CadenceLicensePatcherWin[.]exe

resource	yara_rule
static1/unpack001/bunifu.licensing.dll	agile_net
static1/unpack001/bunifu.ui.winforms.1.5.3.dll	agile_net
static1/unpack001/bunifu.ui.winforms.dll	agile_net

resource	yara_rule
sample	costura

resource
unpack001/bunifu.ui.winforms.1.5.3.dll

resource
CadenceLicensePatcherWin.exe
unpack001/bass.net.dll
unpack001/bunifu.licensing.dll
unpack001/bunifu.ui.winforms.dll
unpack001/costura.dll
unpack001/restsharp.dll

CadenceLicensePatcherWin.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9c97a745de5706db766f9e411b31e26ab63fa444ed4701ff7416401c2f2cff7d
MD5 e55db7cfb0f519bcc438afde86b0ac4f
SHA1 07ba82824f8edb6034e50b023ed12c45f7fe54aa
SHA512 719e5827c58f1a25dd524708653acc4d3e439f294fe12c82c4c13cf974271c3cb2749cd44dce31b793d97f1aa45f746d974bd80da6324da63c20dec59ec0a514
SSDEEP 196608:cVx665wq24yUWX0zQJ/tVrMt4qMZxNoggI2JFCuW947OiggW6:cVxjwd4yUgEWpfNOI2C9BigX6
TLSH
T1D1A63333F3B5644CF11523309FDA02B5A2B0AE51157FE72A3D9A73C8AE33B965A452C4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10101838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

bass.net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4ef3ff2182f084192f3fa00f5209fc248ad214ef117ee6d18aac74db6c284fb7
MD5 46688d7469c0b936f388b1936f75c4ad
SHA1 5e0ec91645ef80a2ee75cbd56e15a0f36b620e4a
SHA512 576767270540d010502d1eb0be1a80586d15d6e0b29f8dc9fb3f108944cfde43f31373f76ff9d2de23065e74a74be776e63f511256265ca452f339a73654ab74
SSDEEP 12288:XhAilLJOTeBtAnoxmbkq+ld9iBzrBFmETmrBVv9lRV8:RAilLJ3AoxtizFmEKrBVv9lR
TLSH
T1A2E46B057BE8BA07D77E137490B24A1557B0E04627AAFFCB4E9494AAADE37C18C413D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

669130

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

bunifu.licensing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 985cf52f94bf2375372e7d3f70678f5ab76cf2764a34772e110ffe4336113df9
MD5 e494278d822fd75a15fd50a519c92836
SHA1 8fdf1c70cffc856e24679cfe96c24cee8cabc94d
SHA512 eb378c7deda3df622931a3742ce706d24b2950010383d91e918ea88218a6fd8dd5ce991bdd99a7c24a6b3a9eec787c78df36e4d02d1aefaad5f91259109af7ae
SSDEEP 24576:JbkurkdR5uuMeiPUf2lHmdpjrcbYdwcqMw5LTvBrq/WGs1xGofGUC9iu:J1roD9MeiUDDjrW4bqD5LDBrqWG0Gofn
TLSH
T11155F150B7F9AF26E1BEB7F56970120807F0BD979835D30C8EDA01EE1B62B848494767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1332990

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

bunifu.licensing.pdb

SHA256 1d5c687db86f5669450f67905f5a63789b61c507d0e3ffeaa2d50fe647a29288
MD5 a094ed92a9e2ce8923c24e9a4bd0412a
SHA1 0f423916b55e2693771b6388310ad41509f97d44
SHA512 ab4cb65636e7b4956c0fbec58a882eae500042adfcf6bff0b35b7e2f7a46e34cf7f335a5c17b0e898151b250d7c5eda10d14355107d70928226892d26b48ddff
SSDEEP 3072:2C3wZhFYjeCAAhDvdmhVbrkUYT5ku+Tg4MJo4LxToQxvfJAvj:MYyCzhDWV/kUYlr+Tg4MJhLF7xfJAv
TLSH
T19454E107BB40C933C06196F8A6AB5F3E4728F5886BCA03DF5B55F02C2DE634EAD56650
MD5 SHA1 SHA512 SSDEEP TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

bunifu.ui.winforms.1.5.3.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6937052b86bc251be510b110e08fc5089d3bd687ce2333a85ea6d5c2c09b437a
MD5 c1d51a0e747c9d6156410cb3c5b97a60
SHA1 86312cba2eb3495cc6bec66d54d4ab88596275d8
SHA512 a8d7b2e5555c01076e8dd744d21d8cd901aaffad052af0e8c22269e8c2f765019422ed245368a64d64157652a0e4fcab1a889086fde4e139b4ccf5f7bad08222
SSDEEP 6144:S8oD4R+RVzdBZI1TAcHoP2iErkSeyoJij/YKEC:S8oMR+RVz2FAcHo5y+eEC
TLSH
T1B754D5017579EA73D9FEA7BD96401000ABB18CD1AB6EE74AFDC853EF2993395500E04B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

3e:60:9f:ee:0b:c1:db:79:70:f4:a1:a5:c3:e7:56:69:b3:1e:fc:57

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Chains

Mar 3, 2022

SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

SERIALNUMBER=CPR/2014/141232,CN=Bunifu Technologies Limited,O=Bunifu Technologies Limited,L=Ngong,C=KE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024b45

Serial Number

5c:a8:2f:f3:e2:49:8f:60:ba:9b:0f:ad:f3:bc:d4:87

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 31, 2021 - Mar 31, 2022

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 19, 2010 - Jan 18, 2038

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 3, 2014 - Dec 2, 2029

Minor OS version

0

Major OS version

4

Entry point

300982

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\wilsk\source\repos\apps\desktop\bunifu\work\bunifu-framework\__build__\__raw__\Bunifu UI WinForms\1.5.3\net40\Secured\net40\Bunifu.UI.WinForms.1.5.3.pdb

bunifu.ui.winforms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 98f902580648b4095d9b15549b83545e27730133ce31e978172b6f0f7c171402
MD5 8b38a57e50852f8874aeb33a814e3d76
SHA1 6eb3ba6908fb5da2937cbbba80be9ebc917eb653
SHA512 2feb41737750bbbf9387a787f6447bfa88c894abb775b23510b446e63cc8e23e1a648bdc59b0837225d08c552a7ec44df0f865654ebeb2defac3e16e1fdbc9fb
SSDEEP 24576:3WuLnDWPlxSq2tO7NZWqfL+icH155aOnvtpq4U:muvYStO7OqfL+L55aUnG
TLSH
T1FF85F9017EB4EA33D16F37B59924201893B6DC81A455FB0AFDDE73EC88E3355990A18B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1803418

