2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_lynx_njrat_remcos_smoke-loader_stealc_vidar

resource	yara_rule
static1/unpack001/puppeteersharp.dll	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

resource	yara_rule
sample	costura

resource
2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_lynx_njrat_remcos_smoke-loader_stealc_vidar
unpack001/cefsharp.core.dll
unpack001/cefsharp.core.runtime.dll
unpack001/cefsharp.dll
unpack001/cefsharp.winforms.dll
unpack001/costura.dll
unpack001/esendex.tokenbucket.dll
unpack001/fastcoloredtextbox.dll
unpack001/icsharpcode.sharpziplib.dll
unpack001/log4net.dll
unpack001/microsoft.windowsapicodepack.dll
unpack001/newtonsoft.json.schema.dll
unpack001/objectlistview.dll
unpack001/puppeteerextrasharp.dll
unpack001/puppeteersharp.dll
unpack001/restsharp.dll
unpack001/websocket-sharp.dll
unpack001/yove.proxy.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 86b91ab3e868bc4fad38270e64d521347b581e039bf528565fe6d61f52a0545c
MD5 f90917d7fe62c1cac9a83ebb0d071556
SHA1 e012a41b65ea332ec7fbf96f66969403cc83e741
SHA512 024cb98ca70072805ef849dd300aa72b3b6064fee81ecab37e1ff84ed5fad86e6b466529f52587c5ee4f066935624b00fec43bfc1c144c34183ad829b17c377a
SSDEEP 196608:QQm594/tUhzmS9zZ/mY+kSIb7ahNMYkUHtkIRqerjB65bKHf4N:Qlnuwr9zP+kSQ7KMYp6I0ilai4N
TLSH
T18A86012A72A04334E5AB453444A9C1B55ABE7E396A68E19FE3C0BD9F7DF57C09830313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8223902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\private_projects\Roblox-Account-Manager-3.7.3\RBX Alt Manager\obj\x86\Release\Roblox Account Manager.pdb

cefsharp.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f2aea23a73799cede84060d54e7357db6f54785f42400f6dd3d02a52f77c8741
MD5 74d6435a8b94c6edf71d165f0a749460
SHA1 9a571b538ce201aaab23c1a19e00fecbd0b6838e
SHA512 34f12197bbc1535be7f24a1330f01c0addb9adf2fdd07ab30000223154c9e70256c4613667290a9d0040bae8064ca2b3c5c2180ed5b9d91b8a50a15eadf0d59f
SSDEEP 768:+DFeCa9x3nwzdudXFhCO1uFj2rGxMO6ClaZ1ussLmn9El9z8nNeZn:+oeeUOoefUlaZ1uTLm6WNwn
TLSH
T180032805DBA8A23AC7EB0E7974A15A410F71D30B6527E72F1C04F0DE9D63B9579822E3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

43838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\cefsharp\CefSharp.Core\obj\Release\CefSharp.Core.pdb

cefsharp.core.pdb

SHA256 125fec284888384fe9bca8e565c47b7532672bd9c2b71dc63f076ac00f897e81
MD5 87873bd0b7e37bf04036b9db6cc24817
SHA1 063dfd4a00f39af7f56524fac0b79369e216b137
SHA512 154795bbf02aa942685357839c468e851782a9cfc86413c3c6823aa4fd7378a98383dd4020f9f884ccb827bc9d742cf837ecd4110004c4fe576c70f55366359e
SSDEEP 1536:DLW+LEH0CZ2jYGcywcYpCkmXqErKx91+qZBKRXGAV1Jv2EWRboYCBXmDkLQ+LECc:HWGQcstZECDEQVD
TLSH
T1F714102BBF44CA32E46984346DDB571D1376E68C1B835B9F9249B0683EF23793C46398
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

cefsharp.core.runtime.dll

IMPHASH 6dcc8c8ff6147ad4fff786bd7cecf6c3
SHA256 019c8ad6f6f58424626385c135e2375ea0295b2c8070210adf884c52afa13853
MD5 6f67f2b194364bacc7131b166b5a9b62
SHA1 af7f4b68e3afaf5c7518ba6c976bb0ec44df4c1e
SHA512 378018d25ffcfe98f25249fa12f9be54d3f4eea8f00555f30464e2f5951f26b81f7ebc4f2a20d051c492938fb52397ebd8846640bfe87b862d12c4aafc9e5807
SSDEEP 24576:W8T/v/c+YfxkzwTPcNerFGSHfm4YXish4E9kUv3qc4ChKZi5B9xh0uLgS3esm2q2:5HdiYXTh4E9kUv3qc4ChKZi5B9xh0uL3
TLSH
T1B4555B35724AC937FE9E66B3C43A927F521B80859365A3D3E244532C1BA63C18F3A357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

603629

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\projects\cefsharp\CefSharp.Core.Runtime\bin\Win32\Release\CefSharp.Core.Runtime.pdb

kernel32

GetLastError SetLastError FormatMessageA Sleep TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter WideCharToMultiByte

msvcp140

?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Xlength_error@std@@YAXPBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QBE_NXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?__ExceptionPtrCopy@@YAXPAXPBX@Z ?__ExceptionPtrDestroy@@YAXPAX@Z ?width@ios_base@std@@QAE_J_J@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBE_JXZ

vcruntime140

__CxxDetectRethrow __CxxRegisterExceptionObject __CxxExceptionFilter __CxxUnregisterExceptionObject __FrameUnwindFilter memset __current_exception_context __current_exception __std_type_info_destroy_list _CxxThrowException __std_exception_destroy __std_exception_copy memmove memcpy __CxxFrameHandler3 __std_terminate _purecall __CxxQueryExceptionSize _except_handler4_common

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _invalid_parameter_noinfo_noreturn _seh_filter_dll _configure_narrow_argv _initterm_e _initterm _initialize_narrow_environment _initialize_onexit_table _crt_at_quick_exit terminate _cexit abort _crt_atexit _execute_onexit_table _register_onexit_function

