legion | LegionStealerV1 Source Code[.]zip

resource	yara_rule
static1/unpack002/legion.stub	disable_win_def

resource	yara_rule
static1/unpack002/legion.stub	legion_stealer

resource	yara_rule
static1/unpack002/legion.stub	family_umbral

resource	yara_rule
static1/unpack001/LegionStealer V1 SRC/bin/Release/legionstealer_Secure/legionstealer.exe	net_reactor

resource
unpack002/legion.stub
unpack002/legionstealer.exe
unpack001/LegionStealer V1 SRC/bin/Debug/My_Stealer_l3gion/legionstealer.exe
unpack001/LegionStealer V1 SRC/bin/Debug/legionstealer.exe
unpack001/LegionStealer V1 SRC/bin/Debug/setupstub.exe
unpack001/LegionStealer V1 SRC/bin/Interop.IWshRuntimeLibrary.dll
unpack003/Interop.IWshRuntimeLibrary.dll
unpack001/LegionStealer V1 SRC/bin/Release/legionstealer.exe
unpack001/LegionStealer V1 SRC/bin/Release/legionstealer_Secure/legionstealer.exe
unpack001/LegionStealer V1 SRC/bin/Release/legionstealer_Secure/setupstub.exe
unpack001/LegionStealer V1 SRC/bin/Release/setupstub.exe
unpack001/LegionStealer V1 SRC/obj/Debug/legionstealer.exe
unpack001/LegionStealer V1 SRC/obj/Release/legionstealer.exe
unpack001/LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/lib/netstandard1.0/Costura.dll
unpack001/LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/netclassicweaver/Costura.Fody.dll
unpack001/LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/netstandardweaver/Costura.Fody.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/Fody.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/FodyCommon.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/FodyHelpers.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/FodyIsolated.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/Mono.Cecil.Pdb.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/Mono.Cecil.Rocks.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/Mono.Cecil.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/Fody.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/FodyCommon.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/FodyHelpers.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/FodyIsolated.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/Mono.Cecil.Pdb.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/Mono.Cecil.Rocks.dll
unpack001/LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/Mono.Cecil.dll
unpack001/LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.Mdb.dll
unpack001/LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.Pdb.dll
unpack001/LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.Rocks.dll
unpack001/LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.dll
unpack001/LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.Mdb.dll
unpack001/LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.Pdb.dll
unpack001/LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.Rocks.dll
unpack001/LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.dll
unpack001/LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net20/Vestris.ResourceLib.dll
unpack001/LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net35/Vestris.ResourceLib.dll
unpack001/LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net40/Vestris.ResourceLib.dll
unpack001/LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net45/Vestris.ResourceLib.dll
unpack001/LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/netstandard2.0/Vestris.ResourceLib.dll
unpack001/LegionStealer V1 SRC/packages/jose-jwt.4.1.0/lib/net40/jose-jwt.dll
unpack001/LegionStealer V1 SRC/packages/jose-jwt.4.1.0/lib/net461/jose-jwt.dll
unpack001/LegionStealer V1 SRC/packages/jose-jwt.4.1.0/lib/net472/jose-jwt.dll
unpack001/LegionStealer V1 SRC/packages/jose-jwt.4.1.0/lib/netstandard1.4/jose-jwt.dll
unpack001/LegionStealer V1 SRC/packages/jose-jwt.4.1.0/lib/netstandard2.1/jose-jwt.dll

LegionStealerV1 Source Code.zip

SHA256 7d396a2e388177cfde1f8e462ed0bf581c409874e46db0d09cbf083e67df681f
MD5 7f59e5d6dcaa1eaa5a10b86b1ea5c319
SHA1 3a0e4320ff3ae27e4cb5a23c8dff2b717cce4f0b
SHA512 7616091598c69c446a89644b840b11a5ddb6f1ce7586cbbf873e5af6ba132cf3363fadb2d97924bdd85f93aba2362edc59037a6913b0d44715ddb7b767951d49
SSDEEP 1572864:5jtk7HQW/SpYhJs0sXPzdLwrwtskf2WXPzdc3UDoqKJnZne5paKx13XlyxQ5pDM7:5ju7wWapYDfOrBwrwzf2wri3U9aZnU6h
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/App.config

SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
MD5 9dbad5517b46f41dbb0d8780b20ab87e
SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
MD5 SHA1 SHA512

LegionStealer V1 SRC/Builder.cs

SHA256 7705f433f1e77ef2b8a5da38904574cbc3d5f519a9a430916d34135dce735134
MD5 053a5e9af2becc72bd49c5e015d89607
SHA1 5e0fa80185f89fa29ca71491a224ecc7a17f39fd
SHA512 099ea9aafcdf61e708d2005b63900a089114b3a82a7a7987ce92a4126e1a36f0299f137b8882185816968730c7950b1196526925512469d7db8ef294a63f79ec
SSDEEP 192:9bpa2jr+VdDeHWdTd7uPBRqdATqihPyrsta5KfXOro+y7stb8TJ5KuQIO:9Va2WViko+GstATJ9O
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Common.cs

SHA256 5f80951d1f65719689602bf12b953fcc2e0f95bcd7383180096b911bb9d04f15
MD5 3b156d6a613e7e605bbf14f8e597918a
SHA1 89bd7ea76a55eed67436fa9fad56b7628a0b2974
SHA512 f2e3203c1c71e0ad24ace0439e3ba600c9a9231887bd8ae39cde0520b9147ad18228467b54bec75ba49d7ea7a04335b19a09210a5e589127a3856f8748f16931
MD5 SHA1 SHA512

LegionStealer V1 SRC/Exploits.Designer.cs

SHA256 47cf7e6b307379805e30585f5a45fa0982ba8f6cbf76161775cf7052dad48eb9
MD5 4234baac0136ae149f1f9328833ab19c
SHA1 eb1a18f075c8001e6d40d9b84e7e2fbab2cea77d
SHA512 3dd225ff8dde537f89d5c14a0c054878b0757a9027a0d712153957320e8ab6970bc6a503ceb11e695ed3a0de17b6fd9d61978e7eeb1152bc91881e3246ff9f03
SSDEEP 384:bwTJSVj7iIWaW92RcMiwRm3FeJ+Nu5y4Khwe+WLFFLou94DSsFWgaI28WEnupEh8:cTkEYhluZN68CCLfMA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Exploits.cs

SHA256 c596b55ba9f853da40eb3726608f014e15b781d0ea08727fc44ce9dde9af0916
MD5 341cc80d21e1654eda6675f774f61793
SHA1 97586ca1fcbf235b4512194c0d2901bedccaafb1
SHA512 2407e3e5769727c3d912aac226f6c6f6866a6c2b560cdec047dc0c9858b856d6387a9c0b7cc0b3be9b9a9729883af73feb2bc98a95a5154c981a1026ddf53706
SSDEEP 384:KKrqKrQFSaROkQj9OgNrMqG8wx5iiYwkG3t7nm/O:zQFSC0qiOGwJhQO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Exploits.resx

SHA256 2aaa23b5c0bb09701d26b2531c674be05c81184afb08b25bd67e2600d153381c
MD5 0782d11adf8c410154157ca67ac1250a
SHA1 c478dabb54f8d3c71b31b3e8425418cc8794931b
SHA512 2b8cefdcafc7113ff380ab2cbd5428576a20412d8de2c136c9c6fab31aade903836ba379d6c2d0636a9029e496038115f2a644597dc6b2d1f971d8b397628f5f
SSDEEP 1536:Kj2v6KyjISj5Ve5rNY44xi10KaIMtuf7PRxHpW:Kj2vy8SjSVei10PIqub0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/FakeMessageBox.cs

SHA256 d1a78bfbdff715f42b02e2875819d695039d84109db68b5d4684ee44bdfd0f71
MD5 25186752cb88161850240a5fca6854a0
SHA1 e6c7fa06397d1b60461a18e251e6afc5d07d10fa
SHA512 1ed8ac4654cb31ea42214589775268d88540cc22cc7c81a46f04f3f2971dad8920914907ba3cf0febb68bb74908a0421e87cb70facd3292b60b6453f4fcfc7b2
MD5 SHA1 SHA512

