Roblox Account Manager[.]exe

resource	yara_rule
sample	costura

resource
Roblox Account Manager.exe
unpack001/cefsharp.core.dll
unpack001/cefsharp.dll
unpack001/cefsharp.winforms.dll
unpack001/costura.dll
unpack001/esendex.tokenbucket.dll
unpack001/fastcoloredtextbox.dll
unpack001/icsharpcode.sharpziplib.dll
unpack001/log4net.dll
unpack001/microsoft.windowsapicodepack.dll
unpack001/objectlistview.dll
unpack001/puppeteersharp.dll
unpack001/restsharp.dll
unpack001/websocket-sharp.dll
unpack001/yove.proxy.dll

Roblox Account Manager.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 be9ddcdedf8c36c64e6b0a32d2686b74a112913c54217ccaa46675bfd1dc82f1
MD5 334728f32a1144c893fdffc579a7709b
SHA1 97d2eb634d45841c1453749acb911ce1303196c0
SHA512 5df9d63136098d23918eba652b44a87e979430b2ce3e78a3eb8faef3dd4bd9599d6c31980f9eaf2bd6a071e966421bc6cec950c28b3b917f90130e8a582c2a1f
SSDEEP 98304:42bT1Qm7d9G4/Ml61KO9bjRxMLywnrmYa0kqXf0FJ7WLhrBzcgPgL6b:/Qm59RMowO9bjRmmYiYa0kSIJ7zgPE
TLSH
T12246E02A72A04335E5AB45344468C1B496FE7E3A6A68E29EE7C0BD5F3DF5BD09430313
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5641118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Roblox Account Manager.pdb

cefsharp.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cec6e0403a2dafea012ee965921f44657caec0f07e813b8f7d259d90351cb8b0
MD5 87fcedd1e06c3c6e5985616320f6e7df
SHA1 c5a4fd2931f39fcdcff0366a260ae131e688e98c
SHA512 9c0c4c975bc5be752b0fe757275337d089534d96f335ca7ab194a2cc366968a93dd210bd297f2f40ae8d4753026a21110173f48f8e87a8197d6fd323169bcdd5
SSDEEP 12288:AJYiopTEAzPl8OI9WDgVJpJJpJXX5PFE3yeDZ:ViIhgRhWieDZ
TLSH
T16B15F91577A89B2DE79A16B3E1314FB60673E3063656E3AD7768A6AC3F033005D005BB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

947626

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\cefsharp\CefSharp.Core\obj\Release\CefSharp.Core.pdb

cefsharp.core.pdb

SHA256 bae3a6bc284b88446cc09af3b1975ac6a5fc87b83164235476e4d82279bfbfa7
MD5 ba6ccebd8e72209752747aa329aae725
SHA1 cf36e78cdcf8a2c9b882791dc0a15a3eab2da189
SHA512 08e4a08f449fd5bc1eeeb318160dcf9c2f79c370cd85820bb2f30d07c19c5b7bfd7c127023344f379e115065796cdf141d42da43769bd6088a1c5b5deebcdced
SSDEEP 12288:0mc1Tn+xlBmO6dJWQI6Jl7eIEvCBBUmMMeE+aSFv1I6JlZE+aSFrh:0mch+dmO6dsyEv1mMZP
TLSH
T127C58127FB40CE73D469893C69AEDB0D0739F658AB42D76FA945B13C2E853850D0B2D8
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

cefsharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3aca7c62000daa613e40714c0c4b7a8f99b9f392dc59adf66334be76f892028e
MD5 446717551db95d0630c652d196a8e8ca
SHA1 7a3d52f42822b9948db1fb7e408b5ee6867b4940
SHA512 4636c97d6e0ab7da9eb0dacc75fc9ab9fa5ed300bde31f72033d4bad44b453168c30d87a35bdcb39c9e096f6b66e198a798fa0dc97c6738092c742f0c8e447a0
SSDEEP 3072:I79yn4kb88X+7jbc16LMfqtgvzyWajH+cO2bm5kPExVX0TOKTAQtrz+pyUU2+tKn:fbtobyRfYg2tz+4AeMX0TjTAU+pmBK
TLSH
T184543C0577E8AA25EAFE4B39B8B02D0A0FBBFD19B035F79E4D08552D1663B058940773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

285438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\cefsharp\CefSharp\obj\Release\CefSharp.pdb

cefsharp.pdb

SHA256 c28dc55559a712ac69b7c3c7bb3b3189f7f23b05382d36e24524d7396ada2f9f
MD5 e5d1a852ced2f28bbd643655a9201b41
SHA1 a64ea6195ca570f73ef3af03f81880cab50425e2
SHA512 bb6047ae6a34704eb41952bcbb0995435d1f88bafa11c531cdd485ad450f9c4bd4d4e346806bcf47f2f59893c846f8893c453940f293df3cc6dca53bac64bdd0
SSDEEP 6144:IPxZWhj4WZZxQ4q5Ak8n2AcpipXC5Gl6RsdXjc8exhi8HZWhj47ipXC5GHc8exJ8:RjLTwAk8hpjIs1jVjPjH
TLSH
T16D35611BFB04CA33F1F8567815DBAB0D6377E3546243A7EF9248A1183EB22493D4629D
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

cefsharp.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8298c55b1687b3962f1ee4565bb77dbe76f583491d9b02cff7341c1138331a3a
MD5 2f93c2c8baa036bde6f4c4e038d7729a
SHA1 11fc4fc936cf6ff821df1a37b2733abeeb6d36cd
SHA512 92832721161a3a9e9f8905ba91fc64f879abe421c9095bbc23c21ce4fcf89c0fa0ace3817fe976154ae6a6b2e050a43b1d5b91527e84d6bd6192df6930972897
SSDEEP 1536:so/AhwNZrYv1tYsQ8kmJOuUySMgYnbgL:sgNCvbYsQ8kmJOpyTgYnbgL
TLSH
T12133091643BC9A7BE7EE0A3D643025510B75EF037592E3A99D01B1A619FB3A0CF503A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

59158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\cefsharp\CefSharp.WinForms\obj\Release\net462\CefSharp.WinForms.pdb

cefsharp.winforms.pdb

SHA256 2468af2e71ec637d867064b6096c88da66a1478bdf59503bfca05a4f0142b3cd
MD5 b3cfc084ff2c9f995ea2e632e90b9dcb
SHA1 779bfb4410959e2700a3ea8edbf99f1e7cac7edb
SHA512 906bcaee528ab572fc8ac456bb67dc2b8145dc65909e9302253d6d7e0a0839ab6ca52b6627f760af9554680c0e190f12c8ffd02bc7fc87610a53f870b4b126dc
SSDEEP 3072:QG889uGQHwIHMSlZVOivlLVbHiUVMVbWi:p8WsHDflZV7bHiUVybWi
TLSH
T1B5E3B62BBB48CB33E078453419DB5F0D1336EA4266839BDFA65971186EF63093E4639C
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
MD5 501981c7fc457d59238eb99780efb615
SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
TLSH
T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\198629\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

costura.pdb

SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
MD5 34b42a5776a3ad022b429124d55e576d
SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
TLSH
T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
MD5 SHA1 SHA512 TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

esendex.tokenbucket.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e46f8e5e563b16c889145f002474de6ef7c78e53ac3cc632723447e367d338d7
MD5 e7842bdb3c2f8b557acd548ee7438434
SHA1 056baa4753b0c482bbae1c1cf5462f92efe5f6b9
SHA512 1410aa0c8bc2976ebc527b2c55d241a2b316c50c95e2a03d901464aac0f37d87e63003ea747ea027e5b8f45dae038d1752a4b5372f2bd069a7f856d8f402be34
SSDEEP 96:7L4Jq/43T3BdCfbcXdKIynwlTIaDph4kdOMxhXk:f+3Bkf4YQnmkcy
TLSH
T131F1D81413FC4B33C9BE0B71ACFA42011734BA119C77D65F454D8A5B2966B940AE1B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\projects\tokenbucket\Source\Esendex.TokenBucket\obj\Release\Esendex.TokenBucket.pdb

fastcoloredtextbox.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
MD5 8610f4d3cdc6cc50022feddced9fdaeb
SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
TLSH
T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

336350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb

icsharpcode.sharpziplib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cb9c05b5a1e1db26ff43490ee26f2e02abae3f321d2dd5ddd43a68da48eab83d
MD5 9e9e0a210297968aaf2e00d13958c0b4
SHA1 a32d2dbeac852718f285e26e3d9436a97879e55c
SHA512 d90deec822f12c55a77e1defba102c3ef803bb463afb43123dbd2fee24d876bb670d71db74cdf799eafcffd74c8afa19de36c3c2f2fbd2fc588e28580f344a53
SSDEEP 6144:1XvJj49GIq1a+L0g9FWz1SSA2ltaccym865I:v49GI2a+1FWZH+cw
TLSH
T130444A142BFC4B0AF6EF5BB5E872819687E5B996613FE38D5C8490FE2C027918801777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

255578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/ICSharpCode.SharpZipLib/obj/Release/netstandard2.0/ICSharpCode.SharpZipLib.pdb

icsharpcode.sharpziplib.pdb

SHA256 d14d75b91138cfda95c8396752c4935fbe8afdad12e026c0845899b460bf555e
MD5 6816fa53932d4a4a32c78258f14dbec1
SHA1 e1fca83029d1440f54fb3747b240365a6df0a598
SHA512 fea3d9ab701356d82daf43c2c2bcc88a6b6bdf0818724678249a705ba0eaed0c80250359b38795613f6fd4137afbca1cf85585a76ade6182f4d3827653164404
SSDEEP 1536:1RQrIuJMBnA7iPQ5hanP7gKf1PAzIDSbuX5cKMxmMrQqNJfsTlRvTHxnsv2:1qrNKnKiPQ4jgruX5qFE5v
TLSH
T106C3D65B92CC832FC406153DC5A29255B7B5C3BCC64B8F1263D8E635F85EB2887A3E64
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

log4net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4ffeecfa1564bcd632891c7e0f376669227ed177e4f34bd8fb25f493162d8c3a
MD5 b1f2f30cce59ac4e12329e83c8b807b1
SHA1 9b5b84143fe1d90006ac69d06d2fbd57c949013d
SHA512 b8d49fa7abdf528b629787adf70e184afac1b417364b9628459014ad26899b8806e44d3e27b0bec728968eaa295d0090fdea73efa31dd699b5f3ac718842c8f7
SSDEEP 3072:hKgY9I6srcV3x5angC8Z7ZEymUS31PQjRv6HaQ0YMkQyUSGmvJukKn7GXcE2qgj:DESngPiyePQjGkyUSbhuOcE2
TLSH
T1FC44175477F94A19F2FF6B74A47414558BB6F956B8BED75E0A80E8ED2C23B0089003B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

265762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

microsoft.aspnetcore.webutilities.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0f96a425e05decd3484eecc05f1957ef39768dfb1ce2e4cac9e10ac30361aa8a
MD5 0d65948a9719aa94218b0012409c3398
SHA1 92deee204350c7c029f59054b115cbed8ffdf1e6
SHA512 8438ceeb545f80709594eb32219961e5d13d830ddf7c391866e7e27431fb0658be0a24653f47c8311ad451c365984ecf8ed9b88e963283e8a99b9fe5a637486a
SSDEEP 1536:PX9wrSVM+ZPyr7gyT8vPuEq3W13uX9/H2IDOpC8WiVkxO7Bx:PnVvesHPuEqiuX9/H2IypCRVw
TLSH
T124533C456BEC8613D79E3BFDA671D5831B36B26E6512F78A1C8CA0DE1877BC0980035B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

76:72:de:19:39:a0:a0:0e:56:24:ba:57:3d:10:c0:d3:d7:0f:ee:1c:22:f6:b0:8c:5b:79:0f:38:b3:a2:da:11

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

62894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/Microsoft.AspNetCore.WebUtilities/obj/Release/netstandard2.0/Microsoft.AspNetCore.WebUtilities.pdb

microsoft.bcl.asyncinterfaces.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
MD5 ff34978b62d5e0be84a895d9c30f99ae
SHA1 74dc07a8cccee0ca3bf5cf64320230ca1a37ad85
SHA512 7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28
SSDEEP 384:cOJWqnwCBbNAP0VES2j0cX6dAl+NWpVzrdcoquWeP/WxR5kHRN7dDFcYR9zPrf8O:culwCBhdVv2wK5fdcUtFFn9zT8pY
TLSH
T14FC27C1A935C1317CEAF2EB4E570D9422935E78A2C22EB3E1588F2950D97345EB31738
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

73:a6:36:c1:dd:b5:ab:95:84:54:f7:d7:ec:c4:a1:7e:22:c6:c0:c4:77:c8:31:52:a6:11:c8:6c:c8:6e:03:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

21458

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/Release/net462/Microsoft.Bcl.AsyncInterfaces.pdb

microsoft.extensions.dependencyinjection.abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c5a119ec89471194b505140fba13001fa05f81c4b4725b80bb63ccb4e1408c1e
MD5 00053ff3b5744853b9ebf90af4fdd816
SHA1 13c0a343f38b1bb21a3d90146ed92736a8166fe6
SHA512 c99fcda5165f8dc7984fb97ce45d00f8b00ca9813b8c591ad86691bd65104bbb86c36b49bb6c638f3b1e9b2642ec9ac830003e894df338acfca2d11296ff9da4
SSDEEP 768:4r85ZhSBuU1OURH7MV5594phn9Uad5J6Sx+I9W6wjMwRLSEnlHctC63/iOn9zT8c:cH7Mz8DiIW6Pw9SEnl8txviO9zTH
TLSH
T1B8533B5533F8C767CBAE5F7338759300DB34A9476532E36F268E70D5088ABC913A0AA5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

14:a7:32:72:64:f7:23:e8:be:57:c2:21:f3:21:7c:b9:a5:35:32:e9:c3:f7:bc:95:3a:e4:4f:b9:ec:9a:ee:3a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

58402

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.DependencyInjection.Abstractions/Release/net462/Microsoft.Extensions.DependencyInjection.Abstractions.pdb

microsoft.extensions.dependencyinjection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 18b39777ee45220217459641991ab700bc9253acaf0940cf6e017e9392b43698
MD5 3452007cab829c2ba196f72b261f7dec
SHA1 c5e7cfd490839f2b34252bd26020d7f8961b221b
SHA512 a8b83a8582dfee144925a821d09c40f5730f6337b29446c3bce8b225659bdc57a48778081fa866c092d59b4108c1d992e33f9543ae2b4c7554b8ff27b5332cdf
SSDEEP 1536:g/F7GzTFh4u/Nf172OPHxZXD2wdOwaOwGuldE4lCyBBiM+z9f:oF7i4u/FYg3XrMnOwGuld5dBMZf
TLSH
T1F4936B3963FC8B26D6EB19B5A87451000F7AF7CF7002E35D0E98A46D1A97FC50B612B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

20:c5:2f:08:47:a4:30:1e:29:79:16:95:df:20:4a:30:61:66:ed:7e:72:5e:29:b9:1b:46:e6:73:16:1c:38:83

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

92062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.DependencyInjection/Release/net462/Microsoft.Extensions.DependencyInjection.pdb

microsoft.extensions.logging.abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5907c585797617c998df0953d2a05d334a9d80f04a5c0bc20377725327e3355d
MD5 edcf259b8ad051b75441657aaf7fce4d
SHA1 732f1260097586da7e99a2ea4fa0c17f0d42fcb1
SHA512 7acd074624479689b299969d3c6018927adb96657dd83e0107db5e861b5a28721f80e3e78ecec76132e845be34f2cb9a7583fb295f35bbb7e7d546bc84a4ca39
SSDEEP 768:KeYEQCkKeIcxfJfEZm/xiOyoOv7vyBnoOF+JLkg9Ts0mPvwXMBvTJRmMFYYtl+T2:je9kpy4JQRbPvWs2MFbOMX/igz5
TLSH
T1AE637C0193EC4323CBBE8D76A8A696529F74C2267407D7177ECCB1292C6B7884F513B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

c2:1f:bc:a4:67:e7:40:57:b2:8d:d8:9b:78:09:d4:bd:8b:e8:d1:be:34:eb:62:da:f7:b5:b1:d8:62:16:42:29

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 11, 2023 - May 8, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:cd:55:07:2a:e7:ca:c1:99:1d:00:01:00:00:01:cd

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 25, 2023 - Feb 1, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

62262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging.Abstractions/Release/net462/Microsoft.Extensions.Logging.Abstractions.pdb

microsoft.extensions.logging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c7756fe1d2641d905a61d11ccdda2acc94c3379a81ba5a280aaf4c1fe4f289ab
MD5 0392cd41ba1ff3fa3be8dfcf5e263096
SHA1 02bec0ee5069fe7e6a3e2a3fcc9590073c150892
SHA512 b87e81a94e2b4c13ce68d112bb6976453ea7031d59a08db9d33f6ff6e64baec4cc47a50632ff1ea4f99fc96ceff363e68d01b2321073005aaa9f90474af3634c
SSDEEP 768:z+WEaLx5VeBjZO9B/Wf0WrKK2tDiZ7ljq6OHedxSV/i+1R9zZLYH:z+WEcbsjZOXe3vZBfOHedxS9iazl6
TLSH
T135336B0143EC436FDB6E1E74F4B8A6448B36DB4B7412F7576E8DB0562863BC08A2027B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

8a:73:f1:d0:9a:d7:cd:26:70:df:b9:af:e0:d1:2d:7f:0d:a4:88:5b:6f:11:c5:c6:3c:c6:aa:59:38:c2:e1:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 11, 2023 - May 8, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:d6:27:69:ff:72:2d:56:c8:ae:00:01:00:00:01:d6

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 25, 2023 - Feb 1, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

48894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Logging/Release/net462/Microsoft.Extensions.Logging.pdb

microsoft.extensions.options.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c9b11d696d9cfd6276dbb057fa9ed0787af16889e7ce0964460de9eea7cce8dd
MD5 84622f295cb1949d8edaf3d94f2ea9d4
SHA1 aab0e638c3169ea3e62beabee3acbd7586ba6ebc
SHA512 60a33945df66666e5deed39bf7217a9ed2255a0704dc63486d4778c28fd0d95947f63f628043b25f6dc6b0436fb12b4ef7b83e58377688fe661d5beed82b98b6
SSDEEP 1536:twY8FVh3koDXsiqK6P2i1YdqC6l5sUXJiQzFrc:OYMVhUJKmXYd/ofXt5o
TLSH
T1A0634B02E6988223CFBF49B1B969A1720E36D31B7106E77FC6CCF59898537406D61B39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

f7:b0:1e:04:25:c7:2f:13:e0:f1:12:85:5a:5b:ea:4d:2a:18:76:c4:17:90:46:26:8c:eb:48:2a:52:98:e5:04

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 30, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 11, 2023 - May 8, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:d6:27:69:ff:72:2d:56:c8:ae:00:01:00:00:01:d6

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 25, 2023 - Feb 1, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

63558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Options/Release/net462/Microsoft.Extensions.Options.pdb

microsoft.extensions.primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3c6ea55594433e2f0340227bd1588fbab1ba8a10c99319b528cc5573259340cb
MD5 cb24b09fdc28b1fc98e432935331d30d
SHA1 048041ffc26bf3ee228e5900e7701dd250c3b6ab
SHA512 2407b85950f33a7d3a329b3c81436b96bce20b93ca865baaab379bb4994800e16f8c40f95d285b74b95c6509bf266cb0c7ce9dd380656762372132715decd20e
SSDEEP 1536:yEmA+a0f5TSCyiOPi7jjZhuiJq4Kui5zM:Xz+a0s2OPi7jjSiJq4KHA
TLSH
T15D236D21A7BC4737CFAE1A70A0A8D2410B3D8399B613EB7B5988E1595C633C54B7127B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

33:71:8c:80:d9:4e:3e:01:b6:a3:02:2a:81:cd:0b:28:a5:65:13:e1:eb:52:8c:0f:0e:17:42:cb:bc:c6:8b:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 11, 2023 - May 8, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:d1:b2:5b:40:28:6c:2e:d2:45:00:01:00:00:01:d1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 25, 2023 - Feb 1, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

44390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.Primitives/Release/net462/Microsoft.Extensions.Primitives.pdb

microsoft.net.http.headers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 751e6493e6e4ec1951f9cd7b912388979ca54ef33ecfaf1c38654e0b87a13993
MD5 71c1985f31ffbd4ca11eb6da9f9413ca
SHA1 560e7100a987f203eb205f6f0d057a8cd1095426
SHA512 4e0d5cf0a31757301a6c1b715c4a2380d801d0a1949e7e45c1e732a48cf942fff977d75356a912c48c9ddde6ff454083e9edb26109cdaeb4d1fb1214727b3f18
SSDEEP 1536:LOxjk4/YqDWaq2L2A2IWOY+e999CGJTVj+/ZoRRSh0IPMAMj8iPV:LOxjj/YqDWaq2L2A2IxY+SSGJR+/uRRN
TLSH
T14F735C663BEC5716D3AF6A34B07610911BB5D797B813CF9F0988B07A1813FE5C8106A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

49:fa:42:44:15:ac:72:e4:14:ed:f9:b6:b3:2f:5b:e8:df:48:ed:ac:75:97:67:04:10:3d:c6:37:d2:95:a9:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 9, 2019

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

71394

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/Http/Headers/src/obj/Release/netstandard2.0/Microsoft.Net.Http.Headers.pdb

microsoft.windowsapicodepack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 808e96f59e7dd2212eace049079d25545f6c9c3f05244ec9cdc539fda18d34d6
MD5 0d661949ebc172dfb3c3b98566bdf0fe
SHA1 c400a3d279b9b2ed8f5cfca0b3a8c342ea64d9e1
SHA512 7baf43c4ae7709d91cdd2f70dfceb1db881d0d7c89c673fb166294d56a0eafff056128b605be20e0ad304f9392235403441a3b17a3c2f785a4e81931b40e0abd
SSDEEP 1536:dCrMf4QNZsVFCnmaDAtfMR1C7KGLnZOzIaxGIA/JtyzV/liTiA70hiuD:dWY7DyymCR1CfNXaxGIA/JwzFliTiFhF
TLSH
T117A35A61B7BC89A9F6FF0B79F6310510CB71FD462A16EBAB2540A5CD14A3BC04666333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

103774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Aybe\Documents\GitHub\Windows-API-Code-Pack-1.1\source\WindowsAPICodePack\Core\obj\Release\Microsoft.WindowsAPICodePack.pdb

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

38:27:11:d0:35:02:fc:58:64:ae:1e:6c:cb:c5:eb:67:eb:5d:dc:c8:86:9e:e4:59:cc:0d:02:0e:5f:d1:fc:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 8, 2023

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Subject

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Serial Number

06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 15, 2021 - Jan 14, 2046

Subject

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Serial Number

0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73

Issuer

CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2021 - Jul 14, 2031

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29

Issuer

CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 13, 2021 - Oct 29, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

704578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

objectlistview.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0b94b3824761723400dc0357e7d490085a5ccf3415e332155c5b8d6c7bfb8788
MD5 b490bb6c6bbb4af7c43c15071c0e5034
SHA1 828a03191d6df0d17975007f6bef8c56e371069d
SHA512 27c60b0c7e85d22249332aeaf5fe1f0d6083e8f68cc461e4e97e3a394e108601378fd2bc7ec39c1fc2dc8338db87f5555511337e95921d63ab9ff7d5d18056a6
SSDEEP 6144:2bKm1kecDAf+bofbvlYRvTj57PE6ucnCNA33ybZH4puTDgcxNr7oj9fUGc/CmC9n:2bKmB2w0jecD33ybZH4puTDgn+XU
TLSH
T142944C5A33ACD63EC0DF0375E014192983F4C584B39BE7AE9DA4D6AD2C43B629D543A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

450558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\jpp\Workspaces\ObjectListView\trunk\ObjectListView\obj\Release\ObjectListView.pdb

puppeteersharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8811f681737cb47e9c72d0d984570206dc88e9112041e8d0bd3e501a0dbaeae7
MD5 48ca3859b1e865e096167268d69dc0b5
SHA1 1472c84e06fad7a53fa63a75f658bb09c04af25e
SHA512 67da3b479d471d39bf3381ff8417ef7930479beed26496ebb1ca061261ad1a57e4681210dd3ec9d011cb631344c4af1c72e5748adc018b0343beaec5272c0afc
SSDEEP 12288:3Yy3Hh5cKhAHe/RPegC3c1Dn4lB4XucnkIKyM4xY1q:FKHeJPZxn40eMkIKZNc
TLSH
T15625390523B88663D9DFAA38BA35C25543B3F10A6A35E75F664CE8953F533424C42F2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

977866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

PuppeteerSharp.pdb

restsharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0cbe7c6b83c1d6256f6023c8c795ec2fa94f867ba3345bbc778adac8921c9d7d
MD5 b77d08ac650bdf0a8b8a7b70c469d32b
SHA1 87d980fcff329484ebb8b4458865564a209448bc
SHA512 e13e58383b313067a52864c582d77f0509625b6abd979f29018783d0933189d1ca53b82479f15bd09ad8cf91d5a9c0d13ff1a90a15c28fdcff2b744b6cb9bc68
SSDEEP 3072:UoJKdktpEZu0g8Jsimri502z2J9rcQoG2BdKOZYao17bZ4JV/3j/loitkFuS:3zOfpzmm5HgYQoGKKCzlTt
TLSH
T157245C2A63A84315CE9F6779F42014308BF6ED19705AFBFFAA58B4FD14637725900227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

217738

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/home/runner/work/RestSharp/RestSharp/src/RestSharp/obj/Release/net48/RestSharp.pdb

sodium.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf5b02ac516e9b62086649f43a29287c7872bbdb87512e9d5ec1be681c77a94a
MD5 fa95d735f88e819edc0cef02d3ee4781
SHA1 9e3c03ee4b0efeedf59edaca15ea304d2ec4cec7
SHA512 554cf8906c7e4bc15653685e70e96995bfdf0803fb30ca196d8bc34f9bfb888a7a1de64e8441415155889893ac7769bb643aa87913f5176c80588b1e3a38348b
SSDEEP 1536:CjCH26g5fMVJXJO466QZmtQLrG3HbK7HIN8xmZ/zuXohMU6i3HFkdEpy:CmH26gr466HtQMbK7HIN8xmZ/zuXohML
TLSH
T10D53E9096FE88F5BE7FEA6346CB013026A7BF4D96D53C74F255D30EA2901394852274E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

b0:83:5d:ce:39:95:7b:dc:65:e9:78:8d:ff:22:7e:c0:bf:64:45:15:c7:05:78:0e:60:9d:ff:13:dc:f4:c0:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer\, Adam Caudill,O=Open Source Developer,C=US,1.2.840.113549.1.9.1=#0c146164616d406164616d63617564696c6c2e636f6d

Chains

Jan 7, 2017

CN=Open Source Developer\, Adam Caudill,O=Open Source Developer,C=US,1.2.840.113549.1.9.1=#0c146164616d406164616d63617564696c6c2e636f6d

CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Minor OS version

0

Major OS version

4

Entry point

61690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Adam\Documents\GitHub\libsodium-net\libsodium-net\obj\Release\Sodium.pdb

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

system.diagnostics.diagnosticsource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c8a5ca93d8e40dafd48759226f70f90af8ccbc3a8df45d4e6fd5dc5626b05ab9
MD5 faef01b70b8e775a92d4b9e2383f2749
SHA1 a35b2fb5fb243319ac4c9b776dad416d76d3aeea
SHA512 c4b482e1249555f9dabbee97b030792617a250362aef175dfd9877a875808a9e91278ff6d3cfac04730a8e919095f01a4c27254a94191433704dbbd6d7a78ab8
SSDEEP 3072:uo4D0KyYm46XJ6jgo1vUHbQ0/buFabBZhFKRiasm5SbzM7gM/0:+ByYm4/1BobBZnKRTnb7O
TLSH
T147047C1063DC0B7BCEEF17B5F16088064372E957B912EBAD2A44B9FD2C137919A12367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

da:b6:6a:96:8e:77:61:a0:d1:55:0e:c0:1f:8d:7a:60:f9:fd:62:23:45:36:29:97:ec:78:76:7e:b9:22:61:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 11, 2023 - May 8, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b5:ad:1a:df:d7:85:70:6d:13:00:01:00:00:01:b5