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

F:\Bunifu UI WinForms\Debug\net40\Secured\Bunifu.UI.WinForms.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
MD5 501981c7fc457d59238eb99780efb615
SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
TLSH
T1F791A51097A8477BE9BB0FB6ACB3534A4275FA61DC27CB2F19C562172C123180A31F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\198629\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

costura.pdb

SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
MD5 34b42a5776a3ad022b429124d55e576d
SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
TLSH
T1F35193776F04C291ED9884B28513DA492B3047127602EE7AE9E51B05CCFFDF8077286B
MD5 SHA1 SHA512 TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

microsoft.win32.registry.accesscontrol.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf3345e75b46c848c184b5923b86d6c6b470cbbc0e44a83038396e47b37292b9
MD5 e2cdd9e79803ecd56e0f9ed3f2658160
SHA1 191d79ad78fb961ce162ad342299eddacacd94cf
SHA512 efc88f559d7506b112ff4d768dc2118c62d63837ed78f87c8b291f68ca8ec864882b7d4bf5b8964641253a28e79d02faf394f5afe750382794b38f6fa23beb65
SSDEEP 384:cSk7xWUHIx0S3WF7rWB/uPHRN7qkZ+lup:c/0UHU0SOKMqkZ/
TLSH
T110922B119BA88363DDB60E30BA76D4522E3DF386AC21DB1F1189E14A4DE3BC59231739
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

89:3d:2e:f7:3a:c1:15:28:d4:cd:99:32:02:f8:22:24:51:fd:28:dc:d6:7a:ca:a3:9a:0f:d8:eb:df:87:bd:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

15618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Win32.Registry.AccessControl/net461-windows-Release/Microsoft.Win32.Registry.AccessControl.pdb

microsoft.win32.registry.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e9a9d281c1a708aaae366f82fd6a1742f65da2918cc4fa5eaaaada0be24277d9
MD5 59c48aacb1c413c108161afe13fdbed9
SHA1 31ace4b26d8a069c84aad6001e06c2a5483806f3
SHA512 8252abe64c67863d9e4c70e820f0c69c517b8678a4b4c13a436118bc276e5f21e84522b93566c0bc009effcb251ed67bdbc60e4907abea2f33b6be3764e28d1d
SSDEEP 384:j4nLpSumfSQrlHViaCZYvLPQmlJLfjnWn6GWfdHRN76+fVlGsa9h:j4QVrxViR9mlxd96lv
TLSH
T140C22912AFE8023FFFFB0E316975D5120EB6FAC52912961E1548D28A1DB2BC8D531738
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

f7:b6:99:b4:22:72:5d:60:72:4d:cd:e6:ad:87:41:f4:90:42:b8:ac:9a:00:ba:37:a8:a2:d1:9d:fe:22:40:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 20, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

22634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Win32.Registry/net461-Windows_NT-Release/Microsoft.Win32.Registry.pdb

microsoft.win32.systemevents.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 82951c4b9e62db0b168305db6559fbe73fc58ae31990ef3db2f1f58c8d5f6363
MD5 b8e48f5cb02aeffa053911ef322b00e8
SHA1 dc97569e1ce6e799307290c1a70061cb1aa3bbdd
SHA512 dd53764bb7a587b8142a3b8b63645302c7870c7e87c4a5d8d2625243e3edd9022cd7e78f5e51bec8e7219db418f34741cee1340e2f58fd8c49b313e560dbbc84
SSDEEP 384:ZdIaf4rbDyIb/KcWCNRWr7JWPr/uPHRN7JW4RGVhlzd4hm:Z+THDHbs6GiMJFR9
TLSH
T1EFA23B2A5BAC4733ED760D3155B6D2162E3EA3D67823E75D1489E00A2EB3BC1E231735
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e6:6f:53:59:e7:64:17:b5:c9:93:47:ac:f8:9d:65:7b:f6:5d:41:d8:76:dc:47:e7:a0:87:d0:3d:4a:52:5f:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

18638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/Microsoft.Win32.SystemEvents/net461-Release/Microsoft.Win32.SystemEvents.pdb

newtonsoft.json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af
MD5 4df6c8781e70c3a4912b5be796e6d337
SHA1 cbc510520fcd85dbc1c82b02e82040702aca9b79
SHA512 964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c
SSDEEP 12288:rktg1lrjC8rjICqbwNjR4xq7iiX19K7Df/SoOKQrIB+jfP:rggD7PIEjR4xq7iiXTK7D3So9AIB+jn
TLSH
T177E4395133F89E1AE1DFA774B4708A2943F2F40AE2BAE74F5A45A5F92C937504C047A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a7:cc:fe:41:40:99:65:07:53:c6:c7:f4:1c:e3:22:5f:f1:9e:7a:db:83:aa:c0:1c:bd:9b:44:a1:54:ff:58:a1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

Chains

Apr 22, 2019

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Serial Number

07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 27, 2018 - Apr 27, 2028

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

Serial Number

0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e

Issuer

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 25, 2018 - Oct 29, 2021

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

672442

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

restsharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0e7a0f3910741e81f9b4660501b30aab5eee71cfa4fa9dcc9b32acb64c865428
MD5 09806e18f9f8e3f2351827be22e634e0
SHA1 54ec870ffb8ce10b3c8b05bbc7fb7ea45142a430
SHA512 45b5743bd3f50f51b6953bbfca9f8c5d1aca75aaed5cee0d6ef401034a05a09f27b928f539101801450b428ca7eac9ecc3ad0b41f2bc19258da52fbc7dc8ed09
SSDEEP 3072:JsC2yztWrT99ZTN/ru4Y1Gs1AvVUDOIpjdz4LuYcEFRZ8w/VrvFjsu2i+:JBztWrT99Z5/am4IFsZ4LuVEp8oQ
TLSH
T114F35C1DA3BC4FB1CACE0E3CA0F081008BB5E65B6503DB9A6D50D8F53A17F559D06B6A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

175886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\personal_source\RestSharp\RestSharp.Net46\obj\ReleaseSigned\RestSharp.pdb

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

system.codedom.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9dbce659a0ef6fd19709fe1d5b2a78be451daf28000274fcbc1cbe080ce71365
MD5 2a42f86af609dac74fe6c898ccf958e0
SHA1 88c8065034ee0e4b9f6a3935fd32e541eff39ebc
SHA512 cd4e71e91569b0a47bc5f5142b103048960929c5bb29d7c9412e4b5331377d44468e6a07af8b2b766d47ac04a2eb65965e722fba067370a1456f1686dae662ae
SSDEEP 384:DdgrnDxt3942O1NEIY3lzZIcKBxehzsCtZ7U6r1fDXJx/WpuWa/uPHRN7u7c+luh:JgXxtu5jEIYDhzZpmeMu7cH
TLSH
T14AC22A1252F88FBAFEBB4B302977C1924FF9B2963535A31E044950592DE2FD09621B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

79:ef:2e:46:66:2a:68:54:c2:e5:c7:b8:43:ea:bf:88:94:f9:21:4d:7e:c1:c6:c8:77:86:e3:d4:77:cd:ca:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

