Release.rar
- SHA256 650b5170977178f56167e383fbee82d29416e8598cfd3ef4ca53de1af02417ac
Overview
overview
3Static
static
3Release/ne...od.exe
windows10-2004-x64
1Release/ne...od.exe
windows11-ltsc_2024-x64
1Release/ne...od.exe
windows10-2004-x64
1Release/ne...od.exe
windows11-ltsc_2024-x64
1Release/ne...er.dll
windows10-2004-x64
1Release/ne...er.dll
windows11-ltsc_2024-x64
1Release/ne...t2.dll
windows10-2004-x64
1Release/ne...t2.dll
windows11-ltsc_2024-x64
1Release/ne...ng.dll
windows10-2004-x64
1Release/ne...ng.dll
windows11-ltsc_2024-x64
1Release/ne...rp.dll
windows10-2004-x64
1Release/ne...rp.dll
windows11-ltsc_2024-x64
1Release/ne...re.dll
windows10-2004-x64
1Release/ne...re.dll
windows11-ltsc_2024-x64
1Release/ne...et.dll
windows10-2004-x64
1Release/ne...et.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Release/net9.0/DepotDownloaderMod.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
30 seconds
Behavioral task
behavioral2
Sample
Release/net9.0/DepotDownloaderMod.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
30 seconds
Behavioral task
behavioral3
Sample
Release/net9.0/DepotDownloaderMod.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
30 seconds
Behavioral task
behavioral4
Sample
Release/net9.0/DepotDownloaderMod.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
30 seconds
Behavioral task
behavioral5
Sample
Release/net9.0/QRCoder.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
30 seconds
Behavioral task
behavioral6
Sample
Release/net9.0/QRCoder.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
30 seconds
Behavioral task
behavioral7
Sample
Release/net9.0/SteamKit2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
30 seconds
Behavioral task
behavioral8
Sample
Release/net9.0/SteamKit2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
30 seconds
Behavioral task
behavioral9
Sample
Release/net9.0/System.IO.Hashing.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
30 seconds
Behavioral task
behavioral10
Sample
Release/net9.0/System.IO.Hashing.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
30 seconds
Behavioral task
behavioral11
Sample
Release/net9.0/ZstdSharp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
30 seconds
Behavioral task
behavioral12
Sample
Release/net9.0/ZstdSharp.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
30 seconds
Behavioral task
behavioral13
Sample
Release/net9.0/protobuf-net.Core.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
30 seconds
Behavioral task
behavioral14
Sample
Release/net9.0/protobuf-net.Core.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
30 seconds
Behavioral task
behavioral15
Sample
Release/net9.0/protobuf-net.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
30 seconds
Behavioral task
behavioral16
Sample
Release/net9.0/protobuf-net.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
30 seconds
General
- Target Release.rar
- Size 1.7MB
- Sample260920-3hlmhavwdy
- SHA256 650b5170977178f56167e383fbee82d29416e8598cfd3ef4ca53de1af02417ac
- MD5 7fe5a0b3ddb44ec700e5c6148d8a8f4c
- SHA1 421c53e3843c5633ec681fcc9441e75cda997d02
- SHA512 a933c1722f8bc96f918e1546c7f5c46545b9f34492ae5011437cf7a5e02484d07b7f44fec481165f900e074be99bd86eee3105c25180c8dafbe6ec0c1359ea4c
- SSDEEP 49152:5u2dhKP6mM+tu5Rm9H2k9HndS0ATey0jwlP8Gk:5ueQZM+tmRFk9HdhOeTslP8Gk
- TLSH T1248533EE6019D178A24E6B3F618E6F515E148E10D6880C75FD8581A00E7BF53EEBD0BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/Release/net9.0/DepotDownloaderMod.dll unpack001/Release/net9.0/DepotDownloaderMod.exe unpack001/Release/net9.0/QRCoder.dll unpack001/Release/net9.0/SteamKit2.dll unpack001/Release/net9.0/ZstdSharp.dll unpack001/Release/net9.0/protobuf-net.Core.dll unpack001/Release/net9.0/protobuf-net.dll
