WorkshopDownloader.zip
- SHA256 61d6cf2f6a9c51f613621cca2a7549349ca8866ade7a8842f00267614d212543
Overview
overview
8Static
static
3WorkshopDo...er.zip
windows10-2004-x64
3WorkshopDo...er.zip
windows11-ltsc_2024-x64
8DepotDownl...s.json
windows10-2004-x64
3DepotDownl...s.json
windows11-ltsc_2024-x64
8DepotDownl...od.exe
windows10-2004-x64
1DepotDownl...od.exe
windows11-ltsc_2024-x64
8DepotDownl...od.exe
windows10-2004-x64
1DepotDownl...od.exe
windows11-ltsc_2024-x64
1DepotDownl...od.pdb
windows10-2004-x64
3DepotDownl...od.pdb
windows11-ltsc_2024-x64
8DepotDownl...g.json
windows10-2004-x64
3DepotDownl...g.json
windows11-ltsc_2024-x64
3DepotDownl...ICENSE
windows10-2004-x64
3DepotDownl...ICENSE
windows11-ltsc_2024-x64
3DepotDownl...er.dll
windows10-2004-x64
1DepotDownl...er.dll
windows11-ltsc_2024-x64
1DepotDownl...t2.dll
windows10-2004-x64
1DepotDownl...t2.dll
windows11-ltsc_2024-x64
1DepotDownl...ng.dll
windows10-2004-x64
1DepotDownl...ng.dll
windows11-ltsc_2024-x64
1DepotDownl...rp.dll
windows10-2004-x64
1DepotDownl...rp.dll
windows11-ltsc_2024-x64
8DepotDownl...on.cfg
windows10-2004-x64
3DepotDownl...on.cfg
windows11-ltsc_2024-x64
3DepotDownl...re.dll
windows10-2004-x64
1DepotDownl...re.dll
windows11-ltsc_2024-x64
1DepotDownl...et.dll
windows10-2004-x64
1DepotDownl...et.dll
windows11-ltsc_2024-x64
1WorkshopDo...ro.exe
windows10-2004-x64
7WorkshopDo...ro.exe
windows11-ltsc_2024-x64
7SteamWorkS...py.pyc
windows10-2004-x64
3SteamWorkS...py.pyc
windows11-ltsc_2024-x64
8Behavioral task
behavioral1
Sample
WorkshopDownloader.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
600 seconds
Behavioral task
behavioral2
Sample
WorkshopDownloader.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral3
Sample
DepotDownloaderMod/DepotDownloaderMod.deps.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral4
Sample
DepotDownloaderMod/DepotDownloaderMod.deps.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
600 seconds
Behavioral task
behavioral5
Sample
DepotDownloaderMod/DepotDownloaderMod.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral6
Sample
DepotDownloaderMod/DepotDownloaderMod.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral7
Sample
DepotDownloaderMod/DepotDownloaderMod.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
DepotDownloaderMod/DepotDownloaderMod.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
DepotDownloaderMod/DepotDownloaderMod.pdb
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral10
Sample
DepotDownloaderMod/DepotDownloaderMod.pdb
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral11
Sample
DepotDownloaderMod/DepotDownloaderMod.runtimeconfig.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral12
Sample
DepotDownloaderMod/DepotDownloaderMod.runtimeconfig.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
600 seconds
Behavioral task
behavioral13
Sample
DepotDownloaderMod/LICENSE
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral14
Sample
DepotDownloaderMod/LICENSE
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
600 seconds
Behavioral task
behavioral15
Sample
DepotDownloaderMod/QRCoder.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
DepotDownloaderMod/QRCoder.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