23594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.CodeDom/net461-Release/System.CodeDom.pdb

system.configuration.configurationmanager.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f393396cb12fb0977e50fbbfd5a0ba7e28b97fe93b68a91a6fcbbfbd24cea8bc
MD5 5dd78e2ca7ba1e18d9df1abc8a9416b2
SHA1 6a511a5688b188c4d1615cede33b1e5278376001
SHA512 2096c182860e7b71942eb1d89624e501daa73eccfc8974dc1c8a27167bed2ce4b8a393f467345570bca7f58ba47faa23edb7b3e715cda37ad268747e3ea5ba46
SSDEEP 1536:J8KGCEPg1QqF3BhejEpvS/ZFQ+2/NVQ8GLa0Uh55T3lEC/IOPbZkxqN4bENZJlf6:GHCXBheNQ+2/NVQ8GLa0Uh55T3lEC/IJ
TLSH
T19983515267F80A3FFAFB0F75BD7AA8585D76FEC91522C15C106A600C0865F904AE2B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

0e:69:fb:67:37:bd:15:03:0a:bc:8d:1c:76:55:be:56:5d:88:14:72:13:33:28:53:ed:bb:60:1c:32:f5:89:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

81666

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Configuration.ConfigurationManager/net461-windows-Release/System.Configuration.ConfigurationManager.pdb

system.data.odbc.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0ce24dcf9e6b7191a6362c69a3b0d28ac66a1fbf9a1d4a1f0493025c84bb65b7
MD5 d98f6d3793da6eab4975776a552e3f8d
SHA1 c57659cdc8b66af4b6d3b7f0e44028f265207fd2
SHA512 067e2f3bfdefbceca6e7bbb5406e87e2acf96d480fd5e496d7ec7da56e65694a2e9f8d3da634a4acfd0b0088e1bfa04fd79e5ae8480cdabfe92e18756f77102f
SSDEEP 768:SsCikxiUPLkOWoYSAkm4fHLofFv9Rit9zzv5dnCbMpcZ:3fkxBIOYSq4/2biHrnCbM+Z
TLSH
T1D083213432B433DEEE6B2533817F0517393E6A56A222C1BA5E58103B6727D716273E2D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

fc:ef:f6:89:0e:50:cc:66:8d:e3:59:36:a4:8b:1a:10:e0:80:10:09:fd:e9:c8:69:30:bd:e6:7f:52:32:ee:e5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

76326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Data.Odbc/net461-windows-Release/System.Data.Odbc.pdb

system.data.oledb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 448bcd63ee9f7184e85573870e81ced680d0df76b3bc2d6b48689b3202ae0d6b
MD5 0fa8556a36b3c856522979934458e145
SHA1 13c03454586f5ed2ad3340185a5276102967ca1c
SHA512 5fe85df2203bb1fea518ecde64e9491deb9b6fba134bae57ef232a9751921705d275c601113f2114b98ac80d384103b4a275265efa306332198eeae49f8fca4d
SSDEEP 1536:N+kZKluk7ZFrtpAauVXrbtYC/xBu9LIMw/:N+kzk7p4rbtYC/xBOIp
TLSH
T1FFA3222533E433DEF9B72532666F0116A93DA693A213CABE3D5C000B5B73D7111B3A69
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

87:87:67:2b:ab:04:f9:b9:0c:0f:73:dd:65:96:5a:76:aa:be:4f:49:80:76:94:e2:c1:95:04:7f:ed:04:99:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

94214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Data.OleDb/net461-windows-Release/System.Data.OleDb.pdb

system.data.sqlclient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d81f4a40b0cd8a28ea552d935ff8a7b86f70d746bd969ae9b3a783a5c8e6546f
MD5 2cf3623600d7948d2d3b2ec51a75022b
SHA1 d00c8be9945b6fbd22929dd0e666799cf0670673
SHA512 1dbe67568aefdd9e3d85117b54ab6062efa15f2f2526f9e9c6e78c295bf4e873d2a7066c53b3c5fddbfe8446fb636c29a9bbef5d768aa7290c39ee6ae24da825
SSDEEP 6144:XXFpBZBJL3rBxad7/bAkGF60FhFoFmF8cjcsc4FEFbFgcbFmFiF6FhFuFBFuFDFQ:HFRf60FhFoFmF8cjcsc4FEFbFgcbFmFQ
TLSH
T17324962433E4369DF9BB3272757B1412A639A2926112D8BE7C8C404F87B3D7551B3F2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

f9:51:1e:09:e5:65:c5:36:26:ca:16:1f:05:b9:9d:ea:a6:44:d8:1b:de:89:06:85:57:04:1e:0e:41:0e:a6:5e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 16, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

218902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Data.SqlClient/net461-Windows_NT-Release/System.Data.SqlClient.pdb

system.diagnostics.diagnosticsource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
MD5 8d9df432109f1cfdd86723b5f171e3d7
SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
TLSH
T145F25B54EBAC8953DEE71D3062A4D9423A3AEB936C10C25E2699E18D0D83BD1EB11737
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d6:fb:4d:67:72:14:08:d2:75:46:a0:06:cb:be:f9:d3:5f:db:20:bd:97:db:cd:de:3c:cd:a0:78:2f:b1:93:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

bc:c6:7a:ba:4c:c6:19:72:95:75:c0:52:c5:b2:9c:4b:5f:0f:69:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:BBEC-30CA-2DBE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:a1:a5:fd:b9:ee:a7:fc:9e:9d:00:00:00:00:00:a1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

24690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\System.Diagnostics.DiagnosticSource.pdb

system.diagnostics.eventlog.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d60378c5c744947bd95aa55c3728f70d091cf65805dd6d0ae194cef395b9e1e5
MD5 249e6d161477b204029ec78765eaeabd
SHA1 b5f3b8153deb32f540c785c030f190daf7c0f3f3
SHA512 c2ba82d41ba012352e7a9b0e1191cabf2f027b9b9c3e7d90fb7916b3e614df88b164142070468d027928d6c1594dbf45fa5b9504e33380e30c5f990cacf4e8ee
SSDEEP 768:xVdeQes+wUTHP0G3cmL+7NQ1OaY74EzMPs:xXeQes+wUTHPbANP7tzM
TLSH
T184E22966EBF8062EFEFB0E3057B6D1160E39B2D71922D21D0465955E1A63F80C770F2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

3d:5f:e5:9f:94:93:2e:15:de:af:26:85:4f:20:16:ac:df:f0:cd:97:5a:8c:b0:dd:b1:d3:c9:02:c3:f2:c9:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

