SDA.1.0.15.zip
- SHA256 308c76e9cb03bc69068e946e39dee566c4584801d2f8bed07ca2f1e5bf513364
Password
1234
Overview
overview
8Static
static
3SDA.1.0.15.zip
windows10-2004-x64
1SDA.1.0.15.zip
windows11-ltsc_2024-x64
1CommandLine.dll
windows10-2004-x64
1CommandLine.dll
windows11-ltsc_2024-x64
1Flurl.Http.dll
windows10-2004-x64
1Flurl.Http.dll
windows11-ltsc_2024-x64
1Flurl.dll
windows10-2004-x64
1Flurl.dll
windows11-ltsc_2024-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows11-ltsc_2024-x64
1Steam Desk...s.json
windows10-2004-x64
3Steam Desk...s.json
windows11-ltsc_2024-x64
3Steam Desk...or.exe
windows10-2004-x64
3Steam Desk...or.exe
windows11-ltsc_2024-x64
3Steam Desk...config
windows10-2004-x64
3Steam Desk...config
windows11-ltsc_2024-x64
3Steam Desk...or.exe
windows10-2004-x64
8Steam Desk...or.exe
windows11-ltsc_2024-x64
8Steam Desk...g.json
windows10-2004-x64
3Steam Desk...g.json
windows11-ltsc_2024-x64
3SteamAuth.dll
windows10-2004-x64
1SteamAuth.dll
windows11-ltsc_2024-x64
1SteamKit2.dll
windows10-2004-x64
1SteamKit2.dll
windows11-ltsc_2024-x64
1System.CodeDom.dll
windows10-2004-x64
1System.CodeDom.dll
windows11-ltsc_2024-x64
1System.IO.Hashing.dll
windows10-2004-x64
1System.IO.Hashing.dll
windows11-ltsc_2024-x64
1System.Management.dll
windows10-2004-x64
1System.Management.dll
windows11-ltsc_2024-x64
1protobuf-net.Core.dll
windows10-2004-x64
1protobuf-net.Core.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SDA.1.0.15.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SDA.1.0.15.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
CommandLine.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
CommandLine.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Flurl.Http.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Flurl.Http.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Flurl.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Flurl.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Newtonsoft.Json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Steam Desktop Authenticator.deps.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
Steam Desktop Authenticator.deps.json
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
Steam Desktop Authenticator.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
Steam Desktop Authenticator.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
Steam Desktop Authenticator.dll.config
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
Steam Desktop Authenticator.dll.config
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
Steam Desktop Authenticator.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral18
Sample
Steam Desktop Authenticator.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral19
Sample
Steam Desktop Authenticator.runtimeconfig.json
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
Steam Desktop Authenticator.runtimeconfig.json
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
SteamAuth.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
SteamAuth.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
SteamKit2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
SteamKit2.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
System.CodeDom.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
System.CodeDom.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
System.IO.Hashing.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
System.IO.Hashing.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral29
Sample