File Explorer
-
Release.rar.rar 1.7MB
-
Release/net9.0/DepotDownloaderMod.deps.json7KB
-
Release/net9.0/DepotDownloaderMod.dll.exe 172KB
-
Release/net9.0/DepotDownloaderMod.exe.exe 190KB
-
Release/net9.0/DepotDownloaderMod.runtimeconfig.json482B
-
Release/net9.0/LICENSE17KB
-
Release/net9.0/QRCoder.dll.dll 141KB
-
Release/net9.0/SteamKit2.dll.dll 6.2MB
-
Release/net9.0/System.IO.Hashing.dll.dll 54KB
-
Release/net9.0/ZstdSharp.dll.dll 386KB
-
Release/net9.0/protobuf-net.Core.dll.dll 292KB
-
Release/net9.0/protobuf-net.dll.dll 278KB
Release/net9.0/DepotDownloaderMod.deps.json
- SHA256 4c7728140a17ec8b2664fd6cedc94f5356260ada99a66b9e8512c10c6430b4d7
- MD5 9a4aecaa4858a8ac676999b996ec5256
- SHA1 bd3b92e8295d93432702df45a8a537d02f633d49
- SHA512 ea05f741cc13dcc3670838ab930e2433243e042c984cfca45cdc0681e78239a324b29eacc85479340f62ccb4cc18804e1161e8fe8d73d13de7fd5f5551dd49bd
- SSDEEP 96:pT/yMFIb7vDbKcu8Dagej13k7HLcfXfYPeBPYbjC6P25j1M9Sp9GNtcpfgqBNF8j:p9335x917Oc1jWBjN5t
- TLSH T1D3F1DD25D4905DB78530BB6159398241F629277F84005E8F78FCA89DCF73E8BA252F39
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/net9.0/DepotDownloaderMod.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 f6200eadeb9e36f6e1529a9592302bd04c17c2be3416bd43641a66262c777e99
- MD5 5d1c24c4a27adccad5341f365122534e
- SHA1 c0661680a150f02d937ee394eda4662b16ee1aab
- SHA512 ac467ee3dae0be05ea9b72951156a906d57e78792bd694e2e7b6bffc8b556995c35800d422d748db790b75665b18efae6947458018f9ef9d7a08f6b440ba111f
- SSDEEP 3072:56lBaLzrYRGp+6PJqV+UYmxiRo1n6hp4b2CLhD5HiVTLjNbODWUzO:ew+GLiJxiSwvCvULjMW6
- TLSH T1D304B3136FB8865DD5BFEA742472952206FABD83943BDAC9348875DB0A737C094E0723
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
135062
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\tools\DepotDownloaderMod_git\DepotDownloaderMod\DepotDownloader\obj\Release\net9.0\DepotDownloaderMod.pdb
mscoree
_CorExeMain
Name
.text
Size
124KB
Virtual Size
123KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/net9.0/DepotDownloaderMod.exe
- IMPHASH 45e4653ae633e067079dd72666b0158b
- SHA256 dd8fdae42102ccf61ed98892c723ec935c86cdb551f1a9c05d4d573ee74f0e58
- MD5 f00e1ba88545732abfcf0b5e4bcf5c62
- SHA1 1355b630e366bb9da9886042390c08efe1e65c22
- SHA512 f2782810958638cbe7097defd76f36b5bbe6e8e7ef0c4421878fc7c9f980a5392cb777b92d42ac5e868ffc02748f3b38d79ef97cd0fd7db97227e591ccd41f39
- SSDEEP 3072:S9rMW83f4Mai9dMzhj0Whrnd6eiO5Qsd35NpejAJx3+p5JmmKrj38OXWUzF:CAWSf4M9lurnd35qAJxup5Jm7fVW6
- TLSH T18114C2076FA801ADD1AEE27889930A02E3F67C97476392CB3350B56B1E776D09DF9311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
75904
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
shell32
ShellExecuteW
advapi32
RegCloseKey
ReportEventW
RegisterEventSourceW
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
kernel32
TlsFree
CreateActCtxW
ActivateActCtx
GetLastError
FindResourceW
GetWindowsDirectoryW
GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetStdHandle
GetModuleHandleExW
GetFinalPathNameByHandleW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
FindClose
CreateFileW
MultiByteToWideChar
GetConsoleMode
GetFileAttributesExW
LoadLibraryA
CloseHandle
WriteConsoleW
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
OutputDebugStringW
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
user32
MessageBoxW
api-ms-win-crt-runtime-l1-1-0
_get_initial_wide_environment
