supQ v4.zip
- SHA256 8d000758f68f5c5181e53972882b731e6450b2d6bf064992e6bf6de9499623eb
Overview
overview
6Static
static
3Release/IC...it.dll
windows10-2004-x64
1Release/IC...it.dll
windows11-ltsc_2024-x64
1Release/Mi...re.dll
windows10-2004-x64
1Release/Mi...re.dll
windows11-ltsc_2024-x64
1Release/Mi...pf.dll
windows10-2004-x64
1Release/Mi...pf.dll
windows11-ltsc_2024-x64
1Release/Module.dll
windows10-2004-x64
1Release/Module.dll
windows11-ltsc_2024-x64
1Release/Ne...on.dll
windows10-2004-x64
1Release/Ne...on.dll
windows11-ltsc_2024-x64
1Release/injector.exe
windows10-2004-x64
1Release/injector.exe
windows11-ltsc_2024-x64
1Release/ru...er.dll
windows10-2004-x64
1Release/ru...er.dll
windows11-ltsc_2024-x64
1Release/ru...er.dll
windows10-2004-x64
1Release/ru...er.dll
windows10-2004-x64
3Release/sc...NC.bat
windows10-2004-x64
3Release/sc...NC.bat
windows11-ltsc_2024-x64
3Release/sc...nce.js
windows10-2004-x64
3Release/sc...nce.js
windows11-ltsc_2024-x64
3Release/supQ.exe
windows10-2004-x64
1Release/supQ.exe
windows11-ltsc_2024-x64
1Release/supQ.exe
windows10-2004-x64
6Release/supQ.exe
windows11-ltsc_2024-x64
6Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Release/ICSharpCode.AvalonEdit.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Release/ICSharpCode.AvalonEdit.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Release/Microsoft.Web.WebView2.Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Release/Microsoft.Web.WebView2.Core.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Release/Microsoft.Web.WebView2.Wpf.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Release/Microsoft.Web.WebView2.Wpf.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Release/Module.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Release/Module.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Release/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Release/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Release/injector.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
Release/injector.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
Release/runtimes/win-arm64/native/WebView2Loader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
Release/runtimes/win-arm64/native/WebView2Loader.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Release/runtimes/win-x64/native/WebView2Loader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
Release/runtimes/win-x86/native/WebView2Loader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
Release/scripts/UNC.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
Release/scripts/UNC.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
Release/scripts/saveinstance.js
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
Release/scripts/saveinstance.js
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
Release/supQ.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
Release/supQ.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
Release/supQ.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral24
Sample
Release/supQ.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target supQ v4.zip
