Kirin-Tool[.]dll | Triage™

resource	yara_rule
sample	costura

resource
Kirin-Tool.dll
unpack001/bouncycastle.crypto.dll
unpack001/costura.dll
unpack001/wpf.ui.abstractions.dll
unpack001/wpf.ui.dll

Kirin-Tool.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8f7333fa1e7b488e772ee2addc0c5ba1ef32feb9b14bec03ab9dc98e9fc39860
MD5 3305ddf060d582204c4ed06cca325632
SHA1 ecbe924ad2bf7a521b5dc1f9d3e72bf3ef0a43a8
SHA512 38f82a03ea56d1d1bdd77af5ad06a328d232a580299a1b5140db22c55f7314da503dfd4e308fea0e5ef835f0293b5b63a0f7386d2b4f946401494e7da3841c85
SSDEEP 196608:mLa2y0CrP700sh53+Eee65L93B8Ozj+Z0K2GA7Z89TCR+ect:mLa2CP0EEJ65RXzaql7Zw3
TLSH
T16196331863F90E54E67BDF796DB8801ACDFAB603E81AFB5C404120CE1CE2785DE65663
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8930990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\!TOOLS\Kirin-Tool\obj\Release\net8.0-windows\Kirin-Tool.pdb

bouncycastle.crypto.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e942cff453287fde8afb2d14a9f901d3c2e4f99ffc647fc3774823f314b81010
MD5 d8e1844d915a974b801d0fc9eb659ffa
SHA1 883936266abf9235d1cfb73a5f302fcf505e5e76
SHA512 cd82291da89a00d3aa232e60a374a2f7154486e1615d8b3c8b119370620e783fa92b5a0a18232b0d90efc6c7e4cac75488c16e49af74ef9a0af202cedcbc9e49
SSDEEP 49152:prUzYM2ldj79XX5PNpbQjEsIFRKaUK+HBkHoOA:tUzYM2lTXJPNqN
TLSH
T14DF55C1677F85E27D26EC7B7C5F05001A7F2FC6AB363DB07668066AA1C12B206D413A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3215358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\git-repo\git-hub\bc-csharp-chrishaly\crypto\obj\Release\netstandard2.0\BouncyCastle.Crypto.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

costura.pdb

SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
MD5 dd3394a0ba6f7158d029e1c3a31b7a85
SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
TLSH
T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

cs.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e62d0a64305bdf6f866320af5c0a9b76f04e324ccacc48b8a7fd74dc15c35e8b
MD5 a3838fefb94850d2e19bf03827eb5452
SHA1 8cd7d08c3b5bf8c6acc5f3870926d5bf5dd274b5
SHA512 4675f7ddb375d80cdfc925212f20ac9b774e5dcdb8c553a748b0f21361a605f94193926c427abeb8b9debe582a633b8d892388da87dade27593a72d84e8dd5c9
SSDEEP 3072:hykgtmfQaOCRSjwPHSwUfhoQR98c/biYOJ25LwYWDM/oUfncF:IwPywIhoQR0vDM/o6I
TLSH
T12924B414B7FA6249F6F34B64BA75D524A93F7F294D06C4AD184A924E01B2F44CEB0B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

9c:7a:80:0d:fd:8e:b5:38:66:0f:27:9d:18:7c:69:39:2e:6b:b2:a5:86:5f:79:24:77:90:6c:33:a3:b1:d9:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

208002

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

cs.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 70db4da263d6f5d480f15cead0d2eb490a6429d1fb67a7b3c840ccec96906898
MD5 fd8934431eb57bf7747efab37f16eade
SHA1 13d887f31d66f3e225ea02c4d48ede022975aa47
SHA512 e59ff758534b0c3d4446f6a4013e42f41f691d67c2bc92eb1761aa8e6ef2e2604055c82d18ef06797d374efb5cabd3f7a1c82a2b19e0d21239846ae9eee99b46
SSDEEP 384:jrlXLkwA5qKV59WIclWmbLHRN7wmcYR9zAA8FF:jp7kwAlrzc5Lwmn9zAnFF
TLSH
T1E09218419BED2602F9BB1E70A6B8E5523D3D7BA71E10C85F1595E64C08A3B81CF60E39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d3:35:4a:84:49:4e:cc:11:59:43:92:b7:33:8c:7c:87:f7:06:ac:9f:d7:39:3c:bd:03:8b:61:78:aa:fc:b4:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14490

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

de.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 67b5b3abde2b6dd89142b4a88e33d0f00b17d7231c5523ff8973a2c85028d476
MD5 94fbc7db003149f59c21326336574278
SHA1 64085b11825253eeb3d9f7a8cf129ec15db4652e
SHA512 0c12dfa309a8ba27005b67df767968e8f537c8704dfe145e89394c815e8ae619f12850fef0694aeec81549be1e7b97c16f1209920069698cc1277c0a7e0e2344
SSDEEP 3072:FSYOZFj16OBS128OJQW8JJUi0iqDzYejJkwRlqtdtXgSbXfR5QfQRa:Fv28O78JJUziUJkXtbXfDs
TLSH
T11B24A451BBEA610CF3F75B60B774D8667E3AFE661A41D01E0059806F05A7AB0C9B9333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

10:fc:2b:b9:eb:9f:2e:a7:5f:7b:0e:10:5a:df:61:8c:7a:6b:b2:65:d0:05:0e:d3:28:af:89:e2:29:d9:4b:52

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

222638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

de.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 645cedc6288a23056c26cf19559ce2b0a886e308b7c9289b5ea1d884a0a4ddff
MD5 273d836a0224dda6421a4353cac322bd
SHA1 899b364b962eb57ef2498d8e72247639f2859707
SHA512 aacb398d1a76ad2532109c09760df1bbad67ecbc4ec5513ebb8f5e3fa424e74b15e29a2be5275c2dc804b51e264833fdecddb39801bc2b52d609b0c5ef89ba7c
SSDEEP 384:GEmGsHW0K/WIclWwLHRN7djezWSR9zUl9Tj:GvGsH1KhctL9q9zm
TLSH
T1EB92F694ABEC0216F5F31F3027B8E4833C3FBBA21910D61E25C4D55928A6BC1CE32A35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

58:f0:14:05:a6:27:bb:8c:45:6e:aa:5a:be:5e:2b:5f:a3:a1:bb:af:35:05:31:06:34:54:f8:a9:5d:66:65:a7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

es.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e75221c1dccf33e30f8134cf908e3c493ae0bae812d94a065efa188effe252f7
MD5 19840a434c062f7d3967d0f33723d463
SHA1 f0c62e223d81219b8cb5f5f75c79205cc0b8c2e8
SHA512 8d5701579ed2df1a11c1e40df4022a9d1ecc1f3bd695656bb10721ec662799e913185a99292ca7c448a4feb01dbd33059d441f55184eaeb72a0a2d151d944da6
SSDEEP 3072:XTLGY9G19ZcsuxpxQ60yKnMKjphWX3fjBcqSp7s7iru+p5TL4oZ9eXDrf0bc:P9pxQ6PKnMQk0uONsDp
TLSH
T19524D6216BEA1701F0F31B54B676E527ECB67C953808C15E505AC39F11E8E48CA7ABB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e6:3f:26:2c:10:86:b2:10:f6:aa:9a:96:fd:24:af:14:9f:a9:a6:fd:9d:7f:07:67:39:b2:dc:30:af:2f:a6:bf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

214010

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

es.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 22201808b528dbb5dbbebc17d7d2c1840d89b9c7fbeb72caa5a30eac0735d595
MD5 4727dc4637bce3435c8fdcf0a56e795a
SHA1 55e2240051a7566e13fe93316ddb86b182a744ff
SHA512 dc54ab92996d606f1b873eafc06bd9db49208cedd82c206acfa2abfc61b3348b321b6812a352f0a04f940794d56be62488ff88612c30262d0cac986ac0fb7112
SSDEEP 384:PiXLpDt4cWIclWLLHRN7Yj7EnR9zV7Fho:qXrcWLYj7ER9zV7o
TLSH
T14092F8918BFC1601F8F71B30AA39E5537C3E7AD76A00C92F16D5E15818A2BC8CE65A35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

62:f2:84:30:b0:ba:18:c4:a3:a5:ea:5b:7c:ef:57:d0:7b:83:b1:b4:1f:05:45:73:02:c8:bd:63:18:12:d0:bf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

fr.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 928ae7ca6c605f3a5238156287f24becb6fdb60d677f4a16d81f8f7022c6bc8d
MD5 2ab65b9ec3377beefcea14afa7cf47ce
SHA1 63a5f26271b84ff9ccb8f8f1bd663054f20472d7
SHA512 820e88ff81888a51aaa3515ff5d8f381180986df532d69942f41ef5b8a965c36d3c5cfd45e4ef2e879e40f755ee5be9776100248e69934ae619d2dd64f35717c
SSDEEP 6144:arqqxj+ltxeVE8RyBEKeSXDJ61JEtBfnN7Y59dpwzHMEqsy5nyU5M49XEu:kpSltoNH1IA9dmzsEqskj5P9Uu
TLSH
T15924E84567EC1608F1F30BB6F676A517CC36FC252A11E11C8999808F02EAED8D7267B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

9c:3f:b3:fc:58:4c:5c:24:1b:84:66:ed:ad:4f:e1:a6:76:64:d7:cd:19:76:a9:ab:95:8c:9d:40:90:4b:a2:22

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

221686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

fr.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 82700ff381065021ef782171a1f4e319a471ea84642b048af5af77d9a05487d4
MD5 d7fd09666b1bca9af9b31336fb81a23d
SHA1 659b9b23596c975b0eda982a42fb0083f8206547
SHA512 e91529eaf6169d7f9ac54e78636b1f62cd0bb00d4cd49bf75ce084af2db52341d4e52e9899040a8752556c586a2925dcf2649e9deffc60a4ceca09bb820f89fe
SSDEEP 384:5uzhehdMDxbBWIclWAzuHRN77s5DNR9zW6M:sNy+DRcBza7Q9z6
TLSH
T1FB921B998BEC9206F9F76F706975E3422C3D7B831A00D62E1A85E69C05D27C4DB31B39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

b2:f1:6d:bc:95:bf:c7:cf:c6:4b:6d:c0:c9:cd:ea:1e:9d:0e:56:b2:8a:dd:55:f0:25:3d:3a:1f:4f:dc:84:52

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

it.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 812b1ad7d49fe847f5960493f6609b234c84326c4aa7248ac031c849c5b58098
MD5 f346a906bc679cc3c2fa241c54319ad2
SHA1 bcfdd5a032fb337fa27ae985220b5ca95ea5b201
SHA512 3e3a0ea58b94e7242860715dadb728c95becba29574bb980ba186a39373c676fd09ac615ae87e6c2e559c1ce2642712603e2ff366e149d0bb4515325b93bab29
SSDEEP 6144:J3UkTCUNTiNbLqv4CX+4iMbkCinAe5tc8jUG42zTdTnR/itQ8fzz1l75GzFrxB:JNTCUM
TLSH
T13E24927673EA2104F9F31764E276F009AE3BBCE97D04E11D505A424F16AAE44EA79333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

c1:10:ee:53:65:a6:26:6d:15:3e:fa:71:67:43:e7:b9:26:72:d3:f5:71:a4:19:44:32:d0:33:f0:82:82:5a:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