api-ms-win-crt-string-l1-1-0

isspace

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh

libcef

cef_string_utf16_clear cef_log cef_string_utf8_clear cef_string_wide_to_utf8 cef_string_utf8_to_utf16 cef_string_utf16_set cef_print_settings_create cef_string_utf16_cmp cef_get_min_log_level cef_string_utf16_to_utf8 cef_string_userfree_utf16_free cef_value_create cef_string_list_alloc cef_string_list_free cef_dictionary_value_create cef_list_value_create cef_is_cert_status_error cef_currently_on cef_post_task cef_post_delayed_task cef_register_extension cef_register_scheme_handler_factory cef_clear_scheme_handler_factories cef_execute_process cef_initialize cef_shutdown cef_do_message_loop_work cef_run_message_loop cef_quit_message_loop cef_crash_reporting_enabled cef_set_crash_key_value cef_create_directory cef_get_temp_directory cef_create_new_temp_directory cef_create_temp_directory_in_directory cef_directory_exists cef_delete_file cef_zip_directory cef_load_crlsets_file cef_is_rtl cef_add_cross_origin_whitelist_entry cef_remove_cross_origin_whitelist_entry cef_clear_cross_origin_whitelist cef_resolve_url cef_parse_url cef_create_url cef_format_url_for_security_display cef_get_mime_type cef_get_extensions_for_mime_type cef_base64encode cef_base64decode cef_uriencode cef_uridecode cef_parse_json cef_parse_json_buffer cef_parse_jsonand_return_error cef_write_json cef_get_path cef_launch_process cef_begin_tracing cef_end_tracing cef_now_from_system_trace_time cef_execute_java_script_with_user_gesture_for_tests cef_set_data_directory_for_tests cef_api_hash cef_run_winmain_with_preferred_stack_size cef_run_main_with_preferred_stack_size cef_enable_highdpi_support cef_set_osmodal_loop cef_string_multimap_alloc cef_string_multimap_free cef_request_create cef_request_context_get_global_context cef_request_context_create_context cef_create_context_shared cef_cookie_manager_get_global_manager cef_stream_writer_create_for_file cef_stream_writer_create_for_handler cef_drag_data_create cef_stream_reader_create_for_file cef_stream_reader_create_for_data cef_stream_reader_create_for_handler cef_urlrequest_create cef_process_message_create cef_post_data_create cef_browser_host_create_browser cef_browser_host_create_browser_sync cef_binary_value_create cef_post_data_element_create cef_string_list_size cef_string_list_value cef_string_list_append cef_string_map_size cef_string_map_key cef_string_map_value cef_string_map_append cef_string_multimap_size cef_string_multimap_key cef_string_multimap_value cef_string_multimap_append cef_string_map_alloc cef_string_map_free cef_command_line_create cef_command_line_get_global cef_media_router_get_global cef_image_create cef_response_create cef_v8value_create_undefined cef_v8value_create_null cef_v8value_create_bool cef_v8value_create_int cef_v8value_create_uint cef_v8value_create_double cef_v8value_create_date cef_v8value_create_string cef_v8value_create_object cef_v8value_create_array cef_v8value_create_array_buffer cef_v8value_create_function cef_v8value_create_promise cef_v8context_get_current_context cef_v8context_get_entered_context cef_v8context_in_context cef_v8stack_trace_get_current cef_task_runner_get_for_current_thread cef_task_runner_get_for_thread cef_menu_model_create

user32

GetKeyState GetKeyboardLayout VkKeyScanExW GetClientRect LoadCursorW SetWindowLongW GetWindowLongW SetParent IsChild GetFocus SetWindowPos SetWindowTextW