- Size 2.9MB
- Sample260804-s6ehzstejd
- SHA256 8d000758f68f5c5181e53972882b731e6450b2d6bf064992e6bf6de9499623eb
- MD5 c559ef6e7e31e26584be4bf0b0903fdd
- SHA1 2b4ea48708e06c9ab9e9eb39129ca5c51516d382
- SHA512 7b8bea9d2c2ee2bdbe9d2349aa41382845c8b6c1c8c062261059655fc5eb3c3146dc54cd1c5091f97bfc690b49e4b35ff4026fa31b65c02f3373dddd1f7ce611
- SSDEEP 49152:5AD0D826jIw301mocrvj3Zi4GsbSy1IUZb7iBCdX+EojvQO313AfQRcp40okeXKA:5AbDjIq01qTjJ5G8mRdRjvLSp40okKKA
- TLSH T185E53303C60B61B8FBC642BBB665509AC7A652D4D0F04A76EF7C7E782CD470729B9036
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/ICSharpCode.AvalonEdit.dll unpack001/Release/injector.exe unpack001/Release/supQ.dll unpack001/Release/supQ.exe
File Explorer
-
supQ v4.zip.zip 2.9MB
-
Release/ICSharpCode.AvalonEdit.dll.dll 608KB
-
Release/Microsoft.Web.WebView2.Core.dll.dll 681KB
-
Release/Microsoft.Web.WebView2.Wpf.dll.dll 82KB
-
Release/Module.dll1.8MB
-
Release/Newtonsoft.Json.dll.dll 706KB
-
Release/injector.exe.exe 49KB
-
Release/runtimes/win-arm64/native/WebView2Loader.dll148KB
-
Release/runtimes/win-x64/native/WebView2Loader.dll.dll 160KB
-
Release/runtimes/win-x86/native/WebView2Loader.dll.dll 121KB
-
Release/scripts/DexC Explorer.lua91B
-
Release/scripts/Infinite Yield.lua98B
-
Release/scripts/UNC.lua.bat 28KB
-
Release/scripts/sUNC Test.lua187B
-
Release/scripts/saveinstance.luau.js 1KB
-
Release/supQ.deps.json3KB
-
Release/supQ.dll.exe 721KB
-
Release/supQ.exe.exe 216KB
-
Release/supQ.runtimeconfig.json357B
Release/ICSharpCode.AvalonEdit.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 0fe9ac94aa22e60b32d670a3d35c58fef628d1b3352d56f32f2986bf5f96f844
- MD5 5b5bae107f9007dc699a29899171df43
- SHA1 34f7a876b5cf0c9ddf46c7e46cd3b9920db0b8ce
- SHA512 8a6262271d3e43bce9f64e119c1a36c338b77bb94ccad4dd25b007879b8c721bd5cd32e651f838e4fc4d8ab0b8b69d7b773c13b497c37c9b0e0e82ab70977410
- SSDEEP 6144:SZnm+2rRLUWzCplOmoG+HRksdH7Dn9JYD//T+jvD+cXXjaoUsCfqMZsCQIJjBZjl:SZf6UWkOH5H7JSLy3JCl
- TLSH T1ABD42A2933AC592AC27E1777F5720144A3FFFD87B269DB8F244461BA7D427224C41AA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
627866
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/ICSharpCode.AvalonEdit/obj/Release/net8.0-windows/ICSharpCode.AvalonEdit.pdb
mscoree
_CorDllMain
Name
.text
Size
605KB
Virtual Size
605KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Microsoft.Web.WebView2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 24b1a6be3a7956e00d0509d4eaebf08e418fc219e964b6c269d2e04439333685
- MD5 ae915341870f891f090228905277064c
- SHA1 749ebcdf4be274d7777124bd081f093403941cce
- SHA512 aa3f2efed0a7e91dbfae414f344f41ca8a5ea5ab05d93436526c6360676e962969e1f29c3e05d428de07571bc5e774cd091af05d5fd3826f564ffcdb4f56f0bb
- SSDEEP 12288:GJ4dCXzRKX4EcJupbSRi461R1VDrP3224c+iKmDRkRFNBMUFeA+imQ269pRFZNI/:GJ4dCXzRKX4EcJAD1RvQy
- TLSH T1F9E4301223FD8619F5F27FB9997412609BBABC97BD78C34D0698642D0D72B819DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
71:ae:24:6a:34:9c:85:3f:fc:49:ae:88:50:38:db:57:dd:2e:e6:b2:22:6c:38:db:65:ff:5a:fc:ea:02:57:c5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 30, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:27:d5:c0:83:c3:b1:2e:57:2d:00:01:00:00:02:27
