Exodus-Larp-Tool-main.zip
- SHA256 5cacbae4473ff0d0ee772ca315841105ad5b0b67b8bb32afc47e3d4219a2ef6d
Overview
overview
8Static
static
3Exodus-Lar...us.exe
windows10-2004-x64
8Exodus-Lar...us.exe
windows11-ltsc_2024-x64
8Exodus-Lar...rp.dll
windows10-2004-x64
1Exodus-Lar...rp.dll
windows11-ltsc_2024-x64
1Exodus-Lar...me.dll
windows10-2004-x64
1Exodus-Lar...me.dll
windows11-ltsc_2024-x64
1Exodus-Lar...ng.dll
windows10-2004-x64
1Exodus-Lar...ng.dll
windows11-ltsc_2024-x64
1Exodus-Lar...ng.dll
windows10-2004-x64
1Exodus-Lar...ng.dll
windows11-ltsc_2024-x64
1Exodus-Lar...on.dll
windows10-2004-x64
1Exodus-Lar...on.dll
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Exodus-Larp-Tool-main/Exodus.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Exodus-Larp-Tool-main/Exodus.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
Behavioral task
behavioral3
Sample
Exodus-Larp-Tool-main/HarfBuzzSharp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Exodus-Larp-Tool-main/HarfBuzzSharp.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Exodus-Larp-Tool-main/MicroCom.Runtime.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Exodus-Larp-Tool-main/MicroCom.Runtime.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.CSharp.Scripting.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.CSharp.Scripting.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.Scripting.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.Scripting.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Exodus-Larp-Tool-main/Newtonsoft.Json.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Exodus-Larp-Tool-main/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Exodus-Larp-Tool-main.zip
- Size 523KB
- Sample261102-esae8aea73
- SHA256 5cacbae4473ff0d0ee772ca315841105ad5b0b67b8bb32afc47e3d4219a2ef6d
- MD5 b5ab41fb5272aa4a7af4050df5aad73d
- SHA1 f4015e8cf77d6830fd9e1e11cb05e5a72cedcb61
- SHA512 72d2e56408b2cffd168f7db12c6596a725f743382362c0934d6d2daf88e202eed16b06cabc7568fa80a1119163376d76c1c0a8884bd8a31bcf3846a0096d0382
- SSDEEP 12288:OXBXWsi9J1PJ8mX8zk0yPuUvEOLsdZp3rD4IT4YjyQ:OXBXWJD8wz8mM3PvTEQ
- TLSH T109B423EBC155D582E30ED7BF9569394CC2C1CFF29B172EB90787A91A152C342186A3EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Exodus-Larp-Tool-main/Exodus.exe unpack001/Exodus-Larp-Tool-main/MicroCom.Runtime.dll
File Explorer
-
Exodus-Larp-Tool-main.zip.zip 523KB
-
Exodus-Larp-Tool-main/Exodus.deps.json55KB
-
Exodus-Larp-Tool-main/Exodus.exe.exe 399KB
-
Exodus-Larp-Tool-main/Exodus.pdb61KB
-
Exodus-Larp-Tool-main/Exodus.runtimeconfig.json445B
-
Exodus-Larp-Tool-main/HarfBuzzSharp.dll.dll 114KB
-
Exodus-Larp-Tool-main/LICENSE1KB
-
Exodus-Larp-Tool-main/MicroCom.Runtime.dll.dll 14KB
-
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.CSharp.Scripting.dll.dll 30KB
-
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.Scripting.dll.dll 133KB
-
Exodus-Larp-Tool-main/Newtonsoft.Json.dll.dll 695KB
-
Exodus-Larp-Tool-main/README.md1KB
Exodus-Larp-Tool-main/Exodus.deps.json
- SHA256 785aff6c0e1ab913b6366a36fdf79072af9b644ec9f80dc3db93ee29de7ae94f
- MD5 10b2de3c74dc46f6531fa9acacca0c8f
- SHA1 a2939c3991531c918a713f52c21cfb0000c2a311