mscoree

_CorDllMain

?CanDownload@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@1@Z ?DoClose@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@@Z ?GetAccessibilityHandler@RenderClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefAccessibilityHandler@@@@XZ ?GetAudioHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefAudioHandler@@@@XZ ?GetAudioParameters@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@AAVCefAudioParameters@@@Z ?GetAuthCredentials@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@_N1H11V?$scoped_refptr@VCefAuthCallback@@@@@Z ?GetContextMenuHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefContextMenuHandler@@@@XZ ?GetDialogHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefDialogHandler@@@@XZ ?GetDisplayHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefDisplayHandler@@@@XZ ?GetDownloadHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefDownloadHandler@@@@XZ ?GetDragHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefDragHandler@@@@XZ ?GetFindHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefFindHandler@@@@XZ ?GetFocusHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefFocusHandler@@@@XZ ?GetFrameHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefFrameHandler@@@@XZ ?GetJSDialogHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefJSDialogHandler@@@@XZ ?GetKeyboardHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefKeyboardHandler@@@@XZ ?GetLifeSpanHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefLifeSpanHandler@@@@XZ ?GetLoadHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefLoadHandler@@@@XZ ?GetPermissionHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefPermissionHandler@@@@XZ ?GetRenderHandler@RenderClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefRenderHandler@@@@XZ ?GetRequestHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefRequestHandler@@@@XZ ?GetResourceRequestHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefResourceRequestHandler@@@@V?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@V?$scoped_refptr@VCefRequest@@@@_N3ABV?$CefStringBase@UCefStringTraitsUTF16@@@@AA_N@Z ?GetScreenInfo@RenderClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@AAVCefScreenInfo@@@Z ?GetScreenPoint@RenderClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@HHAAH1@Z ?GetViewRect@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@AAVCefRect@@@Z ?InternalCursorChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@PAUHICON__@@W4cef_cursor_type_t@@ABVCefCursorInfo@@@Z ?InternalCursorChange@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@PAUHICON__@@W4cef_cursor_type_t@@ABVCefCursorInfo@@@Z ?OnAcceleratedPaint@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@W4cef_paint_element_type_t@@ABV?$vector@VCefRect@@V?$allocator@VCefRect@@@std@@@std@@PAX@Z ?OnAccessibilityLocationChange@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefValue@@@@@Z ?OnAccessibilityTreeChange@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefValue@@@@@Z ?OnAddressChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z ?OnAfterCreated@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z ?OnAudioStreamError@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z ?OnAudioStreamPacket@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@PAPBMH_J@Z ?OnAudioStreamStarted@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABVCefAudioParameters@@H@Z ?OnAudioStreamStopped@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z ?OnAutoResize@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABVCefSize@@@Z ?OnBeforeBrowse@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@V?$scoped_refptr@VCefRequest@@@@_N3@Z ?OnBeforeClose@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z ?OnBeforeContextMenu@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@V?$scoped_refptr@VCefContextMenuParams@@@@V?$scoped_refptr@VCefMenuModel@@@@@Z ?OnBeforeDownload@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefDownloadItem@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@V?$scoped_refptr@VCefBeforeDownloadCallback@@@@@Z ?OnBeforePopup@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@2W4cef_window_open_disposition_t@@_NABVCefPopupFeatures@@AAVCefWindowInfo@@AAV?$scoped_refptr@VCefClient@@@@AAV?$CefStructBase@UCefBrowserSettingsTraits@@@@AAV?$scoped_refptr@VCefDictionaryValue@@@@PA_N@Z ?OnBeforeUnloadDialog@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@_NV?$scoped_refptr@VCefJSDialogCallback@@@@@Z ?OnCertificateError@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@W4cef_errorcode_t@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@V?$scoped_refptr@VCefSSLInfo@@@@V?$scoped_refptr@VCefCallback@@@@@Z ?OnConsoleMessage@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@W4cef_log_severity_t@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@2H@Z ?OnContextMenuCommand@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@V?$scoped_refptr@VCefContextMenuParams@@@@HW4cef_event_flags_t@@@Z ?OnContextMenuDismissed@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@@Z ?OnCursorChange@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@PAUHICON__@@W4cef_cursor_type_t@@ABVCefCursorInfo@@@Z ?OnDialogClosed@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z ?OnDismissPermissionPrompt@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@_KW4cef_permission_request_result_t@@@Z ?OnDocumentAvailableInMainFrame@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z ?OnDownloadUpdated@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefDownloadItem@@@@V?$scoped_refptr@VCefDownloadItemCallback@@@@@Z ?OnDragEnter@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefDragData@@@@W4cef_drag_operations_mask_t@@@Z ?OnDraggableRegionsChanged@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@ABV?$vector@VCefDraggableRegion@@V?$allocator@VCefDraggableRegion@@@std@@@std@@@Z ?OnFaviconURLChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABV?$vector@V?$CefStringBase@UCefStringTraitsUTF16@@@@V?$allocator@V?$CefStringBase@UCefStringTraitsUTF16@@@@@std@@@std@@@Z ?OnFileDialog@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@W4cef_file_dialog_mode_t@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@2ABV?$vector@V?$CefStringBase@UCefStringTraitsUTF16@@@@V?$allocator@V?$CefStringBase@UCefStringTraitsUTF16@@@@@std@@@std@@V?$scoped_refptr@VCefFileDialogCallback@@@@@Z ?OnFindResult@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@HHABVCefRect@@H_N@Z ?OnFrameAttached@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@_N@Z ?OnFrameCreated@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@@Z ?OnFrameDetached@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@@Z ?OnFullscreenModeChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@_N@Z ?OnGotFocus@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z ?OnImeCompositionRangeChanged@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABVCefRange@@ABV?$vector@VCefRect@@V?$allocator@VCefRect@@@std@@@std@@@Z ?OnJSDialog@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@W4cef_jsdialog_type_t@@11V?$scoped_refptr@VCefJSDialogCallback@@@@AA_N@Z ?OnKeyEvent@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABVCefKeyEvent@@PAUtagMSG@@@Z ?OnLoadEnd@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@H@Z ?OnLoadError@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@W4cef_errorcode_t@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@3@Z ?OnLoadStart@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@W4cef_transition_type_t@@@Z ?OnLoadingProgressChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@N@Z ?OnLoadingStateChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@_N11@Z ?OnMainFrameChanged@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@1@Z ?OnOpenURLFromTab@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@W4cef_window_open_disposition_t@@_N@Z ?OnPaint@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@W4cef_paint_element_type_t@@ABV?$vector@VCefRect@@V?$allocator@VCefRect@@@std@@@std@@PBXHH@Z ?OnPopupShow@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@_N@Z ?OnPopupSize@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABVCefRect@@@Z ?OnPreKeyEvent@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABVCefKeyEvent@@PAUtagMSG@@PA_N@Z ?OnProcessMessageReceived@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@W4cef_process_id_t@@V?$scoped_refptr@VCefProcessMessage@@@@@Z ?OnRenderProcessTerminated@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@W4cef_termination_status_t@@@Z ?OnRenderViewReady@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z ?OnRequestMediaAccessPermission@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@IV?$scoped_refptr@VCefMediaAccessCallback@@@@@Z ?OnResetDialogState@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z ?OnSelectClientCertificate@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@_NABV?$CefStringBase@UCefStringTraitsUTF16@@@@HABV?$vector@V?$scoped_refptr@VCefX509Certificate@@@@V?$allocator@V?$scoped_refptr@VCefX509Certificate@@@@@std@@@std@@V?$scoped_refptr@VCefSelectClientCertificateCallback@@@@@Z ?OnSetFocus@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@W4cef_focus_source_t@@@Z ?OnShowPermissionPrompt@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@_KABV?$CefStringBase@UCefStringTraitsUTF16@@@@IV?$scoped_refptr@VCefPermissionPromptCallback@@@@@Z ?OnStatusMessage@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z ?OnTakeFocus@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@_N@Z ?OnTitleChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z ?OnTooltip@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@AAV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z ?OnVirtualKeyboardRequested@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@W4cef_text_input_mode_t@@@Z ?RunContextMenu@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@V?$scoped_refptr@VCefContextMenuParams@@@@V?$scoped_refptr@VCefMenuModel@@@@V?$scoped_refptr@VCefRunContextMenuCallback@@@@@Z ?StartDragging@RenderClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefDragData@@@@W4cef_drag_operations_mask_t@@HH@Z ?UpdateDragCursor@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@W4cef_drag_operations_mask_t@@@Z

cefsharp.core.runtime.pdb

SHA256 44eb03688be527548730442fbb8c86037ea5fdc665270e582e2c50d3cb212234
MD5 60fd7df5882f5cdf1301ed45f5655902
SHA1 4346af1e80845b7c55baa5d104fc992cd0510c08
SHA512 be3afa8bda79c124f3becb3a167bcdadde078aff061f255bf038f99c6a68b63d638402b990a25e6ae3cf721abf4659b8a8e4a9696f69bb98de3b1547d02e4d19
SSDEEP 49152:Pro8dHp+U76tuiXD0dM5tasfN45l1Tf4kX9NuHo1ZPm+1ElAMTCiaBN2llkwwBu6:PQUZHTrQroU4yw
TLSH
T17EB61922E64B5D73D69F463E9297031D2326A80457AFE3C79949A3351FDB304DE2B30A
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

cefsharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e962bd6746bc848d81859fcef2413a41aac91aa61065cce798d27a60113a78fe
MD5 fd438102291a1f3af8416e20d0bae067
SHA1 61109dfcb6474cf80a1329255ed107216fe12b4f
SHA512 c5707d5fac59403493c72da6b96a8c1de1cc5b43df5f1dc57bbb843fbe045c64488d530d158981703ff44c1cab45fd5e73336be280f9afdaa5e29c305d45c8fc
SSDEEP 12288:Lmf1jtXsb4hy2QGF3s2EsIH3DDy42wkMf7TfhYz:qfvy4hjrXo3DucbzTfhYz
TLSH
T16C35E7213BE48729EE5B093384A05625D377D3D6F316DFA87670A43D2C82B675E026B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1110198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\cefsharp\CefSharp\obj\Release\CefSharp.pdb

cefsharp.pdb

SHA256 91ab519193993bcf7cf439864cfb737f5df18e193bfee28b277e884396f0625c
MD5 cd96d21bf20403cbedadde3f0a7f110b
SHA1 e0a69f577b92665f6be340ebaf1039145bd0dab7
SHA512 c9832897ee8c08cd49ffe51732ea746090c3fd977a87ed3f523343b7d7d08e2b91d10278b9489e98fde085778a157d64950195253b859c328ed2abb6fd99050e
SSDEEP 12288:F36vSB5EuGldhxsRhG1I24z1pGXW0zJeMEfR+wEHUHCdI+H5ISJP8yP3avxXWDHh:56vSB5SDssIr8zUK0HCdI4T/avOt
TLSH
T1E8E5B72BFB40CD73E478893C199EDB0D1736E6589B42D7EFA544B1382E963852D0A3D8
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

cefsharp.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d41e5059ba46884ee2a6598f1a0e1de4c5e47580d6cc7dbc1b0eed2ae984ce75
MD5 891b0a96be358b81783593c1bf65bcb3
SHA1 bb2fd659e1e9b5c84af408f7bdcd4d3f4b2b6d33
SHA512 c94b95292f35fa8a26d0b2abbc15236e3332f7901969c51d22dc8ca80b6e1f8d144a1e7828cac484c9ba27acde2cedf5b77b4e61970d95971898afc335e1e314
SSDEEP 768:sLzIyNxuKaANX8IfuH26lyxDCJuSBEZayB6jkmJOVTUyje8fXz7oo3:shNxHaecBuSBEZskmJONUyjhfP13
TLSH
T1B3331A1297AC9A7BEBED0A7C643025520B72EF037556D3E96D01B1EE19B63A00F503B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

58214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\cefsharp\CefSharp.WinForms\obj\Release\net462\CefSharp.WinForms.pdb

cefsharp.winforms.pdb

SHA256 3ec16fe9c14419192154bbdad91a8e4b43024e1f27a8149d28151b3e15a2f9eb
MD5 2fac455fa8f7260d7bba93727dd3c5d2
SHA1 6ed9d2c6b66cb573987340aaf23996d05e23ec84
SHA512 7f2f9d536781cfc85760110f7fd6ee72db9321a1bbf2521aabadae70acd1b499aae2bbcba487e7b7315d828d18532bdaee7b83ce60dda1ba672869c7529f2f38
SSDEEP 1536:jja8r5UHuvTrt9ujSkmf0UhhRBiHQqEHcdtitUGRSji:S8Trrt9YS30U9BiLEHMti1Sji
TLSH
T1C1E3852BFB04CB37E078453819DB5F0D1736EA45A6839BDFA655B1182EF63092E4239C
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
MD5 501981c7fc457d59238eb99780efb615
SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
TLSH
T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\198629\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

costura.pdb

SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
MD5 34b42a5776a3ad022b429124d55e576d
SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
TLSH
T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
MD5 SHA1 SHA512 TLSH

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

esendex.tokenbucket.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e46f8e5e563b16c889145f002474de6ef7c78e53ac3cc632723447e367d338d7
MD5 e7842bdb3c2f8b557acd548ee7438434
SHA1 056baa4753b0c482bbae1c1cf5462f92efe5f6b9
SHA512 1410aa0c8bc2976ebc527b2c55d241a2b316c50c95e2a03d901464aac0f37d87e63003ea747ea027e5b8f45dae038d1752a4b5372f2bd069a7f856d8f402be34
SSDEEP 96:7L4Jq/43T3BdCfbcXdKIynwlTIaDph4kdOMxhXk:f+3Bkf4YQnmkcy
TLSH
T131F1D81413FC4B33C9BE0B71ACFA42011734BA119C77D65F454D8A5B2966B940AE1B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\projects\tokenbucket\Source\Esendex.TokenBucket\obj\Release\Esendex.TokenBucket.pdb

fastcoloredtextbox.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
MD5 8610f4d3cdc6cc50022feddced9fdaeb
SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
TLSH
T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

336350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb

icsharpcode.sharpziplib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cb9c05b5a1e1db26ff43490ee26f2e02abae3f321d2dd5ddd43a68da48eab83d
MD5 9e9e0a210297968aaf2e00d13958c0b4
SHA1 a32d2dbeac852718f285e26e3d9436a97879e55c
SHA512 d90deec822f12c55a77e1defba102c3ef803bb463afb43123dbd2fee24d876bb670d71db74cdf799eafcffd74c8afa19de36c3c2f2fbd2fc588e28580f344a53
SSDEEP 6144:1XvJj49GIq1a+L0g9FWz1SSA2ltaccym865I:v49GI2a+1FWZH+cw
TLSH
T130444A142BFC4B0AF6EF5BB5E872819687E5B996613FE38D5C8490FE2C027918801777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

255578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/ICSharpCode.SharpZipLib/obj/Release/netstandard2.0/ICSharpCode.SharpZipLib.pdb

icsharpcode.sharpziplib.pdb

SHA256 d14d75b91138cfda95c8396752c4935fbe8afdad12e026c0845899b460bf555e
MD5 6816fa53932d4a4a32c78258f14dbec1
SHA1 e1fca83029d1440f54fb3747b240365a6df0a598
SHA512 fea3d9ab701356d82daf43c2c2bcc88a6b6bdf0818724678249a705ba0eaed0c80250359b38795613f6fd4137afbca1cf85585a76ade6182f4d3827653164404
SSDEEP 1536:1RQrIuJMBnA7iPQ5hanP7gKf1PAzIDSbuX5cKMxmMrQqNJfsTlRvTHxnsv2:1qrNKnKiPQ4jgruX5qFE5v
TLSH
T106C3D65B92CC832FC406153DC5A29255B7B5C3BCC64B8F1263D8E635F85EB2887A3E64
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

log4net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d45a6afa38f0b10814063f2a42e6efce45752853667650e765844b8566b3332
MD5 46319a38ce5d09020d2ac56b67829c6c
SHA1 ffe64ca4d4bc9e1dab1d195982d22121a6baa058
SHA512 0de61771a92ee71470e51bccf66d3a39c105ae23d60e73d8e4e7d44135dff4c8d1dddff9bbb6be72ff083d51c784e5ca829a6adefee87fd901d2de58db0ddb03
SSDEEP 3072:h+8gmdoxSO7ZbQFroo7RVir/dtnK0sgdnogtHcU5qFG1RSGCkE9kKn7GCcaLoWn:c1N8LLI/PK0scnodG1RS1T93caL
TLSH
T13544065477F84A19F2FF6BB8A475011587B6F956B87EE35E0A80A4FC2C33B1089117A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

264682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

microsoft.aspnetcore.webutilities.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0f96a425e05decd3484eecc05f1957ef39768dfb1ce2e4cac9e10ac30361aa8a
MD5 0d65948a9719aa94218b0012409c3398
SHA1 92deee204350c7c029f59054b115cbed8ffdf1e6
SHA512 8438ceeb545f80709594eb32219961e5d13d830ddf7c391866e7e27431fb0658be0a24653f47c8311ad451c365984ecf8ed9b88e963283e8a99b9fe5a637486a
SSDEEP 1536:PX9wrSVM+ZPyr7gyT8vPuEq3W13uX9/H2IDOpC8WiVkxO7Bx:PnVvesHPuEqiuX9/H2IypCRVw
TLSH
T124533C456BEC8613D79E3BFDA671D5831B36B26E6512F78A1C8CA0DE1877BC0980035B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

