Half.Sword.v20260218.Early.Access.tar
- SHA256 2728d7ebbf19042871a241aa3c26f11be2530b008c1ea7bb2f97ae3117c7f637
Remus is a stealer written in C++.
| resource | yara_rule |
|---|---|
| static1/unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Plugins/DiscordPartnerSDK/Binaries/ThirdParty/DiscordPartnerSDKLibrary/Win64/discord_partner_sdk.dll | family_remus_stealer |
File was altered after it was signed.
| resource |
|---|
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/Engine/Binaries/ThirdParty/Steamworks/Steamv157/Win64/steam_api64.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/Engine/Binaries/ThirdParty/NVIDIA/NVaftermath/Win64/GFSDK_Aftermath_Lib.x64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/Engine/Binaries/ThirdParty/Ogg/Win64/VS2015/libogg_64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbis_64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/Engine/Binaries/ThirdParty/Vorbis/Win64/VS2015/libvorbisfile_64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfSwordUE5.exe |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/HalfSwordUE5-Win64-Shipping.exe |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/boost_atomic-mt-x64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/boost_chrono-mt-x64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/boost_filesystem-mt-x64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/boost_iostreams-mt-x64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/boost_program_options-mt-x64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/boost_python311-mt-x64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/boost_regex-mt-x64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/boost_system-mt-x64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/boost_thread-mt-x64.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/tbb.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/tbb12.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/tbbmalloc.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Plugins/ZibraVDB/ZibraVDBNative/CompressionEngineNativePlugin_Win.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Plugins/ZibraVDB/ZibraVDBNative/CompressionEngineNativePlugin_Win_Editor.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Plugins/ZibraVDB/ZibraVDBNative/Imath-3_1.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Plugins/ZibraVDB/ZibraVDBNative/blosc.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Plugins/ZibraVDB/ZibraVDBNative/lz4.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Plugins/ZibraVDB/ZibraVDBNative/openvdb.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Plugins/ZibraVDB/ZibraVDBNative/tbb12.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Plugins/ZibraVDB/ZibraVDBNative/zlib1.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Plugins/ZibraVDB/ZibraVDBNative/zstd.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Binaries/Win64/OpenImageDenoise.dll |
| unpack001/Half.Sword.v20260218.Early.Access/Half.Sword.v20260218.Early.Access/HalfswordUE5/Plugins/DiscordRpc/Source/ThirdParty/DiscordRpcLibrary/Win64/discord-rpc.dll |
Feb 6, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=59, id=261, version=31823,
count=8, id=260, version=31823,
count=4, id=257, version=31995,
count=63, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1268, id=1, productName=Unmarked objects,
count=12, id=260, version=31995,
count=4, id=259, version=31995,
count=1, id=256, version=31995,
count=100, id=264, version=31995,
count=2, id=253, version=31995,
count=37, id=261, version=31995,
count=1, id=255, version=31995,
count=1, id=258, version=31995,
Apr 19, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=30, id=261, version=30034,
count=14, id=260, version=30034,
count=9, id=259, version=30034,
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=262, version=26715,
count=23, productName=Unmarked objects (old),
count=453, id=260, version=30146,
count=21, id=257, version=26715,
count=252, id=1, productName=Unmarked objects,
count=50, id=269, version=30146,
count=1, id=256, version=30146,
count=1, id=255, version=30146,
count=2, id=151,
count=1, id=258, version=30146,
Unsigned PE
Checks for missing Authenticode signature.
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=29804,
count=4, id=259, version=29804,
count=31, id=261, version=29804,
count=6, id=257, version=29804,
count=2, id=253, version=28518,
count=1, id=261, version=22509,
count=1, id=260, version=22509,
count=11, id=257, version=29395,
count=341, id=1, productName=Unmarked objects,
count=1, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=8, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=166, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=1, id=256, productName=VS2019 v16.9.2 build 29913, version=29913,
count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,
count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=22710,
count=1, id=259, version=22710,
count=9, id=261, version=22710,
count=8, id=260, version=22710,
count=2, id=239, version=40116,
count=37, id=1, productName=Unmarked objects,
count=2, id=260, version=22816,
count=1, id=256, version=22816,
count=1, id=255, version=22816,
count=1, id=258, version=22816,
Codesign digest Mismatch
File was altered after it was signed.
