2026-07-26_7d6d927f60656d9735785afbe0f80d67_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_stealc_vidar

resource	yara_rule
static1/unpack001/puppeteersharp.dll	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

resource
unpack001/costura.dll
unpack001/opencvsharp.dll
unpack001/paddleocrsharp.dll
unpack001/puppeteersharp.dll

SHA256 129d27be8e151964e9b8ccd6f2a75e25ecf6aed48fd369e3b95588056b0143ca
MD5 7d6d927f60656d9735785afbe0f80d67
SHA1 110e79568c7c325463f258e7790c96e78972c58b
SHA512 83d900cf391bb27316ce28f0331fa947696aaa0968e2facc28264c60467ca8b2f763b0757484308a99220618f6c7a514e5bd47939dd93d04ca3e12b3005cfde0
SSDEEP 196608:mcwnDw07FwkPX4qtkuDXDdD8JnNY1NkSITacD3wkDNMdbIHt5ED6:mvFwkPX4Kk9Y1NkSgaczwkDedbIDB
TLSH
T110B68C81BBA44DD6D47F0375403665614BF3BE5A93B5D34B0E8CA0AE3BA3B41291BB43
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

0f:66:87:5e:5f:c1:63:41:0c:e3:31:5f:2a:2d:8d:17:4a:56:e6:0f:ec:74:7e:05:4a:2b:19:14:f5:7b:52:38

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440300MA5FAR1W6E,CN=Keroro Software LLC,O=Keroro Software LLC,L=深圳市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e7a68fe794b0e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 5, 2026

SERIALNUMBER=91440300MA5FAR1W6E,CN=Keroro Software LLC,O=Keroro Software LLC,L=深圳市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e7a68fe794b0e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=91440300MA5FAR1W6E,CN=Keroro Software LLC,O=Keroro Software LLC,L=深圳市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e7a68fe794b0e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

05:7d:4f:4f:a8:fe:4a:40:39:3c:6c:29:99:7e:dd:81

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 2, 2025 - Sep 26, 2028

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\62347\Desktop\tool\2025年8月20日费尽心思版\tool\obj\x64\Release\tool.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

costura.pdb

SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
MD5 dd3394a0ba6f7158d029e1c3a31b7a85
SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
TLSH
T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

microsoft.bcl.asyncinterfaces.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9d605e925b4885eca8b0abd3203e8d7b70ab077baecff496fea13cf531abf66d
MD5 27fb43d5175e232c0250782617662995
SHA1 c20a1e0cdacf672d4198e720ee8c384c0920d5e3
SHA512 0c7d8244b0fede4b8ff966a165ec62c1d30e161ed3e3429f8b5c511fb23d8c10aaf92fd66edb15083a471924fd2fbf00e8eb3ba061ef156425e4bb4066e584ee
SSDEEP 384:LnuDmDZGXT6NYkxel0ZrS2Yh0WXIdGl+IWg6FU1sGWepc/WllN583oR9z5r7qE0f:LuwIOTxxZ22LwJ0FU1sxA8309z14
TLSH
T18AC24B11D36C8323CFAE2FB5D964D5822E78E38A2C33DB3D114CE1554C9BB889631279
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

1e:d4:81:e0:dd:1f:c2:e9:a3:a0:33:0d:7e:27:7c:34:b6:fe:8d:9a:5c:2f:3f:05:3a:86:be:16:14:3f:6f:f9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 30, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:c7:9a:a1:ee:dc:27:e2:f8:b7:00:00:00:00:01:c7

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:17:71:fb:2e:a5:af:01:1d:ea:00:01:00:00:02:17

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

22682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb

microsoft.extensions.dependencyinjection.abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3169f06618abe45ab59d964f1629bafee35b34a7c4b7434f6a29382eb82fb24a
MD5 b2b438377a88d8cbdf7cb5aac6409e89
SHA1 dacf26717076533fe452053b2a04610bd005a3f5
SHA512 8719105268d0b85782b248e53c265307382499fd4156038eb3baca788e986880aaefa4d18584756c8a9e49e41e0d4ec8e4b9943f08868e923a539ab4689a1be0
SSDEEP 768:RjT1o8x0nc6kEZdTMru4Y+/hztkP2RhL0ypjawq5c1qtivkjLBPO59zWcTA:RTP/WWa6Bky10ygwWco4vmLx4zWcTA
TLSH
T145535B6833FC8B72C7EF46B57AB055014B74FB472A12E75B3585D0AD1543BC860A0AFA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