LegionStealer V1 SRC/FodyWeavers.xml

SHA256 79c688c8d3979b439dc068443bb78d27d43ee8d3fde0383812de633303e2ae4f
MD5 a5a83d4f3a7c54dfb9f3ea972686c685
SHA1 d6ecb6a18b77a5d1531302b8bcaaa0442d02ab8d
SHA512 e616603fcab1ed87630a0a66c98244d2c286045f16cf81241f63ee7113ffb64c074595828acec6ab800a7eef0615db50b1f3782efbb0e5e3faaa21bbaae1259a
MD5 SHA1 SHA512

LegionStealer V1 SRC/FodyWeavers.xsd

SHA256 a24b0566e764a5d1ffec375067f0c0521cf7fe950e98bf9684c81c59dca25a8d
MD5 e1748f1d36ae87d46b4efe6b8e6a2874
SHA1 2248378debf8d32d7b5194fa241819bcb02d39b1
SHA512 fb397092af27f660db1276451c26e909f02c53e8d82b71dfdcc733ec9f3058573c9f72eb62e3a186930590ee24bacc7faddd44861dff75e25456b15f1d019617
SSDEEP 48:3rX+3yoF2+Dyob22CnivQwSdqwVeVJTbJfeFLf1o80SY6p0uOMDMvgQpgPyThALq:7ayOtyusivQ6QMoJyT4yFDMsT
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Form1.Designer.cs

SHA256 4d8de06178585fec70ee186f32fbf38401bc7849bc236c0051d78c97534267f7
MD5 9e6f2ee34e6f26603070933f8f866cb8
SHA1 cec9396804db59a152cbe3bbe218c7cc80723d00
SHA512 560392dc0c5b4cca6fd4f43a6a47cf117576119322abbfbd6712aa0b3920e2d646a12c22336c0d948aff051a9e5c07661490387a1d8b64c3843013d8eb71c41f
SSDEEP 384:nw1zc6SMUpCZD7v34+Nu5q40wJ2RVaxuPpdgDdcV46SSyhV4pFrVq2QJDHGtQOIb:w1zvHy
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Form1.cs

SHA256 9a787d5777404f3cc43796e23cf25b6236c09e614239039a12630ed1ce0b6c2f
MD5 0267f8633eff82de3feca7879b57cae2
SHA1 f833a6dc60b8ce4fe1c44feedd02c05ee72a13d1
SHA512 2a85a4c1ab54a467ed8cdb28b67a09d4e57c42414cda914fa3d60ba1bd6b95207049cc01fb342b810d9fb6703c4fd803e52cf8fc88e65198610f3aef61fe27a7
SSDEEP 96:Jo4h4Dcz02n1XVgUylzG1DNfF7GrC8Dcz6vFQdEdOi52gp2LA0dX:9KGpbB7GoCJdOinK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Form1.resx

SHA256 618c16f01cc2eae2d696fa3e9eae55268a70674bb2e46a982a3d5314fc3015f4
MD5 10af683ee0dd39eeab3cdb0d67dbe384
SHA1 e6dc6c5f54c622405b81b9bb28b285b9837d0249
SHA512 05e7f3a78ec595f0cf8b25afb4b0ca2703f148238fe0df97dbabdfd58651d8e1686edca8508d823da0619eb15ed3b56c8af7e9a2588b815eca2924231ac43efa
SSDEEP 24576:+W+dtiY4PGOL+37vxiW+dtiY4PGOL+37vxm:We+Qe+o
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/General.Designer.cs

SHA256 f67b10283f21518e6d31246b02b5c98bd7d5c7f09364df3d5f6098f776b719cb
MD5 42cae80a45fa7d840c509f74dbfbd671
SHA1 7874345883569e26f0f96ab7e3075e8ac67f48b2
SHA512 961f875e24f64ee3057648739f87d1d221e459f5a0a2f6cdfb710036c29106ad0efba18db49dc7043ed6b29b07d9222ab63e52e141857507fe8a3d12ddf119ce
MD5 SHA1 SHA512

LegionStealer V1 SRC/General.cs

SHA256 d4ed01bf8cecd6a146dac8ea20faab386aaa7ec534eff3066a5e3c881024cae9
MD5 1ab39ca87572516793d1c480d5b2d81c
SHA1 0b501e022306e9e22510cbbe23e0967818abd029
SHA512 14201e38ee2a7321fb126099730f36e7d2b3ca207b1bbfafed3b082c93e1eaf900d4d7c5c17bac533e8917d04c9f2115a25a515b23ee2305f3e93fbaf70f0cd3
SSDEEP 96:yo4h4Dcz02nzXVgLUlF3FvFAF2F2F9FbYFJFCFzF0FQF/FVolU82jn1bn7WmXbm4:IKGpRfQolU8QLaEMks2
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/General.resx

SHA256 4363cd7d5b8671c72442ce1a1bfc10d64ebd24b2d718b54bd4fcd025e4967298
MD5 4eb5913a0e5aa842250f7419538fa230
SHA1 31fb76e5d9babe97a11fea041081f96ce426107a
SHA512 846207f9db4c05d2070482c27af72c50b8f423ac1c7efb5266b059f6a41362704e9f5a590e428f4aefd791edd2e21c1b34473361911cbeea2cfcaf741b5bebff
SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT2+0qSdvabvDBwbjBu3FqvuFZ:KjrbLPD9sLvIzSvKgIqUyahFZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Main.cs

SHA256 7d58af05350d2baa3e2a427ec320f242cab6ccf3f0284162d82b9ffa77196c82
MD5 91543195d4c47fbcb47e7e8dcd302147
SHA1 8225f3269267bfc7ea268479620a0cc67d802b10
SHA512 a2dc6d6d52431c00d5d5cc7aa4647a0f353bcb4cf243a573c41c43d52d8732d064f117a696bd7405c5ca6f6a9509bcf5a3c2ca9b0fb68a0c2639c432ab76e2dc
SSDEEP 96:Jo4h4DcOz02n1XVg2jjfSPfTpg7Lj9HYyLJfMf7SCJj:9KrpbIpY948fbu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Main.designer.cs

SHA256 16e38f83f709f85b7ab797da3be4f108c7eeb17b49388aed89715b35846da872
MD5 677a15093377f58272a74042b871b6c1
SHA1 72718c68cd21add6b04e1722c7121ae72a8b3ee1
SHA512 3d54418d973ebbf6efbb28c3f79be9d6e7961cbb69a45eb84a612ee5fedaff74d32cde80639b01dc9bad577b0aeb5333d859cebdc9a657954e48a8c11a930ec7
SSDEEP 384:dw1zc6SrEIOne8deqmbM+yrRD7Lps9u0fI196+9a/ZV4chI8zdrP3Ut/cFVIXbxA:S1zgEIOzmlkTxk5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Main.resx

SHA256 fc1651661f2c7d65e9768fdf3cc973983ad78206d6fc9723d5c915e8e49d2518
MD5 f772bc41926aa53c753b2f2564d8320e
SHA1 6b52a5ea244395e837d4401c02bba17f54c27b49
SHA512 aafa7110ddc867e743adec2c180e61332d33d984e446733eeb4743d271ed35a7e5c80edba2d69fcb77ed284d456aa542a9dcd7d05827d812f347634ebad767ed
SSDEEP 24576:GW+dtiY4PGOL+37vxNZWgo/ed9P4tLznqxc8Cz9iHK8W+dtiY4PGOL+37vxFCvic:ee+ZWHed+tX8CIq4e+uKv9wnqB4KLg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/NewBuilder.cs