Jan 21, 2026
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=195, id=261, version=33145,
count=36, id=259, version=33145,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=1, id=253, version=35403,
count=10, id=259, version=35403,
count=17, id=260, version=35403,
count=74, id=261, version=35403,
count=65, id=260, version=33145,
count=1, id=262, version=33145,
count=167, id=260, version=35220,
count=31, id=257, version=33145,
count=406, id=1, productName=Unmarked objects,
count=86, id=264, version=35724,
count=1, id=256, version=35724,
count=1, id=255, version=35724,
count=1, id=258, version=35724,
Nov 23, 2021
CN=Valve Corp.,O=Valve Corp.,L=Bellevue,ST=Washington,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=22710,
count=7, id=259, version=22710,
count=10, id=261, version=22710,
count=10, id=260, version=22710,
count=2, id=239, version=40116,
count=3, id=257, version=22816,
count=62, id=1, productName=Unmarked objects,
count=21, id=264, version=22816,
count=1, id=256, version=22816,
count=1, id=255, version=22816,
count=1, id=151,
count=1, id=258, version=22816,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=22710,
count=3, id=259, version=22710,
count=10, id=261, version=22710,
count=10, id=260, version=22710,
count=2, id=239, version=40116,
count=5, id=257, version=22816,
count=84, id=1, productName=Unmarked objects,
count=1, id=260, version=22816,
count=1, id=256, version=22816,
count=1, id=255, version=22816,
count=1, id=151,
count=1, id=258, version=22816,
Jan 15, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=24, id=259, version=26213,
count=143, id=261, version=26213,
count=14, id=260, version=26706,
count=16, id=259, version=26706,
count=39, id=261, version=26706,
count=11, id=257, version=26213,
count=1, id=263, version=26213,
count=20, id=260, version=26213,
count=144, id=1, productName=Unmarked objects,
count=4, id=261, version=27034,
count=1, id=259, version=27034,
count=106, id=265, version=27034,
count=1, id=256, version=27034,
count=1, id=255, version=27034,
count=1, id=151,
count=1, id=258, version=27034,
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=259, version=30795,
count=139, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33030,
count=17, id=259, version=33030,
count=45, id=261, version=33030,
count=13, id=257, version=30795,
count=110, id=1, productName=Unmarked objects,
count=1, id=261, version=33141,
count=1, id=255, version=33141,
count=1, id=151,
count=1, id=258, version=33141,
Nov 16, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=5, id=259, version=30795,
count=158, id=261, version=30795,
count=1, productName=Unmarked objects (old),
count=16, id=260, version=33030,
count=18, id=259, version=33030,
count=2, id=257, version=30795,
count=89, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=21, id=260, version=30795,
count=298, id=1, productName=Unmarked objects,
count=87, id=261, version=33030,
count=87, id=261, version=33130,
count=1, id=256, version=33130,
count=1, id=255, version=33130,
count=1, id=151,
count=1, id=258, version=33130,
Nov 16, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=21, id=259, version=30795,
count=194, id=261, version=30795,
count=1, productName=Unmarked objects (old),
count=17, id=260, version=33030,
count=20, id=259, version=33030,
count=78, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=260, version=33130,
count=59, id=261, version=27316,
count=1, id=260, version=27316,
count=47, id=260, version=30795,
count=7, id=257, version=30795,
count=212, id=1, productName=Unmarked objects,
count=98, id=261, version=33030,
count=230, id=261, version=33130,
count=1, id=256, version=33130,
count=1, id=255, version=33130,
count=1, id=151,
count=1, id=258, version=33130,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=257, version=33030,
count=13, id=253, version=33030,
count=10, id=260, version=33030,
count=81, id=259, version=33030,
count=2, id=259, version=30795,
count=3, id=261, version=30795,
count=1, id=262, version=30795,
count=44, id=257, version=30795,
count=13, id=260, version=30795,
count=43, id=261, version=33030,
count=183, id=260, version=32824,
count=1, id=261, version=27034,
count=9, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=39, id=261, version=32215,
count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=261, version=30151,
count=4, id=261, version=31948,
count=4, id=260, version=31948,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=261, version=33130,
count=7, id=261, version=27044,
count=2, id=261, version=27412,
count=2, id=257, version=27412,
count=134, id=260, version=27031,
count=1, id=260, version=27034,
count=19, id=260, version=30141,
count=33, id=260, productName=VS2019 v16.9.0 build 29910, version=29910,
count=139, id=260, version=32825,
count=77, id=261, version=32825,
count=587, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,
count=79, id=261, version=30153,
count=4, id=259, version=30145,
count=3, id=260, version=30145,
count=119, id=260, version=30151,
count=347, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=3, id=257, version=32216,
count=1732, id=1, productName=Unmarked objects,
count=441, productName=Unmarked objects (old),