DepotDownloaderMod/SteamKit2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
DepotDownloaderMod/SteamKit2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral19
Sample
DepotDownloaderMod/System.IO.Hashing.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral20
Sample
DepotDownloaderMod/System.IO.Hashing.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral21
Sample
DepotDownloaderMod/ZstdSharp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral22
Sample
DepotDownloaderMod/ZstdSharp.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral23
Sample
DepotDownloaderMod/lastsavelocation.cfg
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral24
Sample
DepotDownloaderMod/lastsavelocation.cfg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
600 seconds
Behavioral task
behavioral25
Sample
DepotDownloaderMod/protobuf-net.Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral26
Sample
DepotDownloaderMod/protobuf-net.Core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral27
Sample
DepotDownloaderMod/protobuf-net.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral28
Sample
DepotDownloaderMod/protobuf-net.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral29
Sample
WorkshopDownloader_Pro.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral30
Sample
WorkshopDownloader_Pro.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
600 seconds
Behavioral task
behavioral31
Sample
SteamWorkShopDownloaderpy.pyc
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral32
Sample
SteamWorkShopDownloaderpy.pyc
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
600 seconds
General
- Target WorkshopDownloader.zip
- Size 22.1MB
- Sample260908-fn72cssbpc
- SHA256 61d6cf2f6a9c51f613621cca2a7549349ca8866ade7a8842f00267614d212543
- MD5 f0a31a635c5c11aebd83298c38810312
- SHA1 3506b2300ddb41f38d8012f9a355e6c5c4462da9
- SHA512 56dbfc64e04e77e6f25447bda7921eee666c083b96a9b4c3dd5f6ba15d21bc577c1c7e71687972f239fb21e5ae66c8fe20da41249023767f705346dcb74ddd66
- SSDEEP 393216:frZHRKhkzLA1n9SoM9hHnLrwPSLg8BvyZMd0SAEkWEI6U11K/78+p5:DZHRKqzLA1gRRrMevGMdvkI6U11KT8+z
- TLSH T18E3733FEE9682DDDF9AAD37924B590418ACDE44C0CEAC460A0E887D58C575EC3D6270F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyarmor 1 IoCs
resource yara_rule static1/unpack001/WorkshopDownloader_Pro.exe pyarmor - Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack001/WorkshopDownloader_Pro.exe pyinstaller - Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/DepotDownloaderMod/DepotDownloaderMod.dll unpack001/DepotDownloaderMod/DepotDownloaderMod.exe unpack001/DepotDownloaderMod/QRCoder.dll unpack001/DepotDownloaderMod/SteamKit2.dll unpack001/DepotDownloaderMod/ZstdSharp.dll unpack001/DepotDownloaderMod/protobuf-net.Core.dll unpack001/DepotDownloaderMod/protobuf-net.dll unpack001/WorkshopDownloader_Pro.exe unpack001/pyarmor_runtime_000000/pyarmor_runtime.pyd
File Explorer
-
WorkshopDownloader.zip.zip 22.1MB
-
DepotDownloaderMod/DepotDownloaderMod.deps.json7KB
-
DepotDownloaderMod/DepotDownloaderMod.dll.exe 172KB
-
DepotDownloaderMod/DepotDownloaderMod.exe.exe 190KB
-
DepotDownloaderMod/DepotDownloaderMod.pdb50KB
-
DepotDownloaderMod/DepotDownloaderMod.runtimeconfig.json482B
-
DepotDownloaderMod/LICENSE17KB
-