_initialize_wide_environment
_errno
_configure_wide_argv
_initterm
_set_app_type
_seh_filter_exe
_cexit
_initterm_e
exit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
_exit
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
__p___argc
terminate
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
calloc
free
api-ms-win-crt-time-l1-1-0
_time64
wcsftime
_gmtime64_s
api-ms-win-crt-stdio-l1-1-0
fputwc
_set_fmode
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__p__commode
setvbuf
_wfsopen
fflush
__acrt_iob_func
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
__pctype_func
setlocale
___mb_cur_max_func
_unlock_locales
_lock_locales
_create_locale
_configthreadlocale
_free_locale
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
_wcsdup
toupper
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=34321,
count=12, id=260, version=34321,
count=87, id=261, version=34321,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33140,
count=206, id=1, productName=Unmarked objects,
count=10, id=265, version=34438,
count=1, id=258, version=34438,
Release/net9.0/DepotDownloaderMod.runtimeconfig.json
- SHA256 ab8e3ebb2edfba8d0abc0aa80b96d96cc5957c4d1861b30b51b162b6472742a8
- MD5 4a36f9d048d9a42ceba901d36416b506
- SHA1 fb9ff088e9191438d986377cea35785b79347a5f
- SHA512 c4180455a446af2f50121706043947b1caf69a36c83988001233db4130a1e78569b90efd60d306d093b2944159d112f86d652e3e99dc7fc775e7434c3c62677e
- TLSH T115F027B5CE006C6309BA767AC530C042EA38936B00145CA670FD080C2F3BAE61322F46
- MD5 SHA1 SHA512 TLSH
Release/net9.0/LICENSE
- SHA256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643
- MD5 b234ee4d69f5fce4486a80fdaf4a4263
- SHA1 4cc77b90af91e615a64ae04893fdffa7939db84c
- SHA512 aee80b1f9f7f4a8a00dcf6e6ce6c41988dcaedc4de19d9d04460cbfb05d99829ffe8f9d038468eabbfba4d65b38e8dbef5ecf5eb8a1b891d9839cda6c48ee957
- SSDEEP 384:ghUwi5rpL676yV12rPd34ZomzM2FR+dWF7jUI:gmFWixMFzMdm7jUI
- TLSH T13A82A42E770443F205C202A16A4F68DFA32AD5B9723E1155386DC15E236FE35C3BFA99
- MD5 SHA1 SHA512 SSDEEP TLSH
Release/net9.0/QRCoder.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3c5674f67a97fd9ed38dd537d892ee9efd328afad4d6c1d67f99fde2c108dd57
- MD5 fed90f5e75d7649536ce358deac4a504
- SHA1 a68b2cf92016c0b28cab2cc0d11ee82c8fb4202a
- SHA512 baffd27057ce5dff645cacc6516b222cab122254ad0c0544ff09731818acc718ba7b254b84db358c0e9e4e923f37642e945c0c9384b025f561890594d382678b
- SSDEEP 3072:CHsGRxTqD2JyWxl4sYpO/T8EeQQPIkf533jVFXQos:CHsIJlYpZzIk9
- TLSH T19EE34C2CA7FCCA13E2FF2B7DA87041044F71B4567976EB5E1E9CE99D0952B804811BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
138922
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\QRCoder\QRCoder\QRCoder\obj\Release\net6.0\QRCoder.pdb
mscoree
_CorDllMain
Name
.text
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/net9.0/SteamKit2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2931f875143f17e104bd4de59cb839c84211b11c3b2aaa0bdd5257fe0b3ceed6
- MD5 ac2d6bb647d8ff495d45f9c49b6b0942
- SHA1 bcb2dfbf323e8c7a3a96b68813a9ec4e63893b7a
- SHA512 abd5b5efff44ad49679027725812257cb25a3b466055e4fecd4099e9e1bd3638c6a5013d37ddf68755ed0b36fc7305ba2ab2b92262a4ea568624b7f11ff77993
- SSDEEP 98304:/Zh/VhqahWmftFWt7901kKEIXhwQ7hbbGQ8QYteF/kXTlx:/Zh/V825ftF4m1LXh9IQ8QY
- TLSH T18456F85297B8CA3ECB8A523BD070923D12B2D6013321CB59AD1AD5E91DC1B4D6FF6372
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6467186
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/SteamKit2/SteamKit2/obj/Release/net8.0/SteamKit2.pdb
mscoree
_CorDllMain
Name
.text
Size
6.2MB
Virtual Size