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 20, 2022 - Dec 14, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

183270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Diagnostics.DiagnosticSource/Release/net462/System.Diagnostics.DiagnosticSource.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
MD5 f09441a1ee47fb3e6571a3a448e05baf
SHA1 3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde
SHA512 0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6
SSDEEP 3072:nUGrszKKLB8a9DvrJeeesIf3amN32AW/rcyw/s:OB8l3/aK32qU
TLSH
T1BAD37D6857C6DE56DB5FEC70E02052016631C52F5742BBEE5DC8B8F026923EA28193FE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a4:6c:07:cf:a9:38:ad:dd:05:7b:ae:24:e4:ad:78:9e:fa:07:82:fb:e0:b3:ea:d5:f5:bc:8e:78:ff:71:9b:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 8, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:52:8b:33:aa:f8:95:f3:39:db:00:00:00:00:02:52

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 2, 2021 - Sep 1, 2022

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:a7:35:bb:2e:c2:64:85:50:29:00:01:00:00:01:a7

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 2, 2022 - May 11, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

136114

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb

system.net.http.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 56f51736571f694409acaed608fdd4d7bf55adb00e72bc63ec73d08e43d8acff
MD5 0de12ee2c9e50b9281ae34ea8a26177b
SHA1 346375f9c2e4ddf450070a8f74183b6e174b461d
SHA512 c28a39bfe144aec900d1f1806a5f7dbd26900315bc2237f2435a4b6fd861643d9d207127ab5f95dbbf6b3630f0789751771489dbeff36d6c70d90e26938297d8
SSDEEP 1536:SNLOOOU45ST4k5UVVEo52s/B3VYvbS9FlXABDMia4zE:q8sqE8FYvbS9FlCDvY
TLSH
T1D8637D1867EC8717DA9FAABDA934AB160B35D75A5A13FB5F318C91EC14833040B503FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

ea:a9:af:a6:04:5a:b9:b8:3c:e8:63:3c:c2:ef:89:c5:46:1e:d0:16:6a:37:85:c4:da:79:2c:b5:36:84:a5:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 11, 2023 - May 8, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b5:ad:1a:df:d7:85:70:6d:13:00:01:00:00:01:b5

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 20, 2022 - Dec 14, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

67082

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Net.Http.Json/Release/net462/System.Net.Http.Json.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

103866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
TLSH
T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a0:70:99:f3:f5:b7:ef:fb:27:e6:01:6f:08:b5:3a:37:53:0b:75:67:14:d0:60:c5:7a:94:ea:2c:97:22:88:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb

system.text.encodings.web.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e9c4f5eed186cb129c527c4b8d67d163ea2f2396e9d8b96e30b5e7c12203ce84
MD5 fa9d0d182c63c49a4c567f7c1652b6e6
SHA1 55ddfbe80762c02f9a9c65809f9ec3ef8f7f2ccc
SHA512 58f468c982ab66930ff37efb5a941db116e8c1aed66ebc23720a7b18f71bebe1e929bea76680294edb25f430c23d520b8a87e3a22064c5993d0396819a21cbe7
SSDEEP 1536:AOOgOOOc2yQDmBkKQh39thfavqcdUIUdu4OzfocSWnO73TT+zo:KyEmXQh39HfavqEUTjOzfo5WnMO0
TLSH
T198735E12A748C75AC75E153256A085619BF0DF6F2313F782585CB81E2B733C9EA0E2A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

93:c5:bf:87:63:20:6f:3f:df:14:8c:e6:1c:77:82:fb:5e:85:38:db:da:14:9d:a9:bd:23:e6:f9:c1:84:58:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 31, 2023

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

64978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Text.Encodings.Web/Release/net462/System.Text.Encodings.Web.pdb

system.text.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7eb217f0a0b9fe681de288511cb230708bb1c66e0c4a8553b9c0058632cfd20f
MD5 d88a6b04fdbc82c396db5a301e6bfdde
SHA1 d9201cfb07496f44ada3350f04c09cde5622ba4c
SHA512 64d4fd48c6f9adf2c9e19a858393416549bd17a7d61ba82c63fe28685f72af07edfba14e64e8885e877136c071ed5bcc95b6fd357e3d002a8b70f1d8dfe31497
SSDEEP 6144:9M/44zRvSmawz23Ou3wi4mUfimb7MVM8iHtoqurICVLeV+kctaX+byRcU8sxQiiR:2/Mm43GJObtYi5aJABj3fJVte1ReF8q
TLSH
T1C4D44B01A3E89B2BC99F4735B47602249BB5F82E6379E74B211458FD2C937D18C927F2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