27826

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Diagnostics.EventLog/net461-Release/System.Diagnostics.EventLog.pdb

system.diagnostics.performancecounter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c21b50e57748ba572ee8701fd1140e050aee78ee52d8803559d13a5798b393bc
MD5 fa2b29108a3636056b4adb1360068e99
SHA1 ecfe9ca1ad79826d2272a531cb185d980ed0e700
SHA512 d9e0b4666f91aba36c84420a6ada09f76f5eae7822c3bc98e363f62bc58b92a739f78eeef0329fec92f06ee26e2aa6d2d7a40ad7df517b71fe2bef8875ab63f0
SSDEEP 384:XGAHVcV8a5cg1YeEBfVmVYSGS4W+FyLVRVStbaB/PRTlBRBMJnnvnL0++WYbWx/T:XTyj5cKJfE+MJnnvnL0jqM+ff
TLSH
T11603D705E3FD012EFEFB4FB43974D1668E3ABEA26E11C85D04A4405C15E2B90D9B2B76
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

6e:90:54:d7:49:03:25:3e:64:9a:c1:57:93:99:d9:43:ef:bc:ce:47:1e:82:2b:7f:d3:6b:ee:cd:98:70:67:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

36054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Diagnostics.PerformanceCounter/net461-Release/System.Diagnostics.PerformanceCounter.pdb

system.drawing.common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ca18383a2070518ae8c3e96cbd1705da283c8ada4ddf396217d2bcb7dcd03103
MD5 3c2445d3095f82ec8a526e7843a98ba9
SHA1 2f2c9d016ffc2bd7078104234e27ab2b010bd765
SHA512 9cb5564ee52c1b71c732026d0bdb8414c09ba0037e12440f1d122644a977fb95fa4f9c13666053e4fcce811e265f9b8afe60fe1b007d9d2e278cf0d0a8c243fa
SSDEEP 1536:4JbgUxvrIn01EkO/69KzwmOiGeCcSP8UIrdMe:41xvrInsEkO/AKzwm3C0UOdl
TLSH
T10833C652B3F8051DFEFB0BB57DB9A5154FBBBBD22A22D69C1414500D19A2FC092B1B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

09:6a:f6:5e:9f:d8:67:31:01:58:a5:1b:49:9f:49:7a:9e:86:3a:1d:3d:5f:0d:f8:55:97:84:d1:14:6d:c5:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

48750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Drawing.Common/net461-Release/System.Drawing.Common.pdb

system.io.filesystem.accesscontrol.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e6026501ad4056ff2f1655b0afdfe8923bc6e8fbad67e1e9ef56e3002f49fbb9
MD5 3409c581f0c5083f0c2a93a7a5ac9790
SHA1 18ea7bd41d31247148abf184527c9368a26f39e7
SHA512 ae877c6fddad0e4133274e6372d783eaa4dd6bdcbbf40ab66302fb89bd2f76b215130001186b5c9a135abd16336c5bfd4d414177704d7d359539da91918e82ed
SSDEEP 384:nmjoB5y+MLi9VYp/OiRc715ZkSAcE1l2Yd5zqNz8TWgVbWqdHRN7NfVlGsa9x:yCN9VYp/OiRcnZIfk8PpET
TLSH
T174D24A01A7FC436AEE7B0B316A76D5122F35F2D93913D11E1940E18E1E93BD89A32B35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

1e:d2:50:3d:e9:f4:01:35:eb:3e:ad:cf:5b:85:64:87:da:54:69:6e:64:75:82:87:e4:01:81:b5:bd:9d:6c:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 20, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

24774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.IO.FileSystem.AccessControl/net461-Windows_NT-Release/System.IO.FileSystem.AccessControl.pdb

system.io.packaging.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 85e04bf12239ed095ce5ff772e342d3b31ebd13faea036ed448be85b0aae5bff
MD5 13e674b60d605bc1b4529977932ac21d
SHA1 f788f0b87276b5ef87721813990e905e3344a8b1
SHA512 1ae7ad4e500f33a23769b43389a25be3fae276802d3250fd7f7f6755015c7906fd67488b100af405aa20e73e9b6cf7e716b198761691404e7ccbaaefa1ce10e3
SSDEEP 768:gxua7db+smzMnSzBt++0YfTF61O+luv5tylM6XxRs:gxH7ssKugt+++1luv5tylM8
TLSH
T17423B89173F8021EFEFB0FB07AB5E51A5E39BBA62A12C55E1415500E08B6F80C572F76
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

3e:7e:8a:18:10:ab:e7:7a:fa:ad:af:23:51:2a:6e:ea:1e:b7:4b:a5:45:b0:d0:f8:dc:66:4e:88:ed:6b:d0:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

42150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.IO.Packaging/net461-Release/System.IO.Packaging.pdb

system.io.pipes.accesscontrol.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4babe8db54f6805fa977b09d0bb51dded2205863133206edfef94bbd14510cdc
MD5 5771a66e9f4d64825aab723d115080b5
SHA1 0ea487e0f4a0fa9f7721d25a320e0ed014d86919
SHA512 09c39233d0f4337624babc6fb68dcf2cc38f63259ce54044db711481827b5857587b7c4f103b2489f080133e003845b9c684a364a100dbed6a45f36ed527ba61
SSDEEP 384:NANJdesEvbDYUgmpWrxWNPfWqxWfPsTwm0GftpBjEaQHRN7BZqlc2jCw:IclTD/yod2IwVi2LHaP
TLSH
T199C20852E7FC4242FDA69D7026B8DA437D39FBC25C22921E0059F58A1CA27C4DB31B39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d1:3b:85:5c:f4:a3:54:d4:74:f2:90:28:db:d1:a6:d4:c3:db:29:59:e8:6e:81:fb:b3:9f:e9:e2:0c:2f:25:21

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 6, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

7c:2b:ba:16:0f:cb:47:6b:64:8f:70:a9:34:fd:29:6f:0c:87:9a:4d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 6, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b3:39:bb:d4:12:93:15:a9:fe:00:00:00:00:00:b3

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

0

Major OS version

4

Entry point

13658

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\65\s\corefx\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Pipes.AccessControl/netfx\System.IO.Pipes.AccessControl.pdb

system.io.ports.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 51c305fa9dfcef5386021cdddbcbabaa450395056ab53071d1f89ee504989673
MD5 8d398d535f2b99505a8670785125106b
SHA1 73d1557d00f91cc239f13b27eb385d314ca40511
SHA512 8c96d46faa0ef6739fc1c8f305369ecc9700defa860e70008008cc13e5e3ae520bec305b923ec50ab4dbc4d57b4e14a63bc01a526e8d8be257266ea3962adddb
SSDEEP 384:844n5UYq5EL1hwABz36emeC/JLuCRnBrH5B2Md5z5oraxJE+W2nW9/uPHRN7dhlt:844bN5hwABzKGUn11fF+1WyM1fl
TLSH
T14BE22A02B3F8016FFFFF1B3059B9D15A5E35BAEA3A13D55D0455900E19B2B8086A2B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a3:56:d5:97:f6:05:1b:86:26:ea:9b:47:b5:73:24:28:bd:93:c0:0f:e5:a2:a8:be:c9:7d:6d:d0:6f:fb:2d:7e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

