hedgemodmanager_33586[.]exe

resource	yara_rule
sample	costura

resource
hedgemodmanager_33586.exe
unpack001/costura.dll
unpack001/hedgemodmanager.codecompiler.dll
unpack001/hedgemodmanager.corelib.dll
unpack001/hedgemodmanager.diagnostics.dll
unpack001/htmlrenderer.dll
unpack001/htmlrenderer.wpf.dll
unpack001/markdig.dll
unpack001/mono.cecil.dll
unpack001/mono.cecil.mdb.dll
unpack001/mono.cecil.pdb.dll
unpack001/mono.cecil.rocks.dll
unpack001/naudio.asio.dll
unpack001/naudio.core.dll
unpack001/naudio.dll
unpack001/naudio.midi.dll
unpack001/naudio.wasapi.dll
unpack001/naudio.winforms.dll
unpack001/naudio.winmm.dll
unpack001/propertychanged.dll
unpack001/propertytools.dll
unpack001/propertytools.wpf.dll
unpack001/yamldotnet.dll

hedgemodmanager_33586.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 582031d5fdceff9c99e14399cceeabc5f4807a850bc0d971477ce6d05ba425d9
MD5 9ab6f4dc8258d8639c4621ba7cf5af37
SHA1 cfc4bd65f490f5497e691fcc10b884d602063cf7
SHA512 309a86d2098eecc10eb8e3e1cdd6012fa0b5b8be1c80460d45e2ddcdb29a892599a4122438061b1616711850beb0b0770c9dcfdbbd7d7d01d9d6bde53ce8bcd7
SSDEEP 393216:tomse60+pyx2ej68XRWOQbXowyCAUq818Q5UP7S2hy0VjDEALTfYdW82t4Zngpf:toi60+E3fBu0wy5Uq818aUzS2hRLTf82
TLSH
T189373310167688BBD8AE8B3BA030C408B7367D47A615C71C799EB7785FE2287C657273
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

24095358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ad9a110c8dad457c6f8fca566e88bc12b5eec24debee15d856920b569cf61700
MD5 65700ff9c600ce4d2e89b8638513f725
SHA1 790691b8e17be618abe2c596b93eb925fc4c1142
SHA512 02ae13437374b91b1423c6375a8efcb2af2c330d8bb632bfc2f8a03c59c56e222ede20b7b2009d2ec7669efd470233511c63b68392fd7d1ae9c3bb3f7cb6c1a0
SSDEEP 48:6R+lni2qJfjVRPGwzCU4MhTN0+19sETrpJyH4A9ZQWk1qyFV/2Iby:Dg7KSyE/yYjWg2
TLSH
T17B91721087A8473BEABB4BB6ACB313495375BA519D27CB2E1D8562166C123180A32B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\184432\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

costura.pdb

SHA256 e8887cf55207455c2873a5aa4ceb40be0d5c5e6308e9137067c4a9659facbf2f
MD5 4194c1fdaa0a9bb0d1044a11f372cf95
SHA1 52414ec411dea325110f0ad21378c8d101897989
SHA512 198744f9fb597fdf4492abf191862d137741ba0b58dcbb89a0c3bfdf898831a8e0b4811faf65ab2524f0872ade1674209e5bdfd45d5f0f6a7d1af129f7e8e424
TLSH
T1095173771B40C295ED6880B20123DA58673147127742EE79EAE51709CCBFEF8077346B
MD5 SHA1 SHA512 TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

cs.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 089368c2e5951e9ad287cebd6ab5977a0d3ed33c08bbe35a500b0d235c2d8716
MD5 4c04fb731ef19b86e370e5fdd3518342
SHA1 397ec1a06cc895e1608f7a5f755229f2746e56d5
SHA512 d18a084a911cf169e4f78bce1e5562dbbad054193175b184df3e5f8b29503581aef8782737f37ab6b2db03608e6eec2f967922faf5c3fc2dac602f26f592d440
SSDEEP 6144:OlQiY8STPXps8owAcZ2JPfKHgZPnZwBOgJi0T6Bm:Xgd+5em
TLSH
T1E884B71577E55008F6F70FD87BBAD628DA3E3EA92A14C6AE0449174F00B5B96CE70732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

58:68:0e:9b:57:06:2e:f4:9f:54:3f:f2:53:5e:e4:ff:cd:82:0c:64:21:b3:9e:b3:64:64:8f:77:e2:52:ac:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

396726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

cs.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f34ae4033b451326e3445ef1dc61be1ecb1edce5a9e2a59305612a70d39635cc
MD5 9c2ba0f769af50350054ca9dc1686986
SHA1 6c7d667ca420f83bf342fb1ec81cec468017271b
SHA512 88884ecd625bf2fda28e9b0089930f8dd556eab66525ea665e2abd7761fe4bcee556bfcbfbee317c6bb1e0ff48777a2d20c0ece4f7ae1440b25f59b3cb6d9c48
SSDEEP 768:Ae6Y69oOf2PWyrwWiuT9doq/KJJsnOOPO9zm1P6:d6ZfAWyr1irIwWOOizm1P6
TLSH
T1A723C301B7F8611AFAB72F747BB88655593F7FA62D21D4AD0805868E0A72F40CE70736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

9f:15:77:8e:a2:4f:13:02:ec:15:2f:72:76:2d:45:39:dd:8d:2a:36:ba:18:77:e9:6d:cc:a4:0c:64:23:21:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

40962

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

de.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1b967c7e1c291eaeb78d9130a8540cb3a0b4641dcdaeb56cb01ab8ad8be66bc2
MD5 f5f9bfa1ece80ddb2fd1d84bd1ac7767
SHA1 013e0b7782cf1aaee9e7139ad2dcd2ecbd6a9ee2
SHA512 bd4ba1cd9a4fab651bdfd8fe87bf1b1a91c0f67ebea08d06b45115f9da69406d8d20ca43ee2160447d815ef14d72644bde64228dc866a21b48984b8a3946d97c
SSDEEP 6144:oB8dLB8tnyXNW8/IBnxY2d63urm/7ERSzyqobw1XPhMSbaTJcUJQY:D3uraERSdobWXJMSeVc0QY
TLSH
T1099486017FEA611CF2F75B943F75D95AFE3AB9E21A41C11D105C812F07A6EA28938732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

c9:e8:0e:9d:27:7f:c8:11:98:64:cd:61:fb:45:35:d0:b9:18:ee:1a:f1:21:30:b1:d7:46:96:5d:64:69:bd:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

427314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

de.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 60d64299c8c3dc368e0b109c704c1541d29ed2d8555ee9a12d73138c71c9e3fe
MD5 e8785327216f16485b861bb20d5f26a2
SHA1 60a33b7204d949658f7da6cad9978bb882186ff9
SHA512 f170be7b4b7d51661e2a83a7015b5b8d7e3bee101320a2157e715752982a1b91459e5945f0ff53288fda7c42afd45c5014e6f3f354baa183f0a25ad00c85edc4
SSDEEP 768:Qe6bdcgNkm2G0KTkg9xadf7pLXVBLKsYQtUW9zO:N61kj6kyxadfVLVllYQtlzO
TLSH
T105239242BBF96109F6F72B747B78D856AD7AFEA32E41D01D0104805F0A72BA1CA74736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

73:0c:e7:a0:92:ea:91:4e:ab:62:05:1a:3e:23:f1:69:4a:da:96:d5:c9:55:d8:2a:90:36:69:67:41:a8:4d:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

42870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

es.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3a6fad88f0d2a858a0657bc991303e3c651feb389dae6c9732ca488e7b7c8f38
MD5 f6fb9217e1d42c0868ec3fdb4e6673ad
SHA1 28180c89aa3a8283eb271780056eedff98b76124
SHA512 4e8429f372c88c9178f27683abdd2c12739cae465eb7a848fc527283426f14554dec6ac847159cb385e2286852048435f6549f54581193fc369a26467234c1a6
SSDEEP 6144:8sf4CO5yPbcRUR1FbigUECEvUcrBolAWgT+vE1Q++e2v6sJF9amlK3:V/vfr2FzW
TLSH
T1CB94622667D91644F5F317987BB7D64BEA667CA53900C29E601C431F03E8E88CA76F32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

97:cf:37:f5:6c:a4:b6:1f:5c:91:df:5e:65:f4:4a:d4:8d:f1:c3:1a:66:d7:38:5c:36:d8:59:38:60:57:e7:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