SHA256 31c1472a1a806d30b58c21cbb435d59ec9dd81eeb9f8f74829854758135eb34d
MD5 f630a91f5ad64da2d5fde049abec8809
SHA1 607827cf9910b15d836b6b4e38a4cae41c05db99
SHA512 c106b5ce8517f753818c736d940d68483e3da22081babf8397b476b066a93c95ce7ca9130c804ed079b0e738ee2b25b87f6dc114e8e787cc69465c05a6b8b5cb
SSDEEP 96:Jo4hU2nbXVghQ2jr6VbfoM9s7stb8TJ5y:9bph2jr6VToM9s7stb8TJ5y
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/NewRenamer.cs

SHA256 0c6d1d7ed277bb50ab6333e7207d43c7dc251a1e10f4bfbf5a71e3f1711e5788
MD5 9b0abb2dc3d0b1173a37b0ef7f51b325
SHA1 66f27553c354aec5aac80eb06c7beebf19d6c85b
SHA512 fd8eef9925ec52df2ed6f91c447ac13feae1f013ec9c462ad4d25b8dbf38ecb9175a36e070c04ec2736605761a9849480e24099d9d4fa3b6d6a28d92f1d1401b
SSDEEP 48:xo4h2n3ohApEVm75KwP8AgRxzlmDJGwE4FYhde6lG5zC+cUlrnjUxKVtGjWVQf65:xo4h2nF+mDYlZAz/vX1VZCkwzjrM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/NewSettings.cs

SHA256 759d8888f03545a369a1a9bb531bd4c3a0bb7c5dba790f5326f2005618f2cd1c
MD5 37101b58b7d2d10b84256a662c79cbc0
SHA1 ebd99fe8c0e3a9a8057d3d38ea83eac5178f187f
SHA512 29dd807ed1f01a594cde164b95e58c818518df64fa2418627519a2af559379d5ab847024af96cb18c626de91ccd551f6c0769dd9a8722aa170074e8ca6af74fe
MD5 SHA1 SHA512

LegionStealer V1 SRC/Program.cs

SHA256 077cc409bdfb8b46076ae52a5364bbdff4b568e7e04e662b399639ca0fc83a16
MD5 9b610fe22bddb5f89a39aab62ae72fde
SHA1 bb79a5d81fc5b102363ea2580f31f2e22bc1134b
SHA512 da040e0a82e4cd68439e63a6dfb443fa480ed73a693a5ad44ad40c7675790d194677c5da56b34b6e4d8b60f2523a62c3fe08a681635bc04506e9518ba27fd0c4
MD5 SHA1 SHA512

LegionStealer V1 SRC/Properties/AssemblyInfo.cs

SHA256 ac663167a564ac18abaa551dfd88a9f882af408ecef9d734e7714263c076936a
MD5 9c118f51600cda2a392679a41f4fcf80
SHA1 8bed2f4e62e9f077e8bb079f304fefd078d33ce3
SHA512 35cef3606b6b6a3d75933ff6738976b931f30e0306be2cc53b973eda53e8d4c9cad2385c1d941f89f0ff6de8757da6929b2f0bd6f071d904d7a63123b9dfd54e
MD5 SHA1 SHA512

LegionStealer V1 SRC/Properties/Resources.Designer.cs

SHA256 6a8e613673202849e3a3758b9d42ce51d7ece1a13a56ff4839032b9523d4e408
MD5 a9a5a90cd90c0ad248d3841c5fc9481e
SHA1 6026054a7dee142355451d17f2bbb7fd696d5f89
SHA512 3df6f8f2bbb4706dac53e5b35e055d9bdb788bffb2c8af59447fda7cbc283d10370dbe2b26d5543e07de6bbdde5b40579826618b119ee38bab572d01df28a9d8
MD5 SHA1 SHA512

LegionStealer V1 SRC/Properties/Resources.resx

SHA256 66b5ebd1b0fc73f041ba669ce2184f6f471d5e3524efa34ca31233e9f5395262
MD5 0cd8c971317d19bbed44757809bcb92b
SHA1 47b15748ecc8e952c5935170090db7c269ce4b4f
SHA512 883dba84bf7daae3ea49f9d54c13dda4f125da82ba63f90eeba0900602896ad9492a0adf7b69b67d838034090af20926af5c2934797afaadb38aa069786c1fc6
SSDEEP 96:fijrkiK5k5LPXbac9m5Lv6FzSvd4gIRjETUT200qSdvabvDIwQBugqvA:KjrbLPD9sLvIzSvKgIqUEa2
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Properties/Settings.Designer.cs

SHA256 7752ad2b261fcca44c544633d2967741faa70d834625bc847e8345f25931ed84
MD5 8de49587ceac17a0d4a8cb10ab30f90c
SHA1 a44110f7d22ab9b845b910eaa6ba82c3375fbca3
SHA512 95a9a583413087df168f1d31d83e56976e1317c38c97dd8e47fd6543f03ce56b8e4e6e8ce1b32251817dcd4aca59f240a5d97fb21d3fb95f95e1e82f630e3984
MD5 SHA1 SHA512

LegionStealer V1 SRC/Properties/Settings.settings

SHA256 f6a4290723520caddd934b8800319c7ca6cc7eeab647059ec89b7a13b1513265
MD5 8c0f00d7d9b0046695a0255f1b11b061
SHA1 5e1d04de66ffcc5dfd813530ab6992e6daaae417
SHA512 a95c07dc3241b7c9f37b7f0a5c143c9c133c3bcbfa16e4a689cf47f45b3e9d0ccf5c965143a6848237e7a9fa8deecb89837dc12b12fabd8231fe94f3ccba26aa
MD5 SHA1 SHA512

LegionStealer V1 SRC/Set.cs

SHA256 e82738442eb3a58068f467cdaadc511a81b24680bfc553a5a991e734f53c5f35
MD5 732e3aaf69ba99c7a2ae6b3a50f85aa0
SHA1 1628f1a00825d2d38ac90804dc9ad2a27ea64c52
SHA512 f4b39b21d931004286babe9815e1d0b9bd1ae625bcad976dd4ed012a8a7079b4b75cff4c13dd897d1b2c7570f2398e5953059172a2e3c93d2ab7ac4901e70a32
MD5 SHA1 SHA512

LegionStealer V1 SRC/Sver.Designer.cs

SHA256 aaf72f047c66ce9775cd52309e6f2e672fefa4b026b27954ae4fbe9aac0865ef
MD5 62ef28a3e2996d5eaa5955e6b1cd0699
SHA1 dd3064b6a93b3dd0a0cd858643bc459c4f8906c2
SHA512 d7152fff69862da2e1c0d978b12f144cd8060eecc893595036db28d5ed4480d09a744ea997d304e7fd43ef968ca5effd725f637b62c035e433562c6a5001aa8e
SSDEEP 192:0wo+dc6iVhbRYehV4pF8TPjIbylUBcV46SOW+SHztVzntzyczY94zzasa6WoVU7p:0wTdc6ShbRJhV4pF8TPjIbylacV46SOx
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Sver.cs

SHA256 e447e1df5e38c63b54aeb0f75e9146164d62d1cfb79a8f40b085c76ca826d1ce
MD5 ad570021f48c37ed3248ab1487fa69ee
SHA1 6be9e24a5a25e7a972c2a2fad97198ea03ea9389
SHA512 446fae1ee43ffd025ef8bbe74c2942e128f7befc62186e276a367976be2536059164c6ca8a9d86c949e85cff3ca7f24715cd40806b627dec3262d0f2f9600d45
SSDEEP 96:io4h4Dcz0U2nzXVgoOWFd+Ew75ptqYow1ihJ0fmUJKvX0k:4KGyRVdI7XtDnfm/b
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/Sver.resx

SHA256 052b04bb18c67c3c9caf7fb1dee628576be9ed8892b226216399deabdbaa80cb
MD5 8b1bf053e0962923f2edf6f3ce2d5319
SHA1 de0950836f93607584b34023b1e20a564d61020f
SHA512 a27f71faacedf5cd6c7f8237224565f7f35dff4b04b7d99c72362252ccee1b0d3529319d96273815d758a2fd191b6820a217fb0babf35ad7a40a0595f019dc61
SSDEEP 24576:LQhrAzWqBJyXrT5YEPZky4VhOXxqTHTMYvOjVB:LwnqBMZkl4q7gT
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/asamlby.Designer.cs