29458

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.IO.Ports/net461-windows-Release/System.IO.Ports.pdb

system.memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
MD5 6fb95a357a3f7e88ade5c1629e2801f8
SHA1 19bf79600b716523b5317b9a7b68760ae5d55741
SHA512 293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
SSDEEP 3072:IUGrszKKLBFa9DvrJGeesIf3afNs2AldfI:jBFd3/aFs2
TLSH
T136D37D6857C6DE56DB5FEC70E02062056631C52F5742BBEE1DC8B8F036923DA29093FA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

db:b0:3b:7a:83:84:ef:83:06:3f:da:91:51:13:f8:7d:32:fc:46:43:1c:0f:b6:cd:f7:db:87:4b:17:93:f7:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

136106

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netfx\System.Memory.pdb

system.numerics.vectors.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
MD5 aaa2cbf14e06e9d3586d8a4ed455db33
SHA1 3d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA512 0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
SSDEEP 1536:nPOw0SUUKw+GbgjMV+fCY1UiiGZ6qetMXIAMZ2zstK/hV+sUwS:nWw0SUUKBM8aOUiiGw7qa9tK/bJS
TLSH
T174B387E37F1EA476C7CE857F24F74E1D62B52A57C523D6B640CA5AA2016339B28040FB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

99:0e:22:c8:fb:bc:e4:62:63:f1:99:41:db:03:50:70:a9:f7:d6:99:5f:43:9a:3b:2d:d5:4b:9c:fc:3d:7c:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

12:57:a0:40:75:36:a1:51:f8:dd:f2:97:bc:f9:16:a8:2c:bd:f3:8d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2018

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 11, 2017 - Aug 11, 2018

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:D236-37DA-9761,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:0e:d6:4e:96:89:db:00:f5:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Minor OS version

0

Major OS version

4

Entry point

103866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.Numerics.Vectors/net46\System.Numerics.Vectors.pdb

system.runtime.compilerservices.unsafe.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf
MD5 c610e828b54001574d86dd2ed730e392
SHA1 180a7baafbc820a838bbaca434032d9d33cceebe
SHA512 441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396
SSDEEP 384:EybU8ndrbbT9NWB2WL/uPHRN7bhlsQVryo:Ey5ndvWbMPVryo
TLSH
T1A8824A21CFD84503FE627B344568D183FE38E38A6806A36A2586F57A1CD63C57B31E38
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a0:70:99:f3:f5:b7:ef:fb:27:e6:01:6f:08:b5:3a:37:53:0b:75:67:14:d0:60:c5:7a:94:ea:2c:97:22:88:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\artifacts\obj\System.Runtime.CompilerServices.Unsafe\net461-Release\System.Runtime.CompilerServices.Unsafe.pdb

system.security.accesscontrol.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ff14c5f628b9a6798d173aefbba0a43d61e66f715108e2576ac0d3dfab9071d0
MD5 527595c86ad17045a101d567d7d3279f
SHA1 83014e2a98f7597b9a26e424a0759e5a3d2ecff1
SHA512 9ebaaca1623bc8e2fc8df158f338b5e415670fa53e212bb38771e7e25af9688301cc4aee055c5b64e33f8aa24729ed896e0be8e2dbce54386583c660476c5dda
SSDEEP 384:zdlIF91FhktexyvaMAdB+w3G5h9MF4YfzMfpcrqmf9wEJqIxVRvFNgfBkyN17xWI:ZlM7Ke5/WBkyN1hhMPS
TLSH
T157F2E602A7FC1229FFBB0BB07E7999151D7BBAD63D12C50D1155910E19A2FC0DAB1B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

fb:70:50:61:2f:15:d2:20:b8:f5:2a:2c:ba:9b:30:a7:69:ed:d6:82:f9:44:fb:90:72:17:d7:d0:0a:fe:92:5a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

30950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.AccessControl/net461-windows-Release/System.Security.AccessControl.pdb

system.security.cryptography.cng.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5beb0246fc8cbc617fd7d18dd1f520da8dbbb7ec820e5834d53352836a99bda1
MD5 53ea1ad3dd72ab9e6d36678aa79e45c2
SHA1 e47e323d44743a5104620a9e0b0264693a64ed92
SHA512 5b912dc2c9027ab2aaaa72c03ebf9ad40a9922e70ee09d135a10a8452266f6b8ef39485c4653520bc5738270782bdf6add70cff99c8b5e4ec4c0bf2191c20780
SSDEEP 384:KvFruO/q3r4YV5tEWCfWOdHRN7UlpJAlGsp:KtZS7pqdw3
TLSH
T17A825B71A76C4723CEB72A719A76D4422F3CD3C674228B3E6686E2461CD37C5A321338
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

66:aa:7c:1e:0d:37:4f:d1:b2:8a:26:a0:1b:7a:8a:93:b9:4f:a1:54:58:80:90:bf:3d:38:40:02:cb:08:d1:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 20, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Cryptography.Cng/net47-Windows_NT-Release/System.Security.Cryptography.Cng.pdb

system.security.cryptography.pkcs.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fbfe6a6a9794db868b82d77f9a378226f68f8b99b660c943a406694ce9f9927b
MD5 5ebf8f0dfd2a708b70b4eb0d79a84a94
SHA1 68ae50ec9e5e6d50ef06593e2b70cccfcafb2017
SHA512 9ec6edb90e2dbdccf94f731d03cef1ba91b445e4f4250ef42ac10794e5d9d1d8bd63405113f17ecc00827625475ae867e625751c15c2ba42e7921782bdde94ec
SSDEEP 384:vyBGXZp94Yi06W82WZ/uPHRN7rOslut7wX:mmZp9ZwhMKjwX
TLSH
T1D2924B78975C8772CDA72B71A576D0912E3DD382B823AF2D26C6D2061C93BC88731339
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

9a:fb:c3:17:94:16:44:b3:1a:a9:82:aa:76:f9:a9:59:94:94:c6:8b:fa:38:b1:e5:8c:2f:0d:d4:7f:69:c0:33

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

15706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Cryptography.Pkcs/net461-windows-Release/System.Security.Cryptography.Pkcs.pdb

system.security.cryptography.protecteddata.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4360154b86d0e3a6b3c82bba3684a2a01f1b5d7864a97f7ac1a9ffcd63408c65
MD5 503a90bdeda2e75f57a424a712669ba6
SHA1 ff6f8c28a314b0e878dc3ea10a605a1b06562fc7
SHA512 baba2417bfade7550e2c7698d886b0f69f881804f9a8d0a96ebbfc211a96829e9a8c1da2d5a34d685a83a49df523e2ff58d82308da4a93e02ec91ea859e490e6
SSDEEP 192:ctcukgQDqx4Y4oFP4drFJSR2YChbPWAb6jDWeWOL8/pCuPHnhWgN7acWJGPjG2vz:q4YlS5PWAb6jDWS/uPHRN7ljG24rlrD2
TLSH
T1E1824C625B6C8373EDA32A705676D4973E3CE295A823D62E36CDD2060DA3BC49730735
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