System.Management.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
System.Management.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
protobuf-net.Core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
protobuf-net.Core.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target SDA.1.0.15.zip
- Size 3.1MB
- Sample260910-wp3e9swvfy
- SHA256 308c76e9cb03bc69068e946e39dee566c4584801d2f8bed07ca2f1e5bf513364
- MD5 dd4f010cccced51a2712aba6c9f757d1
- SHA1 ac510f5f7472b26a19fde65acbc69812ab324b3a
- SHA512 48504b63f0dd5110a5ea96cf82459334812c7d1d246042c36256b214c9f8a1904a43f1f4adc251207524637599ac2ea7ff6c46ba40fbe76501b742a1b760571b
- SSDEEP 98304:mPjzvqHMMIbx5IxstnxDV+Sl/sRCXZxaJt5i4:+jWUbxWxszDV+Y/gCXZx2t5x
- TLSH T17CE5336C2B57B387B61873783AC2B74BC7469CE1A0B87E0FE131D426829F1191795DAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/CommandLine.dll unpack001/Flurl.Http.dll unpack001/Flurl.dll unpack001/Steam Desktop Authenticator.dll unpack001/Steam Desktop Authenticator.exe unpack001/SteamAuth.dll unpack001/SteamKit2.dll unpack001/protobuf-net.Core.dll unpack001/protobuf-net.dll
File Explorer
-
SDA.1.0.15.zip.zip 3.1MB
-
CommandLine.dll.dll 220KB
-
Flurl.Http.dll.dll 110KB
-
Flurl.dll.dll 39KB
-
Newtonsoft.Json.dll.dll 695KB
-
Steam Desktop Authenticator.deps.json8KB
-
Steam Desktop Authenticator.dll.exe 1.3MB
-
Steam Desktop Authenticator.dll.config855B
-
Steam Desktop Authenticator.exe.exe 211KB
-
Steam Desktop Authenticator.runtimeconfig.json515B
-
SteamAuth.dll.dll 42KB
-
SteamKit2.dll.dll 6.1MB
-
System.CodeDom.dll.dll 179KB
-
System.IO.Hashing.dll.dll 53KB
-
System.Management.dll.dll 305KB
-
protobuf-net.Core.dll.dll 293KB
-
protobuf-net.dll.dll 278KB
CommandLine.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8a55501cd1a1590a4bd93a17c6fdd2c01a0ed5bff1aea9036bdc78d98c9a3fad
- MD5 05c71fa3a6fc561d7a1f919437dbddfd
- SHA1 5a8cd6b38ee5d63c60c7747de6b5469ba5d1e6b2
- SHA512 1ab183d67220c8b8999b6ac032ac304f57960faf0e908404ffa3aa37c010d1a063d7734923a1576f18a69f7300b01fbbb395e3dca971e1b125b1b3b67ab858d0
- SSDEEP 3072:6G/MfUAMcCbPpKNQ6acJ8vG+L+ERbE9K/ShQvtpEI1aEvjc94OFS/Gi+XFEbliWb:6G/zAnUPpKO6acJ8n+Ez/5wECkliitf
- TLSH T1AF245C4653AD0363C7BF7775E8A0219F87F6E932F894E7DE748898F20D96342984035A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
230770
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\commandline\src\CommandLine\obj\Release\netstandard2.0\CommandLine.pdb
mscoree
_CorDllMain
Name
.text
Size
217KB
Virtual Size
217KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Flurl.Http.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cb204c6865563bc7f023f4655977cf5263536a75069b0e7e1d72a900a66f1eb5
- MD5 92978ac9a26252968e24b57d8399de0e
- SHA1 1c300ccb5ecec6ce641aea823bc937885fc06cce
- SHA512 2b77da40d5c6ed4fc84d8f83d7e5c0be5d3cf89e0232faccb7edc9babe06a00669989deeb33e57d0a33e4b0beb4583d907df039e87d7ce430875bb93e04346e9
- SSDEEP 3072:wirA/44rGXoYv0pKMOm/LvUvGzrlUVREvb:wzrGYYvcUfarM
- TLSH T1CDB32B0863BD8B12C7EF1BBAE0B411178AF6E50BB426F75D9E48A4F9282375165013F7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
118562
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/home/runner/work/Flurl/Flurl/src/Flurl.Http/obj/Release/net6.0/Flurl.Http.pdb
mscoree
_CorDllMain
Name
.text
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Flurl.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7ff7965161f6acc809f7154cd3ba1f56e0290974d4fcfc5944bd4c9030996383
- MD5 3dcec6350ac44f5c2368bad9a9b9d933
- SHA1 8c18a7cbe53e4b44d86e363db193ab77f1cd0cb5