count=2, id=260, version=33141,
count=9180, id=261, version=33141,
count=1, id=256, version=33141,
count=1, id=255, version=33141,
count=2, id=151,
count=1, id=258, version=33141,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 21, 2021
CN=Intel Corporation,O=Intel Corporation,L=Santa Clara,ST=CA,C=US
CN=Intel External Issuing CA 7B,O=Intel Corporation,L=Santa Clara,ST=CA,C=US
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=8, id=260, version=26706,
count=3, id=259, version=26706,
count=27, id=261, version=26706,
count=4, id=257, version=26706,
count=2, id=257, version=26715,
count=3, id=257, version=27043,
count=220, id=1, productName=Unmarked objects,
count=109, productName=Unmarked objects (old),
count=1, id=256, version=27039,
count=1, id=255, version=27039,
count=1, id=151,
count=1, id=258, version=27039,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=32533,
count=3, id=257, version=30795,
count=51, id=1, productName=Unmarked objects,
count=7, id=260, version=32533,
count=2, id=259, version=32533,
count=18, id=261, version=32533,
count=4, id=261, version=32826,
count=1, id=256, version=32826,
count=1, id=255, version=32826,
count=1, id=258, version=32826,
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30795,
count=19, id=261, version=32533,
count=8, id=260, version=32533,
count=3, id=259, version=32533,
count=7, id=257, version=32533,
count=59, id=1, productName=Unmarked objects,
count=3, id=261, version=32826,
count=1, id=256, version=32826,
count=1, id=255, version=32826,
count=1, id=258, version=32826,
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=32533,
count=3, id=259, version=32533,
count=29, id=261, version=32533,
count=6, id=257, version=32533,
count=5, id=257, version=30795,
count=121, id=1, productName=Unmarked objects,
count=10, id=261, version=32826,
count=1, id=256, version=32826,
count=1, id=255, version=32826,
count=1, id=258, version=32826,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30795,
count=18, id=261, version=32533,
count=8, id=260, version=32533,
count=3, id=259, version=32533,
count=7, id=257, version=32533,
count=73, id=1, productName=Unmarked objects,
count=2, id=261, version=32826,
count=1, id=256, version=32826,
count=1, id=255, version=32826,
count=1, id=258, version=32826,
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30795,
count=8, id=260, version=32533,
count=3, id=259, version=32533,
count=25, id=261, version=32533,
count=7, id=257, version=32533,
count=188, id=1, productName=Unmarked objects,
count=11, id=261, version=32826,
count=1, id=256, version=32826,
count=1, id=255, version=32826,
count=1, id=258, version=32826,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30795,
count=25, id=261, version=32420,
count=8, id=260, version=32420,
count=3, id=259, version=32420,
count=6, id=257, version=32420,
count=3, id=257, version=32826,
count=209, id=1, productName=Unmarked objects,
count=27, id=261, version=32535,
count=1, id=256, version=32535,
count=1, id=255, version=32535,
count=1, id=258, version=32535,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30795,
count=20, id=261, version=32533,
count=8, id=260, version=32533,
count=3, id=259, version=32533,
count=7, id=257, version=32533,
count=87, id=1, productName=Unmarked objects,
count=5, id=261, version=32826,
count=1, id=256, version=32826,
count=1, id=255, version=32826,
count=1, id=258, version=32826,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=32533,
count=3, id=257, version=30795,
count=33, id=1, productName=Unmarked objects,
count=11, id=261, version=32533,
count=7, id=260, version=32533,
count=2, id=259, version=32533,
count=1, id=261, version=32826,
count=1, id=256, version=32826,
count=1, id=255, version=32826,
count=1, id=258, version=32826,
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30795,
count=23, id=261, version=32533,
count=8, id=260, version=32533,
count=3, id=259, version=32533,
count=7, id=257, version=32533,
count=91, id=1, productName=Unmarked objects,
count=5, id=261, version=32826,
count=1, id=256, version=32826,
count=1, id=255, version=32826,
count=1, id=258, version=32826,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=23, id=261, version=31935,
count=8, id=260, version=31935,
count=4, id=259, version=31935,
count=6, id=257, version=31935,
count=3, id=257, version=29395,
count=107, id=1, productName=Unmarked objects,
count=3, id=259, version=32216,
count=37, id=265, version=32216,
count=1, id=256, version=32216,
count=1, id=255, version=32216,
count=1, id=151,
count=1, id=258, version=32216,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,
count=8, id=260, productName=VS2019 v16.9.2 build 29913, version=29913,
count=4, id=259, productName=VS2019 v16.9.2 build 29913, version=29913,
count=6, id=257, productName=VS2019 v16.9.2 build 29913, version=29913,
count=2, id=253, version=28518,
count=3, id=257, version=27412,
count=103, id=1, productName=Unmarked objects,
count=27, id=261, productName=VS2019 v16.9.5 build 29915, version=29915,
count=1, id=256, productName=VS2019 v16.9.5 build 29915, version=29915,
count=1, id=255, productName=VS2019 v16.9.5 build 29915, version=29915,
count=1, id=258, productName=VS2019 v16.9.5 build 29915, version=29915,