33:1d:59:3a:ad:d2:81:a9:f7:99:64:c0:b3:7e:b8:df:d0:4b:e0:0b:63:6c:56:eb:fc:4b:a5:51:81:d8:81:c6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14754

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Cryptography.ProtectedData/net461-windows-Release/System.Security.Cryptography.ProtectedData.pdb

system.security.cryptography.xml.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cb489e8172c8ed499bb67080a37016241cd4484117f5d34bcf4042f9c8116787
MD5 4e7a3a388e21fd4ec9bc848cc60378f1
SHA1 c96d0313c788bd447c3ec1145a49e5beae200e33
SHA512 393be0495839f864ff6b94424be227299777ed46b0cccddbfbc78342065c2baca6b0b89ab36cea7e9bee954ea4a7311c6769770f2deb2de3bfe5126c7c24dc88
SSDEEP 768:QszrvuWznnuJlMeEM8Hy8d4Vx50lAhDVC+aMsJk:QgrvuqcP8RE5tQ+aM+k
TLSH
T19E238326BBF8555CFBFB4B34A6B1E22A1D3FFADA5403CA0D1555124E08B1B848670B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

a9:2e:b5:96:e8:a1:1b:78:66:dd:14:3d:cb:b7:df:69:c0:d5:e0:98:94:a6:dd:52:11:2e:67:71:4f:f6:e8:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

41454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Cryptography.Xml/net461-windows-Release/System.Security.Cryptography.Xml.pdb

system.security.permissions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 23b91c7e6e84ab983cc6e18de4d60a06169a26eda82fc01ae297dd014214a023
MD5 066b5e9a1ff681cea20d3dee597907e4
SHA1 b382b80ca629393da72379c2ec0149e7639d498d
SHA512 f755b25564017e7a7828253a1f9970972201c38082c2b1794465f45136f65d12288c5b88d69cf83b1fa631d202d2a1faa807d21ae147172d150616b53422af0c
SSDEEP 384:R8V7FxzsCggZ6L7snLa7SlfpmxjP/aFTWilWSZ/uPHRN7lImlOC:R47XzsCggQsW7Sl8xjP/QZpM
TLSH
T1BEC20923EEAC6233DC6B8771B8B7E24568BD73C338B2553D95A5D0064DD27C4A631722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

b4:d4:53:36:4d:63:91:be:3e:16:fd:30:5c:25:d0:24:78:cd:0b:08:16:37:49:3f:03:69:b3:89:fb:4d:67:c9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

23922

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Permissions/net461-windows-Release/System.Security.Permissions.pdb

system.security.principal.windows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
MD5 be2962225b441cc23575456f32a9cf6a
SHA1 9a5be1fcf410fe5934d720329d36a2377e83747e
SHA512 3f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
SSDEEP 384:cEwo6eTs14YY4cWpOW6dHRN7FYpJAlGspU:VwDdT463
TLSH
T153824A61D7AC8323CDB71A31997AE0533E3DD3C66822862A5689E1061D677C6D731738
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

15:1f:de:b6:f3:56:f1:80:ad:c0:ff:4f:a8:55:41:ad:fa:07:51:b3:2c:1f:9e:57:30:1f:5d:fa:af:6c:1b:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 20, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

14422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Security.Principal.Windows/net461-Windows_NT-Release/System.Security.Principal.Windows.pdb

system.servicemodel.duplex.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 22baf9931392560138103f9a364f86c1d3b54499efc77fa47ce0cd5ccf43eeec
MD5 a7241a1130f74c2d98197db5dcb44fd0
SHA1 038539203a1eab74e1afc9097a6f49d74deaaecd
SHA512 e928280fac092b8dd13bec201107c42825b46837e871cfb83530154b09b50c20cf419a367e6e04f6958d9a674ed12d8fa578703cc7bfc8e202490a63ad69f8ee
SSDEEP 192:bFpNFjxH9W5nOWg1WULwu0Sc2HnhWgN7aQWlBtSLrMhEqnajKslMYm0R5:RLH9W5nOWkD/HRN7ISjlGsl08
TLSH
T146524B91CBB88243ED676EB057B8D9437D3CB7C26D11812A159AF6492C93BC4DB20B3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

f0:72:2b:07:ba:20:99:16:9d:76:24:2c:cd:76:59:77:d6:0e:82:d3:a9:6a:c3:8a:51:d6:b0:6a:f0:ea:83:c7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 21, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

10526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.Duplex.Facade/Release/net461/System.ServiceModel.Duplex.pdb

system.servicemodel.duplex.pdb

SHA256 4547055ff85af7e8e8a31ce72f5dc02252b267ddc0fb5505bec37ef3f20759d2
MD5 2356f0bba259c65452f57a8130f0956a
SHA1 ef795925b5ff7a408fda1913f9b4d0b065da9291
SHA512 216868e276d9dde9e9afe88be2d5980c53cfb75e4b78c464eae857d9254e39ac5b5f8e701098ee865a2afcf806dd1b9a9895ca17ab79b60854236b5a9d0eba14
TLSH
T17C410BAA3300E659E70207703D6A64491574C431D654BD3477E209BCF4DEB9F0AF12F5
MD5 SHA1 SHA512 TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.servicemodel.http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cfaa2b4b7b030d85e51a0018932dc7948e38df24acf345a45a1617fcab9cd989
MD5 37d715797db12b623129735229dde63b
SHA1 4d131d1af5de8a09fc857772d5791e18939e7cad
SHA512 a6c8b0f363446632a3a152980d63f33582d446ef6f92f252ee1ed7e4e64723c36f0418e35f466a7516422d10f9df2a6bfa326654defb89415070a4028ac23a13
SSDEEP 192:gniZ3xlbWvX+WCWULwu0Sc2HnhWgN7aQWWWSpIzLMmDWqnajKslQUIz:ZlbWvX+W0D/HRN7sSpEQmDWlGsl
TLSH
T187624B92D7B84A03EDA76BB0A6B6D547BD3DE7C21C11C61A0546F24A2C937C4DB20B29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

ae:d5:8b:0b:68:7f:1d:70:a4:3b:39:f4:fd:ac:cc:68:b5:65:71:76:37:76:d7:e0:25:61:46:3f:bd:6a:8d:2e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 21, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