SHA256 4a4c549d882fe259b8f601d322f5687b63d9cb125aeeca3c20666dd195b62e72
MD5 4f8190046a55d5bc73b4c3a4b8f56171
SHA1 074a46d1fc46457a22d18c7324a1b0321983fea5
SHA512 a3654399307380fe1e8ad0e56d998b332d0c72c9037bd892314c7cd0666b191e7758c3c93671e04da928503fd7b34d371f50c1870f524063a5814711e3a0a832
SSDEEP 384:awTJSyWOIJJkY3iLk+kAiC8biboasvsqI3+bkOMXbvtf0ToxT5C3UVjI7wFr9Jnk:1TnU0YAuD2/UnulBcb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/asamlby.cs

SHA256 f665c51d2581d7c112905b458eb709d034d51dcdc5b7fe825838d571e3e38411
MD5 c54437eea218c3109241012833c2a73a
SHA1 0ba93124c40fb57d6e21c88cd3e3c59f7ffc6a58
SHA512 6271b1529ee69085695685f720d102d36175549291bce16858998c83dbb6e825924378832ea6a990b725a6118e9f5741d35d4fcfac99d147bac62a320deacd9d
SSDEEP 96:Jo4h4Dcz02nXVL1UVZyHCL47hq7PIIicB28KeKnFV8+:9KGpFuEHWowPIIdseKFC+
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/asamlby.resx

SHA256 44607ba78f7cbddab40debbb7716da4df880aa77eb791dc036673341754bccb1
MD5 c48ea6099e3454742f511c3847b99da5
SHA1 ed28d365a559d7e3f687d718d28fa879548826de
SHA512 8f099c1b23229233f657ca05ec4ead29584cd6ff9d97ac4f56b4ae659bc491c5966b0b7ff1d3812366c5b54c4e0d52f02ea7621bd98cd4d17568d90a7a115f70
SSDEEP 1536:Kj2v6TfR8ejXCIC5UBlklMCLgwi/sunde/Zx5/AdQbCdgVWcYa9A:Kj21mCvyBXCMwL7pjUoA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/bin/Debug/My_Stealer_l3gion/My_Stealer_l3gion.rar

SHA256 423866541d02a9916587d34532c6a20dd4c6387e73c22410826656bc390770b3
MD5 8568f2343c0968940748374cad16c864
SHA1 74b6e7e203d5290078d1454f2ad5c9c9a74e5077
SHA512 7df7e90dba4291b78e06078f74aa7bfed8734a3dbd6b907cb797f65b24d29d498393490bf27663b54e4755db3c10a686965b59e109f12c447a2ea1f15d68b688
SSDEEP 98304:ddh5OcQ/6kNWr0cVKvh5KoQvdqY5zOcG1gj2:J5Q/6PtVKvOdqYVOH1a2
MD5 SHA1 SHA512 SSDEEP

legion.stub

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 583951df0c7f72ae98a54fadbe149a0915d1cbc9c43a479b8ed665605ecf41fc
MD5 a57929203b6285ee60a203411a0abd18
SHA1 16a017003b4913fca19da5487f5c89ad0b9b588d
SHA512 48fe09be5e9d0c361ba12bb3cf0095986c2f208b5d0e25bb546225cee634ea8313618cc3a99e8eaa9c2fbab7224eed01ab3af935e72dfa25f40ea57ef7e25d10
SSDEEP 3072:2Z5E83uNAINiWUkY7KYP5thThghhKDg+FeOvCZvZudmG1PUe98bezrM3uG3G8UPi:sqclUnMBSKDg+o3ZvZbk98bezrAmf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Detect Legion stealer payload

stealer
Detect Umbral payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

251842

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\M Hashir Javed\Desktop\Older\Umbral-Stealer-main\Umbral.payload\obj\Release\legion.payload.pdb

legionstealer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ec726f4d9f821c282198ab703a469e6f3eaa4e73517eef344b9aab6a3daacbbc
MD5 7681c2bf57c7ef0640195a82333a90b5
SHA1 e6ed571b3118c389afa844bcd432623aeba85aef
SHA512 106abcdc8acd1bc882d4501367074d9c6282e341272f336749f523cb5427fb7a6b310fafa79ddc2b10906df011253944d0d71f6625ab0ce314666b5d9d83cd8e
SSDEEP 98304:s+FPMJeFPMJcaFPMJ9wT7DFPMJkhzHdV5RPdnmCvE/t7ZCWqrxToDqk14SGuA+iO:1gxV5RsJ/tVrMt4qkq9uAmf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6238702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\L3gion_Recovery\legionstealer\obj\Debug\legionstealer.pdb

LegionStealer V1 SRC/bin/Debug/My_Stealer_l3gion/legionstealer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ec726f4d9f821c282198ab703a469e6f3eaa4e73517eef344b9aab6a3daacbbc
MD5 7681c2bf57c7ef0640195a82333a90b5
SHA1 e6ed571b3118c389afa844bcd432623aeba85aef
SHA512 106abcdc8acd1bc882d4501367074d9c6282e341272f336749f523cb5427fb7a6b310fafa79ddc2b10906df011253944d0d71f6625ab0ce314666b5d9d83cd8e
SSDEEP 98304:s+FPMJeFPMJcaFPMJ9wT7DFPMJkhzHdV5RPdnmCvE/t7ZCWqrxToDqk14SGuA+iO:1gxV5RsJ/tVrMt4qkq9uAmf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6238702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\L3gion_Recovery\legionstealer\obj\Debug\legionstealer.pdb

LegionStealer V1 SRC/bin/Debug/System.Diagnostics.DiagnosticSource.xml

SHA256 1784132ae3698467a0985b2507d63bdcf19a7970afe3a39d86e36c018c98b29d
MD5 5e91fe301415aced2f304f136a8ebd82
SHA1 31d457e46227f16286f7b52b728208de8970abbf
SHA512 6f99fccc2e35e4ba8d2054d4cb5787bb48ba4364d5181d59825400e6ed9f6a1318197810b3b908e726173ccfd4f23a1871417045174e160c7073c7adca831add
SSDEEP 384:VsKIrXkz1ukSA8Q3vK0mN2I5IiIjI7ImIWIHHtL90/6q6M:VsLA8Q3vK0HY6rM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/bin/Debug/Vestris.ResourceLib.xml

SHA256 d243a0b107c44e654a53bf7941a9ade0dab6476b36eaf0fbe990cf99036bd12e
MD5 a0152babc033f3c62eadb7c4baa75cab
SHA1 b6317dbee83e6f2c5f3eafd21c8ca0bc16f29227
SHA512 f8c9f9c5c27ceff7894edd21c2bfa58a3066c2fb2ff35ee5c99df77e9dd553e427761c9882426b7e3de76697967652957c2a36ff321d1e33d4b5279f6a840fb8
SSDEEP 3072:uuaOKJ1AAlTNKLNWs/+Y4Y4d8yUa/jvGF:ux1AAlTgLNqljvGF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/bin/Debug/legionstealer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5f4a0a9db28d595c4035c380e2a5d4d39a284232aa46dd0ddb91baad021abd76
MD5 4e3b1a3fbe54f485df9b449f85b2c761
SHA1 6450824ac372584e5066be766ef503fac3189a09
SHA512 bdcf379cfa1a0ff02126e298db15cd2c9f3d9041ebb934aeb96142ba099926fd2ed3a5a53b271e7ab9d6c4d80cd66a6eb3d3438c34a45b33902afbce98c5dc43
SSDEEP 98304:e0FPMJ2FPMJcaFPMJ9wT7DFPMJkhzHdV5RPdnASGuA+i1iK8P:dgxV5Rm9uAmf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4603182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\L3gion_Recovery\legionstealer\obj\Debug\legionstealer.pdb

LegionStealer V1 SRC/bin/Debug/legionstealer.exe.config

SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
MD5 9dbad5517b46f41dbb0d8780b20ab87e
SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
MD5 SHA1 SHA512

LegionStealer V1 SRC/bin/Debug/legionstealer.pdb

SHA256 e33c364b9190adac414fc7c8303bb06f2f0e1aa1f9d647dc2d32a06da2bdcd1f
MD5 b26d6f34a5684fb79392ba03a9699ed7
SHA1 0dd70bb5cea1a96c45ee25ac18ec44cc23c7c754
SHA512 844389d11b9767623a25de5b4ef253595fedbbb74c778f1aaf1a3cd14a18c25c311dc5434dba9d81f82b3a3b5ae0bcf5cfba7c21f07f00f67a3c43e8b3593d31
SSDEEP 3072:Wn09rG4ANIj/LH4CkPGHCkrDav5RQQIyihP:W0l1EIjjH49uNrDaRWkih
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/bin/Debug/legionstealer.rar

SHA256 87c29d60eedbf408cbba8212d2b574be92f90a1162ab97c9cc2840fdf1757fa3
MD5 1cd21caa959daa97ca3cf06863bc2cf2
SHA1 84dd1258116b5a7e8a228a6e9409fdd1392259c1
SHA512 66f163ffa4d895f7b7111e958f0042cca0d7ddb2f6a9e1a05c056ef12b1509f3da318c4830ea367d588ee91729d2d4e3f4aad046ddb6db48843c0d84c1ca1d09
SSDEEP 49152:jtkWmUQKqs/uW2+bWxJ3ezFke/ADpHOqTib9eBhXdjbQrVfWThv2InEod5:xmUVq+Y+6xJ3UF/AdHHObMB7nyfW1v2i
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/bin/Debug/setupstub.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 edc69392d35172f113b6ea0edb743383290acfa5df6e4d60aacd395d32a4e060
MD5 d5eb35d97a6696a5d149a6fb3519edc7
SHA1 f30267b4d5eda48d19050436b0b69cb9ce1dd641
SHA512 57f10569310b0bcebf4f13af0dc62bbc67e5a85f2def100c147dc757b4ff345665d9e1a027ab333879d420c63b136752ec6c0009d49df688ca826447dba289b8
SSDEEP 384:dE3zS28bux4uHtHlzjuprip2cfc9uso9H+Ko3FyJKAJNIKtxjCBL0WVXIp0owbIK:OPY+0ZFM9JKBL0+lIYv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

24238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\L3gion_Recovery\setupstub\obj\Debug\setupstub.pdb

LegionStealer V1 SRC/bin/Interop.IWshRuntimeLibrary.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7dac4c4bb399931af0b31e693b362dae46a8236b9b7880c988213cb653ee5b2f
MD5 045dd449146f53a1b3bf77a9b7d2f9c2
SHA1 d8cc2b1c614681ad259c8c964120c2633e120019
SHA512 96cd562ac24137ac059da8018215b19ac6d5615c20d199f24fb3cf54ff3d2a7c9f6148404bd59d3451e1509b87602bccbe1dac2a321f4e96a1e484b28188fb60
SSDEEP 768:UDZfmTXoKYfUkPnBkZlBQQ/SMfzdztuo2z9IkCBCptcNt:UYHYfvStbfBko2z9IDCot
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

43182

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/bin/Interop.IWshRuntimeLibrary.zip

SHA256 e1cc422dd6d59c208e792197d31c6c36823c30af02961a14daa1603f6766c384
MD5 24fab13d74636e7908adcde6a892cac1
SHA1 6c2fd4c3e573088163eeacc8427570fdac7a1b76
SHA512 04919115f6faac9448a7ec4f8bedbd37dba984999eebce59a056f2ef965279d90398761fc61b6272fecbfa0d42d5024d2aba83904ea9ff05fb5de1806378377f
SSDEEP 384:aujr/TC4DV8Ug2g/1yXlQHhPRrHHkHQUj2CoPdl2TCBAk:aSr/Jgl/1+IZrnkHQUj2CoVl2T4b
MD5 SHA1 SHA512 SSDEEP

Interop.IWshRuntimeLibrary.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7dac4c4bb399931af0b31e693b362dae46a8236b9b7880c988213cb653ee5b2f
MD5 045dd449146f53a1b3bf77a9b7d2f9c2
SHA1 d8cc2b1c614681ad259c8c964120c2633e120019
SHA512 96cd562ac24137ac059da8018215b19ac6d5615c20d199f24fb3cf54ff3d2a7c9f6148404bd59d3451e1509b87602bccbe1dac2a321f4e96a1e484b28188fb60
SSDEEP 768:UDZfmTXoKYfUkPnBkZlBQQ/SMfzdztuo2z9IkCBCptcNt:UYHYfvStbfBko2z9IDCot
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

43182

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

dllme.txt

SHA256 2765bb22303e41eb971ecb99e6c6ac13777c4319f1691245f078c732e6864374
MD5 24606f42dd3d72e90e421a9c4be19b50
SHA1 27de1402a870b85171bf58544478c3af99b2ca62
SHA512 12a5775bd978ffc98450a150adea5ad3d8fc47a449514745f9c980cc3af87a7c167046947e39d2e22dfec8d7e72f023391ff47adfed8e794b5a3ae27c47813ee
MD5 SHA1 SHA512

LegionStealer V1 SRC/bin/Release/CODE.txt

SHA256 900b20c9a317f0cf758b8a33100aa9602c8ba755e7a81a552be82eb08ff94b99
MD5 0c5e11506cc38bc35acf3841a4047de0
SHA1 68ab6cc480566c73f4afb8dca2de8138cfb53969
SHA512 273a74a81a75ea6a296c8a2a36a26569523fe6f522b8ef777d9c342d361699f1cb54f384564186e3cd9aecf5373cd88647efda2a317dced3bcd916760f735b76
SSDEEP 48:Lo4h2n6ohApUVq75KwP8AgRxzlmDJcgFYhde6lG5zC+cUlrnjUxKVtGjWVQf69TS:Lo4h2n8+mDKAz/vX1VZCkwzjrB
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/bin/Release/System.Diagnostics.DiagnosticSource.xml

SHA256 1784132ae3698467a0985b2507d63bdcf19a7970afe3a39d86e36c018c98b29d
MD5 5e91fe301415aced2f304f136a8ebd82
SHA1 31d457e46227f16286f7b52b728208de8970abbf
SHA512 6f99fccc2e35e4ba8d2054d4cb5787bb48ba4364d5181d59825400e6ed9f6a1318197810b3b908e726173ccfd4f23a1871417045174e160c7073c7adca831add
SSDEEP 384:VsKIrXkz1ukSA8Q3vK0mN2I5IiIjI7ImIWIHHtL90/6q6M:VsLA8Q3vK0HY6rM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/bin/Release/Vestris.ResourceLib.xml

SHA256 d243a0b107c44e654a53bf7941a9ade0dab6476b36eaf0fbe990cf99036bd12e
MD5 a0152babc033f3c62eadb7c4baa75cab
SHA1 b6317dbee83e6f2c5f3eafd21c8ca0bc16f29227
SHA512 f8c9f9c5c27ceff7894edd21c2bfa58a3066c2fb2ff35ee5c99df77e9dd553e427761c9882426b7e3de76697967652957c2a36ff321d1e33d4b5279f6a840fb8
SSDEEP 3072:uuaOKJ1AAlTNKLNWs/+Y4Y4d8yUa/jvGF:ux1AAlTgLNqljvGF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/bin/Release/legionstealer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8b336346ba44e4a6db56070eeffd741234f6557a213fd72bc0efa705930e7de2
MD5 547bb91afa2e38b63bbc57f0adf8583f
SHA1 cc6c6cebc870f63a1a40a57d9b8ce3cbe8ce36a2
SHA512 20a31dba79c4cb858891264f70f1a4cddde353e7d7bd8bb753b74551d2efdac8d65cb20635fcf56bb1b8df3bd0162dd449b63cc926152e61994593fd9a480863
SSDEEP 98304:l0FPMJ2FPMJcaFPMJ9wT7DFPMJkhzHdV5RPdnASGuA+i1iK8P:8gxV5Rm9uAmf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4595758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\L3gion_Recovery\legionstealer\obj\Release\legionstealer.pdb