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
694098
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
670KB
Virtual Size
669KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Microsoft.Web.WebView2.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 04151e577d83c6fe7a1bd1dc402b49db53ddbd1c48f031afc094b847b551bca6
- MD5 9fd59e7a28c266bacf161320acc22bb0
- SHA1 a1bc2450b4512c2196be410b7699100c8ad5bd42
- SHA512 c9a7eb9c8f4174529b66e83c48d6e6f09264ea893e8f89feff856d50b6bcc2a83da4cf0375a851e033ff062f90b437ed57c61eecc24ac5152a6331ceed17ff0f
- SSDEEP 1536:dh6tArbn5DTtWQZZHIPL2/GC3hJ8KYYUDHfy7yEW30bfc4JAyr4YeUqTHhvU0sdY:dh6irbnbWwZqjSJ8aUDHfyy30bfc4JAr
- TLSH T1BF836CB417FC8C23CAFE4ABC697042940FBDEB837A12D78F1589B5D9589338125523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
41:4f:ee:c8:48:bc:b0:2b:39:b0:7c:64:99:8a:fc:1b:4a:c1:72:a9:02:13:c2:98:eb:4a:14:15:3f:80:72:1d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 30, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:21:33:c0:35:fb:d2:0f:21:a4:00:01:00:00:02:21
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
80094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release Stable APIs\net5.0-windows10.0.17763.0\IIDOptimizer\Microsoft.Web.WebView2.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/Module.dll
- SHA256 88477335bff9430919a79744124b0a38a7d2f003e51bcb172c1a1e45f45b0248
- MD5 43c5f6843a45a39bbb35df1fff4f8b6b
- SHA1 5145e0fd42f18fea5d9628557b3faf57e8ab6428
- SHA512 dc607eecc70e1f018ffb8b6353a050f3cec109af9f48d981269d2737713012af9934cb1296099aa03cf9b9ece06f47bf851da19b18bf64f18fbc90f22a6f8a58
- SSDEEP 49152:Dodbq9bvIMCA9LDHGg9LVXBA5hzSQJxKhFNAYOKyxXA:lNIMCAFDHGg9LVXBahzSWxKnirxQ
- TLSH T1EF95D02AD8B742A55EB3A2F11D0100EE854073713EDEA53AF7AA5FCD19B4231B1B4F25
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a28c251dfe36d881e9e2462e171441b8b0ec156fe3f452602c9149b1b9efe05b
- MD5 c252fe44b67a08e6dab4eade3764db49
- SHA1 fcf801c0915cb47f400c74b1b459eb55ff4a5f9d
- SHA512 40656f812e273cd828b41ec58cba21dfe0cab186b8f5847744602005a9ba7caf1267729af8d37a420ea26f50221dcda85cc9695019a83f271fb81b6c32afc9c8
- SSDEEP 12288:BJJdZj8K4VopGZ5kYNkx8mJ0YHlyGBty0PJxqDo+3:B1J8xNe8MBBty06
- TLSH T159F46B0533E8CB2AE5EF6775B4314A1547F6F41AA2B2E74F6904A5ED0D83BC09D40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
db:69:79:e3:5c:70:08:83:fe:bc:7e:9a:7d:cc:6b:4a:a2:9f:06:b4:df:02:3b:79:7d:fb:2f:07:8c:1c:fe:e5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Sep 16, 2025
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0c:0d:22:a2:ef:64:2e:b8:88:c4:4f:a0:18:f0:0a:1b
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 4, 2024 - Nov 3, 2027
Subject
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05
Issuer
CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 19, 2020 - Nov 19, 2035
Subject
CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:4b:a1:b1:ad:e1:59:fc:e7:34:00:00:00:00:00:4b
Issuer
CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Nov 26, 2024 - Nov 19, 2025