11422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.Http.Facade/Release/net461/System.ServiceModel.Http.pdb

system.servicemodel.http.pdb

SHA256 bb7c16bfa1e0d0c097796ceb70479691aa29d079aff35cbe64ef91be341a3d53
MD5 61fdbbb0ff6ed369a09c570132335b63
SHA1 3cd7ced8805ed67536e6b7db5144db20b822cc38
SHA512 b77222b034cbd6eb03a33ca6718c6af342849999d957beb39153cea566b9bad24deb6075bda7724bd3db1a591231183a732322026c439dc44fc05880dcb9e458
TLSH
T1DE41D5A83305C125EA5652B03E678489A631C03098D4FEA8B3F20EE4E0CB5AF01B52E4
MD5 SHA1 SHA512 TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.servicemodel.nettcp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6560e672d23411e58cb5aeec7b800dc64ec2a19a4961b4c0c4c06c1d1eade9cd
MD5 25df638696a44fb2ab4bde7006edfe22
SHA1 3aac13f00f8a7f55cc06c1f0fb7691b03537b55b
SHA512 7c0345659cda2d4fe1b1882687e13bbe908dcdc5ab890ac84556e2dc0925d1dc5b0d836be3b5af8d42dd9957fb7bee38fdbe4ddc9098472daa4aebed94d13d21
SSDEEP 192:i9DN2Yzttx7U+GWRvWWfWULwu0Sc2HnhWgN7ayvWfsPzNQsxZAqnajTjL4f:g2mtX7WWRvWWND/HRN7isGs/Al3jL4f
TLSH
T130625C918BA84607DDA76AB067B9C5873D3CB7D65C21822F11ADF5492C83BC1DB20B2D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

26:bc:42:ce:f7:19:db:40:7d:c0:a0:94:47:6c:0c:0f:46:48:b7:fd:08:e3:19:60:f0:68:48:11:e9:90:31:b1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 21, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

10786

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.NetTcp.Facade/Release/net461/System.ServiceModel.NetTcp.pdb

system.servicemodel.nettcp.pdb

SHA256 b262a27958d821779f0fb0d7b37f942c9abb609823a6da7bc5a4fb6c0cd43324
MD5 2f78cd92244b63ef299994b643a42c17
SHA1 7adb84b667bbc630cd077280bd9d5c03e04c856c
SHA512 2061dad03a6f51445481d64a4a94c6d624255b670bfb5df7758c0085cc931a2f8e8c2d69a19edd1cd688b3ffbb167fc9c362fee18684aec293832f0b036fa87b
TLSH
T1B741C6AA2704D796D61816707C43999E4332E5202494FE60B7E20AE8F0CEADF05F01A0
MD5 SHA1 SHA512 TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.servicemodel.primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5caa6ad174f10764946ae1bfa94108e1966e78c53b88933b7a4ca59499530de2
MD5 4b911105cd697e808230ea469b415f7b
SHA1 ef600ac2bc485766d0577feef1a3ab281a0e5e74
SHA512 cb05f4851a90c2cd44ce0df2fe7882f550aefe3d81cfb71e4da327d2174ae270e66be1f4dc0998760095b6614046fff816540988365659477ee529eaacbd6dc0
SSDEEP 384:d8h2IgODoeNlPSCqWvVEWdbD/HRN7Vp5UImlgz6:+z1zNlFB/bDvVc
TLSH
T14BA23AD1DB88DF23D88F1770B6BBE4422BF563C2183197265DA894866ED2BC4E732705
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

4d:fe:2f:3f:16:54:58:96:38:b9:af:6b:52:a8:98:92:50:1d:b1:b2:e6:a8:86:65:a6:27:45:66:bb:f9:a3:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 21, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

17610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.Primitives.Facade/Release/net461/System.ServiceModel.Primitives.pdb

system.servicemodel.primitives.pdb

SHA256 c49ce39ab9fbc823e8de9172ce06b843cbb3c7af33e853f837edbe0e97e9c094
MD5 e002514b65aca603c2e24e16d8c37495
SHA1 8e83c5a162eec525281c870b3d7fc2f197a70faf
SHA512 5f211758fff793c146675fc2531b51deb07e09b2a16b8a8fdc0fb04fc4778ca620fd261ccc2eecc24c0fdae0166c1edc75bcc0e1ce9adab9c6144e9adaf495a1
TLSH
T11A712B4B3394F5A1EF0A1374380E41C943A2D7315475AEE5C7D14AF8F0EAE5F01312A2
MD5 SHA1 SHA512 TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.servicemodel.security.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ca8e8ed4c8aec2788c120ad27e9c754d1ceb6365806f15b59f3671364aaef06a
MD5 4cc0861d1cf61cf55978c6c8acfb8fd5
SHA1 9bddaab55a1ff8564dd64fc32a746ca6ad234450
SHA512 55d47e163b6dce2ad0eef561f51aa3436a6283fb26830df1e3c0c9517dc97e3462e3761736cf5fc6d9388ecf899bfb244fc5c8285d79a641785939b2852b3701
SSDEEP 192:4LQfnRbxpxmM8RW1JgWdWULwu0Sc2HnhWgN7aQWhmgoqnajKsWphtvJ:3LkW1JgWnD/HRN7HnlGsW
TLSH
T1F9624B91CBEC8653ED6B6BB056B9C5077D7CA3C62C21825A12CAF1492C83BC9D73072D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

f1:21:0a:c8:6b:ce:6a:a1:3e:de:3f:0d:ab:74:ac:c5:d3:1b:f1:7c:79:99:26:0a:6b:06:66:61:97:78:e9:0f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 21, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

11606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.Security.Facade/Release/net461/System.ServiceModel.Security.pdb

system.servicemodel.security.pdb

SHA256 37c3193db4acf749ee02a09c9d68442c19737cf05e3c30c2b02e0d5688600c60
MD5 39285fdf2f8b2d703fb0de0e3bb4f2be
SHA1 fe75c14f17c7b308d6ae149ca2aa602204aa1726
SHA512 b8adb1ae41ac1ee9eacd1f26aaf534f66494cc58bd91e26d03505be26a688904d900d6eebae4d3507ae2e6c916c824b2fee90045148784bbdc8325fa423cc027
TLSH
T11C51C75977488665DE6603383D1692898571C530AC50EE72F3E21AE4F9CB59F07B11E4
MD5 SHA1 SHA512 TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

system.servicemodel.syndication.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a5229c00dcc51e0ffbf5cc7d0300f3a482db13a4022171b154fe3d6bf9bb9b8d
MD5 6a9cb06b60451b268a971b60598d80ad
SHA1 7490c66757ace1971272087dd6737a7d272a06ba
SHA512 5d87728c33fb017b42f794e63f221a998a41eed9e581838b89684d4ed60dc2c03c43d650d072282674bf3d59b6bd77ac0ca19ab9a772ba30f04ce9e8645e791e
SSDEEP 192:1Fq15e62gYrFSdqw5NW2eWrNWOL8/pCuPHnhWgN7aYWBWypnOCqqnajqj:1ISW5NW2eW1/uPHRN72pn+luj
TLSH
T170724BB2C7684B93EDF75B3096E6E4436E3EA2959C21A73A06C9F1142C93BC05731739
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

bc:a1:e3:55:38:de:2e:b5:2e:e1:8b:ad:d1:ce:9d:c1:78:25:2a:ac:d3:af:fd:51:f9:95:ad:4c:ea:9a:d9:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