LegionStealer V1 SRC/bin/Release/legionstealer.exe.config

SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
MD5 9dbad5517b46f41dbb0d8780b20ab87e
SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
MD5 SHA1 SHA512

LegionStealer V1 SRC/bin/Release/legionstealer.pdb

SHA256 ca00bd04b05459283a8ce6261c1d62809081f360d52cedc9f21e6d3fdf1f659f
MD5 4f20a7103e94c1c1542c3290f25cdb93
SHA1 0188c308582fa95f17c4b5be93e955e1928c38ab
SHA512 460c63fde33101198d43c8112d4c712a1b2eafbd12270e8c9ce66b80faccedee72a819dbf373e9bc72a7388338e9f7c681c3d03441d632f6164505998c2da1fa
SSDEEP 1536:LwblW6Rj3uTJlBgbQ2nZ+PSKzFMohXub7KGImJEKV4HBwfCT+s2NZg3qSCZRcL3L:LMuTJQbBnw+/KbWEK02x2b9rr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/bin/Release/legionstealer_Secure/legionstealer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ea2605aca30fb345fad196a6f275f54bb63872dde799ec54712c0c52511a757d
MD5 649298a72317d061117678aea390f0a9
SHA1 c595e5c791fc81b48d56177dc95babaed2fc84bd
SHA512 d7f6b761fd633d21920c2564f799f6777ea68f4aad590ebcf7e19a9c51661b1eaa9cfb4a7e1c3796a31f767831f1c95d8fa0f42f85498c7a3c35340ad1c6f4b0
SSDEEP 98304:Ir9ujalE4lHtdZ3Ya5TWO+oYNsqrmUm4JL6aVWbyP:IsjaN/F9WpnyvC63K
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4009198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

legionstealer.pdb

LegionStealer V1 SRC/bin/Release/legionstealer_Secure/setupstub.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 edc69392d35172f113b6ea0edb743383290acfa5df6e4d60aacd395d32a4e060
MD5 d5eb35d97a6696a5d149a6fb3519edc7
SHA1 f30267b4d5eda48d19050436b0b69cb9ce1dd641
SHA512 57f10569310b0bcebf4f13af0dc62bbc67e5a85f2def100c147dc757b4ff345665d9e1a027ab333879d420c63b136752ec6c0009d49df688ca826447dba289b8
SSDEEP 384:dE3zS28bux4uHtHlzjuprip2cfc9uso9H+Ko3FyJKAJNIKtxjCBL0WVXIp0owbIK:OPY+0ZFM9JKBL0+lIYv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

24238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\L3gion_Recovery\setupstub\obj\Debug\setupstub.pdb

LegionStealer V1 SRC/bin/Release/setupstub.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 edc69392d35172f113b6ea0edb743383290acfa5df6e4d60aacd395d32a4e060
MD5 d5eb35d97a6696a5d149a6fb3519edc7
SHA1 f30267b4d5eda48d19050436b0b69cb9ce1dd641
SHA512 57f10569310b0bcebf4f13af0dc62bbc67e5a85f2def100c147dc757b4ff345665d9e1a027ab333879d420c63b136752ec6c0009d49df688ca826447dba289b8
SSDEEP 384:dE3zS28bux4uHtHlzjuprip2cfc9uso9H+Ko3FyJKAJNIKtxjCBL0WVXIp0owbIK:OPY+0ZFM9JKBL0+lIYv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

24238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\L3gion_Recovery\setupstub\obj\Debug\setupstub.pdb

LegionStealer V1 SRC/bin/dllme.txt

SHA256 2765bb22303e41eb971ecb99e6c6ac13777c4319f1691245f078c732e6864374
MD5 24606f42dd3d72e90e421a9c4be19b50
SHA1 27de1402a870b85171bf58544478c3af99b2ca62
SHA512 12a5775bd978ffc98450a150adea5ad3d8fc47a449514745f9c980cc3af87a7c167046947e39d2e22dfec8d7e72f023391ff47adfed8e794b5a3ae27c47813ee
MD5 SHA1 SHA512

LegionStealer V1 SRC/keyauth.cs

SHA256 7d6684465746f8c0ffac9995fc45c888a48857e493c19ef52a4b2283ea8eb1f3
MD5 31add283b59969e3d0c38aea0e3de934
SHA1 139f914b3a442609d5f25657bcbb1ed08ae12fce
SHA512 12c5aa64f3e89acd3fc378a670428b9f5531da499db02fe95b9c30b70798a54fbb52d7d2952c1a28fb9d808c7a130e61fef7805defdbf68f1f5da3fd9fcf5bd3
SSDEEP 384:gaG61ja5bBr1T7D1xyalsjU5Plsw6yajqTd4rskrrAMs4CFUYUQDRJS6J3v+sWvQ:TDjyJ1TLyWXNCyVpFJDf+sWvQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/kingnew (1).ico

SHA256 9d5f478cd696b54eb75f7480274547e83d8409d45824cd97fa0009d25e2ada5a
MD5 ddb86a533176eb4989c628cbe3ef150b
SHA1 1f635d1520236b3284e06c9fc47119abf287be6a
SHA512 1b3a788081f3a077bf711c75abf1369c3c5545015074d763a98d11057702e4c1d776023d99c799d6e9a247801cb6786f4a61a195f25ff9a9664e1a27a5434c5f
SSDEEP 768:10o5RXTJiigjTDW3srOrfNTK+mCQBuCSeZqfzZe8:1xrJxgBrOrNZJfzx
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/legionstealer.csproj

SHA256 c5eb75327208f271120b2621fa4393148c0be985f70b88b74716158241b96d86
MD5 4a4afdec49716828a64f95118332440b
SHA1 b50c9db4bb898cb4d29239941edd1d658da7db4e
SHA512 0a2cb7f4d6dc9491af920a3b832380c9bcfc948597fd897bb3ebbf951821b18658a6da83c981c991e0ee8976fb98b1b37fe0e224cae3f3223535d969f2c7a5a5
SSDEEP 384:70o568lNiSNt8uoagNtFjXN11N9vNhgNSJNU/N65NraNSsNu3NGVNHFNl3NpXN27:70ofA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/legionstealer.sln

SHA256 3287ece4271650604834f183a5938a8bbbe8edc7148d05fd7a919a3f39cb78e2
MD5 05d919c9efee502caabe1c530933a6a6
SHA1 e7ceda2955d5973a8eb16a1d9b31c27c78cdd499
SHA512 0149629165e2afef13bafe6b3427c50ff4e9910db630da689dc9459dd2d0297c99dd4c9816d6d452901bfbfd3da20fe6ac330d9912adfd1e71f74446580a36cd
MD5 SHA1 SHA512

LegionStealer V1 SRC/namer.cs

SHA256 4bc5c082f26cc82228f1e7131aa63568205d5d4f38c18b456d1e6c4209a1d157
MD5 d5006a21d630f1e4baea20efbdd21fe1
SHA1 d4142383e2261ef1e713def3e56e50a83e666189
SHA512 7bbc51806ed55d860b0633d7b89a8f9cf7c7e5ca98fb4928dc6c8654f68b14b22ce45e71ac2bcb4cbced6f62f38413e2655c2217d304576b7f1318064ade3833
SSDEEP 48:Go4h2n6ohApUVq75KwP8AgRxzlmDJcgFYhde6lG5zC+cUlrnjUxKVtGjWVQf69TS:Go4h2n8+mDKAz/vX1VZCkwzjrB
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/.NETFramework,Version=v4.7.2.AssemblyAttributes.cs