Minor OS version
0
Major OS version
4
Entry point
715818
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
692KB
Virtual Size
691KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/injector.exe
- IMPHASH 11a799682b9a36d322f68c260caaedc3
- SHA256 5661789114d1715cf6aa612bc24357ca406293430e00a2cff7ffc542c184187c
- MD5 3716feb20236b8fd052ec59b79acefa1
- SHA1 963654245e6f75df6f494f64fe43218fa4184649
- SHA512 cc0c75db6ffb9741ffea166672b09f3f09f29b539d25aebe21c0a37ea6afc7cfd229af6a584e3964cb367a47b301b41960f714a65cd6e65fc0445ae8aeb4ed11
- SSDEEP 768:yMA2G5XOazGJeV1qubma/WYfYL0GxDq7w4EM+qN6vHz6:yMAF5emGJKdB/WYfYL0yqvEM46
- TLSH T188331962F3AC50D8E136C2BCDA635E42EB71B44D07107BEB079191922F17EE4A63D7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
31360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\supquarter\Documents\CompletedExecutorSrc\Injector\release\bin\injector.pdb
kernel32
GetProcAddress
VirtualAllocEx
ReadProcessMemory
VirtualFreeEx
GetTickCount
GetExitCodeProcess
GetModuleFileNameA
GetCurrentProcess
OpenProcess
GetFileAttributesA
GetCurrentProcessId
CloseHandle
FindNextFileA
FindClose
DuplicateHandle
GetTempPathA
CopyFileA
QueryFullProcessImageNameA
CreateFileA
DeleteFileA
K32EnumProcesses
VirtualProtectEx
VirtualQueryEx
Sleep
GetModuleHandleA
FindFirstFileA
WriteProcessMemory
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception
__current_exception_context
memmove
__C_specific_handler
memcmp
strrchr
__std_terminate
__std_exception_copy
__std_exception_destroy
memset
memcpy
strstr
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
fputc
_fseeki64
__acrt_iob_func
fsetpos
fflush
ungetc
fread
fwrite
setvbuf
fgetpos
_get_stream_buffer_pointers
__stdio_common_vfprintf
fgetc
fclose
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-string-l1-1-0
strlen
strcat_s
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_configure_narrow_argv
terminate
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_exit
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=259, version=35721,
count=10, id=260, version=35721,
count=26, id=261, version=35721,
count=6, id=257, version=35721,
count=5, id=257, version=33145,
count=147, id=1, productName=Unmarked objects,
count=4, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=258, version=36252,
Release/runtimes/win-arm64/native/WebView2Loader.dll
- SHA256 eef3eba85d4c28eebddf966f016b1b43df1ee584573210c5a6eb9483387467c4
- MD5 a3844afe1fc850b46d08935983c9f3ce
- SHA1 2a20fba705abe4e3444c282364c62483a0c08a22
- SHA512 968e581db5352975293b10dd4d0628839e561beefbb39e400c018f803b1a2f74d839ffe459ee4c4be9431a892deda0bb2bbe743a1105e28b5b2ff376a261451c
- SSDEEP 3072:nHYVsFqAsEendrQxJAcTsnKBEtJAtbEJHK4:Hdqou3n+EtJobyq4
- TLSH T174E3199367DD1843E6D6E73CCC678950132BFA788930C95E6152420EDE6FBC1DEB4A22
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/runtimes/win-x64/native/WebView2Loader.dll
- IMPHASH c0d801d5bafc25e481c3643ad4c50c86
- SHA256 239a9d6614a6cfade62b47cdb0be36e3069eedc438c3e0647a9e7b7c84ef6ea0
- MD5 cce1332e0af440bc54fdf04eb543d4a0
- SHA1 c7f6c049ff3eee4ed337a98d3163fbb5c4686ff7