- SHA512 44f9ff5c8acd562473f5db127bd4ae1ca4a3502a164a742e78a81f957083a5cc8fef3f256c0841dbbd8a15b2254e117b382a28368e2e645598f426244a8db51a
- SSDEEP 384:mbEJECh61EXALSGbLVRB1HrUFjY9xtA8DDBmncdI9i2bKebWE/nH7lqtQrZiPYHE:mEc6opbp9Uq9xtA8nScq7OWG66
- TLSH T107034B2573DCA3D7C7FF06BAB4E568668B70E229B453FB475E8881B5498B3501A103B3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
45406
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/home/runner/work/Flurl/Flurl/src/Flurl/obj/Release/netstandard2.0/Flurl.pdb
mscoree
_CorDllMain
Name
.text
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- TLSH T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
1234
Digest
12:a2:f8:77:6a:5b:04:46:97:f9:ac:0c:85:0b:b9:3c:9d:a2:ac:a9:a3:72:91:5b:d9:ed:db:47:d0:c2:9e:3d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
705086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
681KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Steam Desktop Authenticator.deps.json
- SHA256 adf125b94f2a7390226d69f5a4379d16ad734c53ab686ae731832d3121d9af2b
- MD5 927a49f255375dffb0659705aebf252e
- SHA1 fd19bb07abb6d214ca2c8dc768135ca685d4e033
- SHA512 67cb4ab79a39ba2e833f21936639e149e638a54daf33677ce2f96a8596662cbe64bc91caa2c9cc86670f37b34c922d7e4f9d5bc66125ee2ddfd4f67e032721ba
- SSDEEP 96:MDyLWFyM3M67Oya6VPi13nf4s8DeJ7HLcfXfEEXOSCrPuFc6ELyV68B+PtQfOtPJ:MDyLWDcdya8P037Cdlfuj
- TLSH T1DB12D916D9A00EB744756FA664394242F72A973B40001D8F78FC688CCF73E9BA1A5F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Steam Desktop Authenticator.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ad0a1fa18b923e4ae0ebbc445a2cb8cac25cff7d1d8309e67455367ec6f901c1
- MD5 39019e11937a2db8d008c2d2866afe88
- SHA1 3e5f5ee193d41d64a2ed7f39079115750fa6b656
- SHA512 6eb02cf2fef42d1d54e5fc23962d5e50f70beb3dc3af6e803c46cd992aea838c181d9a7a9bb384d07d8ed71df45effe8a894efcba45da4cfb020a0463371b8d5
- SSDEEP 6144:ubnApgGRLUPa4V66T6nw10zIf6T6nw10zIf6T6nw10zIf6T6nw10zIf6T6nw10zN:4ng4iJ
- TLSH T1C055E71262FEDD53E3E4067AF0D1D7F426613C1BF4A886A7E9903ED834BBE139420652
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
1262130
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Steam Desktop Authenticator.dll.config
- SHA256 09c28c1c49b85c87e7612d630400c28e9db146d2f1859c63c29b584b82839aa0
- MD5 8d5b7b3cf4e05e82c6459e4e762b8963
- SHA1 99ac522c47f09da46e04ba9e8e3b19c98f9c4c66
- SHA512 0696f2df1f6901c0941808bcea011173ee59e32122fc06bd17b59a679748e9e266ff9e7522cbbbfcb6111a82f6360f46ba2e738ee8809a93d63b67322984d0c9
- TLSH T18611F12151C47F954F7209637A719815CB7543B33C8C095CF4EE6A978F2298A1203176
- MD5 SHA1 SHA512 TLSH
Steam Desktop Authenticator.exe
- IMPHASH 0d90721887af12fe657c83b997d03c6f
- SHA256 51cc065f531ce8d9c0c9e2741faa15c5a23af1702c9a585a4aba8c00d487d0f5
- MD5 33b7b790a80319bc27f5d4a36b5314e5
- SHA1 f7d2c9ae1713ceab8f561fc4ca4046ffc357f534
- SHA512 8431038c823a4bb8c768e35ac8c2f2069e42e6804cd4ba5e762026726a2829335c8c8b6f54c9eba623a12c0a655a3626c35e30a0b928550f74983d463d1cacca
- SSDEEP 3072:rw0EwbZZGGdKsAf26qIJKHYwlBiSkkNpg2Xhbl2/JqGzT6nwMDM0zdLOu2oUQYA:9LGGdWQIJK3+cmx9zT6nw10zgD
- TLSH T16624A11122FECD63E3D11272F9E0DBF55664BC27FAA04197E2807EC97933D839961612
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
6
Entry point
60608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlUnwind
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
_controlfp_s
__p___wargv
api-ms-win-crt-stdio-l1-1-0
_set_fmode
fputwc
__p__commode
__acrt_iob_func
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
105KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=15, id=259, version=33808,