DepotDownloaderMod/QRCoder.dll.dll 141KB
-
DepotDownloaderMod/SteamKit2.dll.dll 6.2MB
-
DepotDownloaderMod/System.IO.Hashing.dll.dll 54KB
-
DepotDownloaderMod/ZstdSharp.dll.dll 386KB
-
DepotDownloaderMod/lastsavelocation.cfg70B
-
DepotDownloaderMod/protobuf-net.Core.dll.dll 292KB
-
DepotDownloaderMod/protobuf-net.dll.dll 278KB
-
WorkshopDownloader_Pro.exe.exe 19.6MB
-
SteamWorkShopDownloaderpy.pyc21KB
-
downloader_settings.cfg99B
-
pyarmor_runtime_000000/__init__.py103B
-
pyarmor_runtime_000000/__pycache__/__init__.cpython-313.pyc232B
-
pyarmor_runtime_000000/pyarmor_runtime.pyd.dll 625KB
DepotDownloaderMod/DepotDownloaderMod.deps.json
- SHA256 4c7728140a17ec8b2664fd6cedc94f5356260ada99a66b9e8512c10c6430b4d7
- MD5 9a4aecaa4858a8ac676999b996ec5256
- SHA1 bd3b92e8295d93432702df45a8a537d02f633d49
- SHA512 ea05f741cc13dcc3670838ab930e2433243e042c984cfca45cdc0681e78239a324b29eacc85479340f62ccb4cc18804e1161e8fe8d73d13de7fd5f5551dd49bd
- SSDEEP 96:pT/yMFIb7vDbKcu8Dagej13k7HLcfXfYPeBPYbjC6P25j1M9Sp9GNtcpfgqBNF8j:p9335x917Oc1jWBjN5t
- TLSH T1D3F1DD25D4905DB78530BB6159398241F629277F84005E8F78FCA89DCF73E8BA252F39
- MD5 SHA1 SHA512 SSDEEP TLSH
DepotDownloaderMod/DepotDownloaderMod.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f6200eadeb9e36f6e1529a9592302bd04c17c2be3416bd43641a66262c777e99
- MD5 5d1c24c4a27adccad5341f365122534e
- SHA1 c0661680a150f02d937ee394eda4662b16ee1aab
- SHA512 ac467ee3dae0be05ea9b72951156a906d57e78792bd694e2e7b6bffc8b556995c35800d422d748db790b75665b18efae6947458018f9ef9d7a08f6b440ba111f
- SSDEEP 3072:56lBaLzrYRGp+6PJqV+UYmxiRo1n6hp4b2CLhD5HiVTLjNbODWUzO:ew+GLiJxiSwvCvULjMW6
- TLSH T1D304B3136FB8865DD5BFEA742472952206FABD83943BDAC9348875DB0A737C094E0723
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
135062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\tools\DepotDownloaderMod_git\DepotDownloaderMod\DepotDownloader\obj\Release\net9.0\DepotDownloaderMod.pdb
mscoree
_CorExeMain
Name
.text
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
DepotDownloaderMod/DepotDownloaderMod.exe
- IMPHASH 45e4653ae633e067079dd72666b0158b
- SHA256 dd8fdae42102ccf61ed98892c723ec935c86cdb551f1a9c05d4d573ee74f0e58
- MD5 f00e1ba88545732abfcf0b5e4bcf5c62
- SHA1 1355b630e366bb9da9886042390c08efe1e65c22
- SHA512 f2782810958638cbe7097defd76f36b5bbe6e8e7ef0c4421878fc7c9f980a5392cb777b92d42ac5e868ffc02748f3b38d79ef97cd0fd7db97227e591ccd41f39
- SSDEEP 3072:S9rMW83f4Mai9dMzhj0Whrnd6eiO5Qsd35NpejAJx3+p5JmmKrj38OXWUzF:CAWSf4M9lurnd35qAJxup5Jm7fVW6
- TLSH T18114C2076FA801ADD1AEE27889930A02E3F67C97476392CB3350B56B1E776D09DF9311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
75904
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetFinalPathNameByHandleW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
CreateFileW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
CloseHandle
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
_get_initial_wide_environment
_initialize_wide_environment
_errno
_configure_wide_argv
_initterm
_set_app_type
_seh_filter_exe
_cexit
_initterm_e
exit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_exit
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
__p___argc
terminate
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
calloc
free
api-ms-win-crt-time-l1-1-0