- SHA512 3484febcb142beac708faa1775699450ff22f5ce13b7e90da4d6d27ac9bbedd1c2477dc33125cbcce00fc7d59d416588300fa7b3c1c607bda0d1e874cb0425a9
- SSDEEP 3072:qjAuqhU/3A5evuBdyoioiVO7kKlU9tKTTnhTEtJI8w6lKIc:36642lioiVOAqnpEtJs6W
- TLSH T1ADF35C57B3E500BBE1B7C27885A74A46EB7678111B609AEF0364433A1F237D0AE3D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
f7:6a:56:32:d8:b3:54:15:87:4b:a3:e9:77:16:02:e4:c4:2a:3e:ac:50:c8:9e:bb:f4:b3:6a:c0:77:fb:1a:a2
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 30, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
22496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
88KB
Virtual Size
87KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Release/runtimes/win-x86/native/WebView2Loader.dll
- IMPHASH ae0401679d3060f6a939c94983dfd354
- SHA256 5388b73b5ca00f1faf2a569cd923fdff00e316a254ef6df9fba240e3839a2c45
- MD5 b99ee8dbcfee7b2c17211c8be731e608
- SHA1 50eac72d43f0251bc89b24cdcf8411063b8c02b1
- SHA512 d34873575b32aa2a1745ef7f87cc266c534d169bec87a523d777af53722d07bc8aedb7591334b8be2012a4e18a0e012ea818176af8a59964d00943d0950cc9fc
- SSDEEP 3072:KyCDCc+IrkrCn0y/smK5dRMt2LILt4CVbA5ThnjuEtJZIJDI7vHNNSp:lUCWrkWdoduIELwnSEtJe2fNg
- TLSH T16CC36C00B5E08031E8BF15791878DA759B3F79A1DF608DEF2B9815A94E347D09F34B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
55:2d:2f:6b:f6:31:fd:78:31:40:a7:2f:e2:17:60:99:6f:de:ca:90:21:f8:a3:b5:15:d5:8a:9f:d9:0a:01:b1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 30, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9600-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:26:35:b4:3e:67:43:93:f6:1f:00:01:00:00:02:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
19744
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Release/scripts/DexC Explorer.lua
- SHA256 bb6943ad0c93a58cf8c7925e7b518b6f0748aab49e026d2672ef8526a5804304
- MD5 ab1f96db7b271d5888fc2bfb0abce8c2
- SHA1 62016d251b7c4adda96e2ab5a96b617504869ab3
- SHA512 092e357063f1c02a6fcd7d440c699acec58d767f3dca991f687f07ce1b7f7e953fc32e86df29412414826af420d94883d24cc8254791220546003b724a0d9041
- TLSH T1C7B012DFA401462D073184C1A60DA09DD921C00CD820C163D1E58414C6508275131D15
- MD5 SHA1 SHA512 TLSH
Release/scripts/Infinite Yield.lua
- SHA256 0d4c6ca6f3d473c9fe81f3952ddd76796b5cc8def107219a5b6dd9de4618744c
- MD5 e0246b17ddf86c45719e881d09987d64
- SHA1 797d7322d3b11d9065f6ddea181d63e1e82dbac8
- SHA512 ed989e87e89c2fd17f98a855fdc63f70d4a275c9c8e566b7f547b484b185c3f40f9a94fd1d314ff9c8f70f6f4223106bcfeda12a53676e9e98e62351872d9f7b
- TLSH T197B012BFD411926E0F3254C8481230D8CA30D42CCAB2C0E6D2FD4468917350BE030915
- MD5 SHA1 SHA512 TLSH
Release/scripts/UNC.lua
- SHA256 e8d53406c916b8e827c65c8f00d8a18b1379e693fd0379e8116e749bdf860cf5
- MD5 b76726d10354343d9af5c268e40b47c4
- SHA1 7103c78071be0c65c8b3a217168cf7909aef748e
- SHA512 5caffd8a06058e890fe4ae35430539281cf53fa791221189f0f6660778a83fa42cc3e5374ce06ff325420d92006c2bfe1003f1486714e889964075da66b046eb
- SSDEEP 768:JopEYRzOKMrGrE7BWf9r+T+f9TkIuP4hUUsbU8FqQFBF5UXzRFEe3cSG5Sg/i5rx:JEKcZuy9p
- TLSH T150D2866EF583B5A202F130F0F53FD009B676CD70A2395559B1DD50E46A289AC8893EFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/scripts/sUNC Test.lua