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=12, id=261, version=31935,
count=7, id=260, version=31935,
count=2, id=259, version=31935,
count=3, id=257, version=29395,
count=53, id=1, productName=Unmarked objects,
count=1, id=259, version=32216,
count=6, id=261, version=32216,
count=1, id=256, version=32216,
count=1, id=255, version=32216,
count=1, id=258, version=32216,
Aug 12, 2025
CN=NVIDIA Corporation,OU=1-G,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=NVIDIA Corporation,OU=1-G,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=14, id=259, version=29395,
count=187, id=261, version=29395,
count=26, id=260, version=29395,
count=16, id=260, version=30625,
count=10, id=259, version=30625,
count=83, id=261, version=30625,
count=1, id=173, version=30319,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=173, id=1, productName=Unmarked objects,
count=208, id=261, version=30706,
count=1, id=256, version=30706,
count=1, id=255, version=30706,
count=1, id=258, version=30706,
Aug 12, 2025
CN=NVIDIA Corporation,OU=1-G,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=NVIDIA Corporation,OU=1-G,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=14, id=259, version=29395,
count=187, id=261, version=29395,
count=26, id=260, version=29395,
count=16, id=260, version=30625,
count=10, id=259, version=30625,
count=83, id=261, version=30625,
count=1, id=173, version=30319,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=173, id=1, productName=Unmarked objects,
count=109, id=261, version=30706,
count=1, id=256, version=30706,
count=1, id=255, version=30706,
count=1, id=258, version=30706,
Detects Remus stealer
Nov 21, 2025
SERIALNUMBER=5128862,CN=Discord Inc.,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=5128862,CN=Discord Inc.,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Jun 19, 2026
SERIALNUMBER=5128862,CN=Discord Inc.,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=16, id=260, version=23917,
count=8, id=259, version=23917,
count=123, id=261, version=23917,
count=8, id=259, version=24123,
count=97, id=261, version=24123,
count=21, id=260, version=24123,
count=5, id=257, version=23917,
count=140, id=1, productName=Unmarked objects,
count=6, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Aug 12, 2025
CN=NVIDIA Corporation,OU=1-G,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=10, id=259, version=29395,
count=187, id=261, version=29395,
count=21, id=260, version=29395,
count=16, id=260, version=30625,
count=10, id=259, version=30625,
count=83, id=261, version=30625,
count=1, id=173, version=30319,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=257, version=30795,
count=170, id=1, productName=Unmarked objects,
count=49, id=261, version=30706,
count=1, id=256, version=30706,
count=1, id=255, version=30706,
count=1, id=258, version=30706,
Aug 12, 2025
CN=NVIDIA Corporation,OU=1-G,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=17, id=259, version=29395,
count=187, id=261, version=29395,
count=25, id=260, version=29395,
count=16, id=260, version=30625,
count=10, id=259, version=30625,
count=83, id=261, version=30625,
count=1, id=173, version=30319,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=173, id=1, productName=Unmarked objects,
count=89, id=261, version=30706,
count=1, id=256, version=30706,
count=1, id=255, version=30706,
count=1, id=258, version=30706,
Aug 25, 2025
CN=NVIDIA Corporation NVS Root,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Aug 25, 2025
CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=260, version=30034,
count=2, id=259, version=30034,
count=6, id=257, version=30034,
count=2, id=259, version=33140,
count=2, id=260, version=33140,
count=9, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=261, version=33140,
count=13, id=257, version=33140,
count=331, id=1, productName=Unmarked objects,
count=31, id=261, version=30034,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=265, version=30159,
count=1, id=256, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,
Aug 25, 2025
CN=NVIDIA Corporation NVS Root,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Aug 25, 2025
CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=22, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=6, id=257, version=30034,
count=3, id=257, version=33140,
count=139, id=1, productName=Unmarked objects,
count=3, id=265, version=30159,
count=1, id=256, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,
Aug 25, 2025
CN=NVIDIA Corporation NVS Root,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Aug 25, 2025
CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=26, id=261, version=30034,
count=6, id=257, version=30034,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=257, version=33140,
count=205, id=1, productName=Unmarked objects,
count=16, id=265, version=30159,
count=1, id=256, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,
Aug 25, 2025
CN=NVIDIA Corporation NVS Root,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Aug 25, 2025
CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=27, id=261, version=30034,
count=6, id=257, version=30034,