_time64
wcsftime
_gmtime64_s
api-ms-win-crt-stdio-l1-1-0
fputwc
_set_fmode
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__p__commode
setvbuf
_wfsopen
fflush
__acrt_iob_func
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
__pctype_func
setlocale
___mb_cur_max_func
_unlock_locales
_lock_locales
_create_locale
_configthreadlocale
_free_locale
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
_wcsdup
toupper
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=34321,
count=12, id=260, version=34321,
count=87, id=261, version=34321,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=206, id=1, productName=Unmarked objects,
count=10, id=265, version=34438,
count=1, id=258, version=34438,
DepotDownloaderMod/DepotDownloaderMod.pdb
- SHA256 3508dbe17a8eb3cdefda1e0d85cc00624963fb3e949da776fbc9b64e207a3bee
- MD5 3b20e111c15b269910930ded95855c92
- SHA1 f019036ac0688658806d7b120fb93c54b98417b6
- SHA512 087ab85f1ee08b7d4f82343e7024d0af3bd3e34e524bd1d801f3862237f7cbd0f32367690b001290daea9dbff42b7cbf5cbbf613092e827d1bea45765488366a
- SSDEEP 768:6nrQiPfskRh5U+SHdZ09kl4KmLoBSZjS04EvMGl0CPhLW15bsWB774vM7gSM8:Efskqj+klcLoBN0TvT0ks/b5B7e+z
- TLSH T174333927C740DA66C55643B284A3C2587338C204E747DF73B3D9B2B9EC5B7598BB2268
- MD5 SHA1 SHA512 SSDEEP TLSH
DepotDownloaderMod/DepotDownloaderMod.runtimeconfig.json
- SHA256 ab8e3ebb2edfba8d0abc0aa80b96d96cc5957c4d1861b30b51b162b6472742a8
- MD5 4a36f9d048d9a42ceba901d36416b506
- SHA1 fb9ff088e9191438d986377cea35785b79347a5f
- SHA512 c4180455a446af2f50121706043947b1caf69a36c83988001233db4130a1e78569b90efd60d306d093b2944159d112f86d652e3e99dc7fc775e7434c3c62677e
- TLSH T115F027B5CE006C6309BA767AC530C042EA38936B00145CA670FD080C2F3BAE61322F46
- MD5 SHA1 SHA512 TLSH
DepotDownloaderMod/LICENSE
- SHA256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643
- MD5 b234ee4d69f5fce4486a80fdaf4a4263
- SHA1 4cc77b90af91e615a64ae04893fdffa7939db84c
- SHA512 aee80b1f9f7f4a8a00dcf6e6ce6c41988dcaedc4de19d9d04460cbfb05d99829ffe8f9d038468eabbfba4d65b38e8dbef5ecf5eb8a1b891d9839cda6c48ee957
- SSDEEP 384:ghUwi5rpL676yV12rPd34ZomzM2FR+dWF7jUI:gmFWixMFzMdm7jUI
- TLSH T13A82A42E770443F205C202A16A4F68DFA32AD5B9723E1155386DC15E236FE35C3BFA99
- MD5 SHA1 SHA512 SSDEEP TLSH
DepotDownloaderMod/QRCoder.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3c5674f67a97fd9ed38dd537d892ee9efd328afad4d6c1d67f99fde2c108dd57
- MD5 fed90f5e75d7649536ce358deac4a504
- SHA1 a68b2cf92016c0b28cab2cc0d11ee82c8fb4202a
- SHA512 baffd27057ce5dff645cacc6516b222cab122254ad0c0544ff09731818acc718ba7b254b84db358c0e9e4e923f37642e945c0c9384b025f561890594d382678b
- SSDEEP 3072:CHsGRxTqD2JyWxl4sYpO/T8EeQQPIkf533jVFXQos:CHsIJlYpZzIk9
- TLSH T19EE34C2CA7FCCA13E2FF2B7DA87041044F71B4567976EB5E1E9CE99D0952B804811BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
138922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\QRCoder\QRCoder\QRCoder\obj\Release\net6.0\QRCoder.pdb
mscoree
_CorDllMain
Name
.text
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
DepotDownloaderMod/SteamKit2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2931f875143f17e104bd4de59cb839c84211b11c3b2aaa0bdd5257fe0b3ceed6
- MD5 ac2d6bb647d8ff495d45f9c49b6b0942
- SHA1 bcb2dfbf323e8c7a3a96b68813a9ec4e63893b7a