2a:f5:53:51:45:6f:72:db:a1:74:7d:dc:bc:15:ad:ba:bc:17:9a:58:e3:21:5f:1d:a2:ac:dd:7c:ed:81:7c:b1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 13, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 22, 2024 - Feb 19, 2025

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ea:9a:24:72:d5:59:3f:61:63:00:01:00:00:01:ea

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 6, 2023 - Mar 5, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

636882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Text.Json/Release/net462/System.Text.Json.pdb

system.threading.tasks.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb

system.valuetuple.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
MD5 23ee4302e85013a1eb4324c414d561d5
SHA1 d1664731719e85aad7a2273685d77feb0204ec98
SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
TLSH
T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d4:37:69:30:cf:c4:bf:17:93:07:4e:1a:10:f5:a8:79:e8:8f:5f:58:7c:25:a7:a1:5a:95:50:d7:24:03:73:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

78:b3:c4:5e:5b:a3:f6:32:6e:9b:44:3e:33:4f:0e:39:8c:1c:4a:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:7AB5-2DF2-DA3F,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c0:de:2c:3d:07:94:e4:49:79:00:00:00:00:00:c0

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:843D-37F6-F104,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:a9:54:70:d9:79:c0:84:65:e2:00:00:00:00:00:a9

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

12898

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ValueTuple/net47\System.ValueTuple.pdb

websocket-sharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 697f13f09cb2c425ddcfe1aa167d698f7af5aea48d03d5370143bc00e9bbfa2e
MD5 e67544b112f568f13b17d72189fda007
SHA1 b75b79c65330a77fe7aea5ef6c319d7f3d1865d4
SHA512 5a3381c0be69df8dc5a8c7c931b14919a189a8d03d2128d3848fbf73e3fd21631fe44eccd9baf97a15f646d0fcc5b3263b6eac2f98d67557a07ad6fb4f91c402
SSDEEP 6144:aG6L6WIqe9bjj1OLNryn2aJJJnoQCSJgI:aG6L6WTeBjKsn2aJPoQ
TLSH
T17324180427F85A2AF3FF9778D1B455248BB6F957BA2AE75D9C8450E90C23B80CE10763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

231766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\websocket-sharp\websocket-sharp\obj\Release\net45\websocket-sharp.pdb

yove.proxy.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0484e0b4de32793c814115b44defddd6a646ba601ebeeb963b51b9146b514a75
MD5 9c81c0ee84f78fc7ccf052bbf94e251b
SHA1 49f97ea2bcc1482905873e0fc56ccc7758173f91
SHA512 dd8aa8ad922f59c6c6c3ebbffa485b0629ac768bdcb526b83e210007190eec4542af2e22228448841226e5d49dddfa5081ddd3b0863fa619727afc6ee1886412
SSDEEP 384:lkYYOntiyJ2Qo282MUwCwS0Kr9U4nskELBP:lztf2R282X1/0YHs1
TLSH
T1F272092563BC8133FA6F0B7EB837029607B5D756A512E79E4E88A4D93D9338344053E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

23238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/Users/sunny/Documents/Yove/Yove.Proxy/obj/Release/netstandard2.0/Yove.Proxy.pdb

Sharing

General

Malware Config

Signatures

File Explorer

Roblox Account Manager.exe

mscoree

dotnet

cefsharp.core.dll

mscoree

dotnet

cefsharp.core.pdb

cefsharp.dll

mscoree

dotnet

cefsharp.pdb

cefsharp.winforms.dll

mscoree

dotnet

cefsharp.winforms.pdb

costura.dll

mscoree

dotnet

costura.pdb

esendex.tokenbucket.dll

mscoree

dotnet

fastcoloredtextbox.dll

mscoree

dotnet

icsharpcode.sharpziplib.dll

mscoree

dotnet

icsharpcode.sharpziplib.pdb

log4net.dll

mscoree

dotnet

microsoft.aspnetcore.webutilities.dll

mscoree

dotnet

microsoft.bcl.asyncinterfaces.dll

mscoree

dotnet

microsoft.extensions.dependencyinjection.abstractions.dll

mscoree

dotnet

microsoft.extensions.dependencyinjection.dll

mscoree

dotnet

microsoft.extensions.logging.abstractions.dll

mscoree

dotnet

microsoft.extensions.logging.dll

mscoree

dotnet

microsoft.extensions.options.dll

mscoree

dotnet

microsoft.extensions.primitives.dll

mscoree

dotnet

microsoft.net.http.headers.dll

mscoree

dotnet

microsoft.windowsapicodepack.dll

mscoree

dotnet

newtonsoft.json.dll

mscoree

dotnet

objectlistview.dll

mscoree

dotnet

puppeteersharp.dll

mscoree

dotnet

restsharp.dll

mscoree

dotnet

sodium.dll