- SHA512 9c615079d5edc1aa44e632a948f1213f15db3762ddd3dc762af2d3186d28cd0cdb1e2aaa0e5447242c2763d1f9ef5aac23dbcafea245eacb4f45c00a017d6644
- SSDEEP 384:VGFfzWpe/wjHCozePJt1R9nhfbOYqAWxY9SiUWYxE33MQ8ZfvpWAWCjGggmWqloN:VUfzWp7jHGlR9wVAUWYx73pWaq6WCA
- TLSH T135430054C9744DF3498A7A92147E44C2A335439B1818BD9C3ACC608ECF5FFAE21B9B79
- MD5 SHA1 SHA512 SSDEEP TLSH
Exodus-Larp-Tool-main/Exodus.exe
- SHA256 6c977cac10245be0d1222fa444aafeed327e840a8864c7a37feb401ed51e7257
- MD5 ba5da443c5e881df3147e9c110240df3
- SHA1 4841a82719a2ef2092752ccf107dcc021a59134c
- SHA512 86d167aaa77b2ecf0b624e8c37b48073b98126aa05e9af949e362b5025f8a81210082810c169ea9a9a2987c3e8052e1110dd2a5f6b7c54e67161338e013e9c94
- SSDEEP 3072:VBRO3hCKpIdtHO1qeGAhY5dqkBfyboS0lYi5iNMfYT:nReIdtuE5dqkBfyboo
- TLSH T14A9495273FB9DE48C21CBD7A69F18737B7318A250D4A05117E122E73D672DA8FB81684
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8396
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
512B
Virtual Size
124B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
770B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
456B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
390KB
Virtual Size
390KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Exodus-Larp-Tool-main/Exodus.pdb
- SHA256 213f5cadb525b745bfbaadf72913fe8327e64272df7e76474bf33b7fcca3e6eb
- MD5 25921d040f99d642f27b838f70f8828d
- SHA1 d9fd2b58e35cb32cbc56c026c20b5d26f07d99b4
- SHA512 1b3f2f2289109687f15d5a5d3a931133e21085065e55d0ab1f89323c70243f65b58c5dfce4381399bb8ee17d785f037db55f2afb46b134361d653841022c8b86
- SSDEEP 1536:ExbYQ7Aso86OGSl7B6KRGcqThhEGCPoB34kGi/61N:S8Q7ARQnucUhCQBFGi/61N
- TLSH T1AC53D6AEF7148762C29966FD50F7C389B330C2658746AF3671C8F825EC9AA209F37115
- MD5 SHA1 SHA512 SSDEEP TLSH
Exodus-Larp-Tool-main/Exodus.runtimeconfig.json
- SHA256 23792ec2c35a93090ce9e96c924197219d92311c3ba95491c1dcc74e40fb2ef2
- MD5 71713ecfa3455316121e5a439a72c4d9
- SHA1 7ae31fbfadc80d2ad6e19f28790ceed7cf74ed50
- SHA512 af9578404c2e1d5b31b249253dddb0413e94de9e0ddc11a3fef54a880b0ff6347aeaa2ae0c463b0b25fb9d6f8d6e8ad7d01a039d2a091d140524f4d4f9623efe
- TLSH T136F02B28CDB65CB3149E75B6892AC1C1AF34C60744183D24B2CD401CAF9FA6D1231798
- MD5 SHA1 SHA512 TLSH
Exodus-Larp-Tool-main/HarfBuzzSharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 43865d1aafa39c8b8fba7d95a09f9c3ec07b87d8cd86b1b1eabe331649d271af
- MD5 eab587a98ba6bc681ec0a26f4bd7387f
- SHA1 4b8483a20337049ce731d188702651d6a064d06e
- SHA512 33f352b7558c2d36d7a322dfc88d5039ae953a796fcf6905a7cb02e18e806b9ef6bdafd13487f4ca4d423e92379ef636238c102833595016039b15d21cf4b47f
- SSDEEP 1536:C7apjMbuurV6308Q9JKWxxwgjZhRkVXyqSB/FTVsHzDzhEphgRmD+jKeMC3+am81:CwWJX7MsowVsHzDB8C3+o588
- TLSH T187B34B54CB984613EBEF5B3DF0365A420270E284B823FB9B27D6D1BCA893750D6D6253
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
29:de:d3:39:e0:3f:8c:35:08:8a:2c:1c:4a:ec:07:08:b0:3a:1e:47:7d:f7:e2:df:b2:2c:0c:11:9d:c2:3b:f7
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Sep 20, 2023
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 16, 2023 - Mar 14, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:b7:21:27:1a:07:a2:2a:86:46:00:01:00:00:01:b7
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 20, 2022 - Dec 14, 2023
