bd38b157d671b1e3bf731a1e2ad85deb7a41bd1
SSDEEP 24576:1FyBaPB+1L9X4mv74iUZVh0lhSMXltA9C:1FyBaPB+1L9X4CMih
TLSH
T126059D1AE6E842ECD17AC17E85A62A4AFBB17C4643616ACF039135671F735E41E3F302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

08:b6:d9:f4:c4:c1:7c:46:45:21:a5:3c:dc:61:fd:e8:1c:78:95:ab:9d:ad:57:dc:ea:2c:32:e0:eb:1e:7c:c4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Apr 7, 2026

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:b3:c7:8f:7b:29:d0:3c:d3:1f:43:82:40:ea:ff:3b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 6, 2025 - Nov 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

330572

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2043_D20260407T165704\fa_rss\Release\Watchdog.pdb

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders

advapi32

RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHGetFolderPathW

secur32

FreeContextBuffer ApplyControlToken EncryptMessage DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleW FreeCredentialsHandle DecryptMessage InitializeSecurityContextW

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash

ws2_32

send recv WSAConnectByNameW WSAStartup shutdown closesocket WSACleanup WSAGetLastError socket

kernel32

FreeEnvironmentStringsW GetCommandLineW GetCommandLineA GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetEnvironmentStringsW QueryPerformanceFrequency GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc WriteFile GetStdHandle ExitProcess GetModuleHandleExW CreateFileW GetFileSize ReadFile CloseHandle SetEvent CreateEventW OpenEventW OpenProcess lstrcmpiW K32EnumProcesses K32EnumProcessModules K32GetModuleBaseNameW WaitForSingleObject Sleep MultiByteToWideChar WideCharToMultiByte FindFirstFileW FindFirstFileExW FindNextFileW ExpandEnvironmentStringsW GetModuleFileNameW FindClose GetFileAttributesW GetLastError GetSystemFirmwareTable GetTickCount64 LoadLibraryW GetProcAddress FreeLibrary FormatMessageW LocalFree GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx QueryPerformanceCounter RtlUnwind GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW

Name

.text

Size

479KB

Virtual Size

478KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsJSON.dll

IMPHASH 674631b5b86309caa1d0df66c91a50f2
SHA256 64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb
MD5 f4d89d9a2a3e2f164aea3e93864905c9
SHA1 4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a
SHA512 dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2
SSDEEP 384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
TLSH
T1D4B21746A6B054F4F57B55BAB4322E232E7EBD08286095EFC73319196860913BB3D333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11845

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

0c9f8ee1baa23b7e7903357083c60cf04bae4e0f3d4eaba76c26b0dc6f5c637e

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/AutoUpdater.exe

ws2_32

winhttp

secur32

advapi32

shell32

ole32

version

kernel32

rpcrt4

bcrypt

generic

$PLUGINSDIR/NSISFastLib.dll

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

api-ms-win-shcore-scaling-l1-1-1

winhttp

sspicli

iphlpapi

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

wininet

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-memory-l1-1-0

generic

$PLUGINSDIR/PCAppStore.exe

urlmon

ws2_32

winhttp

wininet

secur32

wtsapi32

shlwapi

dwmapi

api-ms-win-shcore-scaling-l1-1-1

msi

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

iphlpapi

bcrypt

crypt32

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi