Installer[.]exe | Triage™

resource
Installer.exe
unpack001/costura.dll

resource
unpack001/guna.ui2.dll

Installer.exe

SHA256 527c5898197833458807dda016cd37bc54ca82294d11ede24302d5084ec858b0
MD5 809d4006ed6cb46a4336668c12df2252
SHA1 aa279418923910326cc5ed77d7d0ec15f7028476
SHA512 025ccbad9d5027baa18efeab073c650bc7662959463497fa299873fd7d96da35f941c13b9744ea2a8a120d80d1562fa583c695c171f7e790c9f875c9d16ce77c
SSDEEP 49152:m88FTpxH2T9TpM4iWbsadXBDh+xhU9hJfjXEReI:b8FTpkT9TC4+adfeU9Tf8x
TLSH
T13DA5C03BA2174647D295237CD804F7A88B1223E8FDB783627C547499B554F839A3EAF0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Installer.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6771700a3bbd39251648d73bae181c3a4fa978ac40cccf4d5e2ac7815f18b406
MD5 27180a8ccb9c7d93bc5e1a95d67d3dbe
SHA1 31531eea4711cf48d5e834ff92738769389ee1cd
SHA512 f7ef2014320f82ff98c825b90a7229d74fe39b0e33fa7826b35f214dd5c51918c61e63acae8c19c42d817bd6ad571c9983766516c791b304db697df9dc5cf564
SSDEEP 48:6vP2nhx3BTjtRiaAVLEF4iZ6iMtTg706YElaWTJFu2FY+cYH6AWk1qyFVw2Ib8:JHtRYVLE4YjYELTru2FZFWv2
TLSH
T1A6B1FB28A7B8533BEF7BCB72585353804374BD10D92B5B1F1AC562172C323948931722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\303409\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

costura.pdb

SHA256 4675077d1bcf2a5f380521ef624a03fee29e13310d39c80223c5e6d889a12ba2
MD5 60a922c4e3b7177c537adb1b1130f026
SHA1 4de073819643de254b17cb83360e10e74eb57f0e
SHA512 e221ba6abcdc01a8b19393dcabc9c2e9fa2df8c51acffc900825f4198167ff60db6c5419599aa6a5c619843a5dfaf4a784810a19f25de0435e5796368138433f
SSDEEP 192:FzyMDB2vUloPI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu0T:FWXv1PI6jMai+NLy5nj4SCm5Mz6QkOAn
TLSH
T18BF1B33FAB48C463C89559724521C09CB67343242674EC78F3CB2A08EDAF699C7B5B72
MD5 SHA1 SHA512 SSDEEP TLSH

guna.ui2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4ad0ba156fcd20c5c06b173e5af8b16aeaffbae06fce9771b35974e4700c7952
MD5 f1d04f21d43efa8b2819ef86a48c1811
SHA1 f2deac990818bb151966950a665f49e681498533
SHA512 2987b7be6be37f3ab02225c284d2e0140550793a3943002a42e53ae4cb547e78cdc2fc588145b1d871b619cbb96b3047eb8b76a014385e141608a40c7ca9b55f
SSDEEP 24576:YtmmRH02jXmJyezxrqwEZLBhMVMQW/R5IZoTqVumG8WIsodFldtYzJMDnZoFF9H5:YEvKiV7rk1FFz
TLSH
T19EA509183DD5EA27C16BCE33D5E24011E2F1E4932EB1EB0E66E3576C18427857C867AE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

89:6f:ae:23:a2:b3:09:9e:91:db:05:6f:49:2c:6c:50:19:d6:cb:6b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

2196462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

microsoft.bcl.asyncinterfaces.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 14fa36b71d2edbd278c37428a0dae50e8fcc5d8bb2de1ce6850b7f8f00be425c
MD5 ff487f7c3f23e5b1f1bfb453d2b47967
SHA1 a581e340c35f3eabb3d0f6ededc1b8a1b238eb96
SHA512 aee0696027ade4055d9705b2c1da3763dbbbd969d00970de72eb605d95f0cf1544b64712e4daf35737af92ba70d4622be38fc9179d58314b604c2699588c65c4
SSDEEP 384:xnuDmDZGXT6NYkxe50ZrS2Yh0WXIdGl+IWi6FUmlcWepB/Wx/hljHRN7mnP3U0Ro:xuwIOTx9Z22LwJ2FUmlKuDjmc49zcScr
TLSH
T1CAD26C12D36C8317CEAF2FB5DD65D5812E78E3862C32DA3E1248E6555C97788AB31338
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