216054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

it.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7eb7c83a9d28c637ca07227511f990836a86673de613f6297c3b9a172f28739f
MD5 73dc64a98c842d6c48ba529fdd62c880
SHA1 c9fe7295940fca438ca01b860a79653f8df4c1c1
SHA512 8084fea747007cba9f70cf399350a3f207884d37fe13d462e151aeaa09ad126a2a7f62597983ed377e0308782cb7272aa928f0631a91fa4c4458b92d4badc9a8
SSDEEP 192:bNMxQxkBiPMtuPbw1VKzLzuX0AP5WIclW2W5EB5LH8HnhWgN7acWh612El+X01kh:y8kLKzSWIclW1LHRN7oxY+R9zgLg
TLSH
T13E920AA59BE86201F8F71A70AA75E1872D3FB7976D00C93E16CAD50C1463F80DB28B35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

69:23:2c:d6:c0:06:98:62:2c:d7:e7:0b:74:88:68:bc:8a:5a:45:c0:07:ab:e4:b9:f5:b8:bd:98:18:53:9a:2f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ja.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b9605fac42bdaa7606d817d8a5baaeaf605957098dd5d0f42838d791295a9ecb
MD5 acc21acd9c15efa19f6a83b1842c30b8
SHA1 f1165ca87e5ce291f588517bb47c0b2a0665058c
SHA512 28a2e8a1544227ee6dd93a9c53539e4bd2e506aa2a6321e7d58125ab5444b45bfc464ef4ba495114402d7c9891bc24470a1e3ed8d396d02d224d309d699869f4
SSDEEP 3072:fzNgy+Yob/0lLtJC5/x70Z8vIskY/pVtKdC2ZAtFKYgvD459YipI1ngfTQJ:fCItJC5TRtKdY1g4wKM
TLSH
T10244416CE3F91429F8B217B15C7DA599FC36BC5ADD12E13E002DC02A9971B8CD821B76
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

b7:58:84:1c:18:c5:72:bf:cc:b5:3b:e7:c4:85:3c:77:ae:0b:c0:c6:91:ae:14:84:c6:cf:29:6b:5b:21:5f:43

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

251630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ja.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bcb1f8e2040dbd71ccce58c924e18864e70d4f92bb3572dc444ba406c71a8e73
MD5 e9c32562196e83e1d051180687129d41
SHA1 1ca57a9a0168c670b9fa88614d2dc05b9425c12d
SHA512 c6b339b6c6198f72096f2de40401b9e6e40f64689a2595398c8620d049289535f6d53f05a544ec0ee9f2bbf7c07f5099ad2b0a26a692f8091d17c1741671e2e0
SSDEEP 384:vveZmFLRnyGO00Ik4oF3eUnsWIclWkzuHRN7S31AqR9zIpeX:vWZmFLRnyGO00Ik4oF3eUnKcVzaqr9zd
TLSH
T14B92F79AD7E8510AE9E31A704D75E587BD397E47CE11E13E206DF11809B2BC4DE30A3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

49:e8:32:c5:f9:1a:3d:16:a1:c1:83:94:e0:fb:f4:4d:c5:17:e0:e4:e5:5a:05:c8:80:31:37:4c:a6:fc:c3:02

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

15670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ko.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 14aaee6b3e709cc2c49b56811b0584e11fca10a8972ca200ecadd52b3f1e9a36
MD5 224d1467f6352b833ffd1491bff3577b
SHA1 a948910f5189feae826f463f7baa6661c472b1ca
SHA512 5b2f394b739b6a1331e427dec9ee5c29d5e6057a74710dc10f2db409e5fd99bff3a9a3d267fffb6b9dfea707792b5a9883736a0eaf68b3c8baa8411c009ad605
SSDEEP 6144:204qml8Idb4LvlXxtzai7wzprhu2qBzmo2tGmD:tml8Idb4LvlXx9aywzTu2ymD
TLSH
T1DA2472D563FB1658E9F35B506AB9F51587A2FD73AF23C01C8C008C5A8CB5AC18DA13B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

fd:f7:22:f1:63:62:0f:6d:df:12:06:7c:91:71:96:cb:9e:17:1c:4f:c4:5d:b9:67:34:8f:e8:a2:0d:51:01:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

221054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ko.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aa0dd4abdf3bbdf6ec8b681cf738bd2823d1177bc9c8f77a5c3a401f723536c9
MD5 75b10c7114225f1b0fa33224ee9f0f8f
SHA1 19793a54806ff4158dd93964450d8d0df67884e8
SHA512 3e022155ef2a8c1ec08b789d05fbe783ee9c4e9157aa874371cfc6bce9b8e5e1124cf7021a4c316dbae364974ecf677481c702d17f978e0f7e3a1c078e2414d5
SSDEEP 384:HuN0J3AIGJJWIclWoLHRN70eY+R9zgLL:HuGJAIGJHcxLtYi9zy
TLSH
T1799209E2A7EC4206F8F70D70657AF9825F39BB975B12C45E1685E9580CA3BC0CE60739
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

3c:1e:1f:1a:98:9e:08:08:39:c8:de:16:dd:9d:b5:ac:33:28:d9:7b:6c:b3:0a:7f:e9:74:9a:56:12:81:f9:41

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

15158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

microsoft.bcl.asyncinterfaces.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 00f26117b0a77b562d5c01038d8b52f8d0b9e18b7c532e16dfae1857a19f2271
MD5 84520ccf3e7f424ce2c291529400a196
SHA1 1a462715db5f3e32eb88cfb87a7394ed08105093
SHA512 82c458970d0903933ed3da6c795de616915c7ef531f35b090fed3084429367036bbe00871c9353fb57d4e5f9c906273142eca95655fab6ad7c446ef9427895ba
SSDEEP 192:1zbtuPEO03EnqWeq/WLgW4GD5dHnhWgN7acWVqrOQophFKqnajKsNQK:x08O03EnqWeq/WvdHRN7JJXlGsNQK
TLSH
T123622A91C7AC4603EDB63BB056B4D9037C3DB3E71C51C16E146AF29A1C53BC29B21A2C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

44:06:04:b3:02:99:08:2e:67:26:09:74:32:11:35:f2:40:10:4d:af:23:af:7d:94:43:0b:fc:0e:68:36:9c:36

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 20, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

10894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Bcl.AsyncInterfaces/netstandard2.1-Release/Microsoft.Bcl.AsyncInterfaces.pdb

microsoft.bcl.cryptography.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ed77571f92b2948844dba42410fa4996b5c3fb979f91f09c0c0f063072973388
MD5 e95f511a87c38b225faf8007830760f8
SHA1 d01fa31e63951463717b5d6a39814e6ea1178e6a
SHA512 69f887fec035b22164509d6cbc84ece004956b23ce4f8436e9328705dc7b9702c4f9695def71748011f0ac5b5504eaeeb6102ebbc86d762863e0cb33e0be055d
SSDEEP 1536:rwbT3fyKJyvNjm4F+e4ZKPJYGXEa7Rx8tourkrZoJCNpp6L4KIjIqvQuuVOQc/zM:rwbbAjmkYG0aNxGourkrZo6pp6LTqIuC
TLSH
T13493393C27A4DB27DA8D42B0A1B045475E30D287E083F74C58CB6A6572137D26E86EFE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

f9:09:7c:60:26:ff:b1:11:c7:dc:3a:54:fc:d4:63:bc:20:93:a7:99:26:ed:8b:70:2b:52:dd:73:d1:56:c4:27

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

90806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Bcl.Cryptography/Release/net8.0/Microsoft.Bcl.Cryptography.pdb

microsoft.extensions.objectpool.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ce5b0a485dcc4c63a242757499220d319b7ff655693fab8b87f6d328875d9c41
MD5 5cec4ce46263adf2955cea6100a99107
SHA1 bb2c799bfc1059d89909132149f5b58f3970f9a0
SHA512 42e39c8e2a0eb8b1dd875cc15ba5213e1919e17cd2d9d97a0fa96f351ea07f42372ba90f0bd484351a656b41bcd0477eb344b15fc6138e7b4f8a688839729707
SSDEEP 384:jXJHWb2gAGYmFilKHVhqtqW0Wc3kQWlD/HRN7VlhlZS:7J2fAbmwlMk/nfDvVlc
TLSH
T175A25C55D7AC8227DEBB2AB0EA75E621BC3993CB7812D319044DF6C41C937C09F2172A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d0:da:9d:6d:65:58:2d:d8:c4:0a:21:05:0d:0c:d2:7c:d3:30:24:12:90:25:e2:31:b7:73:16:92:38:5b:fa:02

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 24, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Extensions.ObjectPool/Release/net5.0/Microsoft.Extensions.ObjectPool.pdb

microsoft.win32.registry.accesscontrol.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 75a6a3fd115720670a9a2acb878c58634d05ac1a0950703d94d4da1cb2b6d518
MD5 86ab879a09e71ccecd8902138f88c16d
SHA1 a667956524a976f2cac1581df09edc6269b7abf2
SHA512 b37d56c96a8303f8dee987da3739060803370ddf676201d55740bf7021c952c7e0b8a48b3be514310b390396b74807ebc32b6ead31dff2d12182c2c400bcdc58
SSDEEP 384:EQsAJ+X/BhnqWFdrWthfLXmztvGHRN7Oip9R9zXOZG:EQfJI/B17mhjQtan/9z4G
TLSH
T100922912D7B80223EEB20D7466B2D9563D3AA3D69C11AB1F159AF1091DB37C4CB32739
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

ca:4f:47:26:04:c7:7a:28:8c:80:48:9b:31:3e:e8:a8:dd:da:64:b4:8b:f3:1c:40:4c:18:12:55:a6:a2:1b:bc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

15350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Win32.Registry.AccessControl/Release/net8.0/Microsoft.Win32.Registry.AccessControl.pdb

microsoft.win32.systemevents.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1e3367f9df72e8768285b3b41dd0742a40a95ccf27235f20a9966bd3923a0ef2
MD5 1951e29d217833be927719ad1112359e
SHA1 6653f64916c1597af2cb855740b15607222f5721
SHA512 76ccbe322b8298950a9897121416e83c5a588ebb8ffe4ac7b7730800e6828b41708fd321619004a0541885b10ee854e7c0e24169aafad56fcdbf46dea303fcb8
SSDEEP 384:w/+UKd+XwadOxWYLnIWrdJWtdfLXmztvGHRN7229bt5R9z2aND:w/+UKILd1YjwdjQtaHx9zP
TLSH
T1A7C23A66DB54C666CCF70E3019A5D3122E38E7E6A812E79B154EE00C0FBB7E487B1794
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e0:a2:97:bb:82:45:49:36:19:0c:e9:4d:8f:71:c0:9e:0e:28:10:0d:b4:23:ba:0f:24:10:15:98:fc:29:9c:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