- SHA512 abd5b5efff44ad49679027725812257cb25a3b466055e4fecd4099e9e1bd3638c6a5013d37ddf68755ed0b36fc7305ba2ab2b92262a4ea568624b7f11ff77993
- SSDEEP 98304:/Zh/VhqahWmftFWt7901kKEIXhwQ7hbbGQ8QYteF/kXTlx:/Zh/V825ftF4m1LXh9IQ8QY
- TLSH T18456F85297B8CA3ECB8A523BD070923D12B2D6013321CB59AD1AD5E91DC1B4D6FF6372
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6467186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/SteamKit2/SteamKit2/obj/Release/net8.0/SteamKit2.pdb
mscoree
_CorDllMain
Name
.text
Size
6.2MB
Virtual Size
6.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
DepotDownloaderMod/System.IO.Hashing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a1ca98abdf21ef16e4a8a1c2b9f8b3819957bde39495bc6d4eddaf0453407853
- MD5 9c6054fd59720cc6b1fd1140600a6c0f
- SHA1 5fbe4e5bcd1cb294a4380cfbb38f1b5670b754b3
- SHA512 def62472cb2e069c0e3674e04b1e35ee806dcac0481949d8de5dc70e9114de5d1aeed32581da010958ed4b83cabf74c6e26abdc801a30213720825cbf0c35c77
- SSDEEP 768:k/KjHF4xX3Uq71onDBw9fScSAE0I3o2PpJ/1nNTQSlFigFddSjQtay49zAj:MqCkBxcSAb6oSpiSLddkQcPzAj
- TLSH T116437C475798873BDD5F1C3790317698063EC2A73E12BB4670A899B95D433CD8A213EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e5:3a:b4:8a:9a:3f:d7:16:e3:48:92:2a:ac:8b:7c:f1:f8:91:8d:15:2d:d7:32:67:cc:e0:ee:2e:18:88:70:cf
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 14, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
47666
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.IO.Hashing/Release/net9.0/System.IO.Hashing.pdb
mscoree
_CorDllMain
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
DepotDownloaderMod/ZstdSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f0149a8f123c9ab8baf67df78096ba5b4d983c1030ad52ac1099a3f713eb60c0
- MD5 6722e1b9f8755c2b8054f41701a865b5
- SHA1 461fb3ca0bf33fc7b46f072e5a6446e8ba68b508
- SHA512 ab6db17bd8c50456d5eaefe41b69f642aae1b139c0ec60149b676ad00146086ca595134399ca53776a739afee905131d6894e81638431508224b93f401362b80
- SSDEEP 6144:1bD24+9QP86+8/JaXsJA+M7nntkTDkH5xUQwzQfiN5x4Vdy3xV:5qW869JU3HRP6N5xp
- TLSH T1A7846C36B3C58F95FA8F0B7484A5049A81BE6069FA5BF39B7CAC84D869053D1DC05BC3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
400974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Work\c#\ZstdSharp.v2\src\ZstdSharp\obj\Release\net9.0\ZstdSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
384KB
Virtual Size
383KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
DepotDownloaderMod/lastsavelocation.cfg
- SHA256 49c331fc005c4ac8dcf500240ca92c4ae44fff0dadbf253a0c0c34f152697e0f
- MD5 a11dd3451f73181d1ffda60ae72dcbd1
- SHA1 68ad47474b0f66cd1e8a3c0e245e6c9d127548a6
- SHA512 ba066d7c12ef7474e1cce1535bb54711bd1daf3c3aa21f2194b709e85fa74c8dccee6391cf9d4ad5ebf07ef6c34905609aa2a03b294dff1d65fcd5b76557c4dd
- TLSH T130A022AE0A838882AAA03E20C23C08030CA0300320A8A20020F0AE8E8B0C03830E023B
- MD5 SHA1 SHA512 TLSH
DepotDownloaderMod/protobuf-net.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d8b333ec409d0cc23954a1da07028e54cdaca7d1061a52e4ae265baef63d8bd1
- MD5 c9e1fba894d88d13876ee6f8d81e9fcc
- SHA1 1dc00b1941024220ca916f67d8b287c650117fa2
- SHA512 4e82a66cc0733c870f09d3bd211215fb324ff2b607847031167423f612862bed5641e9caff53b4bedde404411967c36c4ce28d1a062415c9fbe2b90630eb1b35
- SSDEEP 6144:zmn2A/S2g/tHkRSccbgO/loOnbQhqbL+lYiyhHI:9H/LQhKhH