count=17, id=260, version=33808,
count=85, id=261, version=33808,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33138,
count=198, id=1, productName=Unmarked objects,
count=10, id=265, version=34123,
count=1, id=258, version=34123,
Steam Desktop Authenticator.runtimeconfig.json
- SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
- MD5 e0f6f18f9b152bc2d8c710b0214805d6
- SHA1 ae3d39e59fd6edc05792a76cdf4f02a637f52e29
- SHA512 80a6a9ff925bd1ba6f57fa1f7dd40de962001af97f8c2477d0b502728e23b6f412c74134e33efb36ccfeb08bbbeb678beb7e2e52fad24a763967eba8cf09b29e
- TLSH T1BDF02069CA106DB708B937BEC62AD183EA30536B00041D96B9FC080C2F776A22112F89
- MD5 SHA1 SHA512 TLSH
SteamAuth.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf1effec6cc66ef007d112a48f47228833b1b555a177f4ddb16a390fe5bc43f2
- MD5 6a2badbd7ae1abfdc315948c13be4eba
- SHA1 3713a528c292f68f2a10898df0f4528352f3f1f8
- SHA512 b79f911eefac48ed1f9995db067459670da8da6b5c20abed4b36136adb0963ce1f5faea15fe65be23fb90c57dcb58c851fbe93e0186a24b839ed781cda5992bd
- SSDEEP 768:gTFApkbSxELvhjebCTPA+elUlLgR/rS8GPKQ4jCuZpH:7xyvhp2lYsIP+CuL
- TLSH T184132B05A3AC8677E7AF0EFDF83042170A76B26ABC02EB5E4D2CB4DD25167414E117A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
48774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\PC\Desktop\WORK SDA MART 2025\SteamDesktopAuthenticator-1.0.15\lib\SteamAuth\SteamAuth\obj\Release\netstandard2.0\SteamAuth.pdb
mscoree
_CorDllMain
Name
.text
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
SteamKit2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 62968817d202b089d28e26178b0a353e01e41102986b96f615070e26bf0e2113
- MD5 e07865096339f3bedb3bdd1bc061fc63
- SHA1 1da4b568dd6bc9446647f1c3a9cc6221d5934ae1
- SHA512 cfb22cc676efa34a159888b772d081c637984b6426d5f2c99d86784711d237e04e601f0c43b5a00d46340ea76b37f2861fea57a82a48100e31cc1be8261e898f
- SSDEEP 98304:VOD+bvJACPxonNQshBl8Q8QY0OXNkXTlx:cD+bvJAQon7eQ8QY
- TLSH T14D56E71567D7CA3DDACF8134E070967D0270CA857720C766AD0CD66A2CE5B49BFE22A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
1234
Minor OS version
0
Major OS version
4
Entry point
6432662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/SteamKit2/SteamKit2/obj/Release/net8.0/SteamKit2.pdb
mscoree
_CorDllMain
Name
.text
Size
6.1MB
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.CodeDom.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 79e53505a9e9ceafcae4149c303cd1e45e65ca831e07b1e76447ee2df579f242
- MD5 d7742993fcd9ead7c036f1656ed3af2e
- SHA1 d1f84da3c6dfac053c35acfdfa7f9029fec9ca63
- SHA512 0cb2bcbe575a91accc1d2e5166a85b52dc0b57f61a90ea70204e68b566fc7f0ea10f69d5a769768dc625e019a4e347253aff467373f60de185b732dd24a258fd
- SSDEEP 3072:6MKminLBDcR+s0sK1eW0d5PIlwbrebRYSH+ltZh1cjdGfl:mLBk0szhebCSKfOA9
- TLSH T12C042B6437FC8376E7AE6674F028092146FCE44E7283DB5A8D8951F55E23740EE20B7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e3:af:b7:40:76:03:7d:2d:bd:7b:77:05:b1:66:4d:a1:ae:0d:19:55:ab:b8:af:ed:36:52:06:19:14:b9:74:52
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 11, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:2D1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fd:73:f9:68:5a:cd:0c:61:ed:00:01:00:00:01:fd
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
178622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.CodeDom/Release/net8.0/System.CodeDom.pdb
mscoree
_CorDllMain
Name
.text
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.IO.Hashing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 022d1366f82a0d216d136c5e664dfd4cb0b674506c5b778a343e32943a21c414