21254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Win32.SystemEvents/Release/net8.0/Microsoft.Win32.SystemEvents.pdb

pl.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d244d6441177bb7dc055aa366f74b84d575dbe23959e313dea7ed347926a84ef
MD5 cd00ab51b1a165db51853cd076b93b96
SHA1 6e977be96a9df40f56638efda5e3d6e0730c6943
SHA512 b9ad653202d90ef4b102c6b07f1a89a2796409a88e0bfae16280d740d9162ca1c0c6c58a9d3f0ae973abc0f6dd8e08d0649a2716cfb69a80016488a25255824d
SSDEEP 3072:yP3ofKqoj9HQg4ohJWFbrU4M38XIQu84QAynlvErvA+9kWIr9sChlfLcN:yv9NJWFbrU4M38XPBE8+9kWIr9ssdw
TLSH
T16F24C54073F5010EFAF30FA9F6F6986528FF7E695905C51E104E450F46B2A84AAB4B3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

25:9e:0a:f3:fd:01:6c:1b:23:eb:71:d2:5b:c1:f0:7a:1f:41:02:43:af:f6:db:16:42:cc:51:15:48:e9:88:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

221334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

pl.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e6aa0fd29d17e64e41fd05cb56a57c51e497edf1fdb190a3107cddd9a7454a7b
MD5 73b54e1de06f760bc7292e9c34104aa9
SHA1 2b3a85bf9cea3d599f8243e893d83b544976a38b
SHA512 6a8f33c241d05a6d3f864d71e19fed97298f65f8fab60f27f8ce2e8d820e9329b1f8e1e8d1126a347747c44ca333ea6863e7a0bc6f922b065bfa94f3b6277a26
SSDEEP 384:iys4wvEmF+4wpwlU+nACHWIclWKLHRN7sjKlO8R9zwq:ihPFcbLscOQ9z9
TLSH
T18692F8849BF85607F8B31A7196B8E5A23C7E77860E10D81E259ED50C4CB2B85DB60F39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

92:f1:32:89:fa:d6:d6:34:a4:e3:96:fc:1a:83:b7:08:44:e0:ca:d1:71:8e:81:d5:be:68:27:22:64:ba:13:a7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

pt-br.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7d79fd74dafa8557c463d828a99b86e2e5251db8dd8b40e1421c7b11b8341a40
MD5 cd9938b77e01bc49ef3287e88e089bea
SHA1 7e8e3d4ee384524f622662ac8a39372869900b4e
SHA512 a74878305b35ee77617e0d42411405c8fc6c5eb1a01c05ac1178dda18a0c5b8f5679528ab670b6dde7ee135a3b821f25579e2a911cd9ea31677def90883cc115
SSDEEP 3072:sXznumw2Ua3EOYMDEw4XwTZZokUvOh8AwLEovS7W8NegaQxAJcL0Gw+3lQTzbvfR:tOY4EpgTZeOega2iD
TLSH
T1CE24822537EA1314F1F317A1BA36A9079EBA7D657D00C44E416A464F42EAF80CF66B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

1c:6d:09:f2:6e:1c:cd:f7:49:ce:3a:02:7d:24:a7:dd:25:08:c5:6d:35:ff:24:d1:55:ea:1c:0a:bc:8b:8d:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

212042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

pt-br.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 feadab1e8145b437580122643f1e8747dadb81160d87f98ca606d004399f83e6
MD5 f4403adfed481180b29a51289962083f
SHA1 14f80f08ebcf0e16d0d09ee6f02adf343d95c2c5
SHA512 cb930a534a5829aa939231507cbe465b962ad17b169de450b12d66764188b2bd1fce938cc01c5240c2ff3901c567a282fc015cb485cd8026ced83092faaa2393
SSDEEP 384:VRSfVeSN32jJWIclWqLHRN7K0hcYR9zAAr:j2VwczLK0hn9zAw
TLSH
T1859207549BEC1211F4FB1A70AA7AE5872D3E7B972D00D41F1799A90818A3BC0CF61B39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

4b:4b:ee:8e:6b:83:cd:df:90:9f:71:b3:d3:84:f2:a6:07:42:98:c8:b7:5d:3c:e8:5a:a0:7d:b2:79:6a:7d:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ru.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cb57d30c901e7750f8b740c865e11e82350a83187b6ee50a11048486eb14222d
MD5 f26d4304d3fb62e8b7513ba161ca1124
SHA1 29fbf6b5e707f186c17a91624b6388f0288bc0dd
SHA512 0924cf18e038ad9ed13c97a15846a74dcaa4a00a53db19d271888fb23d34d4c583a70d80221d3bd2bacb93968733c5c54e15909f69e796e9733a8ec8418977c3
SSDEEP 6144:dnQBbp3I5qe0a9d/U/8v7+KXRkeirQbnc5r0UWLPfPuJn1NvdLU5wZlT2DuMV:BQBbp3I570a9d/U/8v7+KXRkeirQbncQ
TLSH
T1A554EE6057EE509DA252B51AD928BD097CBB79FE3F5AC32E00542D7F34F2420C63972A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a2:fd:f1:f7:72:84:af:6b:23:8f:8e:0c:ad:c8:3c:9a:69:3e:e5:90:80:d6:a6:43:ed:fb:88:ac:9b:87:2f:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

293446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ru.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f4d992e6a9e2ae86bd84bff077f877e49f509c669efab975bb9aa1d11cde8f5a
MD5 3777e9cf07d3a9c264e5d142b7e704db
SHA1 6a41a56cb7aaed69e41d9e2e60f2645efced0944
SHA512 3a4867121b9819ce8ff43ea2331bbca2e7db79bf84391db91fec619647ef44b4112211002a403433d2db703b88eae221b6eca38fbf74cc435f90e4dbb8aea8ad
SSDEEP 384:F7OnfHjuXOdUWIclWIzuHRN7TD5DNR9zWi8z:56uXOsc5zax9zK
TLSH
T10592D65147ED1406F5A37A31E664E9463C7E7ABE2E50D22F2444A86D28B3B90CE3173E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

bb:5a:bf:20:61:a9:19:de:ab:93:d0:d8:0b:47:0c:89:6a:c2:f6:49:5d:b5:a2:71:ac:2d:09:b0:8e:76:2e:6b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

16126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

system.codedom.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 be0fb6612acb0dec95ab01a47a4480114636f85c9ad3c6d13b566cc392b46ad5
MD5 036403792220bedcf2f64e3154f0265f
SHA1 cad62316e6209e4e33f1c66e1231b3050662b807
SHA512 bf9ab2cdb2c284882ad90eae470201c7c59cbc474074908b9445a3956e3780958239398f5130982a40c6864b3d712deef8e064fdeac525566eb1bbdac533affa
SSDEEP 3072:nMKminLBDcR+s0sK1eW0d5PIlwbrebRYSH+l5rh1TXQbV:bLBk0szhebCSKZHQp
TLSH
T180042A6437FC8376E7AE6674F028092146FCE40E7283DB5A8D8955F55E23740EE20B7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

3a:e9:c8:de:39:c7:86:83:77:61:fe:de:82:87:e9:b0:32:ec:54:6b:b5:dc:06:18:c2:9d:4d:34:50:53:4e:f2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

178622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.CodeDom/Release/net8.0/System.CodeDom.pdb

system.componentmodel.composition.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b2ed3b31ad613c146deb165aa9e068d6cc7840e261533e2783c833eb606afb40
MD5 e04ca33e433231db517c5acd3844a51c
SHA1 2e9df8d377e5f0e9bcd860a898dc9c8fa8d4bc0c
SHA512 d3367031aab2523fda3043ae0a73239e6b378554ef01f2cb22285eeb38d450c4ec2d06f0574b2e34f85578e709a8fcf3cdbd15976a52aa2b4f00654b38a22c28
SSDEEP 6144:NuRKpVyg9MOhCIdZOkZYNpCtC+ag2G1Q:N6KpVyg90IdZOkGNpm2U
TLSH
T10D544B1133FC0725E6FF1FB9BAB4841446B6BD52B91AE74D2449A1FC0A63BC48921B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

db:14:87:1f:6b:70:fd:1a:76:9c:db:90:d2:f0:e9:ed:86:5f:f1:16:43:a4:fd:9c:79:fe:dd:3d:52:40:65:35

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

286918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ComponentModel.Composition/Release/net8.0/System.ComponentModel.Composition.pdb

system.componentmodel.composition.registration.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ef4536f5e10208d4e590aba62ed51c641d98cff9a1e69da07c238aa7769ce6fc
MD5 5e60458631c568d5f8d81717426a1fd9
SHA1 9eff07ed9b0662e4632671aa75edfc85cbdc9916
SHA512 d337c48456d5805dd2b40734fa49055554798c4abc0577d355c3201262d326326f54a3401157ba81c1f7bf0cb5287e58222287d932b526f9502215a77330e4f0
SSDEEP 768:wBTTadmhY4gS3A5qoaZ2zrw1L4dTsdMhl1LrCsCkxgHSvnfdXSdi9z1EfE:OTTVTxA5qoaYsirh7LlXS4z0E
TLSH
T168235D5323EC8712EEFB4F78B230E8090B75FA655902E26D2A9DA16C0567380577277B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

52:4e:26:05:6d:9c:47:85:97:b2:9e:70:ac:42:9c:74:b4:89:3a:fd:93:4e:e2:6f:32:d7:20:70:ba:d2:69:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

43954

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ComponentModel.Composition.Registration/Release/net8.0/System.ComponentModel.Composition.Registration.pdb

system.configuration.configurationmanager.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5063907193e5a1e50deb48cf263c931b439456b2105497ef33054e39887bd0ec
MD5 f5a8cd696b1d8550a6645d16a4309064
SHA1 c73e52eff6da93039bf263991a240a8de424e10f
SHA512 6a575f82cc4bf0730d1ccbb88e5b7569bf789a50d26d3364822344fcecbb0cd61c7abe13b84fb8b4ff81fa5d35b633d696c435667d3ffd578146333420551aad
SSDEEP 12288:fK+vtmMbtze6Yhe0AQ+2/NVQ8GLa0Uh55T3lEC/IOPbZUNZD0drKfOsdV0Z8oApG:fK+vEf6dCr/
TLSH
T18494F52633F8472FF6EB0B35E43950145EF1FD9A2226D74E5995B09D0C26B808AA2377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

40:cc:16:12:e6:f8:45:fd:18:11:6f:b8:c8:12:1a:c7:40:4c:19:74:bf:1d:a2:bd:af:17:6d:b3:6d:71:08:a1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

436418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Configuration.ConfigurationManager/Release/net8.0/System.Configuration.ConfigurationManager.pdb

system.data.odbc.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a794e73a91c13b13f548d4fdb0f8800c2d5c4ecf7bd50473aab4e5250f2b1263
MD5 ee9c01cb5a60b494073ec418214552f0
SHA1 3c3c51331bd89b106ed2d0665b1c478408226f25
SHA512 b3d9d2b0fdd78a43d56b7bc7d4237af4f89aa6b421ed96f14cd65dcb6f3ecfaa386361ac0d4d93727b7f761d6d63c9c7e60e7fe4729d71ec7722f3f24b766b85
SSDEEP 1536:aoh7RV8ETpV1S14/fOfKiBp4vQcrzeQF5:aoh7/rTpHufKSivQyKQD
TLSH
T127A3943436B473DFD9AB2533513F0216293E6E929622C1BA6E59003B672BD716373E1C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

31:a2:bb:13:ea:92:f1:48:20:28:10:67:3c:74:39:74:91:57:8a:98:89:b1:07:85:57:95:f3:e4:dc:08:06:34

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

95498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Data.Odbc/Release/net8.0/System.Data.Odbc.pdb

system.data.oledb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f431ae270682818d0c50ccb18e39e2659420bf9365a601f86022d9b0890e7dd9
MD5 09e002e11be56af09f3e6d6b9abf0410
SHA1 894391321ef30943fada4a7be9de72b90d84c45b
SHA512 18728b4e0d5a93a8b6e46c5b73fe51bb5efcbc5a82f8892fe345b4206d2928cd9575010349cfcea3041a7c5a09172e387bc13d277b7654dcfa4946e7d994f87f
SSDEEP 3072:o8Ttw4wolq21eyiWZlprRrbtYC/JfcQ/s:o8g8lnrbtYC/J0QE
TLSH
T1EFC3786437E4738EE9B71537716B0115A938A6D26A13CABE3E4C500B4B33D7213B3A6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

ea:a4:84:79:6b:3c:3e:3e:f4:d9:21:94:93:e1:cc:d3:b0:92:c5:b0:99:14:d3:24:2f:93:7e:60:e4:b0:c4:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

118310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Data.OleDb/Release/net8.0/System.Data.OleDb.pdb

system.data.sqlclient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 55d57c3f439a3aab7bafe6f915266ea43208bbd130628727494c69d7ac47dd16
MD5 1efc705bf02a619090393553cbd69cbb
SHA1 55a29e1c418759e4912025a153ef6cb180ba3196
SHA512 0ac3ff75cb7c9e1354cbe74fd5a93a94472d659b22a74fa4520b223f746c0daf4cf0fe01483e9da55771e2f4d79f8eba99fc4c483aaa8956cba6de6a2d389586
SSDEEP 3072:SjKJr8K9X4djzQDk7cK497zeS2F4CRWfnlRnaWBM9l1dBkG7hvcHEnR:Sj48o4QDk7697z/lAkGFQMR
TLSH
T1C4F3B67937F866ACFBF71AB475B5512C4731B9D63A01C20D282B801F1462FA486F276E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e7:f3:e2:05:55:f9:ac:8a:99:ee:c7:1b:e6:bd:95:5d:72:f7:c2:82:7b:04:c4:5d:95:f1:92:34:df:74:e5:52

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2024

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

166674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Data.SqlClient/Release/net8.0/System.Data.SqlClient.pdb

system.diagnostics.eventlog.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9a12a05665e1599d1221f9f25b98c88ecb013bbfc399179009d4b31ad65b1fd0
MD5 d3df46eededff665b28e00717fc6de2a
SHA1 a3dc057f405f592440fe1df200d619914812d63b
SHA512 4953a953aaddc68848b7e87d3d4874f2cfa198b0491480ae205a65b0974e735edc72fabddf5c0d17a00cf3ed2e30c4c2b5d40d58411c9bfd18fea12d3cbff53b
SSDEEP 768:qDQ3nDeK8ZHS9R9cMmaHlfir0XqgMGfmAXOaYrSMjQtaOf9zXEif:qDQt8VS9RKb4iBgMLr5QcSzXEif
TLSH
T1143318D19B94432CD9E6BA33B67382AD063496E62D12C64E3E0B350D391EFC847E1799
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

9e:f9:67:87:04:dc:8e:ab:3f:18:87:84:2b:67:ee:52:00:53:1a:24:01:49:52:d8:37:e6:d8:f5:fd:59:e4:d3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

47414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Diagnostics.EventLog/Release/net8.0/System.Diagnostics.EventLog.pdb

system.diagnostics.performancecounter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d02486ed64660d339d81960038d7fbf8af0855112d854f61b87bddaa7a341823
MD5 9f536d0a777e4f757910587e1bae27f5
SHA1 83676e767dcaeb7df329cde7ea390d81f53353a1
SHA512 23b7ee42c2412445571c5de572d233d43b6089f5b1bface9e32ed748839f6acdab23e4ca18601ca26ebcf4ee80d35521e8e9300f0330b70f01deb85493061708
SSDEEP 768:RSfXQPsYcjx7t95Z+X6VfC6rnMwnnkaO2KX4pzxOW9zxG:E/QPit9qqVzrEFXOzUizo
TLSH
T13533D809E3F9411DF9F74B3475B080720A39BBE26E11C90F69A960581697FD0DAB273B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

6b:0a:57:4b:45:d3:20:8d:89:92:50:b2:8e:a2:86:94:e7:c0:91:a7:ad:16:24:87:5b:7e:17:07:38:b0:5c:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

47046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Diagnostics.PerformanceCounter/Release/net8.0/System.Diagnostics.PerformanceCounter.pdb

system.directoryservices.accountmanagement.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 948f1488c23777ed76f01f049cf17f756425aa4e2435abe70c0f0cedb4d37aea
MD5 de949710540b642e8da59e0483e24f47
SHA1 7199cd82fedfbd122cea8a76f0e85f0ea9b1fc6d
SHA512 2220e39046978ed5bd48af591d37da7a8943a54ac43ae95ca358f7d2b254d0d0875049251dff0dfbed49aa6a4453247249dd65ceb5cb6ac4af7a00097d6f3fe1
SSDEEP 1536:FlJHGR7CZAq1Bu+PLsRbbHsMw44O4bniR6bfoZOojQWQc1MhWzI:9GR7C2q1rhj5MZOzWQ3hW0
TLSH
T1FD63A34027F8061CF9F74BB0F6B553644B36BAE629A2D94E241E411D1C6BF808772B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

32:77:86:2f:63:1c:63:2d:2e:63:bb:31:b6:fb:30:ae:37:c1:3e:41:ac:fd:ea:c6:24:a8:32:f0:e9:6d:c3:12

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

63310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.DirectoryServices.AccountManagement/Release/net8.0/System.DirectoryServices.AccountManagement.pdb

system.directoryservices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5cc034309bafb9cd75682a785c49f67cfdb42228037012ecc9f3748525eaf068
MD5 cbc314358e8885797666b6c65f668a98
SHA1 474ac7e889584d1f694b22ac5ea4a3b195b627dd
SHA512 149e89faf640800e7c621040f5c6591a59ffb6738ca6ea686e31c62275b95e6269c62743a9061b0129cdbb6ea243be51c7a4e957a857e0b944fcd160ef88ad6a
SSDEEP 3072:0XGpAxqWrGcqgP9b5pz6Njkq9hhINHbf+qQPCL:nbxcB9DzPvbf9QPS
TLSH
T163C391016BE4C75DE8DB1F31B164562C0A30ABD53D35C6686D4B023DD87AFE08FA26A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

35:31:05:bc:b9:6c:60:6c:1e:ad:ca:20:92:e1:92:04:32:cd:31:84:fc:fa:d0:b6:18:cd:fc:64:83:40:b8:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

123658

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.DirectoryServices/Release/net8.0/System.DirectoryServices.pdb

system.directoryservices.protocols.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e83482ad512603f7a0f68614dd11544e7726283d0ee69db5aab4e5e86befc5a1
MD5 bc001d7b5ede25a09243d0a15a7762d9
SHA1 5c6bfbd9849d5c2ce27de0c7133894b613b9d6ef
SHA512 d176c5ee8005e2f5b18e39552665a540a12da633369a9569ea8a40b37bb1e54c3ef63c98002721f4ba96bc7c071f38ae711df049022b7178fe5dd4f6ede5d5fd
SSDEEP 1536:xLE3pCMAjzGY7xasgPtUD4a5YYp+B6XCzR7:xAx+zGY7xa1UDfp+B6yh
TLSH
T19E63082166F65B2DE9D31670F7A7C2288731F2D92E13C65E381A510E145BFC0A3A37E6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

ed:b7:67:32:e2:d3:6c:62:19:47:71:80:8b:08:bd:f7:25:22:62:10:86:5a:05:c7:b0:8d:24:b0:95:40:16:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

67526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.DirectoryServices.Protocols/Release/net8.0/System.DirectoryServices.Protocols.pdb

system.drawing.common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cbe64b8a6ba7751dfbb8089e080940df3b0042d58d01c1f42cabdb6026f78dc0
MD5 93c7a979d60cc91a0d551697ed139f87
SHA1 384161b86c590ed3375129fcd70335bcac71b9c1
SHA512 0bc86a3caa4a4c78e10f6b6556454b2ce1ae19901b475542bee28c733cf4225eeb6af33b28121799bad77e64616c300762cd630da7a27e90beafc41bcc3cf303
SSDEEP 6144:4g2JrZYn1AFXnpMpEqamX4pwBN2/KxB2mGzQ2ihESSGsi+ULCikEMDSJcXpETuqT:4XIqwESJ2pUuq89Fmd7QUBCA
TLSH
T12AA46B0037A85E1FDA9F0B79E0620F244A72C91AA28BF7CB6AD6D53D5CC37549E112D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

1d:c1:86:bb:dc:f9:7e:8f:f8:e6:3a:19:2a:18:11:73:e8:05:ba:df:fa:f4:55:87:c8:89:7f:4c:d7:e4:35:67

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 17, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

468866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Drawing.Common/Release/net8.0/System.Drawing.Common.pdb

system.drawing.common.pdb

SHA256 4e405bd460e3b28e1d4cfdabd3e148c11a02a403fffed4b48f55571c138e8b53
MD5 c68ca64f17ab1cad29c210b0fcf9732b
SHA1 4be499501bb40a12fb81cc297adc8da1c55f3d50
SHA512 d80df2123f19d8cc2d8e1cedb6345fe5207920d2fc11ce60b9c5c2d20f5a7587b02dd4fb02fb23a0220a9cf23b7bc3ec980731929d2b1bbd9db48668e26e66eb
SSDEEP 3072:HSF52F4LPx1jnzFGh/89iZCALHLVU6UC+FPIs3Xh/K6h7TkAax4FrGOSfkvzItCt:yFYKDbjnqptU6UC2r3XhfaUDZ
TLSH
T1C3446D1ACD48E13ECD1A4AF7A1F783283B78818D77879B45625D72B5A82331D72E718C
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.formats.asn1.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 310c31605ed9c7982ca4d75746e404319cf1305b221fe89a3611d3bbbd6d304e
MD5 295924ed7097b29b146f6026fa2dd104
SHA1 f4e4ab5708043cf1702c4823afbec200e158cdaf
SHA512 54b0c1d43bb15d5b39936e2190958550b6b8e9728c1f75527f71ccee459fed388f34fe4965b5fd11c1b019bbc3b44d73095adf95ebd3d059c9400b1180ac29b2
SSDEEP 1536:md6ao832Gr2NXDjVk+fkWqlNXgvvuG4krZAuZcw4SZV/WkUlQeWrQcgz4:Q6AGGKNXd4/FgXuG4krZAuZ7ZV/W7wrL
TLSH
T139935C0CA7D8C322F5AE4774D0F1C1268636B1ABC792DB1D09CD64686A43BD21987DBF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

66:5e:b4:e3:e3:17:ae:8b:34:15:9a:33:08:45:b3:2d:58:80:ae:c4:d9:e0:ab:14:53:76:41:60:41:39:f3:7c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

90750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Formats.Asn1/Release/net8.0/System.Formats.Asn1.pdb

system.io.packaging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bd80e3e3525f7a99efbc6c0a14f7965564f7159d37a7ef99b9b5849fc5b143d9
MD5 e38be27a8a9719586ce130b8f230948c
SHA1 19bcbbe0540d7a6a81a5e150131246b40129e358
SHA512 609bfe80aeaee4ce124e16bba7ba92a8fa84ffe531f7cad626b4d7b10405370d42b1eec5c1ad4d71e81ee52cef9b0518ad1621ce9e6871b28232c0d3a08c3626
SSDEEP 3072:shFLxn3nEdIhAGE3XFFA6IxUSkXoHHkkY:s3l3nEdIhGovkYk9
TLSH
T1D9F3086133FC060EE7FF1B74F9B461218B79BA526A36D75D194060DD08A2B80CA72B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

c4:de:29:45:a0:e0:d7:69:ea:b8:54:40:f9:fb:04:02:55:16:df:84:7f:b9:63:e8:5b:9e:50:f9:79:fc:15:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

152134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.IO.Packaging/Release/net8.0/System.IO.Packaging.pdb

system.io.ports.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 465f5968e6db6d2f16fff34aa11c2575f230c58cad08a2284e3f091f4877406e
MD5 0529345544f02c083c1770914358a248
SHA1 904c16111212101f7de9b4ac1c7e61cfe1ca6558
SHA512 9d6c9bad306cf546314af786ac4d725dd6ee596fbe28a0797c368b94d48686f4930570be929e5f8ac21e137eeeb3bcb2e32828def43891907972c374a59c3746
SSDEEP 384:fCIPHTPaZC55gm8igAWQDKjO8BzueJe5587dqnBrH5B2Yd5zxNxxWcnWtW+wnHRR:hPzSZiqAR6pBzP2Cgn19f7qeXCK9zr5
TLSH
T1A0F2F946B7F4115EFAFB1F7065B586350B35BEF63A03C60F1466A00E1A5ABC08761F2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

b9:1b:0d:e2:11:11:af:da:78:52:43:d5:3c:d5:d7:c8:bf:9c:2e:cc:9f:fb:98:d3:75:8a:75:df:8f:bd:ba:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

31142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.IO.Ports/Release/net8.0/System.IO.Ports.pdb

system.management.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 277da863d94c84bffe08de96aea91844e81f1ffec0487be1b46b246f35980c09
MD5 a5eaa3a79c3abef536329ce2f000e862
SHA1 9d0552ac7ad4bf3717208ffb1ced2882e2ad0127
SHA512 70589fd69d3016b9a8435349c710e7f5121d3c0aceda23a204c4e9a9a52fb8bc88d90318cdbbbd0c114bbf0615199e7ba6fa61e5449b715a56ad6160773beb18
SSDEEP 768:NV/2DXm3gh3nb3Wm/I4TVEothoQDdkiSLJKdbYNzjQtaMjQ9zj:H/UXmEnb3Okp2QDdxS9yMFQcMMzj
TLSH
T17B73A411EBE88779CBE70670B47083746F74BAC72D22DA4F291B211D197AFC04B61E66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

bf:4f:93:ad:82:ca:63:67:4a:79:e2:ac:d7:5d:d4:f0:fd:7c:d1:33:29:93:7c:4b:68:57:dc:f2:2b:87:46:8b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

67714

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Management/Release/net8.0/System.Management.pdb

system.private.servicemodel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 db8de1773f2a08dd456e481702629a6a8a49ce73d9c023d27e893c4547edf5d6
MD5 94bc204b9f44bb236f9e15c74895e5df
SHA1 b47f71dfe14ab11160bb405d2d635efc6e2c23e0
SHA512 c3aaaae613671f6e277a9b9d3cf76adf49801f96de945c30bcd65a941fb966c6625acf695cd8ffe1db0e69340d9a20e8624efb49e8f16945ca43cd46f7b56507
SSDEEP 49152:J3a1kGOA4Cn4KftEexSc4YAeoTxb45oRMJuhsQR8C3:7GOA4WtSc0
TLSH
T1B7C56A4077F84F1AD0BF1B3CA4705012B7F1F9466B07E25E5654E6AE6CA37608E22B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

f4:57:f5:96:ae:62:ef:29:2a:bd:8b:41:c3:d1:13:2e:34:78:53:05:ee:39:24:2a:02:b2:6b:77:94:6c:02:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 16, 2023 - Mar 14, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b1:ca:90:43:ee:0b:f0:03:ab:00:01:00:00:01:b1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 20, 2022 - Dec 14, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

4

Entry point

2681082

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Private.ServiceModel/Release/netstandard2.0/System.Private.ServiceModel.pdb

system.private.servicemodel.pdb

SHA256 3a6cd3900137a0c79bf945ad2bcfcea364b64580df930f69fd0005c30f5cce09
MD5 0e586c3018eca176cbcd0b60ac05265a
SHA1 e0284b59ff5f4984e2d7f8659000646b351f9d49
SHA512 4f6aecda19f77e0ecb5a14b3ed24e3bb07d24cf2c4c857c436b3a9e403f9aac665481c1c84210cdd71a97b66ef0c452670d15771370d911d48afe7faced27d4b
SSDEEP 12288:db4CHDfsqhbKKQa8W/ZkjvpJELEqHtcxCZUaX4uxH+4WIBzpEmgh:dECHDUqhbfpOjzhu7fyXh
TLSH
T12F15290BC245632ECA1E16FB95E747086738C054E68B4F07728CF7F6BC593A8A56B25C
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.private.windows.core.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 63ea2360e38955c2e95ec24657376957dbac1f9c2648a099c7fc7217cec3a95b
MD5 1aad26c6d05f45527363219690fd527e
SHA1 7e6a4a06ada258e7e8b5ffbaf5d5180298479e7a
SHA512 f1970879d6a6fb47dd95f9477674db7de7f61b0567eca4b0870c8edc8589476e0e90e586fc64107304aeb48c18167187941d847ae34acdefa4aa02dd5b189e1e
SSDEEP 12288:xpIbbvnzBjfo3BjlbqB2hva3Lit7D9hRNTEhQWgv:c3vNo3TNaOVhhTTl3
TLSH
T18605D350F67FBBADFD4859B0B43115C648B7508BA1CAFEB883C9E890C572A9B0D144F6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

23:ed:00:e1:db:f7:66:d2:a5:8d:53:e7:0d:cb:68:e6:04:3d:78:27:1c:08:82:08:65:a7:42:43:d5:4a:05:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 17, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

849774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Private.Windows.Core/Release/net8.0/System.Private.Windows.Core.pdb

system.reflection.context.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3e22beb25d830094bef0fbb420473b33b4b4695e6a0147f43d9c793b9ce4b02a
MD5 931fc3600f3e8b24927b827b7aac8b34
SHA1 d3a0ce6b29feb8ed4d4f4a4a69f2d31efb4e11d1
SHA512 28af8bd73a627acd787d296b35f6899b92de61b3ef6054ab545cfa558fca234bfbaefae097a5e827112cff809142bdd3bdffc99a4e6bfbac940e8fd93fa7799c
SSDEEP 1536:13l4q9SGcezhEpn8T73cAPsYWCZx7GYvQcFzfV:n4q9SWzhEJ8TgAPVZlzvQALV
TLSH
T1CB83283DA368CBAFEBEF4179F22448119771C6563122FF1D6A84EC890947BC16722277
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e9:2d:a2:bd:4c:66:b2:b4:ec:d6:64:e8:67:08:25:d9:86:bf:66:d4:ec:ea:79:19:5a:b0:a6:eb:12:31:b7:3f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

78102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Reflection.Context/Release/net8.0/System.Reflection.Context.pdb

system.runtime.caching.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b4647131c992fc09140a3a991df8737209b7a0b64893d6ab8c7cb2be494857cf
MD5 bf4ccadd6923e8cb7dff2649f33af62f
SHA1 e805ae2c3420e23ace241376769c96fc5c1eb7fb
SHA512 458a5193daadcc25c0665f19d21414c084852d1e4a128ba1f78e568869091b4f5e17d8700e9770a793a2b31e555ec1332e55f04f8a6289648f5784a6beebf76e
SSDEEP 1536:5rJDH1zgbkXUZFm6FYFY5eOWRd73fyzlQN3XT8bvrFAFGi0c003Xjpyfox8jJSL3:5/zgbCUZFm6FYFY5eOWRd73fyzlQN3Xr
TLSH
T1BC936C6427AC865BF6FF96BE70A451630FB5E796A502F38D8C5870BC0543BC04B6127B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

67:46:32:e6:c3:1f:55:f8:33:c6:b0:ef:3e:dd:a3:eb:0f:63:86:d5:2a:06:2e:fa:13:a8:fd:f9:4b:ef:63:dd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

83710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Runtime.Caching/Release/net8.0/System.Runtime.Caching.pdb

system.security.cryptography.pkcs.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 23ae73c9a58562650b3610a82f75806744bd926838d0b106f3c7028a6cae881c
MD5 8f723d5581ccdfa1117dfcae7a43837b
SHA1 22a121f29b13a847d18deac2b18d76986ea170b1
SHA512 54dfc474db215be99c881bd87e36ce4f2a9dec410f6e47aacabae99a5ff10f8f8dbf5da3469c03bd2b8c58c42342b2aa0e0bc444a844069ab2a166ba47200ea4
SSDEEP 3072:yIlpoEZcUKDQoL46Y5pEiWMKV4GZMrybUIFk1XkxcEOur73krZjnJIQJ2KrM3aEI:b0Vi5KVYSk1UxcE2JI/KradVSQGz
TLSH
T1DA44181877F48369F5EF0B34D1B054258E39F9879863E31C188A69EE6523B80DA14F7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

7b:aa:2f:c8:2a:99:2f:b4:ba:01:fe:32:82:b2:db:52:92:41:6d:e9:3e:72:f4:d4:83:b7:46:13:46:a0:7c:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

258310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Cryptography.Pkcs/Release/net8.0/System.Security.Cryptography.Pkcs.pdb

system.security.cryptography.protecteddata.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0ef416e3666a00e5a5bfe677479e7eb5de2fa0f1705e23c57577bffdafa35031
MD5 0b13bb1d8bd8a7a099d16d6581ee3db1
SHA1 01c23b1bc64eda894f47a0d2ef0c7fbb7686749b
SHA512 8c859b686c35597c80ac077b94b4ad0144ef7fa3fe6d2fdd46a04dfa03e6cfb71ef3aaf4c943938704ef4224117b09240c7c3aed603f4e637160b0dc6c22ba67
SSDEEP 768:Eiw9pjvXYwx7FVx7YvcT+CmcqBeySjQta83jIT9z+ziCw9p:EiwLjYAFXflH53QccM5z+G/9p
TLSH
T1D0F24A21A368137EDE564574BC71E44A7C78938AC412FF3EC1C9B14425A2BC59B31BB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