417494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

es.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f042f5a0179c9a95df7c2398c8b1a6487a471e18011f33d6a61823e18ed4bee6
MD5 8b7a2a65cb05d2d780939315e07408d9
SHA1 035f50ae879e55dceb56f10e50ecf7195eba65ec
SHA512 3a1d2b01f55728ca44603ca76285f26ef95a4a0de62c6d0274c16b15e33d50cb7ccbd1facca537fa050a2da3ea9b2d14d41f1bc16293ee30fceae407dc940e4c
SSDEEP 768:3Ze6PQpj0F9VLdipUPoYSvBPOj2+H6rhATENrkrdDV69ofYOOPO9zm:c6/9VxiWPyvBGj2+H6NATENgpDV6mffM
TLSH
T1B723C551ABE82A05F9F32B74BB76C697ADBABDA63C10C15E0015820E15B5F44CE74B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

3f:87:9f:5a:aa:6e:d8:08:c7:78:41:14:69:cd:7d:37:3c:c6:0c:bd:ca:87:1a:c2:a2:c8:ca:9d:20:98:ac:48

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

42546

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

fr.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 db5c4ae17bc368ebbe7b0dcd80f834213146b037e97a074c0ddf95793723af00
MD5 023b45613231754ed0c25173306e7829
SHA1 c820b886aa02401b2535e140fad953aa55adcd12
SHA512 fb817ce365847db212617b99b81e0aab55f8a0da9eebe9fa2188c6f3ef035c9dbb2e29032bfa4b33f0157bbdfb9c09fed2c6d6c3d6a1c2700ddbec47d84cc4dc
SSDEEP 12288:CJT7bZ+sV44IwgL/IdBVKb+LuvVbx1+Tir7El8/dVmjMZjjmGG/aSWeARSbkG08V:+mm
TLSH
T14094A30663E42049F1F31BE9BBB7D20ACA36FCA52B01C65D149C465F03E5AD5C726BB2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

3c:0c:82:0c:00:b1:af:53:67:e1:7a:56:35:e7:2a:62:e0:9d:fd:60:d8:43:77:bb:03:a1:76:bd:67:58:d7:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

427714

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

fr.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f05acc10641e5f86e8520c589e1941d050578e9db9a3d679d927de17cb815edd
MD5 a88596d68bd18de14dfb086134e225a7
SHA1 b69f101790dc19506d3cbd8c322b1d157cabd716
SHA512 b9d26d2aae7185ac5771a2cc9fff960e8424390392d1445942c9d11f01ee38e7307de63d8a45fc98401c9a9635563ec419c0163869a035a91683ebc152bd9fd0
SSDEEP 768:C7e6q6l0YkRUCO5VpK/ZB54NzWihL3jytNX3ofT+9zEi:v6xkByVUp4NsNX4f2z
TLSH
T1EB23C442B7F8220AF9F32BB5BA76D5538C3BBD667901D02C0544818E16B2B94CB65F73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

45:fd:e0:a8:40:81:65:04:3a:84:35:ab:c2:e2:bb:f4:36:0c:07:1f:3d:ef:7e:0a:b3:0f:61:11:50:66:2b:7b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

42998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

gongsolutions.wpf.dragdrop.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2c66f2197ff5ffb99da48e413df592d82e65e4a074981c3b532561a9429c590d
MD5 31fee333ae496abe99414080ab1043de
SHA1 2fcdf9eff0a45f94bbf885853bd7c85e5d7a269b
SHA512 a946ba0217c7d45d771b9977db113d936afb943690bb66bb3790d0bfade2f42077a2b8127db8a210838d55756b9ae89b15126b6ae4b171c51ead0643df961c92
SSDEEP 1536:va4fR6+ye4nlm5yQTeTDTmTmTUuhECZ9wSMezmjFu1BfnAXPM1FgUfoh:i4fRJyeklm5y1fZ9wSVmjFu1hAXPMvch
TLSH
T160835C242368CF21C7DE1A3964B0D5114B71ED1A1722E39AADD0B5EE6BF778207143EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

8c:0b:ae:02:ed:e6:29:0d:fa:30:c4:c9:8c:77:d7:84:32:37:bb:2a:22:7f:05:02:5b:88:b8:10:48:66:26:a9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Jan Karger,O=Jan Karger,L=Alsdorf,C=DE

Chains

Oct 29, 2020

CN=Jan Karger,O=Jan Karger,L=Alsdorf,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=Jan Karger,O=Jan Karger,L=Alsdorf,C=DE

Serial Number

08:da:f6:5b:c1:f7:8e:bf:fe:27:3b:ec:2e:2e:39:7f

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 8, 2019 - Feb 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

83298

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/GongSolutions.WPF.DragDrop/obj/Release/net47/GongSolutions.WPF.DragDrop.pdb

gongsolutions.wpf.dragdrop.pdb

SHA256 f2e7b75c6b57cc32e752f472a408ff5d1fa93ef22bbc8572f8ed57c32b9167c8
MD5 d84d22a99a1dd5f75d237393c4924663
SHA1 ff335dbb9a42dec76d16a9788942f71c551aa8e9
SHA512 03223357d371898d54130b30f9cc4caed216cdb305239de7fbc65fd3a4b92f8f3e2ca5a6913bd839721aa6e8b4722b335f438753d0c784267753cac3330329c5
SSDEEP 1536:wVD5Jfp3FxhFrRVxQaWiaaiSwZbZRTOI2ldWuu/NcHZ756GqYTT0s+u7okB1SQKQ:APsYT7dDSQTlRG1dBrXS6Q4dBrX
TLSH
T13E24A217BB44CA76C46A863C2DEB4F0E1234E6985B42D76F5309B09C7CF33561E4A3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

hedgemodmanager.codecompiler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4123d5d867765f9b1305e9f51111e47dd687d37378d2054f9702e7909e49f675
MD5 d601d0ed7852a42ca1090cae4879c347
SHA1 ec202f31d6eea180b85535002c0268ce49c02fcf
SHA512 73000862a084178176391ba1f55762643badec7ccb55da4b06200b78eccebf5c35d965c869a4847fa52c15838dd65c1933d24d5fee2a11abf97a8bf08ab15450
SSDEEP 196608:P4DpZJ/RoHLArtf5FgUVxsJMv700Qbco3HI0sJgX13Jjv+FbAIYiF:Ps//oHwtfzro6v70PbBXIul52AI
TLSH
T15C963362B406C572FD4F2A370AEA604A73B53513C259D6367E7F22149FAB0C243BA747
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9338198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/HedgeModManager/HedgeModManager/Source/Libraries/HedgeModManager.CodeCompiler/obj/Release/netstandard2.0/HedgeModManager.CodeCompiler.pdb

hedgemodmanager.corelib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 27742a321af47e784cced3f1b392d46d74f2db93a5dda3cda11d66fad0d75b82
MD5 adedcb0891c0e1cdb668cf71fc686e6e
SHA1 b4f9de9eeb244e7cfe62874d63eb6d46a8fa8696
SHA512 fd75aaf9b9d8db6c5b7dc40de717bf871197ff3cf937d1015f2bc0922e55156761077985e6b075040f884d1240c0927e8c7e0e0e18e4e0af623110d68e1ebfd7
SSDEEP 192:XyZytSP8yquAAHVfnQgCB62mB8VP+g4UYLsfUbWnBCetMxLaJVFbh8kt:dAp8sB8iUYZbQBCetC2Nt
TLSH
T1F332C624C7BCD33FEE6A077E78620292637CD7587293DB6A548D9D1A4C1331D1252E2E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17802

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/HedgeModManager/HedgeModManager/Source/Libraries/HedgeModManager.CoreLib/obj/Release/netstandard1.0/HedgeModManager.CoreLib.pdb

hedgemodmanager.diagnostics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9c39cd49d73a6294208deea7e97b2abd59a5916eddcfee52bea00093af16596c
MD5 05e4c33fdd6116233df9d81f154045f4
SHA1 5be7de1d40bf26957997a1e5e0100342a0b82ad3
SHA512 9a7a77d97991ae927ffb4fd5e828b27551776efb708f93e9adc118881ed9a593f3aed4bfedc8e4a0789e60a88284d2458a9145cb05730a27b563536df92287cd
SSDEEP 192:ztUWWkGSv4bOS2HCC1UWZjDmVe7GVlkuwFb5ztM:zWWB4T25JaaGVl4z+
TLSH
T14222D9099399833BCE7B0B31E46762810372F6486503EB6F9944F1E7AE197586612F37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