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
112134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\1\s\binding\HarfBuzzSharp\obj\Release\net6.0\HarfBuzzSharp.pdb
mscoree
_CorDllMain
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Exodus-Larp-Tool-main/LICENSE
- SHA256 144cde79fad8b96b97f3d5b9271406d6127a29d40683d7374b7e195f7d99e63c
- MD5 8c776d1a8f1bc9ce5b87b493d686f007
- SHA1 a8d3a8cd4605bfb12706e2223099533b90c07b53
- SHA512 28dd8f65ed742ea0cbee0f66e2ed8f6ef51c1bd11b8034bfd21011f322711f73690c172bd00e9c7946af573327adf521ec767820a52b9b178ef927ce2c19419d
- TLSH T11E21931E32100B66299713A059A6A8C4B22AB15F7E5B2A84346DF3451F3A03CC2FF840
- MD5 SHA1 SHA512 TLSH
Exodus-Larp-Tool-main/MicroCom.Runtime.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 59839e18e46b06ab23b633944ae3c3b552a300c5da389da870dfa980bcef93c1
- MD5 c27b01d179ab856b42e910496fe749f9
- SHA1 448412817480d6e20ae7eb2ff9250c69ed4ebece
- SHA512 30416fd4bf5554e6b575aff59787ae1078bafa529c36cbe51b05026691851a0824ab648d4d4d2ca4bd26ddab680eba95595e9cd80ee63230abffce799b36dabe
- SSDEEP 384:q5NX9uRskVFcxaQakfIut5vspHczY4DtcW8GsW:SX9uOIFAxtiHOh
- TLSH T1D7523B076B8CC237CBEF077E58F202864776E6047812EF0B34C8715A9D57F8956627A2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
20378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/home/kekekeks/Projects/MicroCom/src/MicroCom.Runtime/obj/Release/net5.0/MicroCom.Runtime.pdb
mscoree
_CorDllMain
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.CSharp.Scripting.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 eb5185d1b4424bc2538c8dbb3311b787f8efa153d68885e82ec199aa5a6b90de
- MD5 b134242e74090be398630d825939429f
- SHA1 01fa962abf9e1879f6342c4aca01855b68edcbb3
- SHA512 089cda457451ea5ca68ea3d7a53c8eda44d7be5fcefc4f26b825ce34239a0b5b7a7733140d5c7c01e3346de9bce25308aa2363c0314028cce83e98f85d33aed1
- SSDEEP 384:TLPzuYYMWBAy475WGY0c8oDIXxfYlcibnlIhWkB2fWPudHRN7p/hl30HGF:TLSYYMHtW8oDIBfYjMUxEc
- TLSH T1C6E24C859B58C247EEEB5A32756EF5127F39F3C259C19628391CE98C0B13BD14F01B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
13:e7:31:8a:1a:d9:27:71:0f:ef:56:cf:fd:7c:98:63:f1:80:b7:34:32:62:26:0e:b9:ec:c3:f2:d4:f3:3b:b4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 12, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:F77F-E356-5BAE,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:2a:e8:17:96:f8:86:a7:ef:a3:00:00:00:00:01:2a
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
27710
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.CodeAnalysis.CSharp.Scripting/Release/netcoreapp3.1/Microsoft.CodeAnalysis.CSharp.Scripting.pdb
mscoree
_CorDllMain
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.Scripting.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 14afc4797218a849c71e88760de14d5aa4eb25ea0f8ce0c6cac693bac681b539
- MD5 f8485604c7af6a2fd52a49db2cbd6629
- SHA1 97da81e26b3a452d4adf61ff30f69cea2133789a
- SHA512 a9bbfb2aad60152368a6851479267b2ae90cb9e81f553c93af2346f50e1c48470a7a5e8983dde7ba7806965a69a4586c7288f90fd9b3db104f83a29baab5c435
- SSDEEP 3072:BJ/hR4eioGli3hytmLLU+hW4VrCD1JYXLCUMF9G:DEe5GM3hFsvErCDrKuJF
- TLSH T16FD37C1063A8535BDADF5E76F5B8A0014B7AF303E482E78D9C487DEE18137A05E22677
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
65:61:9c:84:0b:4d:0c:86:0f:25:03:a0:38:f2:f1:f1:0d:26:3d:c6:9e:f8:ed:df:44:24:1b:b2:2a:8c:b1:3a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Nov 12, 2020
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 4, 2020 - Mar 3, 2021
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:60BC-E383-2635,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:26:df:ba:4b:22:b9:82:82:07:00:00:00:00:01:26
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 19, 2019 - Mar 17, 2021
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 1, 2010 - Jul 1, 2025
Minor OS version
0
Major OS version
4
Entry point
132902
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/Microsoft.CodeAnalysis.Scripting/Release/netcoreapp3.1/Microsoft.CodeAnalysis.Scripting.pdb
mscoree
_CorDllMain
Name
.text
Size
122KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Exodus-Larp-Tool-main/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
- MD5 adf3e3eecde20b7c9661e9c47106a14a
- SHA1 f3130f7fd4b414b5aec04eb87ed800eb84dd2154
- SHA512 6a644bfd4544950ed2d39190393b716c8314f551488380ec8bd35b5062aa143342dfd145e92e3b6b81e80285cac108d201b6bbd160cb768dc002c49f4c603c0b
- SSDEEP 12288:mFIM0KteTMN4Or4D3OdmZg5WHEaEDIGBBjgrIQtD+tVqDMW:6zMTMNNd+g5Wk78GBBjgrIQtDF
- TLSH T165E45A2123E99B2BE0AF2775B032491647FAF542F6B7D78F5604D8AA1C43F558D82323
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
12:a2:f8:77:6a:5b:04:46:97:f9:ac:0c:85:0b:b9:3c:9d:a2:ac:a9:a3:72:91:5b:d9:ed:db:47:d0:c2:9e:3d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Mar 8, 2023
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Subject
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Serial Number
06:ce:e1:31:be:6d:55:c8:07:f7:c0:c7:fb:44:e6:20
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 15, 2021 - Jan 14, 2046
Subject
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Serial Number
0a:de:32:e9:50:9b:44:aa:34:b1:da:f1:bc:0e:c8:73
Issuer
CN=DigiCert CS RSA4096 Root G5,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 15, 2021 - Jul 14, 2031
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=Washington,C=US,1.3.6.1.4.1.311.60.2.1.2=#130a57617368696e67746f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
0c:d1:40:7a:5a:bd:ed:43:d5:c1:73:12:1d:38:c5:29
Issuer
CN=.NET Foundation Projects Code Signing CA2,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 13, 2021 - Oct 29, 2024
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
4
Entry point
705086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net6.0/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
681KB
Virtual Size
681KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Exodus-Larp-Tool-main/README.md
- SHA256 28e9f138aba7a43bc1eda34c8cd039d79590407ab02c9ee8ec57dde36b2a7970
- MD5 fbbc6604ad54608f9254f543ea3b1056
- SHA1 342f420310a660972992368d3083caedc1da3eee
- SHA512 64a007b44e51416bc2a914955619c19ace3cc71dcf34945288b9c8813271acc4bba0cd1b53fce08c7087f233800713279d5e875711fa448cac971bd0991d6f3e
- TLSH T1312130A2312032B0810BA19971CB90ED5FB7E110BB636EB4E279D41313645BE413FA72
- MD5 SHA1 SHA512 TLSH