- TLSH T120545C2817FD8E22C6BE5679FC3445D816B9DE03D466EB855098A3A7F8C63C49F003B9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
304654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
DepotDownloaderMod/protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c482090bf4002b2b65a576a0e44ffa860b63086ff8c3db122f7ea480aeb6f2d7
- MD5 305615fb0986cbd49d3f49968a59e2fa
- SHA1 5515a500a2374dc3028e99b182a2c9ce812d90af
- SHA512 132b3a2db3ae23b48f1ade853ab0d1fe1bc5f9356055aea9f86a221fa0e1164a0ac35c0a5583b4defd88c116b5491f9367f1530bc48c7142855abc79e76f278e
- SSDEEP 6144:FN7lyJxq8Os/VwIwktPdkAsfk82l0SX1rUIf4zOAf5AwwO4wq/m:FAx9iIwiT6I+558wq
- TLSH T1BF546C2863EC4A56F6BF6A75AC30418447F7FD1BE466EB4D8D8050FD8E137824A10BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
290282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
275KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
WorkshopDownloader_Pro.exe
- IMPHASH dcaf48c1f10b0efa0a4472200f3850ed
- SHA256 64109c55eb7216ed219b3531f01d3e5c82534a3e31083e992fde27e34d365e11
- MD5 29a14d3ae222a539d0674e5c7e439d52
- SHA1 08fd09299deadff56cffffb23cfab99070c03cc7
- SHA512 3c2b6635d6adf3e29a04d378c7bbfc67d9a67a6c40bef5791982bd868c7d083874af5e50efa151511adc4e3a72e8dec5e50d4415bd20d3b1f31070981a0313aa
- SSDEEP 393216:cT/GjmFDauMiCTNX0r2aUNarru5W8ZKLbTuCmrXsWAq4t4MaxZQhIAGO:MujmF/Xkcz4W8sHKCmLw4MaxZQCAGO
- TLSH T1882733DDB79408D9EDBAE33DA4E1A46387C9709A0BB0C59787F089A20C535D8FE71742
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyarmor
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
55856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsFree
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
FlsAlloc
FlsGetValue
FlsSetValue
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
175KB
Virtual Size
175KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=183, id=261, version=33140,
count=12, id=260, version=33140,
count=10, id=259, version=33140,
count=3, id=253, version=35207,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=11, id=257, version=33140,
count=159, id=1, productName=Unmarked objects,
count=27, id=260, version=35215,
count=1, id=258, version=35215,
SteamWorkShopDownloaderpy.pyc
- SHA256 a95fe51313f3405441cd2b99f3c4cba90e92b3774642e836c5411522cc787c74
- MD5 76fded9c8e4228c89909199defb8836c
- SHA1 d755143d342d6c780fd6283b93e4fadc038c09da
- SHA512 60397e175a3a6ae97c9e6536e077b785f2ba217315855699cd728aed4068785e3f183c6857545858cfdd09cdd5080d50d222e89fc042a06829e3839dde76560f
- SSDEEP 384:ZsJkDqtsH5krjNEDJfSLFAnP6xaVLddwALFBOtkqlQH0EUfCnpmE:ZDq6H5ONcABkPgaJdXHOtLiH0E4CpmE
- TLSH T10CA2D059B32CAC7DEBDAD476C1416493A8B8A3AEC446094B9A5F53D080F03685DC43FE
- MD5 SHA1 SHA512 SSDEEP TLSH
downloader_settings.cfg
- SHA256 c8f35cf9a65e5ecfd70dc58a145e695ea56498e9852ec279b63b03ef50ba13d3
- MD5 099db257949f47b9d9098461b666daeb
- SHA1 6d41cc5923eacb9b35fed6a75a589a400d48dfe8
- SHA512 2d53ac51f1cf49b4c914ec9adce1f05f335ac4dd658ed3619af3ac06216a6151aafa635ec4988113d86ca4d5ba2588a1dadc8d5893c7cc19a7ede386b9964f1f
- TLSH T184B0128E83C76B1100A568BA213900F204DEA6735424610040D42C06C53232414F3C2B
- MD5 SHA1 SHA512 TLSH
pyarmor_runtime_000000/__init__.py
- SHA256 0347d2f201cc1accf428f2ec865f825dd6efd03b45a3bbe8a7617eb4d4af1c30