16290

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/HedgeModManager/HedgeModManager/Source/Libraries/HedgeModManager.Diagnostics/obj/Release/netstandard1.0/HedgeModManager.Diagnostics.pdb

htmlrenderer.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 921a098b93e32ffd3f0f104dfdd302293f77a5f4c3029371d86c65008b1334c6
MD5 e65fb31fb079dbbcc6f025b98b13d65d
SHA1 c6ffd49ad49d5229add173bc184de06304822287
SHA512 7ab099383fa6d066aea9e59e7cc956adf1079e8dafbbaf639ff17fa43770911af4f576bf9b3e1efff3a74cf9d1059c1c1323aa3597c7d950c3e60b68d928e308
SSDEEP 3072:gX9aNvq0nfSsECdOa4dbW8Ay/Edn6rmx327WB9cS2bLLiYDsXGiKqjIkBLiYDsXp:GaHnvJe/Ekrm87WB9ctA
TLSH
T19724085863E54619F6BF4679E8B208458AF775033ABEDB6E5C8D60ED0B233C4C6107A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

227874

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Downloads\HTML-Renderer-master\Source\HtmlRenderer\obj\Release\HtmlRenderer.pdb

htmlrenderer.wpf.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4bc89062871e4df39cd3111d986a18e05f42f6a9506dd5c08e37cec90252b9a0
MD5 6cc59a4486e0364b04f99ec383575448
SHA1 251dc18efad80c4c44c7dfa28acae8b322dc7bca
SHA512 b9b16d699dccfea9c850f8075df64760e4305479ae4e35f0b47c225b07b2e3606153c4877ecc582cb2216a45ff909aba088ccbdba9080e4a5b9fe22758fbe85a
SSDEEP 768:48vOkG9uk9Wr4FWUeilf3+1BTCq+MMAqNBnAlJ+8s3RM6GMUm3jpf8ajXEan:48vOkOtFdJg7hKLM6GMUUjp7
TLSH
T11623280E73A8DE7BDE9E4676F5F1061403B0EB062292C7891EC264EFC99BB501912393
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

52310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Downloads\HTML-Renderer-master\Source\HtmlRenderer.WPF\obj\Release\HtmlRenderer.WPF.pdb

it.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cf094ee237769e1500c93d0878169e95343c79cba91800ad8a7ad95e1d5e1666
MD5 cb41ce04a72dd8463fd4c6b5fae9d3cb
SHA1 b4f91d63d9b4a2b422a39774f6dfc0773e95c976
SHA512 72e8612f47346902493a0b260bda352bce985276b8abce5d7a7b1f747026a082a9f967ee72141220716e23505b4de9097158fdf263a55fe64127a6ded398b7f3
SSDEEP 6144:zxVczkxw5zfWB0drye78W6L70ay/bKwabHznjZHpW0z5F2Yf6IA7DxiTIBP2Ny/g:m+70aGKzW0z5Rf63Dgy/z+23peD+clig
TLSH
T13994616673E91014F1F327A87BB7E108EF3ABCE57A01D25E205C070F03D9A859A69776
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e0:19:48:cf:f0:d5:a5:58:4a:d2:9b:ef:43:88:5a:21:4d:f2:c2:87:d2:05:3b:b9:f5:7d:97:26:06:7a:82:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

423866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

it.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e679bdb71a4b74ccabe619c2f83b14c17027a96536cbed167a5adaaa8d5d1c52
MD5 1a5fa0ce31d856cf68ecafe18cf6cb4b
SHA1 57c406741cbf4ccb6fd424e430b874da40e40934
SHA512 7c0169ac60a6a60f4f7eea896d55b3c512d6e5f0c0c20a9d9fb70230950225c12f74d1f862c67c84207318f84aa5ab3f78949f5227b766608b8f598957fdd4d6
SSDEEP 768:Pe6x3rNplO/BRjULwt6GkfjEr37hbNdNXACvEoLtRsHUW9zdS:G6rOpRjiwPkfy3xNrACv3LtOHlzk
TLSH
T16223B36277E82108F9F72B74BAB6A04A9D7FBDE67C11D12D1004064F16A2F44EE68737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d1:ae:46:86:84:a4:5c:d0:2c:18:a7:e3:6d:33:0d:9b:8e:db:46:bd:15:bc:33:48:51:1f:de:fc:c3:ed:0b:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

43046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ja.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e202ad6086d504912ad9deda9d0bba5407cd00db817390edcc74cea69ae7d029
MD5 a06425cbde666446e49d9130efb202a1
SHA1 7f5f539ea616ff0df79e9a7072903c985c7d697e
SHA512 5881d67ad6484dd8482a9914ce75afa4965430c3a5bc728062077d4ada4236283cdcf9f94d83198762bc289585d94e43b5ca90dc80a5861f1bf480dbfc417461
SSDEEP 12288:niEGDU4QmknZIM8mXdxufBCILbxuCN9vIrwyiOxPc5Q6kn2qmhObYk9sylLkDBqA:OQmknZIM8mXdxufBCILbxuCN9vIrwyij
TLSH
T1CFA4536DE7E41029F9B327A12EBA9289E9267C57DE12E33E501CC11B5B70BCDC820775
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

bb:cb:a7:ce:b0:32:66:5e:20:97:c5:6d:3f:84:06:6e:4e:53:49:38:7f:2f:1b:6e:3a:6d:d7:8d:21:5e:45:0c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

467522

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ja.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 78c3c2db115144bc6c9c32422fd3d9c168dbb65b1c7e5842ee2e44dad446c87b
MD5 fa4f3bd0cbd62c3d82bdd855ef11db1c
SHA1 c41826e3ff9a9b1b0bd00a1fd80f5339006a510f
SHA512 b084957c117f60d45622c145709693bbe7bf481941db3d9cd3b470b72fad8dd469a4a2ce008558c488892af48011a69d65f36699dc026e0c4038a9eaeb8958d8
SSDEEP 768:ne6RwuabebjNGaDIOBIta4/Un0vY7dUsBG7Yl9zYU+:e6bBbjUaDMtGkYRXr3zYz
TLSH
T19333526CE7E8641AF9B36B702D799185AC3ABC57ED12E23E002DD41A1971B8CDD20736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

7d:01:65:cc:6e:36:89:68:19:dc:98:04:b5:bd:6f:73:31:34:bc:d0:70:7d:89:af:b7:04:1c:db:a3:60:70:18

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

46118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ko.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1a1f9ceef40a17bbf34ad35a1b7bceb52e2bd3e3a598d26c472aeed8d5473967
MD5 bd910d4c7b2eda8ad43bbc7e06c97c2d
SHA1 4345a514ba354fc3f00981dcda8acb10a9d156eb
SHA512 a0bab93df2198a3d588013bda6ac223efc2a792b7301dc4a118bd6b56494a429e632a8bfca69b99691c1eb14922ac4ddcbc2b3e4761957ba0074f5b6b7f32b49
SSDEEP 12288:eL0jYrXtou22AhEJPgg/52IbsWSG6is60J:eI3
TLSH
T1419454D233E74548F5FB5B943AF5F608C7A2B8629B13C14CAC484D5B4EB8E828D52772
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

2e:5b:7f:36:8a:e1:47:db:8e:d1:7e:8a:70:02:e4:8e:c2:b0:c0:30:0f:bc:22:6d:f5:67:51:ec:74:4d:54:36

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

429274

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ko.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4cb43d17100775186ee3673d499a90017feefad4373529668f251a72511feb00
MD5 8308cdb8266a9489eaee909a7af925d6
SHA1 8e774c1711be7a7f3be4a02702686f32dbc84b1f
SHA512 16c9c32accefc6f7cbac015051be94457c472832dcea30e84d7f40fa0cf4787cfa2a02f224db187b8d8c576a44ae99295ba048107c4c9bcefcd8de26de72965b
SSDEEP 768:6e6RRJVlENurxRMoxTiucD3+8Io8G0MlylJU/8VhRj2Z4xchQQYmRwVasIOOPO96:b6rONGgZ+xRMGvnRj2qxsQQYmRwV1vOP
TLSH
T1562382D2A7FA1208F9F71F703AB9A1554AB6BD976F63C01C89408C4E4C75B80CE617B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

cf:13:11:63:1c:07:fc:aa:38:fe:86:d8:4b:e8:fd:c3:a9:3a:6e:f1:5b:05:85:f1:f5:8c:9a:c4:d3:fa:df:3b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

43158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

markdig.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 845be872fad4c96c4bdda12738591847bbb4fd35b0b02e84d106ab730fc626e2
MD5 5c03522d5dee2e2b2b0e6d64838c7a1d
SHA1 403f344679db36153f3efbad767752630ecb0ee3
SHA512 ae71833d951d1f73e7023472618240850a6a0ef7764f9bbf543d1845f258edb43605caceec934dd3699a638727fb91736c2c1518ae7b5c9b6077407997195e4f
SSDEEP 6144:GaW5iR+Qw3W1sFYFOdQ0IbQswCooQ3oQQY4QwduKJwF/GtdcU0rpaXV+JUbx7c+u:GaVR7wm2/oyNL2+wk6+pWmWtBg
TLSH
T15B94C720A3F451D6F3FFEA3AE4F2281416FA785BEB01ED6D0564345D48B5B4C9CA3622
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