7c:8d:28:90:aa:4b:4f:09:79:42:b8:46:f3:16:13:1b:1f:2b:93:61:12:b1:82:d0:e1:8d:bc:53:3e:b5:6d:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

32222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Cryptography.ProtectedData/Release/net8.0/System.Security.Cryptography.ProtectedData.pdb

system.security.cryptography.xml.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 adfffb08c25a432d0704e3a915a143db0d74efd146142b6e1f81e4755668c2a7
MD5 82b21ba81f81f96218f32a420e8c2a6a
SHA1 432b90b9be9aebdb80cf8e465e43e4b1454c2811
SHA512 97a90cf0a708bb5dd01ff3bb1816687a0efb8fcc4a8a81ae40c88ba63aa6928565e5a31eb239599324a81f4f5eb2a15f3e28fc1b611349750f6fe28c905a3ead
SSDEEP 6144:OyKioPdFDyyH1xwoqv/HArnguEHd8bO5MV+Z:jKioPfyorRVy
TLSH
T15114182577F8460CFBFB4B38E5B060215AB9FE576862DB0D1E9121ED0872B80D621B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

75:12:34:d5:1e:03:8a:37:8b:8a:7f:c9:05:ee:f5:37:e6:64:a9:7b:20:04:73:10:05:4f:00:3f:d9:c0:33:93

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

189666

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Cryptography.Xml/Release/net8.0/System.Security.Cryptography.Xml.pdb

system.security.permissions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ad4b5ce8a524f2f4bedce739d5413ac48c9feec0af08d28beb7b1c4e41edc2a9
MD5 206b3cb22d34c3276cbc0980d231e500
SHA1 d87ef46666515f13c267b7a22b3461ef7a8bcea1
SHA512 80e01cd594908366050b742b1c4e35781d6893bd3c0c8f55cef0ebeb09d4a5bbc28404724e9c5003609e3a6fbaf9934cc426c55956f2a0cfcb3b363cec5c9826
SSDEEP 1536:5QKCqHNruvu2cfy3X9tlzoGlGNwDkp4BIPHFvTbUKVxb7CQcgtzy5:jH9uhcfkNtlPGN8Q4BIPRfbCQdt+5
TLSH
T10BB3F75AE3FC573AF9B6AA71B0B402210739F6493422E77D471C9A9E29637C05E24337
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

7f:10:a3:e0:69:02:df:15:d3:82:d7:c2:b6:76:a3:79:a9:2f:0f:fe:06:17:08:84:ba:aa:57:f0:bd:4e:91:94

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

111006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Permissions/Release/net8.0/System.Security.Permissions.pdb

system.servicemodel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 49624a49e5e93bb9e0f67d53b5f800df1639a96b6c499b4702ca2400036e1017
MD5 e01e7b5b8531e6eb5d72b31369b7d10f
SHA1 7f84834d55da7470be9a1d9461754de070cc9e4d
SHA512 61c4fc9c58b1e3076f662f2894970f5a27497582c6ca749eb71c1f52f774682b0cd9df637263b8320e924da5d983a82fb3d370415d1467bf4bd5542ac3b8274e
SSDEEP 384:iavvglJDNfBt2rDs//wn1d7WGz4WYLHRN7EvEnR9zV7Fhod:iavIllpqvS/w1xzOLSER9zV7od
TLSH
T1D7B23AD1D6885FA2CCCF1BB0BDB7E04A2BF757922431A326568AE85528D7BC4D731306
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

db:3d:cc:97:cd:2c:09:e7:96:e1:bf:9f:4f:bc:4b:b5:ec:69:13:d2:d4:b8:ec:8e:90:21:27:40:da:f1:59:fe

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

20138

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.Shim/Release/netstandard2.0/System.ServiceModel.pdb

system.servicemodel.duplex.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 47df412f4314dd8167b98c00b07ee72d8cba519d9157746a434cfc14f35f9157
MD5 22d5966013fea0293cc187e60fd6cc3b
SHA1 a80f5e835e4b917bc231398588e7c974683ac413
SHA512 e75290f97c87b4d6b0162a8c8d854c05a70aca6642746c5371b07a2ca38ccb63a5699cde82547834f6eefddbd460927761c057cb13ee6fd3ad6a5d82d7807441
SSDEEP 192:rZT2xHjiWhVOWrW5EB5LH8HnhWgN7acW2p13s5yX01k9z3AJALToV:V4HOWhVOWoLHRN7zcYR9zAAP
TLSH
T1DB6228908B788343ED5B1DB0A2B8E9833D3CABD62D10951B16CAF6441CA37C5DB31B39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

14:fa:53:e1:57:ca:64:34:e3:72:5d:7d:a4:7e:39:b9:9d:be:cb:03:e1:49:2e:16:70:5e:a3:89:b7:4f:11:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

10562

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.Duplex.Facade/Release/net6.0/System.ServiceModel.Duplex.pdb

system.servicemodel.duplex.pdb

SHA256 b2ba0dfb925f3ba5c961cc8aa257ada7bc0ed1732453fc415108667337cfe332
MD5 895231ad180f36cc9c0ad5cb7accc8b9
SHA1 5d0cf9e9c04bae8659939379c3bb08c6fabd9dcc
SHA512 c47278d723f90827d5daf38c5e760a045686df5ea3328e69c54136ffbe4b604b75c8025af5825731cdf96c53070e582a07d9b95d1eb747f783f3cbb1e996d7b5
SSDEEP 192:2M/u/QFW32cXk27S6Ca8X33UwTuaYFj7+lQfuvRVUQDdkUqJx46qeUHff1B/lclo:2L1D7S6Ca8X33UwaXF+lQfu5VUvb4feW
TLSH
T14232D377474CE6A1C145267B6966C0CC363193222315FCB9F2D82A45DEEFAAD43F60B2
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.servicemodel.http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4b42f2d27aee9fdc2063709b485d052bf46c387e6a6e13ce92adebd5a5fad2d4
MD5 e9134319b19b847278eb7e5dd9d6eeb8
SHA1 a8c73d76a6989d9f9f433cdd6bdd0882b649c3fc
SHA512 e3511c27d088bb91d9b06edbaffbcea048152d4884155fae01a845fe181d3f8d6fc6b14f60884abed9439b40714a5c1abf9909156fceb1f8bd128666c303f5e1
SSDEEP 192:pkGgokJxlxQWX1+WOW5EB5LH8HnhWgN7acWN0gNQlO8X01k9z3Af7jchcnwwP:7NkTlxQWX1+W9LHRN7SLKlO8R9zwOKP
TLSH
T128725C95D7A84603FCA72EB0A2F9E5437D7867C20910992B1686EA061CDB7C4EB3076D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

cf:1f:1b:20:ac:1f:01:f0:7d:bf:80:e1:ea:dd:76:ed:b5:64:1a:bf:22:f0:77:e4:86:85:7f:7c:09:b8:ab:e5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

11418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.Http.Facade/Release/net6.0/System.ServiceModel.Http.pdb

system.servicemodel.http.pdb

SHA256 a5ac2250095b1a0d1c4aeb1ba9525917fd9a9a88f9a3b746319d8291a8350173
MD5 65effb8b7ad614efeda1daaf03c563c4
SHA1 43a7ae75d68c95d3f9bc34e450691bd562a58c82
SHA512 c7010d1b57f7633757c2e219128dc06d1cda271f503ad1262214db97978421373862e41a4cb6e117de1c4d2f0a05e4b5b4e4f79ed6d2ad3a9c7c9e79c0898d02
SSDEEP 192:X+M/oXL1f5Uh32cX827S6Ca8X33UwTuaYFj7+lQfuvRVUQDdWUqJx46qeUHff1Bl:X+pp56b7S6Ca8X33UwaXF+lQfu5VU7bm
TLSH
T1F532D477474CE661C14666BB6825C0CC3A3193222315FCB9F2D52A45DEAFAAD43F60B2
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.servicemodel.nettcp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9176ab9d413a02065eaf3cbc2cc8f3b9a7828bb42eeb60f0e94f4c62e90c37cc
MD5 d7ffa082f353427ed86cb50fc559900d
SHA1 12cc4d9e96407daa953abde5d998b95b5e669741
SHA512 d5805285cf2c86b0dcecd05519360b0d84064a644b0e982242145196fc1caf08a3506d4d4a01f1102d2c68c5e9b41990ef06e68352b2757e4893de60f00c3415
SSDEEP 384:bAt07AWJNWWBLHRN7QjjezWSR9zUl9MS:bi0zNJL8q9zmt
TLSH
T140626C958BB85347ECA71EB056E8D9473D3CABC64D20966B16A5F5442CE33C0EB30B28
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

12:7d:fd:38:f0:d4:34:b2:46:03:c6:c7:de:ef:71:57:1c:4b:0a:b3:89:2d:b9:b8:92:3d:b5:6c:ca:f6:23:75

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

10826

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.NetTcp.Facade/Release/net6.0/System.ServiceModel.NetTcp.pdb

system.servicemodel.nettcp.pdb

SHA256 4943f14dcc2e05003198bb610743e2f03a3ff640d1bf88864397eff97734638c
MD5 4a3cc0c9aa4e917ec0daa7aa516468f0
SHA1 5c08d553a3bae7bf2c73531d3a54e0f03602e763
SHA512 a337613e5257510938a4b2950ab686aa3623bce09e9c8797085dc2dd91e4242e58c9d9cd52133391def4669f22b85f8954ed4d04b1a4c745e7a6584e031056af
SSDEEP 192:3M/VOQppJN32cX827S6Ca8X33UwTuaYFj7+lQfuvRVUQDdWUqJx46qeUHff1B/l5:3G3zb7S6Ca8X33UwaXF+lQfu5VU7b4fz
TLSH
T19232E477474CE6A1C045267B2965C0CC3A3193213355FCB9F6D82A45DEEFAAD03F60A6
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.servicemodel.primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9ba3a0e63c793cd63910882f6458e6e23fbb35d7a424f02fa8659eb8515b0b7e
MD5 128ed897ffb833711021eb7517d98d5e
SHA1 7951eabfb685f0b7cf0f7f74f5a901d10aa3efd5
SHA512 8e8820dfbcb196bf253e37a11ea77eb8a09e92c7a7082b865384142dea9c8dcf66585bbfca618f5bf56a454e5236e1ed4be3fd3bf8f59dc4c0650474dda44250
SSDEEP 384:N/HL/+FpWgGoCYeNnPSCWX3EWgzuHRN7sjKlO8R9zwjC9:N/Hz+CECDNnW3ezascOQ9zh9
TLSH
T1D2A24BD59B44DF2FE8CF5772E9A7E4062BF617C024315B962298D6462CC6BC0DB3130A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

ba:a5:76:73:11:5c:3d:58:4b:06:fd:90:fd:5b:e2:08:db:50:a9:22:1c:c3:b7:cb:1a:91:90:51:d4:52:0c:53