- MD5 84f4f66205047866d268e11ec2b888b8
- SHA1 7a96098b58659decbbbedb537f987488e5f105a6
- SHA512 154e6f11c4d1d2e30684d670daee49c255d24b258affe9c90da422a0f8aa189669638319c167fb86944367255dc241661075ae93489f17f2536e5fb3bf62feff
- TLSH T1F9B0124116903F87B33251C9C6673038476570832FC144641E45517447D2519CC46212
- MD5 SHA1 SHA512 TLSH
pyarmor_runtime_000000/__pycache__/__init__.cpython-313.pyc
- SHA256 41d39ef7b4886125587e20be55ecc2bbd563bdb3b53bd22b43cc39ebe3089899
- MD5 67ff9043395d6b5d10a07bc50e7d2427
- SHA1 52769fba611bb17d3245cfdd43c3c2910da74805
- SHA512 22628a188f4ba4f6ed732038f9e26deb9e20f8708ef8d27d11964a8d8c12ee9205d8056378a9ce9e9c6ae6bc7be007d759f47cd837514d93c27ca14509e111c8
- TLSH T1F5D0A74584415B13E17050758131A7A81696D5889987C0035C1C127D96ED6028920A0B
- MD5 SHA1 SHA512 TLSH
pyarmor_runtime_000000/pyarmor_runtime.pyd
- IMPHASH ee385b1f474d84c677e4af3aba22248c
- SHA256 d08861729387f40ff576da91edce86ad4824e46b3cad7f748f2be295baa811a7
- MD5 b58e36a429f9e044f7c7ae264db1961a
- SHA1 28d989af0b99ae3308ddca1b6c8c72c602b30b29
- SHA512 a84adbf1119650f8d05f86f599a7c8fd715e27268e2ccd7d8d8177d5b2b9561d581e7a90f93fcfbbb59e78afc2911dec9cff96db988835945853fa365c074001
- SSDEEP 12288:a9Vtet7AtRTshSvnctjdcg7fUoPtuyOVnE8vaEUk:a9fQoctjdcg7fUoPtuyOVntjU
- TLSH T10ED4294BE1FA29D0E6B6D17C078BF2337C3ABA488160775B755CD3A127D0A5212E5F22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
python313
PyArg_ParseTuple
PyBuffer_FillInfo
PyBuffer_Release
PyBytes_AsString
PyBytes_AsStringAndSize
PyBytes_FromStringAndSize
PyBytes_Type
PyCFunction_GetSelf
PyCFunction_Type
PyCMethod_New
PyCell_Get
PyCell_New
PyCell_Set
PyCode_GetCode
PyCode_Type
PyComplex_FromCComplex
PyComplex_ImagAsDouble
PyComplex_RealAsDouble
PyComplex_Type
PyDict_Copy
PyDict_DelItem
PyDict_GetItem
PyDict_GetItemString
PyDict_New
PyDict_Next
PyDict_SetItem
PyDict_SetItemString
PyDict_Type
PyDict_Update
PyErr_CheckSignals
PyErr_Clear
PyErr_ExceptionMatches
PyErr_Fetch
PyErr_Format
PyErr_GivenExceptionMatches
PyErr_NoMemory
PyErr_NormalizeException
PyErr_Occurred
PyErr_Restore
PyErr_SetFromWindowsErr
PyErr_SetObject
PyErr_SetString
PyEval_EvalCode
PyEval_GetBuiltins
PyEval_GetFrame
PyExc_AttributeError
PyExc_EOFError
PyExc_ImportError
PyExc_NotImplementedError
PyExc_OverflowError
PyExc_RuntimeError
PyExc_StopIteration
PyExc_SystemError
PyExc_SystemExit
PyExc_TypeError
PyExc_UnboundLocalError
PyExc_ValueError
PyException_SetCause
PyException_SetContext
PyException_SetTraceback
PyFloat_FromDouble
PyFloat_Pack8
PyFloat_Type
PyFloat_Unpack8
PyFrozenSet_New
PyFrozenSet_Type
PyFunction_GetCode
PyFunction_NewWithQualName
PyImport_ExecCodeModuleObject
PyImport_GetModule
PyImport_GetModuleDict
PyImport_ImportModule
PyImport_ImportModuleLevel
PyImport_ImportModuleLevelObject
PyIter_Next
PyList_Append
PyList_AsTuple
PyList_GetItem
PyList_New
PyList_Sort
PyList_Type
PyLong_AsInt
PyLong_AsLong
PyLong_AsLongAndOverflow
PyLong_AsVoidPtr
PyLong_FromLong
PyLong_FromVoidPtr
PyLong_Type
PyMem_Free
PyMem_Malloc
PyMem_Realloc
PyMemoryView_FromBuffer
PyMethod_Function
PyMethod_Type
PyModule_Create2
PyModule_GetDict
PyModule_GetFilenameObject
PyModule_GetName
PyModule_Type
PyNumber_Add
PyNumber_And
PyNumber_AsSsize_t
PyNumber_FloorDivide
PyNumber_InPlaceAdd
PyNumber_InPlaceAnd