55:ed:5d:a2:dc:b2:4f:7d:3d:2c:dd:4a:bc:98:43:2d:52:df:8d:3b:90:5a:f3:e2:7d:32:6c:ed:ce:94:a1:ee

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2d78d770c9cb997199154ae8c018b9f1d1efbc86729f7264dde6dbad2a12cac3
MD5 902760412abffbd10be14842e83f0c09
SHA1 d87680e1a96549cf45506d17566ec08c27a770d8
SHA512 016a283723e32eedaa3b3c6d92bbd0d4c4d2663ab0f0b74bda56d6d2d742632ea0005b3c0c982ca77dd152b839deed0af07228172f059c9e0840e31b530bd0f2
SSDEEP 384:7RJyzxhqFAB5n55560IZplFuA6ccxReXWd2WkRnfLXmztvGHRN7LgFA9bFs0R9zJ:FJyYkx60InTuP0njQtaUFQZs49zUS
TLSH
T187B27C11D79C422ADE7F1A716AF9DA862E3983C16102E66F144CF5040EE37C9DB31BB8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

be:68:48:ae:8e:63:d0:cc:97:89:10:b1:45:84:7f:68:66:d0:47:4a:08:eb:2a:b6:89:66:c1:09:09:16:a3:9e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

18706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Buffers/Release/net462/System.Buffers.pdb

system.io.pipelines.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d8508ce70081f6dc4764d3b1a96b1a2ae2e80b823cf8d63680ff12480e85034f
MD5 323c4f691ab5c41699e7d762036202f6
SHA1 e5178e93876d6493238a1b423f1ae0ea3ae4518b
SHA512 5b98e361009c1a7c48f26f4c29807acac1b0ff17021b112972451ac1f4109419f1b23316de00779935e5708092a5136f9acab80eb4f000c62a68e61bd0cdfca7
SSDEEP 1536:1EqfoDX1DK6+ZXWKJF4uONjTQ4ROY/4bgN0xIRgevBjM8E25pTdVZ1zv:xglUZGQFENTPwY/4bgN0xIRgevBjM8TB
TLSH
T1FE835A6893BC0B1BEF8E19BDE17452521FB29B257917E75AA58CF8D908837C046243F3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

bb:40:19:83:3c:73:37:0e:6f:6a:05:50:c1:92:7a:dc:c9:7c:c9:66:37:1a:c9:b2:c4:0c:83:cc:0d:18:fb:13

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

80750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/System.IO.Pipelines/Release/net462/System.IO.Pipelines.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5e8e4866f9cfa66f7765660f84b210198893e55335487afe5ebda342c0e913d
MD5 bd7f42207f4fdb9c7eafb0013abd7334
SHA1 96c87b7148805a0adcd4b9e23162deb06d7a4702
SHA512 a903fda3c5585af8978918c6fa5dd7649e84bee41d0dfa09667e151819d74e16cff626595eb9760588bec12c0b8ec31f527e7dc84800378683156309c3247240
SSDEEP 3072:IPgSRYPuMbrhcabqwwwUumu36xNOIRJAW:OuPaaWwww4u2HX
TLSH
T161E35CBC67C6DD12CB5F8C70A028621A5A31873FAD43F7E615C8E4F425A37A936193D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

ae:a3:86:d1:9b:06:39:d7:1c:ad:68:32:06:75:f7:af:5a:40:e4:f5:66:01:12:56:75:99:3b:c7:18:c3:38:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

