2026-09-24_571cdf1bad73c8af85087a4608412855_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_smoke-loader_stop

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

resource
2026-09-24_571cdf1bad73c8af85087a4608412855_amadey_coinminer_darkgate_elex_glassworm_redline-stealer_smoke-loader_stop
unpack001/autoupdater.net.dll
unpack001/brotlisharplib.dll
unpack001/deviceid.dll
unpack001/deviceid.windows.dll
unpack001/flattabcontrol.dll
unpack001/gma.useractivitymonitor.dll
unpack001/inifileparser.dll
unpack001/restsharp.dll
unpack001/streamextended.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0d334956125e8bfaa184ba34e97bb1570e1a36e8c9a19af77de6aaef9dd83f26
MD5 571cdf1bad73c8af85087a4608412855
SHA1 55120797668562c3561c1f8679e1c2bb5c1b2da9
SHA512 a65755a1913eca5643ab9eaae6f608ac81384a35926b7e8d621f7f157f1054f5561522af5abd4b73fa7a93f23502581b06c2eb4b93cb2fb8453043b24f4a5131
SSDEEP 196608:HMgx9/+1/muLzGKNqrsgiZBYPxU26zhQc5WdAJsGOdJAUcwti7TQlEtOvOL:HMgx9/+ZqK+iZCPxUxanjGwtQQliO
TLSH
T11DD6BEA2B99050F5E11B32B4202AD62F55F826328F2560EF36D07C7359353D35A37ABE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12875150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Gunny\EasyGunLauncherLite\EasyGunLauncherLite\EasyGunLauncherLite\EasyGunLauncherLite\EasyGunLauncherLite\obj\Debug\GunVui.pdb

autoupdater.net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0b4627ef5dd0a0577f287fbf34746e814feb6de2df27189383275cef835a4a80
MD5 84f820972ce561372769d35f91dc55d7
SHA1 1e08abb09ac95a70913647847496b86f60891725
SHA512 ba3e852a227f07fb234e83981523511d3422923a0ad46aeefbd1b9dfdc669ea12eaec907ce4632f5eb1cca2e72f8ceba4134e596bde2c19e123b0a91faa9eda2
SSDEEP 6144:YVcqDIerL/6jT0LD2hn7brbOdT63ixiwz1tXQM+ain:ohDIU6jT0Di
TLSH
T1D29419127BE94229D4733AF658359291463A7E65BE20CA6E14B4320D5E72323CF71F2F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

434478

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\projects\AutoUpdater.NET\AutoUpdater.NET\obj\Release\net45\AutoUpdater.NET.pdb

bouncycastle.crypto.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
MD5 0cf454b6ed4d9e46bc40306421e4b800
SHA1 9611aa929d35cbd86b87e40b628f60d5177d2411
SHA512 85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048
SSDEEP 49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY
TLSH
T15EE57B0577F81E67E56ACBB7D1B14012D3F1F82AB363DB5B5882633A1C13B805D826A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody

Digest

f6:a3:c5:7e:59:87:21:c6:7b:dd:bc:9b:b2:2d:4f:d1:d2:a5:cc:63:04:1d:78:fb:93:6c:0e:40:16:85:b2:61

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 19, 2021

SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 18, 2020 - Mar 23, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

3221146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

BouncyCastle.Crypto.pdb

brotlisharplib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 271d8719cc932d0f204b271e7bb9eef23e7dc663884077616ac1e1450b33f15a
MD5 e151a680ac7a231f7774228f7f37a4aa
SHA1 96cdab49f66b302ea98fa2f4867e5dc94de7a43e
SHA512 355ab6ad3b3692fdc48ab809a46c54f259a2f136ac1b9a2a82fa96b858567d21309f444cb0ad51ca4f27ca1cee2bb91326e6e3439eecad3ff6e43d5af9616406
SSDEEP 24576:TTpp+ZPe0AI/Ip+Tof6nHuFPZ7sYgdlTa/7oW/dGy/KmlQ82VHP3JYgprP5//pAF:T1p+ZPe0AI/Ip+Tof6nHuFPZ7sYgdlT4
TLSH
T16555E8652A58372FD7EA8930D21BA01492DAA4D7B77E119E6E3CC76FD409700BC314FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1049958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