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

18026

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.Primitives.Facade/Release/net6.0/System.ServiceModel.Primitives.pdb

system.servicemodel.primitives.pdb

SHA256 7154a11b4498987b807d058742e548b91ee3523de18613e227c2f002d1b4aa4f
MD5 2d0e2d4ba407931594b8a92fb5918a21
SHA1 e9a44dd7abedb3881bfb72be50806b3f5a7b66b3
SHA512 e563f2d48c43ae32e4556f2f445b8c89bf8340611de5c38dd23a0de5ff4e80d89fd17f950ed2754310b1979a3e2ea82d63ae97fc16b61f7ed680c1d943d35cd4
SSDEEP 384:9sLL9f3u7S6Ca8X33UwaXF+lQfu5VU7b4MeUHff1B/lcl77Mv:9sH6viUGBMv
TLSH
T1CC42D4B74748E271C049567B5865C0CC7631A3222355FCB9F2D82A45DEAFA9D07F60B2
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.servicemodel.security.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d557f54112db1b908bb0f15cae688204420c8a76413085e33dd8a18fd8ce097b
MD5 288c3cb83e6a066b55bce368c89b1e9e
SHA1 6e2b8410cbcac437eb5fe1254969a0678743edab
SHA512 ca394e64a92f406cdace101d1d0a3b961b5a7a0e341fa01ceee4da657631254534aa9b8f1aeebf60ef04aa9c920f875e759fa7c30fe200952ea44785301420e2
SSDEEP 384:JIiGF8A89ALMW1LgWcpLHRN72XNNPR9z+Do:yiGKrybLSpLk9zJ
TLSH
T14E724B90875C8723EC4B2F7061B9E5277EB927C22516996F1785E2416C937CCEB307E8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

c5:f2:fd:20:d6:86:98:c3:6a:cb:35:20:56:11:2a:fe:68:48:bd:69:41:fe:12:75:26:55:ad:ed:25:50:e9:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

12654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.Security.Facade/Release/net6.0/System.ServiceModel.Security.pdb

system.servicemodel.security.pdb

SHA256 70df190d4980355dd80956095146659fdbb00997b1846f65da11bc972acf117c
MD5 ea380a45e8c498dd7c0192eeb3c95a87
SHA1 b11fec19d56ff11cd2f64332f920cec587eda1b3
SHA512 641c27ac428dad86280fa6fd59070906c1385b42e23ed1b80675ae6f777f7d9c59fdbe12c5b00dcd55a71781c0ce13341cae35cf581f430a0bff7e20d0b4598b
SSDEEP 192:rM/sICHq32cX827S6Ca8X33UwTuaYFj7+lQfuvRVUQDdWUqJx46qeUHff1B/lcl4:rJICab7S6Ca8X33UwaXF+lQfu5VU7b4h
TLSH
T11532D3B7574CD661C44526BB1825C0CC3A3193213755FCB9F2D82A05DEEFAAD03F60A2
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.servicemodel.syndication.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 59244566497067bb0c0cab710c667d3f4897454e2080293de509e14bf69972dc
MD5 e151e9bd62a1e75308846b91805044df
SHA1 b963262a9235750bedbf35c4e96f7b96e11bda49
SHA512 feba1604a8896b446de867b2dae8590a6d14302d78113968fea91fed2efd7b9bd6c5a1739610ead9f65ab61da6f47ab0fc10792e5cdfe8b5a677ee7905cd2970
SSDEEP 1536:uSUWeZyOFl2ujnqlbJ7U9JwthlKbxUKgqW25O+wqXcLls4xj3XEzIe:uSUWjIZnqr76mth4bCr0XcL3xj30l
TLSH
T185C34B28379C471BD7BFA2BCF570504886F4E35B2413EB5E5D84B4A918A7BC0B221D6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

04:f2:a7:65:03:d2:7a:25:cd:24:92:ec:b1:53:f2:58:1f:72:1d:81:13:37:3f:de:81:77:66:c3:b9:68:d2:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

115970

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.Syndication/Release/net8.0/System.ServiceModel.Syndication.pdb

system.serviceprocess.servicecontroller.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 848ff52f07797b4837b1967f311fb687a9fdec754d79021b1a9eb97bd3370d44
MD5 ba94f6101f79cb8d594fc61a578b6bcc
SHA1 a2a381087de7bd2dceacca820b9d1b557f8e6a98
SHA512 4887f3d9ebe5995b425729c491424f53606d40628f76a6be7e066da138e33e3886f6e7b6ba1956898f6f1c6794f51406f50e3f2ef44642630d37c41f5da2da80
SSDEEP 768:B+ikccc/ENTb7ONvN92D1Nl3fejQtaiR7in9zoQ:B0cPElb7ONvN0ToQc59zoQ
TLSH
T1A2E23B5197F807A9DEF70EB0A9B2C3250E3677C70E05C71F29A9A00915D7FD847B2629
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

6f:84:88:42:e1:99:f4:a3:5b:27:d5:fc:39:31:97:0f:da:d9:13:a2:9d:e5:e3:d4:7a:4a:25:ce:ea:e7:9e:16

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

28278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceProcess.ServiceController/Release/net8.0/System.ServiceProcess.ServiceController.pdb

system.speech.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 90a8f3e527f91877c106cee23067f9b30e24b4556fa2081bd658fff0ec207d47
MD5 b1161ec0dcb76b5578819098136c8c6c
SHA1 34555d163eb7191bfd454ecdbde4470dbeac72a9
SHA512 0d861c5404032aa4c6a650a39c8e83c3b9a2ffe7dcada62901d3ccde1c1ba194d89173b0446a5d4871825c9d93d0e31064d3d7cc7985d9f593b0b9fd6ed7d007
SSDEEP 3072:YygrtNNYwJapDvW84D2iKRAOovCc/3j6c/OpRqjAkk9Ds1X5+Xgr39Iy+jfQpDCX:YxZbypDvW8M2iKtOvPCy6
TLSH
T1AF6471493BF90249ECB6463C64DE45353B39BD9A3A13C40F0756B53E38A3B44E2E19A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

22:66:31:0d:b7:bf:b8:1e:5f:8f:1b:10:87:f3:3e:8c:1f:bf:9f:79:35:78:4d:54:24:be:b8:7a:01:f3:68:74

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

303822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Speech/Release/net8.0/System.Speech.pdb

system.text.encoding.codepages.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ad25527cb96cfe2ccdc2e45f133aaeeb5edd960632a1e0aa153a9ba00b30d85f
MD5 06f0401066d4bc40a3c80949c5f0608e
SHA1 e3c16dfdb705147dd8a30e81226a1f5253e7952d
SHA512 b81dc577e7d01e06306fbbb0db846bf6d01fb5fc69d280a59b2733e9ad1e92bba6a81b9ba42f6703d3a9f75f28947bf743c1622a28c5e025be3c8102229f21ed
SSDEEP 12288:9Q7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rtH5:U9km6k/IwRYbiBeKGC0Z
TLSH
T17BF4AEA096B59B17F9BBCD3197F13013DAF6AC567E02483BB952530684D3BF019C4A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

aa:1b:45:64:3d:90:ee:b1:f7:94:40:4d:91:31:ec:c7:0d:8f:eb:23:bb:36:63:c8:e5:e6:62:5f:a7:eb:c3:14

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

735518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Text.Encoding.CodePages/Release/net8.0/System.Text.Encoding.CodePages.pdb

system.threading.accesscontrol.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2236d25ccb78fa4d56c53e440f6d0e7c6c3983cb622fbffc89f6c92b283c56aa
MD5 f83fe683cac78d05cf49663a1e931879
SHA1 543b63bd7aba3ae1eac29fe8c4eecf6515de9e8c
SHA512 f3201b3776fe85b7685e2dae4f60849482f63312af4687cc6819cdca1258f6c54553dea3c5f4cfe164d8e64086261796344429e4c208e7e7dc64db0c996789f5
SSDEEP 768:mhFdElflmlElHlEl3lEl21qubeTfH7M9SIjQtasio9zEF:m+ube0kKQcJgzEF
TLSH
T1C1E20816B3F8022AEEB74A70B5B487755A31B5E24D02C25E3556B01D199BFC0CF62B3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

9c:6e:28:a3:41:82:87:70:23:94:2d:bb:93:15:2b:84:02:45:f4:16:e9:da:28:cd:9f:a0:e1:20:0c:16:dc:87

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

26574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Threading.AccessControl/Release/net8.0/System.Threading.AccessControl.pdb

system.web.services.description.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9a6fc857975a2a18062892b0a41a1ef111bd0ba3dd4a662adaf7ed619bd984d5
MD5 608deb562bc42837ea6e0a67a3ffbcef
SHA1 79b0160d42f18af5a34a5169a981739eaeeda6f7
SHA512 88d3be768878444327a5e18dbf1bda466d5ee4acc0716f270e33f6e96b05517e0015a36f989991477bf7d2e0b879532270458d34555a515672f8b90fcbd89e14
SSDEEP 3072:dJureGHKh4csNY8CRGGZ0dZj4ikMLIcm1wLCEkW3f6sAt22wzF/DVYtusEx25I6i:dJyMNwLpp5WYxR6u
TLSH
T1898421427BFB0D04D17E6F6BA57220914A7BBC1E1CB5E1AD24AEA04C96D3E01D463B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e4:42:4e:90:3a:f9:b4:73:44:c3:e6:ba:cc:d0:a6:6b:d7:f6:f6:4a:64:68:34:19:fd:e9:8d:75:d0:75:19:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

380086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Web.Services.Description/Release/netstandard2.0/System.Web.Services.Description.pdb

system.web.services.description.pdb

SHA256 93335f658a85ba48254a092ec6d79929ffe251b7a40e858960931743c6e4ba09
MD5 d1aa35493ffbeab682309ba197d4e094
SHA1 ae0e3303b81498d63915edc51f1c53ec72f88940
SHA512 445c16f734a03803d06545f33d48dfb47707f7f2c3f400f388a245844e68a61b535906f3d3c1cadf24dac4fad7bacf9a45ba85377cf9280c422b05e7a5bebd2f
SSDEEP 1536:16bQAkQkNU7uslMIy1hsKqBh+7g3ZpRbL8zwnte:16bQAk7sgvqq0bL8z
TLSH
T1E3A3721E4AC6A71BC27BD5BBC156072CBBB8C1507263CF1357A490FDBCEA7384982658
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.windows.extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0e55a1f514b587d767a95fcd8a6b6be355dd4ad2b961c7d3b1e87b4a68b11a51
MD5 ec44fbb3b834961556c3ec962c0da943
SHA1 b23c631eb35b886dc08c69604d1c31861a9c952b
SHA512 4e0df9e32f113c637cde623f652950ae325419a2d21055962903694a3e5cd4d09bb96cd3d0b6de445f2b622c878e6925e3e3fe7ea9aea6abd0c40a6829abdbc9
SSDEEP 768:nD33333333re09kBZxlGNVYjQtawwGOrF9zkue7o:nelBvlGNgQcwyLzkuec
TLSH
T15EC25B6567F4433AEEFB4E71AAF2D1011F39A7C62A01DA1F248AE1085DB3BC44771325
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

b7:b9:8e:42:30:6b:ad:71:55:5a:3c:10:98:c0:23:af:3d:d9:94:9e:67:7c:3f:46:93:69:14:3f:27:a6:07:a2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 16, 2025