76:72:de:19:39:a0:a0:0e:56:24:ba:57:3d:10:c0:d3:d7:0f:ee:1c:22:f6:b0:8c:5b:79:0f:38:b3:a2:da:11

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

62894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/Microsoft.AspNetCore.WebUtilities/obj/Release/netstandard2.0/Microsoft.AspNetCore.WebUtilities.pdb

microsoft.bcl.asyncinterfaces.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5dc372a10f345b1f00ec6a8fa1a2ce569f7e5d63e4f1f8631be367e46bfa34f4
MD5 970b6e6478ae3ab699f277d77de0cd19
SHA1 5475cb28998d419b4714343ffa9511ff46322ac2
SHA512 f3ad2088c5d3fcb770c6d8212650eed95507e107a34f9468ca9db99defd8838443a95e0b59a5a6cb65a18ebbc529110c5348513a321b44223f537096c6d7d6e0
SSDEEP 768:DulwnBhYlTVv2wK5idcgF4of1n6K9zUYJ:ywHYFtKYdcg/f1nXzUYJ
TLSH
T1C6C26D16E35C5317CFBA2EF5E570D6432A35E78A2C12E72E1148E2A51C97384AB31739
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

dd:e4:54:0c:99:60:4b:1c:d7:75:bb:9f:7d:c3:a0:52:66:42:53:8a:ea:76:a1:ad:88:a1:38:83:d6:18:e7:a0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2022

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

21490

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb

microsoft.extensions.dependencyinjection.abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 039155f155c5d14f5b73f4ee2cd1fbd9290f391b88a1d2a0ba815569205edb74
MD5 37eb7cce6e282d3572d64c880e1ac3c8
SHA1 9a2952589a19d650932e7c633577eb9afc04f959
SHA512 e3c2ef1cc52e3aa5bd77b74dec93a4fc9e908df823426f13ca304265d41605de51970cc8c7e18c2e76319d3225707b2ea2d8613402a25c4fbd3951e70fcfd521
SSDEEP 768:AMWC5N7mKWPKz4VJ4e0jeuTGlBh0JzqPPxofk3l9z2I:Y67hCfV8j3TGlB+JsafkHzP
TLSH
T137234D01A3FC4253DFBE2A707CF59300DF34694B7522E32A6649B095289BBC45B64BB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

c3:a7:a1:fb:82:f3:e9:b6:96:78:90:21:7b:ce:52:1c:ae:0d:f6:22:ca:a1:67:18:41:4c:61:cc:91:11:09:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2022

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:04:c1:03:19:7e:c6:05:e4:04:00:00:00:00:03:04

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2022 - Aug 3, 2023

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F77F-E356-5BAE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:aa:a5:31:9b:0b:cb:b2:08:0e:00:01:00:00:01:aa

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

42998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb

microsoft.extensions.dependencyinjection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 40dcb80a87a762745d0a15294b5ca7783a9ead1d93ad352d25b5edaf4994651e
MD5 4186a905dc180a0cc2110403727bd792
SHA1 e0563d20ca7e95688a60f4bfc1ab0127eae1f651
SHA512 1c3459232b41c531f01bcce54e46799f2fb3fcd6c87d7f908c633abcc718d9726d98e65f964b1a870d416a38f545971779054fe65f7c1299905fc7dc24fa2dec
SSDEEP 1536:0kUuBN7CjSkp9oa++t1BVryVKXDORdDeCNia6Lj4Fu/qSGnJdo0Wzs:ju/t/VryVKXeDezVLj4F/JdWQ
TLSH
T194836D3467EC8B2ADABF2A74547941014F79E6CA3403D35D0E98F9692A97FC10B22377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

54:ae:f4:ed:8a:71:64:bf:cb:ee:e0:f6:87:fc:18:63:8b:59:e6:a0:54:75:43:26:52:93:69:54:40:90:55:34

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2022

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

83262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb

microsoft.extensions.logging.abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 154a5cac85be0c7d144f4e46bc8f054550405ab8c14444b8872cf904f4750b8a
MD5 7e4077b1de8c84de9bda96cc580d8cd1
SHA1 d0c8df2043dde5b8ed2c57a0db6d188cfcde630d
SHA512 e7ee138510a5979c947b39544e5281fbb3838333f7b4d80c7f3f655baf7c2ea213c3ac64ce760ec8add0715e1eeed353e76f5bd621307784e417866727444ae4
SSDEEP 768:YJSQpn6Ge9qAeIbNGgc+EnOZV2k8tDbBJKrwMuwZ5XseUzh54eZBTJRBttYNh0kt:YbyqwNGgTtHXWz0mttJOoatfuzS
TLSH
T1B3535A115B8C5363CFBE59BDE161B603573CC6AA7003D35B5CCCB2252D6BBA84A106FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

c9:69:33:9a:59:9a:07:06:81:0a:66:7c:32:5c:e4:a9:6b:77:79:ab:40:6c:a3:0b:8d:d9:5d:b7:db:86:9e:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2022

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:04:c1:03:19:7e:c6:05:e4:04:00:00:00:00:03:04

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2022 - Aug 3, 2023

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:DD8C-E337-2FAE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:9c:0f:a6:4d:61:d2:9e:4b:28:00:01:00:00:01:9c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 2, 2021 - Feb 28, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

60482

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net462/Microsoft.Extensions.Logging.Abstractions.pdb

microsoft.extensions.logging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a8e30ff3d55dd697b149529e981a56705e1cc675e338daf09d16987f84b46354
MD5 acc186364f11860ff6f3f9e3c1a7ca9a
SHA1 017f1c5c5d683cdf740e7666a198841069d5eaa8
SHA512 7d47b589af06e7215ff21bcea1f6af35aa6ff0d59aabbf77cbe8dacf7686f9dd82aade02ef398ae4cffacc59ff0bc5e27179a99809cfd350976f37e4e5bfd5b6
SSDEEP 768:UwqdTsmcSrZz2tWWqLXu5h/sfxwuo0N1pOQ69zNc:Uwqu7qSZsfDo0sze
TLSH
T108236C1493AC87B7CE7E1A78F8A4A4850A3DC75A3012EB5BDE8CF59129B37845360277
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

61:4f:42:81:0c:da:25:8d:15:49:4f:ed:91:fe:05:8c:14:5d:be:26:5b:46:05:01:ed:c9:56:75:64:4c:ec:c5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2022

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:05:4d:62:0d:68:85:07:aa:33:00:00:00:00:03:05