59:1e:7c:ae:95:76:7c:45:b0:ec:3e:31:b9:22:0e:e4:21:dc:8c:d8:87:80:18:a9:c4:69:e9:6b:cd:18:f1:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 30, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

60678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb

microsoft.extensions.dependencyinjection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 184cddce357c17f6d01d6222ed8f9bdc62c0d8379816f657f9339de5f1cc7c07
MD5 e098fbaf0f4c1c6da978ac7aeff3f2d6
SHA1 5e0d1477edd630062f4124fa41f509387326a33d
SHA512 79708563b28d7ee53217fd95824ac24e3cd4f3889b7bc346fbf5068b97302682a60833efcd6ca531bca300884af5400accad7ba20a35c66e0db247944ab568c0
SSDEEP 1536:gPbhGjEmBQa/gSIW/U08GmvSmcwjowrQshsmugnjyL1zE:khoEmB/yMULTcmowrQGuL1I
TLSH
T15BA37D7563FC4B66C9EF2AB5A43541400F7AB68A3403E72D5EC8A16D2A97FC147213B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

2f:1c:3a:bf:d9:8e:c9:7f:20:8a:50:07:33:d9:e1:fe:10:20:fb:b3:1a:21:ec:5d:c2:25:0e:48:74:45:49:76

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 30, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

96954

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb

microsoft.extensions.logging.abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2813435ea9b77fcddddde1e07f662a6a235f84e1cadf2a965154d07cac6bd3bd
MD5 12d689acb50aa1387a4695a95a04dc10
SHA1 9f684ff8feffde6558fa8b002fdb160ded279ee1
SHA512 fc39af59aa1213f6d413bf390fd954e72aaf9e5d2a6d697450c3532b17e3c0e33737941083fcbc15d4b22b957f65c3e5652eb9721399f93924281843fad3dc71
SSDEEP 1536:2PQdMW7wYF5pvglCJbaUJD35XKYazOdzL:2YX7wUpc0uU1X3d3
TLSH
T139637C1A23EC0363CF7F4D76A86A91129B35D3967007E32B7DC8F158286BBC55B4127A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

31:34:92:48:a8:3c:1b:fe:c4:8a:64:e6:a9:2c:09:07:2e:d9:95:53:f6:d0:48:3e:c0:50:fe:29:d0:b8:b9:4c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 30, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

64742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net462/Microsoft.Extensions.Logging.Abstractions.pdb

microsoft.extensions.logging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c16a2bdd2180f5823177f9f146cc3026b5b2e518406c9d46204a67307e104b71
MD5 50a68db796230992ed4952943591d7c7
SHA1 f6aa5cd959e1dc7ecfcb039c9b9cef37f7f0f592
SHA512 da3223db856e570e0842d35991979a6e3e76fb51e7f5bf80686ad6d367a423286f12f64fe23c5ace5919e3fc3b2aad2d4f782e83cc028799cf693f1aad1d221c
SSDEEP 1536:E6aGqSpwQrDrrrrrrrqr4bxwZ92Q0GmXi1zBzf:EtGq6SMaZIGmS1Fzf
TLSH
T146335B0247AC8372CBAD1E74FAB895955B34C75A7053EB672DCCB0A219B3F9046112BF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

0a:04:d5:7b:e3:45:05:3f:ac:c4:c8:eb:0b:03:5d:23:85:e3:7c:36:38:de:65:26:6b:8d:a5:f2:27:38:93:0c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 30, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:c7:9a:a1:ee:dc:27:e2:f8:b7:00:00:00:00:01:c7

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:15:18:03:d3:81:07:26:7c:53:00:01:00:00:02:15