6.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/net9.0/System.IO.Hashing.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a1ca98abdf21ef16e4a8a1c2b9f8b3819957bde39495bc6d4eddaf0453407853
- MD5 9c6054fd59720cc6b1fd1140600a6c0f
- SHA1 5fbe4e5bcd1cb294a4380cfbb38f1b5670b754b3
- SHA512 def62472cb2e069c0e3674e04b1e35ee806dcac0481949d8de5dc70e9114de5d1aeed32581da010958ed4b83cabf74c6e26abdc801a30213720825cbf0c35c77
- SSDEEP 768:k/KjHF4xX3Uq71onDBw9fScSAE0I3o2PpJ/1nNTQSlFigFddSjQtay49zAj:MqCkBxcSAb6oSpiSLddkQcPzAj
- TLSH T116437C475798873BDD5F1C3790317698063EC2A73E12BB4670A899B95D433CD8A213EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
e5:3a:b4:8a:9a:3f:d7:16:e3:48:92:2a:ac:8b:7c:f1:f8:91:8d:15:2d:d7:32:67:cc:e0:ee:2e:18:88:70:cf
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Mar 14, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:40:14:fc:0b:e8:3e:f1:24:5f:00:00:00:00:04:40
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 19, 2024 - Nov 12, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:09:08:07:e0:f9:5c:8c:e6:55:00:01:00:00:02:09
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
47666
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.IO.Hashing/Release/net9.0/System.IO.Hashing.pdb
mscoree
_CorDllMain
Name
.text
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/net9.0/ZstdSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f0149a8f123c9ab8baf67df78096ba5b4d983c1030ad52ac1099a3f713eb60c0
- MD5 6722e1b9f8755c2b8054f41701a865b5
- SHA1 461fb3ca0bf33fc7b46f072e5a6446e8ba68b508
- SHA512 ab6db17bd8c50456d5eaefe41b69f642aae1b139c0ec60149b676ad00146086ca595134399ca53776a739afee905131d6894e81638431508224b93f401362b80
- SSDEEP 6144:1bD24+9QP86+8/JaXsJA+M7nntkTDkH5xUQwzQfiN5x4Vdy3xV:5qW869JU3HRP6N5xp
- TLSH T1A7846C36B3C58F95FA8F0B7484A5049A81BE6069FA5BF39B7CAC84D869053D1DC05BC3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
400974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Work\c#\ZstdSharp.v2\src\ZstdSharp\obj\Release\net9.0\ZstdSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
384KB
Virtual Size
383KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/net9.0/protobuf-net.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d8b333ec409d0cc23954a1da07028e54cdaca7d1061a52e4ae265baef63d8bd1
- MD5 c9e1fba894d88d13876ee6f8d81e9fcc
- SHA1 1dc00b1941024220ca916f67d8b287c650117fa2
- SHA512 4e82a66cc0733c870f09d3bd211215fb324ff2b607847031167423f612862bed5641e9caff53b4bedde404411967c36c4ce28d1a062415c9fbe2b90630eb1b35
- SSDEEP 6144:zmn2A/S2g/tHkRSccbgO/loOnbQhqbL+lYiyhHI:9H/LQhKhH
- TLSH T120545C2817FD8E22C6BE5679FC3445D816B9DE03D466EB855098A3A7F8C63C49F003B9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
304654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Release/net9.0/protobuf-net.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c482090bf4002b2b65a576a0e44ffa860b63086ff8c3db122f7ea480aeb6f2d7
- MD5 305615fb0986cbd49d3f49968a59e2fa
- SHA1 5515a500a2374dc3028e99b182a2c9ce812d90af
- SHA512 132b3a2db3ae23b48f1ade853ab0d1fe1bc5f9356055aea9f86a221fa0e1164a0ac35c0a5583b4defd88c116b5491f9367f1530bc48c7142855abc79e76f278e
- SSDEEP 6144:FN7lyJxq8Os/VwIwktPdkAsfk82l0SX1rUIf4zOAf5AwwO4wq/m:FAx9iIwiT6I+558wq
- TLSH T1BF546C2863EC4A56F6BF6A75AC30418447F7FD1BE466EB4D8D8050FD8E137824A10BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
290282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
protobuf-net.pdb
mscoree
_CorDllMain
Name
.text
Size
275KB
Virtual Size
275KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