- SHA256 2b65fa532276a08ee1244e5da834142515c60851f663c19e06231a06f2865725
- MD5 ebe77591605689e27c4e8efde71c57a7
- SHA1 754dc7871de6f25cfa8dcecc39dc8f82df58a79f
- SHA512 a7235ffaf8f5094278b027356bf5530feec5345f2d018437af090ee8f4e3fefcb5c009540a685150ce741996925f8766f0abb7463a927472954bda2f0382b887
- TLSH T1ABC01269C84B8A7C52331580C44A3062EB26862A34BE1423F0FE40004E710A52416D1E
- MD5 SHA1 SHA512 TLSH
Release/scripts/saveinstance.luau
- SHA256 5d25b9199767db40f7b55da4c55d9ed2ae0948285ad57d7afe37580a5d90b783
- MD5 69c32e096d8a140e51d0bb025aa780d0
- SHA1 4cb9d31ddc37027a43dd58adf7f9ef9bb7ecc5d5
- SHA512 23506923eb832b568ee920156d98bf88fe17594f10d46398eb4c4fdf157897e9f3867e13e830008a415d309fa147143987a3c3bbc49bf44a3dc3971790bd56d5
- TLSH T1C531468F13132DB90A3910E4A94F7486BB7EA15D01359570A0FC78887B9676AA1E72CE
- MD5 SHA1 SHA512 TLSH
Release/supQ.deps.json
- SHA256 49034f1dc6303467ce45220b521a773ff1e0f5850fb3f43c289824c6a8f1a877
- MD5 fc372aa802084fb69f5c024e94e02837
- SHA1 d8fe2dce5f584f94f8bbc6bde4097586e597b772
- SHA512 3ecd0a95cd9456fa4a723519b983fc3e05200e71ae230a6b679e57f9ebf9265124cbbc094868b9f9f6dc74049f8feabcaa738ccf0574aff245f84f122d2e1ebe
- TLSH T1F9817522D4608C2704716BEA94374AC1FA25636F61426A6779FC659CCFB3F77A080F39
- MD5 SHA1 SHA512 TLSH
Release/supQ.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6b317314cb24041780c16a8c33f478a7f0b631a1ff1cdf18f5cc141b638c2297
- MD5 522e21338e21530ebf94286dbed08a00
- SHA1 54a44132f7b916f3823908b00437c0a750a3a056
- SHA512 25315de4d3da1e2657548e757da743dd8277323e2705889f93bc02986810c10538f394364f5c041f025f3e7094c567bd0117fc790cb5ffd2a47d6e773fc8b2f2
- SSDEEP 12288:XTkxjrq8wZo7/HPC/1bfACKc3STXO+kz55g7WkjACxqQLK8IPXD:XTc1vCRICKc3Sbf05ma00V7
- TLSH T173F4D01073FA0619F5BB4BB949B681404B3BBA1EA83CD71D35AE98DC1FA379245107B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
674586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\supquarter\Documents\supQ\obj\Debug\net8.0-windows\supQ.pdb
mscoree
_CorExeMain
Name
.text
Size
651KB
Virtual Size
650KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/supQ.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 6b14ceea049869ed8f7903a3421b643c3b3a93804fdb9aab6711d184a6aab7b7
- MD5 f335bd29b2185f55e09885ed792a7d58
- SHA1 dcf8613914a6152df52caad46a1da996ad39d074
- SHA512 63cec6a0012ab7b0da49d361142253b3b6b25829119d04d8e13adf777dfc33ed88a4c2f35ebd914e8693001e9532f122150c034ba3ffab2af0079157bc4e0876
- SSDEEP 3072:LqeXA/4yIbHkNPN+6H6xCYOigUE2653JBHjhXOm6NFOZqLia:LvdHkNFdaxmMEXJzXMFOkL
- TLSH T143248D07E6A850BEE1B7C679CD924C41FB72785A4B71A6CF07504E761E63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Release/supQ.runtimeconfig.json
- SHA256 a6a31e881a564ce497254b0cc044c32ade3cf5f02c6501e43c8425e8698b2c00
- MD5 35bc322bd42045632a8cb4fce81a90d2
- SHA1 351f78a6441ac2c8a34a03d92561000889260326
- SHA512 747651399d598da800d2d0090924b682bac3578c6718adf60cd6d99fa4f89ae8c343addb97476b64597c59007b2259fdc1a49380d7c33c8cfe220a30201ee718
- TLSH T192E08C3AC9144DA315F53BBED52AC287FE3047AB0158092AB6BC441C1F725625000F88
- MD5 SHA1 SHA512 TLSH