I:\Git Projects\BrotliSharpLib\BrotliSharpLib\obj\Release\net45\BrotliSharpLib.pdb

deviceid.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 855e7683baa7900676b36905e7dca4c38f9400e0c3f241023d0f6002e1cb9aeb
MD5 9dc24a27a5f00768ae19c308e6b96be9
SHA1 370bd98d889f395fa5dea846905ff02e2beca7a1
SHA512 c02899b89064f7b2480900439480fadc3769a9236d06292d340424fe350bb228f4f9afcb5722cb3fb5a3ecc350b75a56df8ccdb7d10569129bda45b8ff71f515
SSDEEP 384:tMGBBoSJHNilkxurZU8CA+OYDRvRb8FlxJzBuA:tM6o6UlkkrZUvA+vvRb8FlxJzBD
TLSH
T1EAA2172463BC4727D6EF12BC6CAAB6D203F4F7566893D75E1C20C28A1E577640E01BB9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28106

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/DeviceId/obj/Release/net40/DeviceId.pdb

deviceid.windows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 271c8c57e5a4480c6db11fbc3ca91b84df17c7d115f82e946f0537c5a458027d
MD5 99d219c3cb692b232255ce7ed7ed7948
SHA1 4515f5f8d6b9d0502574e399f33a5f5ead53d0fe
SHA512 bce2569cf335ea6841bec141555cff86aa3ab195e74fa63143f2b9acf6c3e3b4181e7b81135c35883fb8bad4a3aa63027bd8e0e938e86253bad9f45222712a77
SSDEEP 192:tSKToBc7USHjdXHi9EOxyBSEVEZ36pcQiyo:wMoBc7UENimO8oEVEA6Qxo
TLSH
T176F1C52093F88A2BE8F30B3EA9FB230046B6FB58BD73DB5F0511815AAD7174149617B5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/DeviceId.Windows/obj/Release/net40/DeviceId.Windows.pdb

flattabcontrol.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2232fd5ec4631b803ee09b4b52062bd86be14d1722b7889a4410d7f2666ca5c9
MD5 cd0b142f24c78e6a44c177b17bf73109
SHA1 66b100f992ce7e755aa2600e0fc76f596cffd435
SHA512 9fe43cc7c2bb4a43d2c3820d91ab1c4b42e2a24cddaab494d4eacaf81cce194891c37cebde9ea914291cea1fa2fc7141fab670790bf9a41875a680aa6410c54f
SSDEEP 384:V/canv551dY4w++30wbbsw2w47R1WEhgIGDbwjuokwJwAoY1w:V/can3s4w++EcC1W7I8
TLSH
T1ACD2081AB661D375DD3F463EF4E3648082B0EE007500DF894E9A3A799D7B71E060EB96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

gma.useractivitymonitor.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c5e35a22f49a181ef2dc1d79d78529bab27d999ac22320dc996f7f1f49871bd2
MD5 53e9813e627b575f8d97d3a879f8e729
SHA1 e1d4a8b438030082776753115c34615733bc0fa4
SHA512 7220862b58037e0bdcb68fa3e09c980bbf6da4f1837973fa537cbc982527bf619ccdda957ab7353730bb07be5ad3b806c22be99e782effdd971649e349a136ae
SSDEEP 384:FdieqpuEsmfOF1ITY39999999J9LfWmwuLC0AiD4wYjO6dNbPf:OputmmKY39999999J9LfrwuLC0A5j/
TLSH
T1DED28205C79D853FD6F9CB319897480396BCE640B752EFD924FA10B0F5033E82AA26D9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