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2022 - Aug 3, 2023

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:3BBD-E338-E9A1,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:9d:fe:89:e5:f9:7b:bb:4c:c0:00:01:00:00:01:9d

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 2, 2021 - Feb 28, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

44942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging/Release/net462/Microsoft.Extensions.Logging.pdb

microsoft.extensions.options.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c74798fbd888aa5cd7589ab6cdb924e7bd69a03090dd193e9ef950050403919f
MD5 a78597736475e3143b4fc6ef49f9dd97
SHA1 4a20dde58f07c09633374566e092b77a2429449b
SHA512 065564a3094c8ef28b218aa003512b3ba8f8c1fa8ac3aa9aa0f0794904e26ae923834c4eb546372d9bb58c461290545856b664efc4385d8ca6f1592c62523404
SSDEEP 768:vONSDQiLnQy3PA7A6duKBn1QClL+otQmp2q4gFHn91nHsyH7OvFwuo0Ob50Zi9zm:WmQI0U6ri0+orpeu9ayHYFZo08zuL
TLSH
T195535C0EE7A813A3CEFF0970B95560130B3BC2977992E7BF46DDF984282775049A1639
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

b6:f5:fa:ed:1e:b0:cb:5e:58:33:76:6b:44:cc:39:7c:d4:57:c2:08:5e:ad:0c:d1:b1:12:54:74:e0:02:df:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 20, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:05:4d:62:0d:68:85:07:aa:33:00:00:00:00:03:05

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2022 - Aug 3, 2023

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:32BD-E3D5-3B1D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ad:fc:df:4d:58:e3:5d:32:e9:00:01:00:00:01:ad

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

59010

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Options/Release/net462/Microsoft.Extensions.Options.pdb

microsoft.extensions.primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dc997827664ee67da9d93c08e012f4f77afb166236b06c8371d9379f7cfd4215
MD5 72db6ff0a92724cb156a6e8fbc559ae6
SHA1 c50de610d1db4e2a83f21d6f2f23dcfc2b6c9c22
SHA512 bd963bc3b33840ef7e2450ae4b41bfc6302ef356bac50e69cf1d3c9323508cfd30b8c3ff5754ac9d2c8b86677530c5440f88ebb6b954a498d0ebea741edaa824
SSDEEP 768:5vwI/tRiB1tAMH0BdaNg0CAAQ59414DCtOPOXmWwjjcKMuiIKfuUIwIuo0hyJm9I:thlRiBRE8b7CtOPRjjjBMuiIKfZIqo0E
TLSH
T1F3236D11A39C8337CFEF1A74A8A9D2511B3BC3D9B612F72A5588E06518A37C18A71377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

6f:80:31:b5:73:ab:b5:9d:18:43:6b:35:c5:ad:77:46:f8:68:50:e8:9f:ef:a5:e9:c8:f5:49:ef:ea:ab:39:23

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2022

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:05:4d:62:0d:68:85:07:aa:33:00:00:00:00:03:05

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2022 - Aug 3, 2023

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:E5A6-E27C-592E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:95:b7:fc:0d:d6:e3:37:31:25:00:01:00:00:01:95

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 2, 2021 - Feb 28, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

41886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Primitives/Release/net462/Microsoft.Extensions.Primitives.pdb

microsoft.net.http.headers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 751e6493e6e4ec1951f9cd7b912388979ca54ef33ecfaf1c38654e0b87a13993
MD5 71c1985f31ffbd4ca11eb6da9f9413ca
SHA1 560e7100a987f203eb205f6f0d057a8cd1095426
SHA512 4e0d5cf0a31757301a6c1b715c4a2380d801d0a1949e7e45c1e732a48cf942fff977d75356a912c48c9ddde6ff454083e9edb26109cdaeb4d1fb1214727b3f18
SSDEEP 1536:LOxjk4/YqDWaq2L2A2IWOY+e999CGJTVj+/ZoRRSh0IPMAMj8iPV:LOxjj/YqDWaq2L2A2IxY+SSGJR+/uRRN
TLSH
T14F735C663BEC5716D3AF6A34B07610911BB5D797B813CF9F0988B07A1813FE5C8106A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

49:fa:42:44:15:ac:72:e4:14:ed:f9:b6:b3:2f:5b:e8:df:48:ed:ac:75:97:67:04:10:3d:c6:37:d2:95:a9:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 9, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

71394

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/Http/Headers/src/obj/Release/netstandard2.0/Microsoft.Net.Http.Headers.pdb

microsoft.windowsapicodepack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 808e96f59e7dd2212eace049079d25545f6c9c3f05244ec9cdc539fda18d34d6
MD5 0d661949ebc172dfb3c3b98566bdf0fe
SHA1 c400a3d279b9b2ed8f5cfca0b3a8c342ea64d9e1
SHA512 7baf43c4ae7709d91cdd2f70dfceb1db881d0d7c89c673fb166294d56a0eafff056128b605be20e0ad304f9392235403441a3b17a3c2f785a4e81931b40e0abd
SSDEEP 1536:dCrMf4QNZsVFCnmaDAtfMR1C7KGLnZOzIaxGIA/JtyzV/liTiA70hiuD:dWY7DyymCR1CfNXaxGIA/JwzFliTiFhF
TLSH
T117A35A61B7BC89A9F6FF0B79F6310510CB71FD462A16EBAB2540A5CD14A3BC04666333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

103774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Aybe\Documents\GitHub\Windows-API-Code-Pack-1.1\source\WindowsAPICodePack\Core\obj\Release\Microsoft.WindowsAPICodePack.pdb

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 8, 2023

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2021 - Oct 29, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

704578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

newtonsoft.json.schema.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9f1a8f06c284a4ee01f704d89003ddc7061846f2008094071e9adf08267849f9
MD5 4a6ca31a317485f46a2e38076dece916
SHA1 890718b23c301ced9dc7eefdeb764383ec49c318
SHA512 551e772fe2ee72b349d5c4ed5d5f8d8957d50cfcbbde7af5d5740d9652bcad626a2c00bc0d9223db7c874962187a90f9160397f243eadee1c594585ba2b155e0
SSDEEP 3072:KaCtGLj7onSwh8HPF+9/CDj/RzjjSysNLkF4mZYw4Rv7T6BpiF+2htnX0w0wiA0g:RCtu3rwh8Hs9aDjZWLwDp4Rv72pfp
TLSH
T1F1442941A7F84A36D6BE6774E4B401018AB1B61BD46ADB1EBD9CA4FE0F337009501B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