138594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Memory/Release/net462/System.Memory.pdb

system.net.http.formatting.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7b58adc6e23b24cd6615b35e848a002bda053a26d48f9ddafacfc8098e97c49c
MD5 b676d5e9828d6010339743f236f54ec4
SHA1 0dff461be2e04ebf6da5f4f2d3eb639cc2e0a8b5
SHA512 cca0ed47b391b12f44716db1921314e7dcbf2a9f6b0916c78642b4aa814825c570569b103a7f5e298e9c02dbae22e7cb905f08f80f94ad6dcb69fe09085cd8a8
SSDEEP 3072:BXWun8Jw8fCk/Dvf5eso7DpGbG8pwp2xuRLYs8ZS:BXWu8Jw4L/D3UVVGbGbMS
TLSH
T112044A2967FC4B1BE7FF59B8F430A454CE7AF2066416EB4D2C49A0EE1493340E521BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

50:f7:ba:6f:12:20:c7:5e:88:33:d9:bd:f4:e2:34:26:9a:b1:46:f4:59:52:31:5b:5e:c4:07:b0:0b:ac:b8:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 28, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

174998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\BuildAgent\work\8f8721ff33b44e63\Tooling\obj\Release\System.Net.Http.Formatting\System.Net.Http.Formatting.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 20c2fa81b8c70d651099d762954f285fd4f942e63b2d7217c145dab8d4b2f4c9
MD5 a57f205ce75d4e4a19020e8b627469c4
SHA1 c5583c3257cf193ff4736671445f8da64366a6a1
SHA512 6b5985cb7ae4daecd1be3d6dbc709171ec94b89c0671aec1dc7288e08f5fe172900be75da1c43b75fff37504a33e7f8992c66581e562397f47e2ef2cefb46b54
SSDEEP 1536:2uIaashZlF/cLecJE3+DWG/E2NstmOz+IAKvR7NQcmzF9:2zaashZzWeca3+DWG/E2itDf9NQ7J9
TLSH
T147B3DFE22F6C655AD7CF9F7B20E64E120B331963C403D2E160DC67A227A776729421E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

0f:80:90:1b:17:38:ec:61:65:dd:0a:c6:a3:dc:d4:0b:33:38:e1:79:30:66:08:69:e4:67:38:b9:b5:4b:38:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

105250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Numerics.Vectors/Release/net462/System.Numerics.Vectors.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 08cbd7278b66f1e68425a82d4b97181a4130d93e3dd91831407aba7212ccdacf
MD5 cb5b861883d2bddd9833c9fe956406f7
SHA1 43290cd4aaf80df5d1cf9f242486ef8e646fddda
SHA512 79de2065d8af3713662afb2a10e0a62c0821920608cc63cc2a47a09dc7bb6baf1fa71612da3ebe22d410ddc92fe52c0261faa019839d241fe9252d1663f4f4c1
SSDEEP 384:RGbUedrbbxT4WT2WCwnHRN7bEpGR9z04yy:RGpd1R3XbEY9z
TLSH
T1F0827C24C7E44503FE627F3485ACE543BE3893960902D72B2582F57A0C973D8AE35A2C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

e9:bd:64:c2:63:64:c7:c2:51:d3:cc:93:e1:f1:65:00:fd:e6:b6:bc:8e:9f:5a:34:69:8b:2a:49:55:41:8b:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\Release\net462\System.Runtime.CompilerServices.Unsafe.pdb

system.text.encodings.web.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f511dfaa55ec6fe9d4f58d25caf52f1260b33a0ebd97c58afda2c843215d11f6
MD5 90edfb0955469b78d6822d5aef18962e
SHA1 d6ebfadc79020dc710567410c85872da780eb637
SHA512 e0ed22a51b68e1a51e84c9c460c1fc40d140142eefa0c0d2f70ffb539c861ffe3e6111466a2f54bb075e3e9a63cd4c19572d0eae572300b91d29fd576292b588
SSDEEP 1536:kYQU6qF6FmUroWpn5qTQlyydbrkSGNICopK6B5nMifDWzBf:kYcqwTrfgQlTBraNloxJbWJ
TLSH
T14C836C12EF9C862AFE5E013B5DE090655B74EF961133EBC73859792916333C8620DAE3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

17:c2:89:91:f0:53:15:a7:f6:93:09:8e:e1:28:23:8b:32:80:00:9e:29:f9:02:a8:8b:4d:e4:f0:59:db:46:9d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2026