count=1, id=262, version=33140,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=257, version=33140,
count=310, id=1, productName=Unmarked objects,
count=18, id=265, version=30159,
count=1, id=256, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,
Aug 25, 2025
CN=NVIDIA Corporation NVS Root,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Aug 25, 2025
CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=6, id=257, version=30034,
count=7, id=257, version=33140,
count=147, id=1, productName=Unmarked objects,
count=3, id=265, version=30159,
count=1, id=256, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,
Aug 25, 2025
CN=NVIDIA Corporation NVS Root,OU=IT-MIS,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
Aug 25, 2025
CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=20, id=261, version=30034,
count=8, id=260, version=30034,
count=3, id=259, version=30034,
count=6, id=257, version=30034,
count=3, id=257, version=33140,
count=148, id=1, productName=Unmarked objects,
count=3, id=265, version=30159,
count=1, id=256, version=30159,
count=1, id=255, version=30159,
count=1, id=151,
count=1, id=258, version=30159,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33808,
count=8, id=260, version=33808,
count=23, id=261, version=33808,
count=6, id=257, version=33808,
count=3, id=257, version=30795,
count=89, id=1, productName=Unmarked objects,
count=25, id=261, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=258, version=34123,
Unsigned PE
Checks for missing Authenticode signature.
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=33808,
count=8, id=260, version=33808,
count=40, id=261, version=33808,
count=8, id=257, version=33808,
count=697, id=260, version=31106,
count=34, productName=Unmarked objects (old),
count=1, id=260, version=30795,
count=6, id=257, version=34123,
count=21, id=257, version=30795,
count=506, id=1, productName=Unmarked objects,
count=45, id=261, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=258, version=34123,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=259, version=33808,
count=8, id=260, version=33808,
count=13, id=261, version=33808,
count=7, id=257, version=33808,
count=2, id=257, version=30795,
count=64, id=1, productName=Unmarked objects,
count=5, id=261, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=258, version=34123,
Jan 24, 2022
CN=Windows Developer Tools Component,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jan 24, 2022
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=29804,
count=4, id=259, version=29804,
count=6, id=257, version=29804,
count=22, id=261, version=29804,
count=5, id=257, version=27412,
count=93, id=1, productName=Unmarked objects,
count=8, id=265, version=29913,
count=1, id=256, productName=VS2019 v16.9.2 build 29913, version=29913,
count=1, id=255, productName=VS2019 v16.9.2 build 29913, version=29913,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.9.2 build 29913, version=29913,
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33808,
count=1, id=253, version=33808,
count=4, id=259, version=33808,
count=8, id=260, version=33808,
count=13, id=261, version=33808,
count=2, id=257, version=30795,
count=7, id=257, version=34123,
count=70, id=1, productName=Unmarked objects,
count=10, id=260, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=258, version=34123,
Unsigned PE
Checks for missing Authenticode signature.
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33808,
count=4, id=259, version=33808,
count=8, id=260, version=33808,
count=12, id=261, version=33808,
count=2, id=257, version=30795,
count=41, id=1, productName=Unmarked objects,
count=5, id=260, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=258, version=34123,
Unsigned PE
Checks for missing Authenticode signature.
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=33808,
count=8, id=260, version=33808,
count=31, id=261, version=33808,
count=6, id=257, version=33808,
count=4, id=257, version=30795,
count=9, id=257, version=34123,
count=270, id=1, productName=Unmarked objects,
count=25, id=261, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=258, version=34123,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=33808,
count=24, id=261, version=33808,
count=6, id=259, version=33808,
count=6, id=257, version=33808,
count=3, id=257, version=30795,
count=119, id=1, productName=Unmarked objects,
count=32, id=261, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=151,
count=1, id=258, version=34123,
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33808,
count=4, id=253, version=33808,
count=3, id=259, version=33808,
count=8, id=260, version=33808,
count=12, id=261, version=33808,
count=2, id=257, version=30795,
count=49, id=1, productName=Unmarked objects,
count=15, id=260, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=151,
count=1, id=258, version=34123,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33808,
count=4, id=259, version=33808,
count=8, id=260, version=33808,
count=13, id=261, version=33808,
count=3, id=257, version=30795,
count=58, id=1, productName=Unmarked objects,
count=36, id=260, version=34123,
count=1, id=256, version=34123,
count=1, id=255, version=34123,
count=1, id=151,
count=1, id=258, version=34123,