266694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json.Schema/obj/Release/net45/Newtonsoft.Json.Schema.pdb

objectlistview.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0b94b3824761723400dc0357e7d490085a5ccf3415e332155c5b8d6c7bfb8788
MD5 b490bb6c6bbb4af7c43c15071c0e5034
SHA1 828a03191d6df0d17975007f6bef8c56e371069d
SHA512 27c60b0c7e85d22249332aeaf5fe1f0d6083e8f68cc461e4e97e3a394e108601378fd2bc7ec39c1fc2dc8338db87f5555511337e95921d63ab9ff7d5d18056a6
SSDEEP 6144:2bKm1kecDAf+bofbvlYRvTj57PE6ucnCNA33ybZH4puTDgcxNr7oj9fUGc/CmC9n:2bKmB2w0jecD33ybZH4puTDgn+XU
TLSH
T142944C5A33ACD63EC0DF0375E014192983F4C584B39BE7AE9DA4D6AD2C43B629D543A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

450558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\jpp\Workspaces\ObjectListView\trunk\ObjectListView\obj\Release\ObjectListView.pdb

puppeteerextrasharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8d13200e7c9e52eb23b7a5fccab29530e6d91c262e0961919aca35cdf60c98a3
MD5 60cab9c975e11f9f0d4822994f4aa517
SHA1 372b1758e2b2d3647447633f92467efd066dc0e4
SHA512 5cf4458d3b0e77cd516d7e9b3e52941baac87dbe5235c210b835e87269f413f599a6167ea76eaa9267c5cc3319453b97316cf0632f061596a2b958e0c124791c
SSDEEP 3072:PU8zirwFBwAkgMQzNgK3spozQCPV5YQ1F18VIQj:RzztkfQzNgPQQmd1YN
TLSH
T127D34B46B2549222C6BB177CA6576601E33593333121F2DA7EACA2D83F33741C465FEA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

136246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Oleg\Desktop\PuppExtra\Puppeteer-sharp-extra\PuppeteerExtraSharp\obj\Release\netstandard2.0\PuppeteerExtraSharp.pdb

puppeteersharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 340d4ae2f27302b7d098e333f62ab9de623444ae5d795dca9c2e471be0192b05
MD5 07826cde40b03130a948a440e36497b6
SHA1 678363bbac588b905ef8b23ec221f8d7a75bb5d4
SHA512 23ea6a2f4659475545b0d8c48c337eb1e45cdccf86d4fcfca81b1dc00b8d3f85acfb261a544f08d93f5a3ff3c3a3c3518310be6aceb61b5a39c065bb0da99640
SSDEEP 6144:ekwHrSx4N1TzscIJdSb3o/6B0/QHCQlnPPpwkujn+9OS10yK1FHDX3G8Bow6gtgk:ekmOi/gnveHl21k2CQMrEzH5p5
TLSH
T1F1F4180303B98622E6EF5937A86182A586F3F5426574EB9F158CE4A42F537478C42FF3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects Windows executables referencing non-Windows User-Agents
Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

761234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

PuppeteerSharp.pdb

restsharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 199e6a74e46ae881ad238656169ceaa390e2c2ce8038494baac236c117838d9f
MD5 98a13f2791c25c39c65268a55ebc219c
SHA1 9843e3fe2bdb0d42509f5b1ddf02a71a6683fc82
SHA512 3f74016b5fb2636f102df8347d283fcdd831ad0884a133623cfb1147d1e47e795f772162a401adeeb3bc1787fa022ef6302c50580bc2405a4c6c7daa407ceee7
SSDEEP 3072:Zn1z0eAv+f6FuseJFf3+Ptl6n6dYQ7g8QqWF2OYiBbcfJS/zC3lR6O/c:Z1z0bv+f68LRol6n6diqyt8R6
TLSH
T118046C5453A867A5C7FF6778F4306022C7F6E445B5A5EBEAED08F0E9109330AB81127B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

190006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/RestSharp/RestSharp/src/RestSharp/obj/Release/net471/RestSharp.pdb

sodium.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf5b02ac516e9b62086649f43a29287c7872bbdb87512e9d5ec1be681c77a94a
MD5 fa95d735f88e819edc0cef02d3ee4781
SHA1 9e3c03ee4b0efeedf59edaca15ea304d2ec4cec7
SHA512 554cf8906c7e4bc15653685e70e96995bfdf0803fb30ca196d8bc34f9bfb888a7a1de64e8441415155889893ac7769bb643aa87913f5176c80588b1e3a38348b
SSDEEP 1536:CjCH26g5fMVJXJO466QZmtQLrG3HbK7HIN8xmZ/zuXohMU6i3HFkdEpy:CmH26gr466HtQMbK7HIN8xmZ/zuXohML
TLSH
T10D53E9096FE88F5BE7FEA6346CB013026A7BF4D96D53C74F255D30EA2901394852274E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

b0:83:5d:ce:39:95:7b:dc:65:e9:78:8d:ff:22:7e:c0:bf:64:45:15:c7:05:78:0e:60:9d:ff:13:dc:f4:c0:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer\, Adam Caudill,O=Open Source Developer,C=US,1.2.840.113549.1.9.1=#0c146164616d406164616d63617564696c6c2e636f6d

Chains

Jan 7, 2017

CN=Open Source Developer\, Adam Caudill,O=Open Source Developer,C=US,1.2.840.113549.1.9.1=#0c146164616d406164616d63617564696c6c2e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Minor OS version

0

Major OS version

4

Entry point

61690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Adam\Documents\GitHub\libsodium-net\libsodium-net\obj\Release\Sodium.pdb

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

system.diagnostics.diagnosticsource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5b8ccdda36486950de37484c25e1334376431e52176c32f87dd730690b273e3b
MD5 eca216927ed487613b7a042fc643bd8f
SHA1 030bbd6d404138a5de6ad850269985372c89d9eb
SHA512 c234b5a11e14b5da6cc940bc0d989c0f64c73e66cfe62970ecdb5db37f1e86a163861987a947a3c6fe93291557356f1f1c1fbbfa2187dd61f4a9235c1e374e78
SSDEEP 3072:bNcLPcNABKuTwIxpRoZgM4U2Ny1jb54rbHXrwZ2F3c:p1NAB9qZgM4U4qnQwl
TLSH
T1ED046C1423EC4BABCAEF5B79F178C8524771E917B112E76D6D04B8ED2823B918E01277
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

9a:39:a3:d5:b0:f8:6e:56:44:96:85:b7:fb:f6:be:0e:8d:fa:c8:d2:76:4b:63:b6:d4:5a:88:42:1d:99:ae:65

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 17, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

167622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Diagnostics.DiagnosticSource/Release/net462/System.Diagnostics.DiagnosticSource.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a4:6c:07:cf:a9:38:ad:dd:05:7b:ae:24:e4:ad:78:9e:fa:07:82:fb:e0:b3:ea:d5:f5:bc:8e:78:ff:71:9b:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 8, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 2, 2021 - Sep 1, 2022