SHA256 621199557e90fb1661e401cc9a973163c850b4b7e65bbc8d100f67f6699eef70
MD5 896ab120ac6b6af2895fdb71c452b9d3
SHA1 eb545ccd7a1bafcdf31ad0f32c09ac505744aa39
SHA512 834f53444444cee5c348da44674a2b8e6ce51f21a7565a23629001a5c535533c78a4dff8663176d982bab24f0dd272868cfc5c2fadeccc9b97a14f6946766dee
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Debug/Costura/105D65BFBC12E8E9C27D6DDE9484BC85E7A7F77E.costura.jose-jwt.dll.compressed.compressed

SHA256 56ec522a1158d24782465b5dd7f8101a0f6ad5364cb2d6357a2d485c88a266ea
MD5 7e4e5e16ed417ad4cec0fb93c89f80c0
SHA1 e6e3aecfc431c75b3d4c3bae00691af70dac19d9
SHA512 a1fea15f0a844fd525c8ffeaca6a6903f566a54a857026f327135c4272720a934b102eb94c5dc5f1f7e3dd0ae709187675e2275186679cdaa3dd9429bc59d16b
SSDEEP 768:oOSFKD1vBCJEZLXOdKNiB0PhsVzbMgCM28Hzc9GMMTvDNmQ:oOSYhvBuEvieSVzbMgl2YzcM7T7h
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/14995E7F1D12498606D9D209D78D55FE6FD87802.costura.siticone.ui.dll.compressed.compressed

SHA256 d5f0dfdace6b7809eeb1587c26d2d9fa31ad1fd3374f499a47943d1bea00b9a2
MD5 845f5b188c2b2dcd89850dea8033dd30
SHA1 530a7c8c1bee00f26fcbc3dc303e5cabf0f5b638
SHA512 a6f922e5d932bab8efe3d317d724c3a0736584844dbeaaa1215ec011f6ca1bf948edeafb4d2ba6674e9a118c0fcc546f3d74db2cf554bb849ca8074b5caf2384
SSDEEP 6144:wtZoAkWJEZ1mGyFQlQ7ckn/Uo+dW03T7b+iq+FvnSsxAXboBnK5dka2UdnCetvyF:wDXMZ6GQ6ov2m+UtbVkGDvAd1p
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/19B2A8967106DDDBDB60D09D6012BAE36D0D17EA.costura.mono.cecil.mdb.dll.compressed.compressed

SHA256 a0a2a74aabda8765e26dd5c23d29f0f6a10d31a8b8781559056ec0dfa615d4fb
MD5 db4b6391f9aa487b200706e8c2833e05
SHA1 5c0738a10d6c7b191bc3a2d68eaa6c87397e4ef1
SHA512 55a220d4ab3fdebe3de11061c08bff1d7f42ca66bb45280ecdd23021cf7a49510215e1e065289d8bdab2db53eca0876af9c7adbbac117a710e4e28253228b248
SSDEEP 384:Q+2K12x0V+ilJiW4OFowDVrA36mb2yOna9tiwF0kYa9q3HJQwOSyVQPDg5QGAY1:QWV+iviW3pVk36/yOa9TkawHWIyMGAY1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/3F82ECBE123C783B24705862C066018F827355B6.costura.mono.cecil.dll.compressed.compressed

SHA256 cd328b7d21f6ff879d82d49ae6265d2051c375d937999a076e901affe754d22b
MD5 9125cd3500ab199dbb1ae7be37d35e63
SHA1 b693dabdec9711737a479c42da17a2259cc07198
SHA512 bb6f64f288ad633b3de10aa295c0dc745d0a728d478368c0760902f61fec4de4a41a2ffad41b1d0c29077624d5cf08d1af47531994bec527a35d439d1fd790e4
SSDEEP 3072:JZSB7DnVoMXZKe47q74lsvqw8Yf29xJKbh7By0zMRzvpO/kbxG3k0NEysf:/SxDnWkKd7quDxJKFo0A9vpO/uxGNwf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/4A2620EE8EADB5E8ABA6905EA4F769BA30C52AE0.costura.mono.cecil.rocks.pdb.compressed.compressed

SHA256 f581295b364b79a6518dd9f69fbf68431f33e4a53cd1bb78e086b66748a18b09
MD5 7908b0fb29d1987953f3e5cc3ac09875
SHA1 a866cb96014a8696539389b7add997b9d937f8d7
SHA512 580d05dcf4d8476df9c29e665ef0befd3fd74f988fe66f30ac2b8c762ba672fbb99a244689c94baca15f25b84a17ad02a894a176d3e713a57a049aa35af5c942
SSDEEP 96:4yURdBT7IkH1jDtKq0MAsKIUF12Xn6d+b9rlInI/gcEoUt+x2H3:4ycvIkHttK9yKhs6d+bBlII42M3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/5FE276894DD8622A389E503CACCCBE8AD89AE0CC.costura.mono.cecil.pdb.pdb.compressed.compressed

SHA256 5fe4da19f4941f9c35aec5070f1398703f46af0bd14ec0e683170dfdc69b41c6
MD5 84eb8036e93baade50743bd80c5a04f3
SHA1 2b327396eb89a90d66b5b3d35a8e51f8ced70fa9
SHA512 a8d8b57ad52841b61382c9a2bc160d771ba5d9739b577e850a9e83765a7fcdf12e599c6eb834e0a1f7aba5ef1f0ec83e5362229fd84fdcce384d864a967dbf89
SSDEEP 384:pdbY1v1sJY64ULX7EEshIbTRwS2kR4Dv6:E1tJ3OTRJ2M4e
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/6C6000A5EAF8579850AB82A89BD6268776EB51AD.costura.costura.pdb.compressed.compressed

SHA256 fbaa489666a278edc8ba51a9963f48e4dfe4c2d7a02f5454543fb87510b5dc7c
MD5 b5767ad39b384c21d677cc9e6955512f
SHA1 b92a52dca7aa6ad26eb143896dff54534153aadb
SHA512 8695fb5a7bae767fd05617bfbc36cf875b281ca7f006482cdf960b01a857b23eb27cf7dca87033e2dfa76341e5ca12e8929342c09dc52b8c1f9be3d50182b439
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Debug/Costura/85DC92EDD4B0049ED9049E075C4DEF8A3D64E43B.costura.system.diagnostics.diagnosticsource.dll.compressed.compressed

SHA256 484bfd73e9877178bb82a8963305ebd8422beff3157a3ac7ee29229c967b9a09
MD5 ef497d95f8db18306b5605fd8a633958
SHA1 b65ed0db54f13ff7f2b0e9fc3fbbfbfe07bb66e7
SHA512 0fe5cd7198ca27f5efb38954c6bcba77777733b3e7bad255911b6ef495fdd0b6980862ffe4572877856ff89182062eabaaa588b789063afcb531503a5866329e
SSDEEP 384:GXFTOZC9hI9i9sOVKreONqtH5uq78Vn7tJF2badft8uFgIWFO0P:GQ29sOcqtH5uqanxJF2bCfSuCjQm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/8E69BA2487B8DC373CD39FE360E867269DE9AF19.costura.mono.cecil.pdb.compressed.compressed

SHA256 52603150682617542bc9d37c4e07b920f4060eed566aa2e66e8947c0e47a47da
MD5 24f695fe20cfed5cfd30adb668326903
SHA1 d433654db1eb265e3ee2e7733e3b51ac118056e7
SHA512 d87013634f81c511bf59c99731cfde50261520a7a9b67d1ea910d0fb6e831580754f502b8cdb833bfe944990121dcb4f62be97dacc988e82eab96fb61f6bd645
SSDEEP 1536:8/uHvy/EcyoWo6yZtU+m294RRRgOZv3+b7FKr7wjIPdtdB1GEDsNvFZV:Zv30d6IihjRgsQZuwsPdtxGJFFZV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/8FDF1C70CFFC856E24679CFE96C24CEE8CABC94D.costura.bunifu.licensing.dll.compressed.compressed