PyNumber_InPlaceFloorDivide
PyNumber_InPlaceLshift
PyNumber_InPlaceMatrixMultiply
PyNumber_InPlaceMultiply
PyNumber_InPlaceOr
PyNumber_InPlacePower
PyNumber_InPlaceRemainder
PyNumber_InPlaceRshift
PyNumber_InPlaceSubtract
PyNumber_InPlaceTrueDivide
PyNumber_InPlaceXor
PyNumber_Invert
PyNumber_Lshift
PyNumber_MatrixMultiply
PyNumber_Multiply
PyNumber_Negative
PyNumber_Or
PyNumber_Positive
PyNumber_Power
PyNumber_Remainder
PyNumber_Rshift
PyNumber_Subtract
PyNumber_TrueDivide
PyNumber_Xor
PyOS_double_to_string
PyOS_string_to_double
PyObject_ASCII
PyObject_Call
PyObject_CallFunction
PyObject_CallFunctionObjArgs
PyObject_CallMethod
PyObject_CheckBuffer
PyObject_DelItem
PyObject_Format
PyObject_GetAttr
PyObject_GetAttrString
PyObject_GetBuffer
PyObject_GetItem
PyObject_GetIter
PyObject_GetOptionalAttr
PyObject_IsSubclass
PyObject_IsTrue
PyObject_Repr
PyObject_RichCompare
PyObject_SetAttr
PyObject_SetItem
PyObject_Str
PyObject_VectorcallDict
PySequence_Check
PySequence_Contains
PySequence_List
PySequence_Tuple
PySet_Add
PySet_New
PySet_Type
PySlice_New
PySys_GetObject
PyThreadState_Get
PyTraceBack_Here
PyTuple_GetItem
PyTuple_GetSlice
PyTuple_New
PyTuple_Pack
PyTuple_SetItem
PyTuple_Size
PyTuple_Type
PyType_IsSubtype
PyUnicode_AsEncodedString
PyUnicode_AsUTF8
PyUnicode_AsUTF8AndSize
PyUnicode_DecodeUTF8
PyUnicode_FromFormat
PyUnicode_FromKindAndData
PyUnicode_FromString
PyUnicode_InternInPlace
PyUnicode_New
PyUnicode_Type
Py_BuildValue
Py_DecRef
Py_IncRef
Py_InspectFlag
_PyBytes_Resize
_PyErr_BadInternalCall
_PyErr_Clear
_PyErr_ExceptionMatches
_PyErr_Format
_PyErr_SetString
_PyList_Extend
_PyLong_FromByteArray
_PyLong_New
_PyObject_CallMethod
_PyObject_LookupSpecial
_PyObject_MakeTpCall
_PyObject_NewVar
_PyRuntime
_PySet_NextEntryRef
_PyThreadState_GetCurrent
_PyUnicode_FromId
_PyUnicode_InternImmortal
_PyUnicode_InternMortal
_PyUnicode_JoinArray
_Py_CheckFunctionResult
_Py_Dealloc
_Py_EllipsisObject
_Py_FalseStruct
_Py_GetConfig
_Py_NoneStruct
_Py_TrueStruct
_Py_ctype_table
_Py_hashtable_compare_direct
_Py_hashtable_destroy
_Py_hashtable_hash_ptr
_Py_hashtable_new_full
_Py_hashtable_set
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegEnumKeyExA
RegGetValueA
RegOpenKeyExA
iphlpapi
GetAdaptersAddresses
GetNetworkParams
kernel32
CloseHandle
CreateFileA
CreateFileMappingA
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
FlushViewOfFile
FormatMessageA
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LocalFree
MapViewOfFile
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock
msvcrt
__iob_func
_amsg_exit
_errno
_get_osfhandle
_initterm
_lock
_mktime64
_snprintf
_stat64
_time64
_unlock
_vsnprintf
abort
calloc
clock
exit
fprintf
fputc
fread
free
fwrite
getc
getenv
isprint
isxdigit
malloc
memcmp
memcpy
memmove
memset
rand
realloc
signal
sprintf
srand
strchr
strcmp
strerror
strlen
strncmp
strncpy
strrchr
strstr
toupper
vfprintf
user32
wsprintfA
ws2_32
WSACleanup
WSAGetLastError
WSAStartup
closesocket
connect
gethostbyname
htons
inet_ntoa
ioctlsocket
ntohl
recv
recvfrom
select
send
sendto
setsockopt
socket
PyInit_pyarmor_runtime
Name
.text
Size
520KB
Virtual Size
520KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
676B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