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

136114

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb

system.net.http.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b1148146ff0b6abf9150b6ddd0a960814fb0344c01dfac2f37403622026402fe
MD5 b6cc43fbd813258c1d08ccbbeb072fbc
SHA1 6581908fb5fb34f4f9220a1527642749819a75af
SHA512 d8453148172d267da0789c841363785f50d1fc9338482dfe114a36130db533cc7e8c8eed14b2b67c7744ce5ab343664a93a8e4a841b50d1760b99b2670858b06
SSDEEP 1536:pJZfV2EZPqmGabOKja9YCY6w9nCEDeySilnALYzc:j11ZKafjaPY6w9nCEHlAEo
TLSH
T19E536D1597DC9713EE6F3EFC68B052928B35D2A5A522F74F948C70E829D37840A047BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

bc:21:4b:38:9e:d2:e6:c0:b0:17:57:74:55:ba:1a:39:d0:39:f3:61:6f:66:7f:d8:2f:33:93:af:ef:35:9d:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 17, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:06:9c:9c:5d:25:e3:10:aa:47:00:00:00:00:03:06

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2022 - Aug 3, 2023

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=Thales TSS ESN:E5A6-E27C-592E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:be:f4:20:a2:ee:96:d6:20:d6:00:01:00:00:01:be

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 4, 2022 - Feb 2, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

59634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Net.Http.Json/Release/net462/System.Net.Http.Json.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

103866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
TLSH
T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a0:70:99:f3:f5:b7:ef:fb:27:e6:01:6f:08:b5:3a:37:53:0b:75:67:14:d0:60:c5:7a:94:ea:2c:97:22:88:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb

system.text.encodings.web.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c792bfe3f43c894e20339252d159a96a20ccc6e13322b2d382570ff97939e501
MD5 c77ae3414d78c1f082c65415fae69661
SHA1 3b35461d86a774535ac226ca9706fb50332de20a
SHA512 08941ba8be5031cc4e363a916525437c62b409576c91c10fc72795faa10bc989f0d1797b576802e208dfe4305a4447c0299e2755ba92f97f531de1f56fd5865a
SSDEEP 1536:4OO7OOOc2yIDmBkKQh3rt7jUGyRG/mz4CRLf8ocVW4t72bfQZHzp:fyMmXQh3rNjUFG/mk8f8owW4s0ZHF
TLSH
T1DB736E16A748C71DC71E153256E085619BF0DFAF1323F7822845B82E2B733C9FA1D6A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e8:c3:5f:a8:e8:49:f6:6f:ce:7c:4e:41:6e:cd:0a:5b:2b:95:b7:d9:f0:22:47:29:d8:22:9f:86:e5:74:80:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 18, 2022

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:04:c1:03:19:7e:c6:05:e4:04:00:00:00:00:03:04

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2022 - Aug 3, 2023

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F77F-E356-5BAE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:aa:a5:31:9b:0b:cb:b2:08:0e:00:01:00:00:01:aa

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

65030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Text.Encodings.Web/Release/net462/System.Text.Encodings.Web.pdb

system.text.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1f2452eee60a8c4ef3a894ddbac663f91ebba3eefee54e1b7c424de1f82e6b6b
MD5 962630bd48df30b2704db18658887f7a
SHA1 b57d63dd1442a9c350fed5eb0b509835809523fb
SHA512 2182418471c12421bf885f31e6b2120e1ddb4ffe4c16baf527b10bc307c48ef037e26a2a3a8d4fc37b7f5bf2694c0330ef6fb7cd07ea5a638ee978ea85b8868b
SSDEEP 12288:Wo+rY8ZyAVNXL1VPGSEhOiUHsHEg2A9fcRne:WhxXXrPGSR529
TLSH
T152C46C6023E89A2BE6EE0774A03550148B7BFD2AE3ABD74F114499FD1C927849D913F3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

98:9f:21:c3:68:0e:c1:de:5d:f6:89:23:82:34:a5:08:36:66:5c:65:81:08:f8:33:b3:fc:70:84:dd:1f:60:30

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 20, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:05:4d:62:0d:68:85:07:aa:33:00:00:00:00:03:05

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 4, 2022 - Aug 3, 2023

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:7880-E390-8014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a8:55:f0:61:a9:cc:30:18:5c:00:01:00:00:01:a8

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

575678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Text.Json/Release/net462/System.Text.Json.pdb

system.threading.tasks.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb

system.valuetuple.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
MD5 23ee4302e85013a1eb4324c414d561d5
SHA1 d1664731719e85aad7a2273685d77feb0204ec98
SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
TLSH
T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d4:37:69:30:cf:c4:bf:17:93:07:4e:1a:10:f5:a8:79:e8:8f:5f:58:7c:25:a7:a1:5a:95:50:d7:24:03:73:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

78:b3:c4:5e:5b:a3:f6:32:6e:9b:44:3e:33:4f:0e:39:8c:1c:4a:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:a9:54:70:d9:79:c0:84:65:e2:00:00:00:00:00:a9

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

12898

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb

websocket-sharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 697f13f09cb2c425ddcfe1aa167d698f7af5aea48d03d5370143bc00e9bbfa2e
MD5 e67544b112f568f13b17d72189fda007
SHA1 b75b79c65330a77fe7aea5ef6c319d7f3d1865d4
SHA512 5a3381c0be69df8dc5a8c7c931b14919a189a8d03d2128d3848fbf73e3fd21631fe44eccd9baf97a15f646d0fcc5b3263b6eac2f98d67557a07ad6fb4f91c402
SSDEEP 6144:aG6L6WIqe9bjj1OLNryn2aJJJnoQCSJgI:aG6L6WTeBjKsn2aJPoQ
TLSH
T17324180427F85A2AF3FF9778D1B455248BB6F957BA2AE75D9C8450E90C23B80CE10763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

231766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\websocket-sharp\websocket-sharp\obj\Release\net45\websocket-sharp.pdb

yove.proxy.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0484e0b4de32793c814115b44defddd6a646ba601ebeeb963b51b9146b514a75
MD5 9c81c0ee84f78fc7ccf052bbf94e251b
SHA1 49f97ea2bcc1482905873e0fc56ccc7758173f91
SHA512 dd8aa8ad922f59c6c6c3ebbffa485b0629ac768bdcb526b83e210007190eec4542af2e22228448841226e5d49dddfa5081ddd3b0863fa619727afc6ee1886412
SSDEEP 384:lkYYOntiyJ2Qo282MUwCwS0Kr9U4nskELBP:lztf2R282X1/0YHs1
TLSH
T1F272092563BC8133FA6F0B7EB837029607B5D756A512E79E4E88A4D93D9338344053E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects executables containing URLs to raw contents of a Github gist
Detects executables manipulated with Fody
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/Users/sunny/Documents/Yove/Yove.Proxy/obj/Release/netstandard2.0/Yove.Proxy.pdb

Sharing

General

Malware Config

Signatures

File Explorer