- MD5 b18ff6d3bfc61fe850e27906580c4224
- SHA1 bc09bbd122c7da2217ef3e1cb4cc2ce361f8b4cb
- SHA512 bf03b65207606538bd6243af6159ca256d7cadf426974568a07df7a9b1dc547c23a714909547231b13a1b8739e0d564a25b399dc71478c04fee3edd8f42b4823
- SSDEEP 768:7IK8f7JwG9PHZxqyu2E+qDAE0I3Eshpn/139lUWHKigFdv8WJdu49z0:7IBqQroAb6EypyWHYdv8WJJz0
- TLSH T134338D465BE8873BDD6E7D72D0305155463EC6AB2913FB8770EC64B418433CA8A263EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e8:cd:1b:f3:2f:e1:eb:62:5e:a2:95:a9:32:68:24:03:99:5c:0f:04:91:e6:3c:40:83:f4:12:08:fb:7e:cf:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 29, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fa:fb:3b:44:d3:77:33:c6:d3:00:01:00:00:01:fa
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
46758
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.IO.Hashing/Release/net8.0/System.IO.Hashing.pdb
mscoree
_CorDllMain
Name
.text
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1fd6733ec97240f987485d288941069d20d41142fbf0df40f9ae9dc9fe0cf12a
- MD5 9949c691a3dd78725b81d8b136b6d8f5
- SHA1 311ee678ede69289726e3f6a3a1f2f197bfd3ee7
- SHA512 1c0f66828f02d76001c508c6f95478d051141e156a08531ac930488753d72ae173d51e281fcf27a23fc9d716706551e426b1582a41cae309e688bd89cd784343
- SSDEEP 6144:syj+butGieusJEYE1SF7c39iwjwmppwbHV/ZqPJkobp04SxptV4:s4+butGieusJE31Shd/k9sxp0
- TLSH T15B64062023F88A44E8BF5FB5A0702060CFB5775B2A6EDB9C4D917CED19B2740856732B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
be:f2:d9:54:7d:21:56:16:f7:b8:f8:b1:22:f8:a7:a5:17:c8:75:35:3e:4b:86:ea:51:da:9b:16:ca:1b:2e:dc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Dec 11, 2024
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:d3:76:69:dc:80:ec:01:a2:43:00:00:00:00:03:d3
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 22, 2024 - Feb 19, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fc:18:a0:af:cc:69:5a:87:3a:00:01:00:00:01:fc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
306882
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net8.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
292KB
Virtual Size
291KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
protobuf-net.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 223274eabaded7c56eb137cbe783fbc9bda2ff98b9fd754e951f2b1231c4eb05
- MD5 37379d336e63f737992667598e7a5683
- SHA1 50cc1d5e179c4a7800f176339a4266a92968f20e
- SHA512 f35068b1eb537d5f625a5047028ff488b4859dc4bb16e0a453e9272109d2dc7f788dd7a0f1e2baf7c6f75edfaf078655f4ed9fefd70d152bfabb259fc42ca4fe
- SSDEEP 6144:UWXn29oH0OjEYpPcTFLMBlfiXk7alcBMRU1h4J:B3RcSfWO+U1h4J
- TLSH T115544A2417ED8936C6FE5A78F87048CD167ADF02D4FAEB99506853B9E8C33C48B04669
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
305206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
290KB
Virtual Size
290KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cb19363f3525719e95408d1e1e1c78fae65c82a34a9132751fe56c635389bd32
- MD5 85e4eed9d1ef301886fca75b08437313
- SHA1 b711bb1bde52d9b15b68274673eb25b6667d50ec
- SHA512 e60f39c31b6c02b69988de603fb50bfbcca80774af5351dd66b65d1807fa4705f5115d6983132f4ed85d5d9196ddc64d6595fbf8e5912da08c8287923c97d705
- SSDEEP 6144:M8SvqpPD+qjDIhhtEGIWdpGFUj6Pgkv7dYiHtT6RWQX:M8dPnjehqGIWdp3j6PT7dYiNTeW
- TLSH T14B546B6433EC4A26E6BE6A367870105146F9FD1FE8A6DB9D5C8050FC8D63B805E10BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
290670
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
276KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