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

50138

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/Microsoft.Extensions.Logging/Release/net462/Microsoft.Extensions.Logging.pdb

microsoft.extensions.options.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a26ed828f31c5b6a37f4d37b9985b89a65aeb313508989d4bc4f54b392321101
MD5 05ba18fabf25e8d4260093f8eb0a5c8b
SHA1 81e9def6f6c70c7443f1d95bfbfccb0ab635f511
SHA512 a82fdc3f0237eb24ed2f5666422c9306fec674daa1f8aa679194254aed28adeab344b8d21f5c091b44eaa7c90ea0d80bc2b7b89be4779fc045d147a5a5bdaa4f
SSDEEP 768:63nzwVPfnjaifxMqdt9ROwIgPWM6sYRn+XzuF+zdEDuCxHI70FBu09zl:63nzwtVb/IgaRn6/dhIHI43uczl
TLSH
T1B6636C31B658C722CBFF8A71F935A4B20B75C3467402EB2F5ACDF15418677484DA263A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

da:fe:eb:ad:99:77:1d:52:72:f8:67:92:ef:68:c3:86:b8:61:0c:e8:af:8a:24:16:52:a3:52:ac:9d:e1:6e:01

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 30, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:c7:9a:a1:ee:dc:27:e2:f8:b7:00:00:00:00:01:c7

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

65422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/Microsoft.Extensions.Options/Release/net462/Microsoft.Extensions.Options.pdb

microsoft.extensions.primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8116dbec58276fa52261fcfe4fae4fc34e3ffb11f472f1fca102213eaebe64f4
MD5 c6b6009f52c4bbf93a7a266aef8ba510
SHA1 e7f62e654964b6d3de283bb7ee1654141fd5ca95
SHA512 f3f968281b2a93c68d85b232eb9b2e00445e6d2f67973dce37b26c2d3a2f44f62606949249925ac0d9d7e00115cc913a9959171bb7f702622afeab1656ade933
SSDEEP 768:+8f8DA8lIsFTzQ9yvTDTmsDavOPfX6WxINju+Juie4l9DRMnz9zJ8y:qlIsW9hsDavOPy3NjrJuiDlfMnZzCy
TLSH
T1A2336C11A3AC8737CFFF5979F49196524B38C7EA3612EB67658C905908A33C08B712B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

30:e5:51:21:83:b0:54:ed:df:cd:17:fc:4e:0e:2e:9a:66:81:59:32:fb:90:c8:e1:86:5c:d3:bb:d3:cc:35:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 30, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

45998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/Microsoft.Extensions.Primitives/Release/net462/Microsoft.Extensions.Primitives.pdb

microsoft.web.webview2.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 82587fa2c24a8038362f7b14bee39544cca4053207d746e8d16bd8fd3ba41467
MD5 cafa990293dca180d2ea806bfa479d40
SHA1 7b2ccc61c0486b3874e1ae822bc40c15bdeac2e4
SHA512 cfc50994f554e4b832df1de1c25d72f567651e3fb359ea3bb107aa35cd7758d8ddf33f25581bb9f572ce9b39703dba78cd87909f43d9b0e01edc077d8e063551
SSDEEP 12288:3/TcW1vbrB3ye+iKzORFNgeA+imQ9pRFZNIEJdIElxPrEIgcvLcglxMwCepM1STZ:3/13iF
TLSH
T153B4522223FD466AF6F26F75557412208AFAFCD6BE79E34D459C212D0D32B419AA0333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

d3:3a:55:e8:2c:c4:d6:4f:2d:b1:1a:16:8e:5b:f2:66:01:fd:e3:24:3c:33:f3:4f:b6:af:a5:40:fa:da:71:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 10, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

496246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb

microsoft.web.webview2.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2473eb3d73e95fb2960945c29bc799114b256df98e2b31b26563fe5abef90fb3
MD5 9eefa6ed07611e40bc0fc4e5416fa64d
SHA1 2b5020ad867c14a25ed9d20afdfffab23cb73b23
SHA512 d06fa86a7ecea231b9753a025879261c09acac0f4017afa627da004def0f0d90e434c118a9f3da14ae7ea4e3cb7e5c3c85c6da30799feaa26393136d88120d35
SSDEEP 768:zNGbP6+wTLtcZDgcEST3p4Jjrjh2jJFSUyauYv1JKia5/Zi/WGQKVu6bLm8K6Rte:pGm+ktcZDgcEST3p4JjrjaJFSUyau01M
TLSH
T169034B0083EC861BEAEF5EB875B091A11A7ABE837D60C39D5C84F19A1D737E059503B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

0b:57:c5:24:d7:8d:19:9d:82:b4:c5:87:dc:bd:64:c4:e5:4a:4b:f1:d8:c4:3d:7e:70:30:bf:84:89:44:47:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 10, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

33402

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\release\net45\Microsoft.Web.WebView2.WinForms.pdb