449190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\markdig\markdig\src\Markdig\obj\Release\net452\Markdig.pdb

microsoft.codeanalysis.csharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d8e70399ff5725728ba13373d4fc5f6b7b219fc78d520b68ddf01abb1389dc70
MD5 14f797ffbf968a61deb5fcfdd5323bd1
SHA1 3cb807e8c1ad35da90fcad5c06e6adc9acaa0dc3
SHA512 a6818d226ad7978bfc0ec628c6edabb002df3d094478514ac22e87005096e4c71df7807a6676e28cded1c2b9907719b7ff077944a2c458da7bb52b90bd4576e0
SSDEEP 98304:zknExwx1t6kL+xaYN0ngWHKaushCTMAxV:wnExwosfnush6MAH
TLSH
T1C1667C11EBE98F2AE5AF8375F1B36125A3F1E8881752D7091400BE7F2C477609A163B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

bb:1c:06:3d:cd:c8:48:9e:54:cd:9e:6b:34:3c:b7:59:e4:f2:51:7b:34:e6:c0:30:c7:c7:ba:f6:b9:29:f8:b8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

6271486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.CodeAnalysis.CSharp/Release/netstandard2.0/Microsoft.CodeAnalysis.CSharp.pdb

microsoft.codeanalysis.csharp.pdb

SHA256 9ec8d7ecb114c1166d76a49d38a1304234cbf3816c792242660ab1b85fbc2180
MD5 d97103cd64b052fbb74562fadc59fb29
SHA1 6f3e17a79f2196db3787de4e3c32be2f617e0c4c
SHA512 512da52cb3535cfe0d2f83d5219e401e4b49b59e651763b01ca41f1decac584618aac5bdd02ac3463725b858f84ea3323e0516b0e29140e9e18107bccdb841ca
SSDEEP 24576:UWAYLOyY2rkUGnj1B+5SbpxhUumD8fipKCfFS4XlVqteK7nqvlMi8dpZWRX:zLOybWa5Sb1GD8qpKYoWljX
TLSH
T10ED56B12A2A11B5EC31622BBD2C34665BBB4C00DE687AF0233FCB3FAAC55B55495735C
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

microsoft.codeanalysis.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 233e5d17d266068a72d4f044d52d2ab06fdfd07c1816bb0cb5be5edf73179e35
MD5 45425009ef78c7b1bdb84d3e9e9775c3
SHA1 d21c4eb93a2ba60f75fdd6262efa7eb60564376c
SHA512 3b048eaff09030a6a60612fd326dc9c181d5ea745ced91d1c977e7c0719276c360abe2325d403f44b78c5c2b1877092e0a6b61c161df52852b65b6c823d6aa40
SSDEEP 98304:MIZqz5WLUW+PzDFWyjLU9ooobKy+LPwOyLpE:hy5WLKPzDRUeKhPw/L
TLSH
T1A4265B52A3ECEF27CBFE027994B2D3553675E95E0301976B492CF8AA1802F349D47236
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

02:78:49:8f:76:11:80:e6:a5:8e:79:78:1e:5c:ce:d9:e6:55:1f:b4:46:58:a5:a1:43:7b:e7:35:2e:68:98:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

2812254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.CodeAnalysis/Release/netstandard2.0/Microsoft.CodeAnalysis.pdb

microsoft.codeanalysis.pdb

SHA256 bc541d7a5af185a739e00f975daac9495d6050a2fb4cbfbb4403ba9f63bafe5a
MD5 9f09ac8478467881c78f7a72073ca3f5
SHA1 e67ffb455a0487a3526ef6d86d700fd684174513
SHA512 ce6de6587afe28304551667c5e20c32a8a01a87736f2f186baf1c75a7cc7f2df24a2fde50e212ea1aaa06f8f85b2c59067308a1fca6cb9df879b5f0e52574bd6
SSDEEP 12288:q+xjgTL6D4W3Se33ZSzleqrkxxxxxQuMR4tR3MLSG6h7npXyN39L:ZKTlxD/rLSzh7npXEtL
TLSH
T193257D1B9B524336C93A057B69E305581ABCC108DE875F23A3ACF3F9A879774254B27C
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

microsoft.win32.registry.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
MD5 da40f3db8b34571684c0cb5bcecd2a79
SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
TLSH
T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

5e:d3:f9:23:6b:09:bd:27:29:6e:be:e0:b7:d2:f4:95:7f:a3:7e:ad:a3:49:ee:89:bf:31:0e:bd:89:19:30:88

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 15, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

19162

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb

mono.cecil.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 71c8b01208ab37a5164f5bacd69054899db9fc00f2da87dbd07dc1ee40fc06a8
MD5 037dbbacc199b24bc0ee91f60a561f06
SHA1 3f82ecbe123c783b24705862c066018f827355b6
SHA512 dfa108f22e5e9250d0fdecb91317278c6212773d87b9fa36ab896c3f7a66a549da3d57f71b24778fe0727408eab89cc078f260dfd245c8738a0fe78b9c812549
SSDEEP 6144:krsdKY7ap3A+oQ8suUmk/yC/tyPyJH+dIz1R:gpY7YuXAyPysIz
TLSH
T1CB748E3963EC462BE68E537BE056446E42F6DC1AB34BEB8C9DC4E6FD4C83B525500263
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

364286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\obj\Release\net40\Mono.Cecil.pdb

mono.cecil.mdb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d65e445a02dc2d2a189d19745f14368c6a24d05914e36bbc7ed9732962998ea5
MD5 a97d8b05414aaaa056d6aec577ab15a8
SHA1 19b2a8967106dddbdb60d09d6012bae36d0d17ea
SHA512 be05b237d8beaa52ae22a97a27280341a5eab3f88e59816c9c699ca9fe74ac22b0e5e8611cf4ddce1f13d5f8afc2153422906fe08dffc74c742529dd4358dc25
SSDEEP 768:Yr5EYZep98C87KHeBUZwrEe9EAnlF+em5Kktn4CRIcZwMRTIzCuAtpx:Yr59g98C87KHeBUbTAnXGVXdwMRTOAtr
TLSH
T1AD1319156BFC8B27C29E51FEA4D226060BF19178A513FBA79EC0E5F7BC43B45450222B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

49134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\symbols\mdb\obj\Release\net40\Mono.Cecil.Mdb.pdb

mono.cecil.mdb.pdb

SHA256 a39544801392aa28d0061a2570e0f85c58c268fe41aa9c314d263c66878f9e66
MD5 fadcd29d4ca06ec44e6d08a2af0ce82a
SHA1 9c9eebb17d714ca4ac1ff6ec7b0b28ff4f90d46b
SHA512 826b032990b09d8fc762acba1a5211f2ff17615b78d9d8c3c032371f8ab61b09e84be5286ccf5167d398423fc5dc9e6e32c7f5502839feca0a1f542eec1000f2
SSDEEP 384:A9NdBvkE/zECNLuSY5oA/+yj7j02r6u9K2tmrNvnmBXizuXNYpkUeB8ukOVgDq/k:ABBvkE/znuSOtj7j/DF3B8uqK7g
TLSH
T16682A626D2C98359CB16557B9172932F63F6D1C1C58F0F0683ACAB79BCD172872A3705
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

mono.cecil.pdb

SHA256 c7f81c42b072979c73bf57731079125766252e2fa352d2763ac309aeeafdab45
MD5 44c278b56dbb3b5aa973906678156233
SHA1 8e69ba2487b8dc373cd39fe360e867269de9af19
SHA512 297b73621e784dcb57f20aeeaec34183c480e9da9b27b3b92bdf67e6e78f473d470aaea296a4c6085f591af1010653ecad94503feb57d14d1e1508f385b56856
SSDEEP 3072:j2DACw9iCUWQZQz9VldIas3I3uSZyMQ4kGeUG5svuXlTb:qD2kCUWX9NTAIeStmCvvuV
TLSH
T1D804080AE981B73DC6A944F6549332D22AF8928DD54F8B0563ACF235BC473287F93749
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

mono.cecil.pdb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8e221211df8a917d69145239b71b71c87e61761fb0c96d5e997964c172dda4c0
MD5 358ee793e3f5139ec1f835f0cf306baf
SHA1 be0a3453276ae078d66eebed4f3516f246805cef
SHA512 b48a78e55573c29ea925138753f4996309929cf1ada435e1c88ae3b9f97b13eaaccb2e756f929b341ab9110204f85b5d024e65364e023e286fe2f8e50c7d712c
SSDEEP 1536:ifCEVETXo3f+yAvaDvNaPS/vSC6GOALYKXgAJGsZAhcbcvjCXej:kuiQPwvH6rArVJGXh+cveXej
TLSH
T196938D35E798672AE5DD797628A60D050BF1D2B9C153A70E4A84FEF83E0B7121973383
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