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

73682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/System.Text.Encodings.Web/Release/net462/System.Text.Encodings.Web.pdb

system.text.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f2f352b38489686e607b5b8e8ae169b7b1917949dcc79c8b7619e4eeddb81df7
MD5 d7ff7c279b4c8e4c73a70fc0a24aecbf
SHA1 9512009d7e49c2b7a3a78a7f1496509f97a5b5a6
SHA512 7e353aa4229dcebe7169ddbc5f8d78a7076af2daa8dae6c261f45cbd6fb29a41c8626191e9ae51c29583fb39b6b0bf83da86d1f372ca37f967e352d03d1c2664
SSDEEP 12288:AVbxFO7lcQTJKd/805/dlQVzjx6tlUgcBdYOX4WXoo:kyl3JH8dlQbjYOX4Bo
TLSH
T10F157B21B7E8D72BD6EF5B31703084188BB9FB2D63AAE34F254856E81C927449D413B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

c4:0e:22:5e:84:c7:b4:eb:cc:5a:0f:2f:5b:ab:2f:02:02:51:f6:90:8e:1d:61:18:08:e1:fa:34:1d:78:b7:bc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 11, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:9200-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:23:4f:d9:60:24:53:cf:fe:2b:00:01:00:00:02:23

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

771050

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/runtime/artifacts/obj/System.Text.Json/Release/net462/System.Text.Json.pdb

system.threading.tasks.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 af4e13ef418fd89b432de20cd1dfb7fa10a7179c8dd049c9856316e50c5949ca
MD5 0fff41795a1107691ec1e5054211c04a
SHA1 3439da9b7918fa0c17836acbe1fa4e05c40119ec
SHA512 1333847b76025af23a4a4dd421707732078673c96dcdb726a38b477c51606395002574fbcdbf224fd0ae5b80e8da8b2f02dd4972d88f31c36c3dcbf595510e90
SSDEEP 384:F7PVBSE/ug12sib05JCw0p8CUQefpnQKwU3RymGWuXWJwnHRN7rpGR9z04RI:9PV0iug12TY+bUKmGfXrY9z1
TLSH
T15FC28D6183B85113CF6F8E77D2A9CC175F74A3466A02E7391AECF2D40C5338A8A31275
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

16:d8:01:cf:fd:de:8b:33:89:18:e1:8b:1f:5e:60:e2:48:88:65:aa:1b:f1:2d:69:fc:ae:73:d7:f9:1a:25:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22842

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Threading.Tasks.Extensions/Release/net462/System.Threading.Tasks.Extensions.pdb

Installer.exe

generic

costura.dll

mscoree

dotnet

costura.pdb

guna.ui2.dll

PE Signature issue

mscoree

dotnet

microsoft.bcl.asyncinterfaces.dll

mscoree

dotnet

system.buffers.dll

mscoree

dotnet

system.io.pipelines.dll

mscoree

dotnet

system.memory.dll

mscoree

dotnet

system.net.http.formatting.dll

mscoree

dotnet

system.numerics.vectors.dll

mscoree

dotnet

system.runtime.compilerservices.unsafe.dll

mscoree

dotnet

system.text.encodings.web.dll

mscoree

dotnet

system.text.json.dll

mscoree

dotnet

system.threading.tasks.extensions.dll

mscoree

dotnet

Sharing

General

Malware Config

Signatures

File Explorer

Installer.exe

generic

costura.dll

mscoree

dotnet

costura.pdb

guna.ui2.dll

PE Signature issue

mscoree

dotnet

microsoft.bcl.asyncinterfaces.dll

mscoree

dotnet

system.buffers.dll

mscoree

dotnet

system.io.pipelines.dll

mscoree

dotnet

system.memory.dll

mscoree

dotnet

system.net.http.formatting.dll

mscoree

dotnet

system.numerics.vectors.dll

mscoree

dotnet

system.runtime.compilerservices.unsafe.dll

mscoree

dotnet

system.text.encodings.web.dll

mscoree

dotnet

system.text.json.dll

mscoree

dotnet

system.threading.tasks.extensions.dll

mscoree

dotnet