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 8, 2023

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2021 - Oct 29, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

704578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

opencvsharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ff86300fb6d475cbb39a2e92d3265f66f2a178acad5374c4236a1a2021657b1a
MD5 a9cb287b06a17a394f1bc1e2bcf2171b
SHA1 df56d09335983d4de0fa0a165571ca1a5d1237b1
SHA512 88a57a2ad95d6c0c2a28d01a582feeb4a0e6b59a38c4db15e60fb9195eb9344a12bfb20d29b5e4c049102768956ffb0151e520a0a07c61a10e3e065229d356fc
SSDEEP 12288:OuTma4jHF5et/7weta3sAfspU/1WFOzWk2rxOibg:OuTm5R5nUA0pU/1WFOk
TLSH
T13415F701BB905657CA8E8372D02A4F70E2B3E4E7339BDB4319B5A6791FA27D41E019D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

927798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\opencvsharp\opencvsharp\src\OpenCvSharp\obj\Release\netstandard2.0\OpenCvSharp.pdb

paddleocrsharp.dll

SHA256 5af4e96732bb6d91aaeaece30fd700caa18cb9767ec721f3ef130af4ca7c716d
MD5 172e3cb109a27f9dea2839cdbd1a830b
SHA1 3d3bf613796a18dcd86dffe615d21d1a859eba61
SHA512 85c3469a751e6e1d278c1cb227682258ecd860ee4fafd25c15afaac6d74395695351e5208ebbcc393fea492ab6461d05ea3d0fc374a7fc16015ea27f993ab6de
SSDEEP 384:QZuI/Uy7ggiigggiiI8pxMf8a4d2Z99NqtAAXYMtJ33M1RGcISbk7IKpBqJ8FyN7:y/UypPNExXYsJyGLSbkNqJ8FyN
TLSH
T149C2D62463A8F339DBED8E38A874525C06F2A2DE3511DBE9CF5870CE2F167541600BE6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\MyWorks\OpenSources\gitee\PaddleOCRSharp\PaddleOCRSharp\obj\x64\Release\net47\PaddleOCRSharp.pdb

puppeteersharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3318964365647bff70a0c82f9e6d1df648910bad10d82fccbb4690f581fd8b63
MD5 e7ed99173d6408814ec1e2e0a65ad557
SHA1 96083a63c65db3a7baa3afc7880b9a5ad61b02d2
SHA512 04bc9714eeaa6db5f63c467d95e4b3391ca350746d11aa61de5574825556cb089da741fa553dd6aaae77e9c5273639f5e79700c3c4944c678b8f2ab69c28e7c0
SSDEEP 12288:JQlw+UxyQAuMq5VzZBpx4bpfGG9+0/dBc8Kvn9FS:JYUxxM8DqbpuG9X/dBc8K/
TLSH
T13725080023B4D726F18F6579EA72511447B3E1266A30E78F2A0CE5DB6F93B41CC4AB63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

997922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

PuppeteerSharp.pdb

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3af1e07305bed0abe0cf32d9854e0a7f5f470216adee1b87d02350be09d31b35
MD5 b20c1ed526c9fd90569a340914864d32
SHA1 8c23283128d23f6cbc208e3a485a1cf1a9c0cb50
SHA512 c7de839aa129b73094678efea3da88073c3521c99e3533a0858ec8e0804db2004c4e84af12ecf4358ce134b12c66040fd04add9ab96c78414a247a7cbd0d75d5
SSDEEP 384:HRJyzxhqFAB5n55560IxEFuAUTcxR+sDWY82W6fX6HRN7gCJDtdQ5R9z1QUMtr:xJyYkx60IxeuSM2Wrds9z8
TLSH
T110B27E21C7DC421BCE7F5D7056B9DA862D3A43D5A503E62F108CE9081DE3789DB32AAD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

e3:fd:68:c9:ea:31:03:97:61:76:d7:4c:e4:86:cf:3c:be:86:85:7c:73:ee:69:b8:8e:fd:53:24:60:7d:38:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