94910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\symbols\pdb\obj\Release\net40\Mono.Cecil.Pdb.pdb

mono.cecil.pdb.pdb

SHA256 e21e21ea1417f9f488311c39778afaa1666d5ae3176a595d7ff27c84cef86f90
MD5 62455ea634b851e6c1caf5507ff144ab
SHA1 5fe276894dd8622a389e503cacccbe8ad89ae0cc
SHA512 4319a24c0ebe4b6926c06775fd518e961458d00f06a631926a9fea44c5f148bca48360aa250340b23cd90b97c4bec74496afa44d516f1b543f7b12ea594858d1
SSDEEP 384:Rt7ZdhNC72Xtqp5dZ+li1NjEOsG0TSLJdTWhmtBsqMK13BwzCsLWpOyesLiRQkef:RR/CWwZtjDsGGQdcmUK1ohsuU
TLSH
T1DBC27222E6F4C628C936873D81B74322BBF4C189A7074B0B13ACF37D69977686D83655
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

mono.cecil.rocks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9db3edaa8bc6ccd7ac6e2517c743591658bd6bdd436a146e0eda101d30a1332e
MD5 6fcdf77e1f173f269ff56752f273f094
SHA1 d9d26753c23fab955bb20289a20e37a1812888dc
SHA512 84f87537685ff55a681bf2acb4e35f77ea6ef3afc3cfb6257b7a72a62ba7f27e6a580fda89ddde2d8f9c22cce6a94622b58fe344d8fa52ff163d7cbc7d7a1804
SSDEEP 768:7gVxLIKwiowt0j1KODTq7/hRssvewJ1pfFpFo:s/6wtm1J3Wjssvew3o
TLSH
T11AD22A0217A6CF3BC1EF5D7AB8F2132801B1C6863003DB664DCCA2E9694BB955B613E5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

35326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\rocks\obj\Release\net40\Mono.Cecil.Rocks.pdb

mono.cecil.rocks.pdb

SHA256 dfd4428bc7cc44796355de0b7baa65ce8ea7ecda5c75131e2a65a279000f9207
MD5 f20f8df203d6bf60baf93b1673ef77b3
SHA1 4a2620ee8eadb5e8aba6905ea4f769ba30c52ae0
SHA512 62fb132eb7d0a84d6f5d15ab2a12739d36976e9e4017c713c986cfbbc0992fa04ebc0f477ff22dbdc29baf4e85b86049e50974d88a3ea749882b8e8aaa7a1216
SSDEEP 192:+3GYL4JSGEMUm10L6Nn5MNMtT9RS68Y4h0BKld9Mi0DEyKKJ2VjF+n:EnySGERN+9R7Qh0BKp7040AFa
TLSH
T1AF129107F8FC8F5DC98A09B9D163531977B0C60CD30A0B1492A6F635ED873A927B27A0
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

naudio.asio.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2d803671990dafcfedda2883f4c7811c6de9d830596433ec48af5a114c7128ec
MD5 883e5153b0d9ac447015c23446c2d31a
SHA1 4f13ebd4923b0411417a029ab89b6d7a02bd88c5
SHA512 711082327542d5d56b93d69c5650d752f52e68e192e409e903666a5f2c31f98a8336c6ae9823dea53257e0fe7aa9775d74b4c116aeaf5b3ca20a709adf46c75c
SSDEEP 384:j9hsa/6sN0KYB/aIDP9b4xkofM5zHJUg7HnUeE8rtCumaf7c76+Ghjq8D2yBb4Gw:j9h/8NZDPKGcM5zHJweE4Yb6ttD3BbK
TLSH
T134E22C61EBE8CB2FC96E2ABD74F110050771F591B663DB4F550C90ABAE6938407A03E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

39510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Asio\obj\Release\netstandard2.0\NAudio.Asio.pdb

naudio.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 171fe65c30b2ac757e8047dc69bf5bd772d1eca920a2f086f127e06b4a10559d
MD5 bc0a96668c76a6b382d3e7f9dd5bc5ea
SHA1 cffb0f104264f04604a44e5965e534304c2b647f
SHA512 1c6079fd42d1147fb26b75d9bacd23f1340543fc6daaacc3ac3dbbeeebd1d3e24604c9fd49fc432991dc632a5a370164b3b178864366a4db366527dd85a0e5d8
SSDEEP 3072:mIJAvGxxPwkHFkpKRdYq2oETRBrRK+7VROY1kquSwsM+S7wl:DAGx9wkHFkCCTRBtfVR7m9U
TLSH
T105045B2123E88266D66E67F5F4F30827C7F1F4863067DB4E9D405AFD2A07B029516BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

190962

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb

naudio.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7df6fb26b0669832b709efecf2c1d556395b3ae133dacb317038eb5b91a37677
MD5 c6a835b258538f28665c5fabbcbe8285
SHA1 030a1fb26137880354fffaf6e23b8aae89b2ffb8
SHA512 b5c0bfa338a895d964c84b4526c5c0d071a4959ecaa2d81fabc2ac7f11abd6d4cfeaa8de5f8a9de68ca1d50d5cea7f2d7f63f711e2a6a381094b64cd9f92ccba
SSDEEP 96:M8QcCYkcJ08WjUDQ+liyKrJldqEK+AAVUhko2MrrRGkxRoJjSd26:Mpi08Rs+lwDqEK+AzSo2MrlQJjSB
TLSH
T191F1F921A394CE37CEA787B6E96747841375EF509917CB1E0D8C614BAC133498F52BD2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13466

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio\obj\Release\netstandard2.0\NAudio.pdb

naudio.midi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1f9d7754df7397ae44ac105504facd2e95e0253125df4b902c4861a80995bb7d
MD5 5b59e7e277804dd539d2bccd07db339f
SHA1 3e6741abb9dee3662540fab2d64f8b778893a93f
SHA512 b9d1f9885dd1c51edd09ba383a8fe87ef899e11829666dec13ecf3313e0b8b3fab3369e273b55c2a9b9f8a2850b6bd4f901515d28141734e437dd2cbe6b7a380
SSDEEP 768:lgnriR3/szTLuf1wjUjIuI7sWFbP9iWvmYRMUM6Lheu5/xAS7BC8i5:lgnriR3k/Luf1wjUjpm9P9lvmYRMBie1
TLSH
T1A2130904A3F8960AD2BB3B74BDB152114BB2FD9ABA32C70F0E8454AE5D23B845D51773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

50882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Midi\obj\Release\netstandard2.0\NAudio.Midi.pdb

naudio.wasapi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5739f09678a761057669744fd9d1a740062c6bc81de1cf83ade2941cbdb7129c
MD5 77139686699ccddbc4bb96e5d0d2b499
SHA1 08050fe150577578cd601e3ef374c75ea31b88ba
SHA512 998b938070154ab48befe4ae0a477cbb98aa1ae335faca69760520fcee0296098f505c5ec0fd33a037b4d0d44a8c805313d5d8421f6b63227291a0e530aea246
SSDEEP 3072:frfbQ2pEzV4ulBy8R3L7nDzkku9SMLKASPIzj7FDEfsH2nEs:frfb0Fzt/kXiIf8y
TLSH
T1A5F37C3236A8C972C5EFD3B6F8F30A8783B1D14639578B8D16C0AB544C63B919904BB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

173242

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb

naudio.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 12b7c0f56ccf67c38e77bceb87a97823fbb1355a5ecd75c0f310fd4f3da654d5
MD5 1a0d91a1fa28a10c3bf4e9d08b293094
SHA1 8b8d8d071e982adc77686377c3ff30df1559171a
SHA512 a9b831fc8b415d95a998eee5ce4b6fd1c09de8cd87ed6b08b1342b48417472a762cf53c66c0c41d243e4d1269022b9b9f8066679839abb3b51e95e50f9fa260a
SSDEEP 768:dNMJ4j7TupqLq+VHDvtiT8dDwOCPRtbQDmZ1R9T+GjQ2fPj9N2fH:DuiqP8dEOMzbQDm+1
TLSH
T145033B25A35CC37BCA2F1A7E48551106037AEA84B441EFEA7DCC729D9D93B421720BE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