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22354

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Windows.Extensions/Release/net8.0/System.Windows.Extensions.pdb

tr.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e00f6367ef050fb22f429abbc9d60a7a691fcbd32a87a421cca4d47dd62e405f
MD5 e48b344cda8417cac70771adccdcbccf
SHA1 98a97a75ee131b7bd0a2627f116ec4e28a9d4d07
SHA512 6405cbe20d1f5e480cddcff3dce2d66c54c33e0299334d046cb6f1d304dba708bb2110097040c4f3aabff7bb68439329b5d1061608a6fa5c0044571182aefe0d
SSDEEP 6144:4kWlony97g41l1mKcqPdbEbMYyK8zx8w8N8l3a1363XPVg4KFXJD:YloydlW8zx8w8N8l3a1363XbS
TLSH
T1B424A74477FE241CF6F70BAAEAB49919EC7B7E622E31D05D4009861F1671B818AE5333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

de:74:08:94:29:b2:f8:e1:c2:33:82:d6:bb:e6:a9:aa:f3:33:08:d7:74:13:c8:2c:4a:14:74:36:a4:07:f1:a7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

207606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

tr.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 615391322e31a3b1b6e2a61859987a1c344f0e5ef5551d594562065ce6f92775
MD5 edc85876b3c7f2116a89a20c5e6e4e21
SHA1 0f1c79699e69fcc446b89873cca61372868bead1
SHA512 12fc462d543df0f57560fbee22841d5a0d713bda91f1e28b6aa11d021bf17718d7b7290720724a91c8200e7825130613c0bd05aa2c59b569805aa55888254fe7
SSDEEP 384:4vJ3xC8MYWIclWypUzuHRN745DNR9zWuF:K28M+cZ2za89zzF
TLSH
T14A920685A7EC1606F9F71F7095BDE54A2C3F7B526E20C41E1590D26C28A27C8CEA273D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e8:ae:6a:70:b2:a8:6d:fd:3a:e4:42:b8:4e:30:67:41:d4:7f:83:2c:c7:2e:2e:34:d5:40:93:1f:61:15:71:22

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

wpf.ui.abstractions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 29038f4c2fc28074e798fe30a55d1032e5360b5265b7226941371d790e3a96ac
MD5 61672a46aaa3622111d8830be32cd5bf
SHA1 75fedd6ce95a3cbfba76d2efdfa67c52d6077c5b
SHA512 dcbc4abcd3b21b2b493a8a8b820fcfde16050e3766db0ebe452f634da5b13e1eeac8522818739c8be81138bbe2c93045faffa0cda8c28ed6fb40a26e9e1e2350
SSDEEP 96:gg6JhMvAHuBdgkyTmvVe4mgCoXLtdBTZPUhyRuZebm47l+XS9FX1hH:glMYOsfWmgCobtHuh5Zb4J26XDH
TLSH
T1C0F1C631FBEC4372DCBB4776F8A69A805A74F602AD575B3F15C9810B9C192085E73722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/Wpf.Ui.Abstractions/obj/Release/net8.0/Wpf.Ui.Abstractions.pdb

wpf.ui.abstractions.pdb

SHA256 78d79b2b5e37976359c82ce7f2598e3c6ce9c02757ca9acf29c1d65fa173e96a
MD5 85fef718c4f00c990d59387336f659bc
SHA1 bd9f1489a21168326430168b8d201af27a2a8d8a
SHA512 1942a4ad9af5d46c5305531c1c94a316ff0c40e174c0300be67f469ac3243f20750765360f36af7354921c239c1386f0a7ede28619fd0e80e9de78b19bf4dce9
SSDEEP 384:BqOv88nThGywq571aZKgMBjbR4vbyGgN2yXYIIqZxHrfB96RidB2PNt:BZnThUkQfII+Gb
TLSH
T14852D477838CE221C4401A7B59A2C5CC3731C3162796FDB8F1C42944EDAF69E43BAAB1
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

wpf.ui.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e6c8042ba1861a72eb734f75f1674ca13b756a40eaa579a30a911445fa458f85
MD5 252f9ded32783db92448941aaf776de4
SHA1 1a438ae3748d06a067516c769e14480f996d08f0
SHA512 a3e14fc1d105c67e40ea8b3ec569364f89f5e2e121afea91c53d60fd67899ddd27934f406cfa622b842190d98ace9178d4bbb55b3ed40c1792031f97cd813be1
SSDEEP 98304:9pbON/XzMvSmaRT+KcbNdvPp4zlAHDfyNr7l:7O9oNdvPp
TLSH
T1BD565B5E23ED4D32C3A3837A8DA0B3231D6519752143AB834F4A9B3D44BA1C9DDF169B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5955662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/src/Wpf.Ui/obj/Release/net8.0-windows/Wpf.Ui.pdb

wpf.ui.pdb

SHA256 0db6d7553c0a07f08700a90ed6ea7a604fa4bf4331f0b268f96c0993e5a3818d
MD5 c2f985f4734a3a1d5577ec355b539dd9
SHA1 11ca6fcbcb20bb5fbd3fde8379acaaf459f4076a
SHA512 8ad506a1a3c9a068a3c193387656e116d71059ab8e503312d3e889b6896c80865444a207e27f6e94bf38c09ac8e3af56cc8688a2da42cbed7a373d52771a171d
SSDEEP 1536:IPkdaO9drER4q2JFzXfu22VInadgUvE6y2p0h09gKjRGosOfw/1Gq6QZd1p:loR0zWrunaKUvEJKl6OYL1p
TLSH
T151D3096B8B85C73AD85A14774477876073338A04BB45AF2772EBB6B09C5630C1B9B2DC
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

zh-hans.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 59048b72505417ca18885e69f432d59197afa3d076282235a3f8ef6e0b3295a3
MD5 0a3255946482f326abac2b98988d63f6
SHA1 22c57807aee41eb604ba6d7e2844ddf18aedf352
SHA512 b8dc24eb66fa1e7a646620ce521bb5a2d517fdc392761f09eadca44b33d480aa70d382e8393298a2bb00e8af351a3646a9539c0e0723f800be340e13f82aafaf
SSDEEP 3072:t5SLxjP48iNrtEUGz4xbu9vPNCbAdytH6lr0KFOObnPDHk//pSih+kkf/0BE:OIEUGzubu2+F57PDQ+
TLSH
T1A104C58237F929C9F6F71BB8AB799419F837BE665D26C10D0002464F8971A84DE70B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

3e:ad:19:ce:43:0b:4f:0d:a9:b6:ed:8d:47:46:d4:e5:8a:4a:5d:d7:ee:90:6f:3b:40:22:bc:4c:f4:db:ae:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

183614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

zh-hans.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 272ef4d9e8a072f22d7ce8510f40d802d5324847a78691ef74551a1ddbe4f1ea
MD5 8cd74dabce05da1ec26ffb73548b3679
SHA1 bf4761dfb0d5ec0351cf952b714ed89b15799108
SHA512 f2e89495dfed6c8626fe607b94081ab6f0314af6bea01735b0d14029089647f892e19b063fe47d62ae18939a9229db7fa727b517538795aafec0ed7e1c0b8218
SSDEEP 384:helHhVhLu4y8D7WIclWPzuHRN7i5DNR9zWTs:Qdh/dcOzay9z/
TLSH
T110823C899BEC5686F8F71EB06B79E0422C3D7B575960D62E24D4A52C18637C0DF30B3A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

3b:5a:95:79:c1:b0:f9:33:74:5a:b8:cb:b5:26:1c:5b:d2:a4:c2:67:fb:61:17:ef:ea:37:e0:2c:4c:ef:b9:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

zh-hant.system.private.servicemodel.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3151df36dbfecedc5d1e9d1b738d878f8354af2404b7bc40e04fabe5f3001222
MD5 bad18ac952e4c146af1b398fbdcb3d98
SHA1 bb4166be1344fac1e2ca793d0eb6a892b8f850f9
SHA512 1212da68160a1de50af6d5cd1f3ad9e96b04e2423598cb87cd82ffd7ae4d1c3614d0e1ac76d4cdd4cf78ba55bbd6ce58e5b4bcc33ac79c35da0c636bd6015520
SSDEEP 3072:Y/g/xRCWdCWqC6vQn73aehbvaEZE48LuTUN1/x1ot4hSBKGsb9fTuFWewZpMbfK9:0tIn73aehbiqwz/7xd7dT
TLSH
T10A04E69A67FA166CF2F31BB0ABBAD609DC767D695E22C11E4109100F5972F80CA71733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

c5:59:a2:b4:f6:bf:43:b8:07:4d:be:2a:f0:ea:da:9e:11:b0:ee:da:d6:a9:01:40:8d:b2:99:a3:54:a5:de:8b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

184662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

zh-hant.system.web.services.description.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0612cf6e56c368742a34026a68397e38c28b2ad7681af4fae39c40f0b6b2086e
MD5 3e13e59cc162f6d90f0e5ebb2f432972
SHA1 e7456e4385101627158c86c01e67fd9bfbffbad4
SHA512 9d471f87c1e309885d40af66fcb57780c09b268b444f060730bc2543db72a3ffecf5f2bd42cb90a813f06f720f0880dcd0981712caff6ac3d7123b67fe1e292c
SSDEEP 384:N3KkIv2FCcdTWIclWDzuHRN7mQKlO8R9zwNvN:Nm4c+zaaOQ9z4N
TLSH
T1F282298687E80146F8F71E709BB8E2426D3E7B565D60D56E2944E56828637C0CF70F3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

bc:83:c6:1b:39:60:e2:ca:84:e8:9a:c9:ec:2b:8e:18:c5:35:0c:71:de:8e:af:d6:b1:b1:d0:31:6d:2b:e3:19

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 11, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

Kirin-Tool.dll

mscoree

dotnet

bouncycastle.crypto.dll

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

cs.system.private.servicemodel.resources.dll

mscoree

dotnet

cs.system.web.services.description.resources.dll

mscoree

dotnet

de.system.private.servicemodel.resources.dll

mscoree

dotnet

de.system.web.services.description.resources.dll

mscoree

dotnet

es.system.private.servicemodel.resources.dll

mscoree

dotnet

es.system.web.services.description.resources.dll

mscoree

dotnet

fr.system.private.servicemodel.resources.dll

mscoree

dotnet

fr.system.web.services.description.resources.dll

mscoree

dotnet

it.system.private.servicemodel.resources.dll

mscoree

dotnet

it.system.web.services.description.resources.dll

mscoree

dotnet

ja.system.private.servicemodel.resources.dll

mscoree

dotnet

ja.system.web.services.description.resources.dll

mscoree

dotnet

ko.system.private.servicemodel.resources.dll

mscoree

dotnet

ko.system.web.services.description.resources.dll

mscoree

dotnet

microsoft.bcl.asyncinterfaces.dll

mscoree

dotnet

microsoft.bcl.cryptography.dll

mscoree

dotnet

microsoft.extensions.objectpool.dll

mscoree

dotnet

microsoft.win32.registry.accesscontrol.dll

mscoree

dotnet

microsoft.win32.systemevents.dll

mscoree

dotnet

pl.system.private.servicemodel.resources.dll

mscoree

dotnet

pl.system.web.services.description.resources.dll

mscoree

dotnet

pt-br.system.private.servicemodel.resources.dll

mscoree