13442

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceModel.Syndication/net461-Release/System.ServiceModel.Syndication.pdb

system.serviceprocess.servicecontroller.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8019efe9c63170a85ad8b5cddf1b1d29e2d12a4148af1e98b46a2d201d9caf64
MD5 195be5e140532aecd87e4ca2167ae498
SHA1 a027be116049b789bf6451c03fa6a53b7c8c3bad
SHA512 2882c4bba8c65a4b86f33dffc90b58f169d73e60f0d00fedd0713fcac3e8f2315ef3efaac14317546bfb8601f4c8b29ac6b3dba730ec858798dcb68ed8aa0083
SSDEEP 384:p7O4YkTdk8VKWCWV1upaW6/uPHRN7Ess9l8Q1N:p7OSQYMFmn
TLSH
T197922B2187BC8772DDB71BB0A876D4531E3DB386A822D62D16C5E0061DF7BC89A71339
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

e7:c3:d1:9f:12:23:32:a2:e2:9b:bf:dd:9c:c8:1d:1b:05:5c:88:e3:ee:0d:f3:99:e6:1a:34:d1:29:06:c9:2a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

15146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.ServiceProcess.ServiceController/net461-windows-Release/System.ServiceProcess.ServiceController.pdb

system.text.encoding.codepages.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 87f7f43626cac445a9cbacda4068c51c0b17b6af6e6b752ff613668c21e49412
MD5 4c12c76415a3d8af9c3cbcf0a3cb52dd
SHA1 b6a5ebf42211fdabcf377ec2018b6b9a14a99761
SHA512 e01ea56118437f54068375b3472ea611e865888f932ec5a21d2c8049d7e398713152fd69b674723fed87ee23ba7939895b3d5b5bee690b13c00428f884b9f116
SSDEEP 12288:ZILs7xn7kZQ6kliVreJIHHr0tRYbKr2KtG9VKABC6rPqm:OG9km6k/IwRYbiBeKGCzm
TLSH
T134F49DA066B55B17F9F7CE3197F13012CAF6BC567E02482B7962530A84D3BF019D4A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

fb:3b:ec:58:b1:fb:ba:ea:58:60:d8:7b:6c:23:6e:9b:e0:ff:c7:ba:54:7e:c7:e5:d0:50:c8:53:99:ad:20:df

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

745070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Text.Encoding.CodePages/net461-windows-Release/System.Text.Encoding.CodePages.pdb

system.threading.accesscontrol.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 de92b6292da9300744bc3bf5495fcced945b8df0cc24b788337a1a6a014e22ed
MD5 2bfa1a0e019cfabc1357723659a55534
SHA1 5b721c140591e0adc68963c49a0ee72b0c27efef
SHA512 b6e1f6aa86f61716e2981d69997bacdbe36565a85f39f4becbf819f99e826cf15266aa72c4f4b21004034cae85c003364ee8d9792de43a8116bfc787dd625478
SSDEEP 384:ZMTiavAbgFWyO5XIu+TJSl2Yd5zcNEkUr6ODA7WpOW9/uPHRN7nG24rlrD2N:ZMWavA+YHfsZtaNMGW
TLSH
T18ED22C15A3FC023BEEBB0B706975D14A2E35FAD62912D26F5095E00F1A97FC48761B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

c7:87:30:ef:db:21:2a:e9:73:ba:ac:3a:af:f4:f2:b4:29:da:da:dc:40:89:5c:c3:68:74:6f:93:f0:93:1f:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2021

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

25210

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Threading.AccessControl/net461-windows-Release/System.Threading.AccessControl.pdb

system.web.services.description.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 77178b012a5f2fbb731f8eef86c824cc938775dac221b97424c1bdac5b908dd8
MD5 37d66c41909985e70c884b7b7512dc9d
SHA1 7889b3830e815c1ec2ca9b3bc40fbe115b6b9cfe
SHA512 9250425d63f847ad264388bc71f3d9703406f6e43446b279e06d87fdee886595100122757b9825d2ff1728273068567a9236f3e4ddef110c46e9edcd176898cf
SSDEEP 192:D2iXzgaYx1MWeLqWlWULwu0Sc2HnhWgN7aQWhJQRs4ptDqnajKs21ZG:Dvx21MWeLqWPD/HRN7VRs4lGs2X
TLSH
T1677229919BA8DE03E8EB0BB056B7D5423F7957E55832D31E049EE1452C83BC0A73272E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

f0:9d:59:83:eb:79:e8:08:03:19:d2:41:5a:10:67:33:d2:b9:d3:44:d2:85:81:19:d9:a6:37:72:a9:d0:82:cc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 21, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

4

Entry point

12602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/artifacts/obj/System.Web.Services.Description/Release/net461/System.Web.Services.Description.pdb

system.web.services.description.pdb

SHA256 b087efcb385e5f9bbda32cae3c814394f34195c7cffca0bf3d1d75802ca14dad
MD5 1a5f39b426f186619c212f0da04e1ebb
SHA1 db3618ed05b40478e26949650e4439616a8c5161
SHA512 859d955b0d76108e632e443fec796dca1184211343426f22e8a1eabeb75151c0217fb9bc1618485766fa8986dcd296f2d352d2e54760049dc83b5a159a622da6
TLSH
T1F15128B93710E482E24A32713E6705C46334C3214570FFA9A6D119F0F8CA54F5AB83F1
MD5 SHA1 SHA512 TLSH

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Sharing

General

Malware Config

Signatures

File Explorer

CadenceLicensePatcherWin.exe

mscoree

dotnet

bass.net.dll

mscoree

dotnet

bunifu.licensing.dll

mscoree

dotnet

bunifu.licensing.pdb

bunifu.ui.winforms.1.5.3.dll

mscoree

dotnet

bunifu.ui.winforms.dll

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

microsoft.win32.registry.accesscontrol.dll

mscoree

dotnet

microsoft.win32.registry.dll

mscoree

dotnet

microsoft.win32.systemevents.dll

mscoree

dotnet

newtonsoft.json.dll

mscoree

dotnet

restsharp.dll

mscoree

dotnet

system.buffers.dll

mscoree

dotnet

system.codedom.dll

mscoree

dotnet

system.configuration.configurationmanager.dll

mscoree

dotnet

system.data.odbc.dll

mscoree

dotnet

system.data.oledb.dll

mscoree

dotnet

system.data.sqlclient.dll

mscoree

dotnet

system.diagnostics.diagnosticsource.dll

PE Signature issue

mscoree

dotnet

system.diagnostics.eventlog.dll

mscoree

dotnet

system.diagnostics.performancecounter.dll

mscoree

dotnet

system.drawing.common.dll

mscoree

dotnet

system.io.filesystem.accesscontrol.dll

mscoree

dotnet

system.io.packaging.dll

mscoree

dotnet

system.io.pipes.accesscontrol.dll

PE Signature issue

mscoree