46878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinForms\obj\Release\net472\NAudio.WinForms.pdb

naudio.winmm.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 06a22b15b473c32b6b4691e289c49e047affed82ab35fb1e0b72c08f1b0e60ff
MD5 7e7e41f89100e08df75f6a62babc5af8
SHA1 438c490528c4df3248bec312f586f86adf78e322
SHA512 2e7ff3d9475bd91fa98ab997f815091682f9006f594739a611ac5a9a90aa29767801dc5bc763249e0fad029401d1856b91888999646580e081459e19a97cd81f
SSDEEP 768:3QFu51JOtZiHr3CJBTNgUEXahPrDVSve+u1tQMgGd8GbpDrXa8Rcer+7U0:3Q8zrHr3CJZNGahP9Sv1u1tQufpDuW0
TLSH
T167434B013BD8427AD2BE1F3EA1F30A524B31A8D6796BFB4F1598F1D99853B8049017B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

63238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\markh\code\mygithub\NAudio\NAudio.WinMM\obj\Release\netstandard2.0\NAudio.WinMM.pdb

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c5c83bbc1741be6ff4c490c0aee34c162945423ec577c646538b2d21ce13199e
MD5 715a1fbee4665e99e859eda667fe8034
SHA1 e13c6e4210043c4976dcdc447ea2b32854f70cc6
SHA512 bf9744ccb20f8205b2de39dbe79d34497b4d5c19b353d0f95e87ea7ef7fa1784aea87e10efcef11e4c90451eaa47a379204eb0533aa3018e378dd3511ce0e8ad
SSDEEP 12288:WBARJBRZl/j1TbQ7n5WLm4k0X57ZYrgNHgK9C1BSjRlXP36RMGy1NqTU+:WBA/ZTvQD0XY0AJBSjRlXP36RMG7
TLSH
T112E4284123F88F2BE19F7B35B4704A1947FAF91796B5E78F5908D9A51C43B818E803A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

3a:57:8c:7c:68:8b:18:66:50:3e:ca:01:8e:c9:25:ce:98:4d:c3:92:f9:6d:09:57:64:2e:4c:79:0e:24:5a:52

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 24, 2022

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2021 - Oct 29, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

704522

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

pl.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d22dc7a3a00d45e492c6b056a657523b6f67cbb857c62cb9400bb66d60bca26d
MD5 fd272b85b86352db82e81a64ae9c4e6f
SHA1 98652567a49ca5863ff5d025c0ecb2ad110ab859
SHA512 15db25b5af2b294249b1f281a1b554e170236f49b68f3f337dbc0c5e73d60ed833cb7dcd023726031e57c43b6ef27c86b3109ff72a78fcab26dc77ded9a63333
SSDEEP 12288:SSiZn7potl8lBIOyxzAPbI1IG8fud4xV+QD/KMZTmCvk7GWUt02wp099X96ptKVQ:UHu
TLSH
T1D794871033F4440AFAF70BDDBBF78688D9AB7CA52915C29E204D0A1F43B59969670B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a5:d7:f6:68:fe:ea:51:66:5d:99:94:ee:52:3d:75:64:4b:46:fb:77:8b:b1:13:03:e0:58:e6:0c:42:f8:d9:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

429634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

pl.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3ebbeec3e2336d9e926282a6023bd2d7e513781e18c7627b07ff4cde887c6644
MD5 e743689352dc79a147ffb48e95b2ede4
SHA1 c203387f004cfd996ef0321dde6a4e573b894519
SHA512 3bd49d0f640f29df619fb5114e3e61dafc67c499d696305d0c0df2536b2a3966967565d2e97cb1aa4423311c00b278b793717ee7380953d78f41389ffb43e8b3
SSDEEP 768:Ee6UYeqYgJkD4mxEUeJXgbdUvsWEiUW9zVv:h6ugSkmxvCXNEJilzVv
TLSH
T1C323C540BBF8550EFAF71FB5AAFA89955CBF7D962D10C41E0049450E0A72B409A74B3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

68:22:39:64:e5:d3:5c:fa:13:f2:76:85:71:d7:12:4b:d4:e6:8c:15:a1:ab:6d:d8:4c:54:ae:28:0e:9b:12:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

43054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

propertychanged.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 70de89301758982ff435cf9eee077c78aabd8d9c8171ee2ca5fb77ce662c5af8
MD5 31bb53f0d487611bd726c2e9e2d60f90
SHA1 c1eb76635181f6ad62afe68d1e6d6266673e6250
SHA512 a133e452b04e4069c6b3ef6a373a9b7ab253707b90697187db06e0fa1ac6113c4f4b903c6583e86ecb562e527d39ede8ebc8e071e1475744752298569e25f905
SSDEEP 96:qbMcTp9nHReqSLIPrSVGYK5wVQkoag/GaC5F9:qAmLnHRgkPeVGneVQkKs
TLSH
T14AD14231B3A44333DDFF0370D9232B528575B9A4D6B34B7E1B81921B6C257184679BB2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\propertychanged\PropertyChanged\obj\Release\net40\PropertyChanged.pdb

propertytools.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 78fa8d76e3a4fa5dada850e7d3531006fcfaf2c391f5dc92c45d06b3fc293f8f
MD5 c06718ae4a7f8f0a64197e3280b19fa5
SHA1 3220f3d7f998f8397fd6a23d3024e3be3f6a6fb1
SHA512 b41bca81bbc10c4d74da9250eff605258c55dace7bb9abc103f4b07345a7fecd36c9a10ec8d96295bdf18b66e40fed70638bdb69a0a4cd3f1a83e8405d91012c
SSDEEP 384:kzT+Oc7AqHp9fAEdf5bDHM0hvUwVoeA5ZYX9uEdOdC:kzSOkxdRfHM0hvUwVobmR8C
TLSH
T193A29335033CCABBEFAC5631F57167550161D2883233EBA9AB18F94B7E5738801B497A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

27994

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\propertytools\Source\PropertyTools\obj\Release\net45\PropertyTools.pdb

propertytools.wpf.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e159a0603ad50a7615b645ee09452ab3fd2520aa85d2a56011a53a0ddb731afc
MD5 7a9d0b6ce3b3608dd26cd8a63450e9c8
SHA1 81bc8fc2aad278c73666adf593bfae7399cd175f
SHA512 1748db7c0dcce5371f54a354285b754948f04781f3acea1c74177269ec74332e80680b1889b7050fa758abd36cde60bfa7f4208c160e51cffa5a4ccb9b2adc53
SSDEEP 6144:dmIZnG4CBVyhZ8u4L3PBwwbG5MQqvhIiCNInaaZNL6umU1JEkFAR0NYe1:AIZnGVBCDgwwbG5MQqvhIiCNInaaZQZd
TLSH
T123747E5123B4C66DCBEF0772D0A0052083B5E64BAAF5D7596BC1A6FF1C8B70296122F7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

357282

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\propertytools\Source\PropertyTools.Wpf\obj\Release\net45\PropertyTools.Wpf.pdb

pt-br.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6b958ef997c7fdd5fe4362f5e4db794fb856c38c8a43b14b3b513ddbcb304131
MD5 2fff310e4c7f169b33c3738d7208c583
SHA1 605fb4fd45ed6f4ea7cb7abd147bc26b8af7dbdd
SHA512 b409335b7a656ee052795bd6d626137d8f5c9f83fee397c04229cf88b0023ef950735c5a63aecf1a592bd7a4c202f9268002f94d687919a0eb491eb3d7d4206a
SSDEEP 6144:Scn2gFRoOh8S9t8hwpV9ydmhkH+Q4Hz24kuf/kg+6dfDStwOce1aa:6d
TLSH
T16694742637D91254F5F307D57F76AA0ADE6A3CA62D01C28E605D0A0F47E9E81CE35B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

4c:f0:2b:1f:c1:b2:25:08:47:b3:d4:15:91:50:7e:5f:e6:4e:d9:36:0e:67:f3:e9:ee:26:f1:dd:aa:d9:24:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

410314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

pt-br.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 823bd1bdc8f1138a381e21a7fb2d4bf364b780e4f4d59fc60c32f9c89eb88898
MD5 59d623c3cbabeeec9a9c553f052c36d1
SHA1 b9bdc99a144bfe6545be758f9982119e7ece7c5b
SHA512 58793debf5a31ab061622d4739eee6c51682fe6818b246995b9d1c91fc5e01590fd2987156b0d55c6aa993d14753324e61cab446d4bc31c6614a56c022b0e409
SSDEEP 768:Be60w8lmeUKyzfoWiz3u/n52B2enyNHhHMrErVIMGstKDU9zV6V:067F7iz3u/52B2eeHhHMAJIMpgYzV6V
TLSH
T15023C315ABF82209F9F31B707A369A07AD7EBEAA3C01C45D0155490F59B6B80CE70737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

9a:b6:6f:ab:1d:68:72:1f:45:19:1a:8d:fd:90:4d:1b:8a:80:46:12:f7:64:3c:27:2a:3f:d6:45:14:db:f3:79