inifileparser.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f81ba0dd987d46a67b1879ef4ee11c14f32940ff211eace347a68e42bf272554
MD5 2e77f841dbf271fd1ffc460bfd87a1d5
SHA1 18125861f0519cdf643560c0a988bf70c87d47b3
SHA512 556e4133d28935c13d93e5190178804b13c98334332316ced50b878f35730b92c62f0440f1c2e1bc3f5c36eaeced5ca794cd2fdf9ad5434af6194940aed0e346
SSDEEP 768:3FBulP+gma9/YzvPtAlzIzlpAuJa2kIhW9:1B8yaWzvPtpAEa2kSQ
TLSH
T1ECD2F80127ECC33BC7AE4778F472125102F4EA5A7123DF4A9EAC60477E13B946A5636B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

34674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/Users/ricky/development/personal/ini-parser/src/IniFileParser/obj/Release/INIFileParser.pdb

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9abc594d53fa81489c2ba2f82f9fc6e6958ded508f16031b4b3d1a8df025030b
MD5 928dc7d8e87fc1fb3cf80a80089af0e9
SHA1 425dc6fb3d676400b78ea02130a18c8a517936a3
SHA512 7fd45135a26596df781628d3d8fafd8f3bdd5714095e3ecd1151665dab46c7ec34a02531fabb4c5c6dd9b8e8c5f491c437f844a41a2a5dac4ddc7fc51bfd0e6a
SSDEEP 6144:D7dHBN8o1/vsH21/zJra/IAo96q4ee+UnApaYa6ORP9y7hDd6alMBu0HMkOAdRJf:fN8oRsK7SRTBAbOR0lpsBOADJKLy
TLSH
T1C1B4274023EC4E66E6FF2734E6305D1857F1FA6BA9BAD39E194095FA1C83B508D107A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody

Digest

12:c5:95:30:c6:87:7d:dd:be:ed:91:b7:57:e1:1f:ea:25:5f:30:4a:8d:ce:39:5e:ac:05:55:b0:bf:f4:37:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 24, 2022

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2021 - Oct 29, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

509070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net35/Newtonsoft.Json.pdb

restsharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c29e542b89e72b82789d9534cde1ea3ac2104ce189a031776a8ade6517eaec98
MD5 641fae5167bd61703311d7e350813e35
SHA1 360b2973e871091a7ebae2569ae49278fa6f2776
SHA512 47093e1c2a691f77757213a33de8da2d3c0e57ddb202ff3f60b8fedf8e415d62fc4342ecfd2dd328292a0084764e44c383712117accc4a432f73d9623d7613bc
SSDEEP 3072:12nXEmQDVdwQeoOOrNQzXPafpH1UDxh0SbAtl8DJk/wr4OiIglaqJ50:12XEmQJdwv4YafpVUDXb8tl8Dwe
TLSH
T135F36D1D238D8631CA9F4D39D4E098114FF6EA2765C2EB9F6D00D8B61F93B8499036B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

167438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\personal_source\RestSharp\RestSharp\obj\Release\RestSharp.pdb

streamextended.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2a84463e6af4def5a2b34092a60cb31043727568188f88a16f119bdeee90548d
MD5 f762f281d1d0060c154795b68f0e90b8
SHA1 ebf30a02fe4c38f9fcb3ab4020ec762590430109
SHA512 e83cdcec2b760724bbd156a2c84ed86ac77034239e26d3cbf49302dd49c4fb9f611db733ce12a91391b5e68b03da9aa5bdf3adf8894437b95f4fe4a171f77c26
SSDEEP 1536:T4kYfmst31K+SrgLI6uYa1f13ZYix/moS4dPCBAZuS7CAwcBxGWBigErn9N+63dd:0+S31B3U6L7J
TLSH
T181731F2936E87027F637F5FBCBC291B4D665B6FA2A52C22B08CD01590722F07AD5253D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables calling ClearMyTracksByProcess
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\streamextended\src\StreamExtended\obj\Release\net45\StreamExtended.pdb