18706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Buffers/Release/net462/System.Buffers.pdb

system.diagnostics.diagnosticsource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d97d0a57f820fe773b76283cee9b53b88cda300aac269d0837ab93759be344f5
MD5 1209cad7fdd1e9ac9a699cb497d048a0
SHA1 a2b126d033491eac955a44de1f086e04e0094b87
SHA512 68dd70f4447caafab1ed15b3cfd3718f321821e8ebc52d164c725dc745e51e224ddbd28cd8404b64704353a1855586ac2ce7c62516d48cfca1660b8518984b9a
SSDEEP 6144:WJW8g3H/UQX0HXzmfZxfaXzV6tO7IfgHziO:WJGH/Q3a0
TLSH
T1E3247D1033EC4736EEEF2B35F0A094054BB6E52B7456E78D6E44B4BE2D53B81AA11363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

dd:8c:79:83:88:7e:ac:b0:09:b0:7f:af:3b:36:ca:f7:bd:a4:93:b4:91:24:9f:23:09:fc:ce:fa:d4:83:d4:3b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 30, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:c7:9a:a1:ee:dc:27:e2:f8:b7:00:00:00:00:01:c7

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

217478

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/System.Diagnostics.DiagnosticSource/Release/net462/System.Diagnostics.DiagnosticSource.pdb

system.drawing.common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ca18383a2070518ae8c3e96cbd1705da283c8ada4ddf396217d2bcb7dcd03103
MD5 3c2445d3095f82ec8a526e7843a98ba9
SHA1 2f2c9d016ffc2bd7078104234e27ab2b010bd765
SHA512 9cb5564ee52c1b71c732026d0bdb8414c09ba0037e12440f1d122644a977fb95fa4f9c13666053e4fcce811e265f9b8afe60fe1b007d9d2e278cf0d0a8c243fa
SSDEEP 1536:4JbgUxvrIn01EkO/69KzwmOiGeCcSP8UIrdMe:41xvrInsEkO/AKzwm3C0UOdl
TLSH
T10833C652B3F8051DFEFB0BB57DB9A5154FBBBBD22A22D69C1414500D19A2FC092B1B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

09:6a:f6:5e:9f:d8:67:31:01:58:a5:1b:49:9f:49:7a:9e:86:3a:1d:3d:5f:0d:f8:55:97:84:d1:14:6d:c5:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2021 - Feb 10, 2022

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:462F-E319-3F20,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:58:70:5a:22:f7:be:96:e6:03:00:00:00:00:01:58

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 14, 2021 - Apr 11, 2022

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

0

Major OS version

4

Entry point

48750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Drawing.Common/net461-Release/System.Drawing.Common.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b8fe216aff0f6d162f8eefe7be1712162b7d8199e20ce2e70ffac36c7ce20a4c
MD5 35e6237ff5533342516bf01a46e4b7cd
SHA1 f8a118f07eea37ce732b487ab730646dedc46235
SHA512 dce731c61aea73d16813b0932d47ac94926d84d9077115ef147971b1e1c76a88e333ccd0f88b34fca9e2533f54c140947316fd63415199fe5f20a45cd0aef033
SSDEEP 3072:wPgSRYPuMbrhcabqwwwUtiPmu3XxNtvckP:2uPaaWwww7OuR4k
TLSH
T1F3E35CBC67C6DD12CB5F4C70A028621A5A31C63FAE42F7E215C9F4F436A27A935193D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

a4:39:e2:43:4e:c5:d8:14:7e:fb:ba:42:fc:56:b9:dd:2a:b9:0e:a1:5a:1a:ee:d1:46:3c:33:a1:91:9a:d7:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

138594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Memory/Release/net462/System.Memory.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
MD5 a57f205ce75d4e4a19020e8b627469c4
SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
TLSH
T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

0f:80:90:1b:17:38:ec:61:65:dd:0a:c6:a3:dc:d4:0b:33:38:e1:79:30:66:08:69:e4:67:38:b9:b5:4b:38:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

105250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Numerics.Vectors/Release/net462/System.Numerics.Vectors.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

e9:bd:64:c2:63:64:c7:c2:51:d3:cc:93:e1:f1:65:00:fd:e6:b6:bc:8e:9f:5a:34:69:8b:2a:49:55:41:8b:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\Release\net462\System.Runtime.CompilerServices.Unsafe.pdb

system.text.encodings.web.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e9c4f5eed186cb129c527c4b8d67d163ea2f2396e9d8b96e30b5e7c12203ce84
MD5 fa9d0d182c63c49a4c567f7c1652b6e6
SHA1 55ddfbe80762c02f9a9c65809f9ec3ef8f7f2ccc
SHA512 58f468c982ab66930ff37efb5a941db116e8c1aed66ebc23720a7b18f71bebe1e929bea76680294edb25f430c23d520b8a87e3a22064c5993d0396819a21cbe7
SSDEEP 1536:AOOgOOOc2yQDmBkKQh39thfavqcdUIUdu4OzfocSWnO73TT+zo:KyEmXQh39HfavqEUTjOzfo5WnMO0
TLSH
T198735E12A748C75AC75E153256A085619BF0DF6F2313F782585CB81E2B733C9EA0E2A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