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

41910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ru.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e78ac0924290b665a8a9d5f6012c06424aa9e99d9b3e6d65c44f4b75dc2cfc55
MD5 d1fcbb5600a01328d437f9df410e8dd3
SHA1 5afc670f51e90ef19e8b3f34bb9ed6d44a89b626
SHA512 c6e9f1e03bf921f7e526ee78247fc47a66db4684ec1debe12c12056f1521cefedf692a10c7d9214c1eb47498ef7734569e240613a5dbfaf5ade2f218787f91b1
SSDEEP 12288:e55z+irpYp3euLQ1P8Vo7xphnxEBf1Vo068i0y1gJ5GVHbjeFe:i
TLSH
T1BFC4F05153DE109DB262B65ADD28BE09BCBB79FE3F56831E10582D6F35F2020C639326
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

58:0b:a5:40:0a:8b:28:58:d3:3c:62:8e:ac:d4:7b:5a:f4:37:a2:c3:f4:41:40:56:a3:07:bf:ee:2e:59:9f:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

566562

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ru.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2777e7546cd668f4744b0f8a822d444c3c332357196433b9fa4b0fd4d42d8916
MD5 91b0e53db9bec4a33938648ea5887aba
SHA1 0f058e12d205a5eb1f8b3115eeaa54d91bb85a6e
SHA512 0dfd2a77893794b26079a86f8c48a62012820aea25708889e4e082a057d25a15e10a7cdd6ad6286051509305511b2922affecb8b7fe56d3422a7a7c695d398ff
SSDEEP 768:/e6rVjC8acUKu3HtcEEcXLYYBriuksh8nyCsofvACxNaix9z:W6OVBHSEEc7YYBriukVnyChfvbjz
TLSH
T14743406157ED1049F162B636E938AD093CBB79FE3F66D31E05142D6F24B2610CA3873A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

03:82:8b:e2:e6:fe:c9:00:a0:3c:85:21:5a:f5:db:44:24:47:3a:cf:64:95:cf:69:41:cf:ab:cd:9d:5e:16:4f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

52718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

system.collections.immutable.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d168af8e4a1263b5844180b1b371c5879b21b5b666feef7ca749b10192688006
MD5 7b2a749a73990140bb21395e2c786f0c
SHA1 2f1ebb67e21b33c74c4c6cf217ac1f797959f18b
SHA512 aefaa2ea20766775581da160291c234f5aef3a81a356ece2af4051f6c453c213cde2ebcae1986f9ca113d27aced45e50237fde3e1af8b2a1537e2098cb65abd4
SSDEEP 3072:EWXnUaec5PO4MJJEUjYeasDs4fGBvSj2bgtZV1HJ7IMt7RMjODTAkzcKb:EWEaVPO4gJNSsDsowvSj2bgtn1CXDkA2
TLSH
T183142900B38C5B33CEBF5DB3B962949B4A32C647A196F79E60DDFBB440833648C94529
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

6f:82:f5:ad:ca:82:31:07:87:f6:40:56:2c:9e:58:31:13:9e:24:b2:bc:cb:74:25:83:ec:34:2b:88:de:1f:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2022

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

192858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Collections.Immutable/Release/net462/System.Collections.Immutable.pdb

system.componentmodel.annotations.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 04113c8549185519f3202790ceb23df609644872b9c249a56d2bcf59566102c4
MD5 7d3d14b0417a68ccdd9c51972ff74863
SHA1 ceacbd53b6a02e1f7337a6b0058924e1e11949bb
SHA512 b2d133214f21d700e1af0c248dcc11ef66ea6da62043ff6d5e900fe2a1665d75583e4cd218526a146f2c62e22adf4ca2fa3b8879ae0f5a2e515e2c3a5184ce9c
SSDEEP 384:GnXppnvYs47bNql0kevR9SDQxSWIfYYL8oRT3KI3lUlBmeEZeTfyDxdQocwc1fVZ:gXDQsPurQcR3y6JOnSHDYFD9VioLQJ
TLSH
T10313D842A7F81139FDF34BB06B38ED96597BBED66D22C12D149890CD08B17D08B6173A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

5f:90:d3:b6:dd:87:df:4e:84:6f:b5:22:f4:f6:9c:c6:e6:fd:34:f3:6b:0a:66:83:1d:4b:6c:06:60:25:a2:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

c3:31:16:77:dd:f7:23:e7:e9:f0:6b:b3:3c:f4:65:e7:13:97:71:ed

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ac:8a:21:bc:7a:d2:9b:72:f4:00:00:00:00:00:ac

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

30786

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ComponentModel.Annotations/netfx\System.ComponentModel.Annotations.pdb

system.diagnostics.diagnosticsource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
MD5 8d9df432109f1cfdd86723b5f171e3d7
SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
TLSH
T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d6:fb:4d:67:72:14:08:d2:75:46:a0:06:cb:be:f9:d3:5f:db:20:bd:97:db:cd:de:3c:cd:a0:78:2f:b1:93:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

bc:c6:7a:ba:4c:c6:19:72:95:75:c0:52:c5:b2:9c:4b:5f:0f:69:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:a1:a5:fd:b9:ee:a7:fc:9e:9d:00:00:00:00:00:a1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

24690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\System.Diagnostics.DiagnosticSource.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a4:6c:07:cf:a9:38:ad:dd:05:7b:ae:24:e4:ad:78:9e:fa:07:82:fb:e0:b3:ea:d5:f5:bc:8e:78:ff:71:9b:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 8, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

136114

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

103866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb

system.reflection.metadata.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 171317ebbf661b0e7deb43ac58ec8541bdb23409655379a59114660fe42f506e
MD5 4b43d4b3f590490ae2fd1378d077526a
SHA1 0bd0bba896496b0e30ab059fddd74834b3247958
SHA512 e65120a34e8c47c55a88be6dbde1dc51a208b8533606a6283e1fff6ff58634100cd9a327ecbf7392c197e9c6577fc8e69703a05645590bdabb1a4819f406a633
SSDEEP 6144:ClpPdPl2Aeng49YBjlr7zkXEu7Pl4ZMzboKiWwNq:0pP6j/9YtdgEu2aeNq
TLSH
T1DDA46C5273BC2B2FCB9F8378E065441D53B2D6022607EB4F8A98E66D0CA3795CD125E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

05:c1:60:6d:2f:9d:0e:40:7c:7c:2e:c5:4a:f7:c6:4b:31:eb:bc:c4:46:16:ef:bf:6c:e2:65:d1:95:20:86:1e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2022

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

459966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Reflection.Metadata/Release/net462/System.Reflection.Metadata.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
TLSH
T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a0:70:99:f3:f5:b7:ef:fb:27:e6:01:6f:08:b5:3a:37:53:0b:75:67:14:d0:60:c5:7a:94:ea:2c:97:22:88:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb

system.security.accesscontrol.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
MD5 2d3e0b4ddf8628b41057b2aceef296eb
SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
TLSH
T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

4f:c3:ec:31:89:27:00:92:43:e3:5e:92:97:46:45:aa:bf:13:7d:68:b8:13:75:e9:a9:9d:47:54:0a:3f:8b:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 15, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

26694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.AccessControl/net461-Windows_NT-Release/System.Security.AccessControl.pdb

system.security.principal.windows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
MD5 b40bda63658a012d46f930c243b77056
SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
TLSH
T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

66:14:6a:1c:ea:9c:3d:ac:d8:5a:fb:65:4e:52:79:df:9d:05:29:ea:6b:fd:f3:7b:a3:29:c0:13:11:0a:76:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 15, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

11394

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb

system.text.encoding.codepages.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 67d868132552144c49ad929af33b774b371e3d1e5cb6ad2b67523bcd08351553
MD5 40f8b2e776e65b772c02356ee2b75161
SHA1 6b7198566d80d2c9c2d3629bb1bde3cc2d8921b8
SHA512 60fddbbdae3b546b4ef92751d16b999336c4d51f4d3ffc1846df108f897f3d73c94087687dca35f8b9d8ab01a8f428ad0ad6446c559a5980c12807dd5b4455df
SSDEEP 12288:s7i7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rPDdC:689km6k/IwRYbiBeKGCms
TLSH
T1B2F49DA066A55B17F9B7CE3097F13012CAF6BC567E02483BB952634684D3BF01DD4A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

ef:9a:1f:32:1b:e8:cb:d0:81:92:17:0b:16:9c:45:86:12:43:65:82:ee:24:fc:d9:3e:09:4d:a0:89:eb:be:b0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2022

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

747070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Text.Encoding.CodePages/Release/net462/System.Text.Encoding.CodePages.pdb

system.threading.tasks.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb

tr.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8d41f609435f616541c9c732b385f909e422dea9efae8c8b5e7849fab55de750
MD5 3656140cdf89776b31f1eb327c5d0f99
SHA1 6a4d532e3ac2d0c68e0d3885addb7257dbd229fd
SHA512 efb6160ae38e2636f7f69a4b62baf119dc15bd56330701f437e918d3a182207c0c745b77c8cd2cba102d4b5afbb7a108758d691b85a8e926ece3cae630f3fa48
SSDEEP 6144:8Co8YEiY2pYZs/CYFehQeA/HyPzK2bOfsnL9Awzp7LPEOifS941sbSWxQHTBwI:F11zSC
TLSH
T1FF94A501B6FD241CF3F71BD9BBF6851ADD6B7DA22B21C24D10094B1F17A4B8286A1736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

46:f3:cc:93:da:0d:04:06:61:74:87:3e:86:dc:ae:95:85:42:a6:ba:e8:e8:89:d1:94:c7:80:41:95:95:5a:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

406962

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

tr.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f2797ea23dd1cdad1ad701d40bc9bb156f700868e867a03f2ccf86591f6d5df1
MD5 558b5f7fa39644e25e9f4833d604118a
SHA1 b22e93ad50eb68b5f4aead8ee5cafc660d9fb867
SHA512 7d038e23bef820d2c7b8b5bf54d4362525125e41d0dd2738d46526e5ba31e7d9ce613fff13b79d3479ce000bf31d1a53b33455b5264343f647dd27e8464b1309
SSDEEP 768:eKe6ZZAyxOn+wgkI/wpnxC6LmdCGETTUbEJynIBUDslUW9z6r:S6kn+tzoW8RTUbEFBUgllz6
TLSH
T13523A541BBF9240DF6F71F75AAB8895A9C7FBE937D21D01D0001860E1A72B85CAA1737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

85:92:a3:e0:a6:cf:43:83:16:69:b5:07:dc:8e:d9:65:3a:44:d4:37:d5:72:bf:94:75:69:70:83:73:c1:a8:32

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

41350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

yamldotnet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c9f7c93d615b48747b3ad704efb6a77f042091fb2c4b39c26bbabd46e432fd98
MD5 1fc1e5b81845494f6ddc1becc731b3c4
SHA1 7f64c93be41259fe76dbd76159937bdcd67a647e
SHA512 9213d963ddace8065b1e082fb8905cbec6f109ba417cbc89bb5ebdef8a9edc55582ac530ed911c75645874bb290da222455e07578dea858c2c9244cc0be56a9d
SSDEEP 3072:/sGeiVvadOZSHRTizKEuazZU+HaQXUFI6R0Q6oG4Imeaw0JadYvCn:/rjmuAizKE9eQEFI6R0IGzaZ6
TLSH
T1D934185463EC4726EAEF7779A4B015088BF5F897F9AEEB4D085498FA1C12741AE00373
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

238586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\yamldotnet\YamlDotNet\obj\Release\net47\YamlDotNet.pdb

zh-hans.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 97c23309957df9eda0baa8c72b010bd8f64ec149bbff3a424829ed46f149e36a
MD5 e80ec9f50744089ee5afefb87d3701d2
SHA1 9a9c4703baf9c0f44168d1aa806673107c5cc2e2
SHA512 929ecc02ba2f4ea8acd19c08635a86635a689e4327c621e37142082b452973ae643a47f41f37d2f82ae0dc0a995de31aea0566946b4feb996cd5fa207e4301a8
SSDEEP 6144:k2s3aVble3n4P5Is07h9MwMCM18Rw5X69I+Dux3:oe18Rw5X69I+Cx3
TLSH
T1DA74855263ED1889F1B35BEC3FB6C158F9367DA25A16D24E245D071F0BB0A46CA20B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

cb:82:d6:3a:3a:19:fe:be:a3:0f:3f:c4:3c:ca:6b:7f:15:71:83:e3:01:19:9c:9b:7f:92:a4:cb:1d:11:ec:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

361430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

zh-hans.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fd186b00053d6c3afe5580644aaa4ec55e933a137c43c8d17e15951cf73f14fd
MD5 1cd945d2658b6ac3b9c7afa0031c61f9
SHA1 c5a8b4bdbadf4500554fcd6b51cd31bf2e229b9b
SHA512 04cc2ff2ad62f472bf5cd5d8c416e6ab9367166f5b17b21a11d051937a13c384d7f781fc7b8668fd6cf343a748bf2dec7bc6643c0d5152545bed6781a10bbd9b
SSDEEP 768:9e6hH56MCEMES7vWWJhFdbGTncsMDqXBwAWoflCxNaix9zX:A6FCHXLFdbGTnsqXzjfcjz
TLSH
T19613D541B7F82A49F5B72F787BB98455AC3BBEA72E12D05E0145594E0A31B80CE30B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e3:33:ea:d3:8e:78:b6:b8:3b:6a:61:8b:3c:80:5f:91:e2:25:f0:14:76:c6:4b:5d:8e:7d:85:5c:a6:34:cc:23

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

38370

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

zh-hant.microsoft.codeanalysis.csharp.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ae157811039664bbfc7571f6a2e2fc084b712b4f795ed57fd4ffadd3a0b58e57
MD5 3d9708ebdece38c0916d3cfebac3e424
SHA1 f8fb456266020f2697de3f25d089391d842eb27b
SHA512 f47b757d2c78f3ac1591e2c7f040baf9f758d56b9e20800545bdeecab0c13606fa3272319967b5528ebff0c36aca5ef7b13b42d507d83797179c00dcd6ab234b
SSDEEP 6144:ba8eNp5lyPOirZkB12Wp4SZaR1GwhbQUqQqRAi:2wNhbZu/
TLSH
T1AF74524663E9156CF2F32FE83FB6D60DDA767C951E22C24E204C165F0BB5A458A22733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

04:6a:9c:8f:9a:5d:ba:8f:20:0f:94:b7:52:6a:ab:88:4c:3a:b9:22:a6:24:8c:cf:39:34:2e:6b:93:3f:b7:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

361038

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

zh-hant.microsoft.codeanalysis.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8db9a99f2b9cfc7f77ddd81db316e3de8c810a82bde8ada2cf17ec13ef6a7fbd
MD5 84d4fd25f6d19218ef9d6f09c7e8e6d1
SHA1 81be45915cdc1f27ddb39ef5e3c28ae838b4e518
SHA512 039adf325664a4538db75eb619ce655287237e48e1abe0f302d8aa7e696b0858f962943100355597976ee1328a6915f33d7d3ee1ffb90a8af2d0e94d0274e92f
SSDEEP 768:oe6hyX1LW0tsnn+cJBiKCifNPZC4YeNmeXsFUW9zUA:F60tsn+cJwZifpZC4YAbcFlzUA
TLSH
T11213A382A7F9251CF6F72FB46FB995499C3BBEA66D21C41E1104548E1A32B40CE71B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

1f:43:9c:03:eb:c7:23:9f:6a:b5:58:26:b2:06:50:fd:d6:db:30:fc:fc:41:58:bb:53:a3:8f:b2:41:c3:97:7d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 9, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

38458

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

hedgemodmanager_33586.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

cs.microsoft.codeanalysis.csharp.resources.dll

mscoree

dotnet

cs.microsoft.codeanalysis.resources.dll

mscoree

dotnet

de.microsoft.codeanalysis.csharp.resources.dll

mscoree

dotnet

de.microsoft.codeanalysis.resources.dll

mscoree

dotnet

es.microsoft.codeanalysis.csharp.resources.dll

mscoree

dotnet

es.microsoft.codeanalysis.resources.dll

mscoree

dotnet

fr.microsoft.codeanalysis.csharp.resources.dll

mscoree

dotnet

fr.microsoft.codeanalysis.resources.dll

mscoree

dotnet

gongsolutions.wpf.dragdrop.dll

mscoree

dotnet

gongsolutions.wpf.dragdrop.pdb

hedgemodmanager.codecompiler.dll

mscoree

dotnet

hedgemodmanager.corelib.dll

mscoree

dotnet

hedgemodmanager.diagnostics.dll

mscoree

dotnet

htmlrenderer.dll

mscoree

dotnet

htmlrenderer.wpf.dll

mscoree

dotnet

it.microsoft.codeanalysis.csharp.resources.dll

mscoree

dotnet

it.microsoft.codeanalysis.resources.dll

mscoree

dotnet

ja.microsoft.codeanalysis.csharp.resources.dll

mscoree

dotnet

ja.microsoft.codeanalysis.resources.dll

mscoree

dotnet

ko.microsoft.codeanalysis.csharp.resources.dll

mscoree

dotnet

ko.microsoft.codeanalysis.resources.dll

mscoree

dotnet

markdig.dll

mscoree

dotnet

microsoft.codeanalysis.csharp.dll

mscoree

dotnet

microsoft.codeanalysis.csharp.pdb