93:c5:bf:87:63:20:6f:3f:df:14:8c:e6:1c:77:82:fb:5e:85:38:db:da:14:9d:a9:bd:23:e6:f9:c1:84:58:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

64978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Text.Encodings.Web/Release/net462/System.Text.Encodings.Web.pdb

system.text.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 86c3f263ae9b4469ab1266c80471087082447eb4a38e6b97bf5e84de15c07a1d
MD5 d7e1e8629da31f3482045f243edd50be
SHA1 d3ad7f529c0b9232206348842e31566ad7347135
SHA512 0ebfcae7cf17ca0c4299f6d1cd850f0f8959b49e6bbc05079fa6679838abff9eca3a09ad8158f7b0395dabb20a0b9a25efe1d8f645ca9ef69bedce45606a23d3
SSDEEP 6144:oQ4zRvmmBhTxZOnAHqBfFgICCSToJkR4mUfimb7MVM8iHtoqurICVLeV+kctqWan:BmhZBAXM3eVcTQKiyfVtQ1RCHe
TLSH
T1E4D43A0467E49F3BEADF5370B07941249BB5F81A6329E78B520844E93C937D29D837A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

14:84:37:79:2d:e6:3c:26:07:5a:7e:71:44:17:92:c8:60:46:ab:47:d5:40:e6:fc:ab:99:e2:c0:2e:9f:6c:8c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 17, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

637726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Text.Json/Release/net462/System.Text.Json.pdb

system.threading.tasks.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 af4e13ef418fd89b432de20cd1dfb7fa10a7179c8dd049c9856316e50c5949ca
MD5 0fff41795a1107691ec1e5054211c04a
SHA1 3439da9b7918fa0c17836acbe1fa4e05c40119ec
SHA512 1333847b76025af23a4a4dd421707732078673c96dcdb726a38b477c51606395002574fbcdbf224fd0ae5b80e8da8b2f02dd4972d88f31c36c3dcbf595510e90
SSDEEP 384:F7PVBSE/ug12sib05JCw0p8CUQefpnQKwU3RymGWuXWJwnHRN7rpGR9z04RI:9PV0iug12TY+bUKmGfXrY9z1
TLSH
T15FC28D6183B85113CF6F8E77D2A9CC175F74A3466A02E7391AECF2D40C5338A8A31275
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

16:d8:01:cf:fd:de:8b:33:89:18:e1:8b:1f:5e:60:e2:48:88:65:aa:1b:f1:2d:69:fc:ae:73:d7:f9:1a:25:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22842

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Threading.Tasks.Extensions/Release/net462/System.Threading.Tasks.Extensions.pdb

system.valuetuple.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7cd7ac314a72774b5e2255fd798f876926c63e19f9b8304cae25df012beabbcb
MD5 81dd9246981abe9a9f99ef1056d36cba
SHA1 e4351b41d2ff50e458cdcb35e50314d9a0122eae
SHA512 e1d32ccafb8d192c4f75f2bc53e30e72d1a9ff584957adac04a898941f9668867b1a1c321dc56c47a2d7c29da92f3a7e1c8ed9feac4c8777dbc84354f5570b98
SSDEEP 384:5b1gPit3W8GWe/hljHRN7wo/wGOrjR9zssVx:5ggmDjJ/wGOrF9zxx
TLSH
T136726DA64BAC4203DD7B5EB0A6F5E6833D7C67C31981956B16E2FA451C63780EB3063C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody

Digest

4a:0f:43:47:f8:b4:c8:5a:7c:ee:87:8f:99:70:15:c5:4e:e4:ad:95:38:33:5e:92:ff:25:a8:48:ea:2e:53:e5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 12, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

10858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ValueTuple/Release/net47/System.ValueTuple.pdb

Sharing

General

Malware Config

Signatures

File Explorer