SHA256 ac160754110a28a866d60c0ad6ad2983341dc33b28fa3e8f0cd07c4c50d78532
MD5 abed9b4e1ec5b570a2b3ff6d9fc38b4e
SHA1 0de313382dd515560a2ea677acf3c040bdd70435
SHA512 4c89025b7e5fed1c34538b011270c92c4b70a16e190d020a1a997542d2a9aafb38853efdb460f797bb33b18e8f724fc26d863915139eb2d3f90ec21dc9f924c0
SSDEEP 24576:IpgtAsrkfN5g+Qoi3Uf2lhmdvTr4bGLw2Kiw1h5vT/0/eq6xn62:qCDrE/PQoi47ZTrCWlKJ1hxT/geqq62
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/9C9EEBB17D714CA4AC1FF6EC7B0B28FF4F90D46B.costura.mono.cecil.mdb.pdb.compressed.compressed

SHA256 31ae4e94480980383e1c9fb6081dc3b5b327be3c2708f82175faf545f7db1f17
MD5 02edd59f9c5102c71a3867fed55e7986
SHA1 d4fc3291e2530f4cdc7b011ebb48844606b52c9a
SHA512 fa260e04fc77bd6219f3ac637d99388a95f71482d63ac26b9d1e14f3d9067ec052ec4a35e36036012cc21e378a5ca781b666aff9254f68c7278b1c6091738e00
SSDEEP 192:RW+rwl1YgONqVgoghtFzGBnxfCF5a0pUscoAtYs+Zt3ZxPYF:RJrG4YVhKvGnmwQU1CtpRW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/A1936AC79C987A5BA47CA3D023F740401F73529B.costura.vestris.resourcelib.dll.compressed.compressed

SHA256 7470f98df853be3fc739d38f4dd439788e15dfa940302e0c761f3be66ba760bd
MD5 31dcceabf0473cfbe99f7ead973a42bf
SHA1 223132fee0ffc3d5ebcba52cd53b4756f946aacd
SHA512 92728f2c231520c806a747fccb61dc8f9c7117df0bfc95569860601803c236850509842c3d99affa0db6831d4737354b33741331636f77d7204f01dce3b891f0
SSDEEP 768:8yJnqm0rkIU3uZOhhyx0UCYaZFdiagkvQDE53+q6qHGCfHm:8xhVzo4mLHZFdiKYDMJmQm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/B09168EC88109422CA29CF4F1B6462D51930873D.costura.guna.ui.dll.compressed.compressed

SHA256 42c3396e382e3232e141c354b4c5239b95a59badf28aa5deee1f43c18f042294
MD5 60f9844f4a2d884ff56591f449ac7f5a
SHA1 330aca0c497f2aff84af828c75e02a88a7a786bc
SHA512 77dbb974561fb5d565d6d56060cfa9e4fad46e149bd1aa32b92699c892a997851de85b481d5f9fccc2fca7ffd650c218e49ae163895a091dbf5b69acb6355819
SSDEEP 12288:VYc2NU8Fba5hiJRb/AXSqlZeguFa1hQQJQIlzwOha:VYc2my25MJRZXQtQOha
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/BE0A3453276AE078D66EEBED4F3516F246805CEF.costura.mono.cecil.pdb.dll.compressed.compressed

SHA256 6ed1e4114a05acfd3d79391f965b9ff52f0453c165c4942d6f08b133891408f5
MD5 47b8e7299ee5fb6238793c5bc6540da5
SHA1 db1b71149d3befac723dd2d73f2c3e92b7fceff1
SHA512 904a326ac00a259e318d4d12792cb405cbffdf08b3b4eabc290135f5db21a677c8a0a444486df50e2e94bcea633851d4acd24511d2182eeb07068947120fedc0
SSDEEP 768:FVawZUMF5oyKv2ByNGcEPKAWB1dBRa7WA6XDbhGyH8MBG5rUxI3AjtOeWc/7:FV3UK5oyCFNbEiJLaGTtfGxH3AME/7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/D9D26753C23FAB955BB20289A20E37A1812888DC.costura.mono.cecil.rocks.dll.compressed.compressed

SHA256 c1e2e4ccdac41dde58f3adc0e0257d2c9da6dc75043da809498603b6987f11ad
MD5 9a1a0b8300b95332a175751c52b3e121
SHA1 edc7093204b03ea95f09419ba02d9fd39f25800f
SHA512 ec67cb3ee8aaf847645d9008ae9c938d2644c87e17ffac8bd71158a64236790a5e1e79784c97af0d343ac74ec665b8430c82416024a7331a09153a2de05f5030
SSDEEP 192:GunskT/JZetQjcxIGpoBsQyaUa03RZE+hC6WmaZvwevzDowlazdk6tcohtD7QEcZ:StQjRGe3yO0wr7Z4OJmk6n7QcS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/Costura/F1F25C01F6ACF33BDD62C4F82D3EF078E76F0906.costura.costura.dll.compressed.compressed

SHA256 74291771dd1f0338517e85182e062a96279f6e4ab8251502b8f7d1c33c6ce655
MD5 786a1377c3a7d94f8294f48f1f20abbc
SHA1 115046c4ec98cdd48f141f4d086dc6b896287714
SHA512 aac4fb8b94af5eacbbaf65181e036005ab6a4285529ba7d9010261f15588854630f2804a6764c6e09f715d4bff0adaa22d94a1a7ce5d8369afad183b75ea8f6c
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Debug/DesignTimeResolveAssemblyReferences.cache

SHA256 1c09903be50b9bf6d9eb0d6a10e0d08d0a204ab9502e1bc477ed2108edff2bda
MD5 8eb2c8c30334dfb181dd1c157e4707aa
SHA1 de7779f86b31a816538d98e87925a4be5050233f
SHA512 4743369a0b275548e85f59a588fe04011ed36d2e5448613a167769fe726bf25ad3bdf2e231754ba2d6661cae0663f640937a70d4ca3b0f39d95307d66d49d1a9
SSDEEP 384:GplQuQVImC2/yj6wnGKx5Nyj/KQyXKXlAPdP207KByNKUUln5S/yjr:Gno7l/mn9XEV8QGFXyUc1g/0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/DesignTimeResolveAssemblyReferencesInput.cache

SHA256 792ca5cb6e68c8a35cd1ef1d462d12c2c614a441dde74e14eeccd64d712df93e
MD5 613c9226abc35d21c4434bd883b9207b
SHA1 a7fc88a9aae649a95d1983e55437f43181f74766
SHA512 d251cf899ca278029208f70948a812f67a498a083117d9a807854926a3c04ad6962f950054b12f4978e04f9ced14635ba5bdc50b9bd05b6eb5560792245bf185
SSDEEP 384:/ig1EA1E6eFeFeFi1EA1E6eFeFeFM1EA1E6eFeFeFxO0zAsLARemazy0fc5CoiYZ:/qss7ssxssfo7iYAx+Q2gssjsWsv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/L3GION_STEALER.Exploits.resources

SHA256 c5e7e1b3c4b5e7d15fd1d8de7f9d6dd060a2722ae7e59b459842e8d53ea35f41
MD5 fac77d92236d4331e806919f96bd0b24
SHA1 f892b323ab29048377d9cd2b4201920e4b364ca3
SHA512 788bcb631cf11f82b0e8c2c304f882bfe640a513a19e8e98c7a7a09a1faa9d1adbe29725584c64d630c7bc114d46adc5a9d99597257c85e0269c0cfa96c5a3e8
SSDEEP 768:i5CeXg6ghgCDSxZy5zealDE9mY4UNQcbvudMO3eD9M3eD93:zJhgKSxZ6zeUDE9mBU1buqOyqy5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/L3GION_STEALER.asamlby.resources

SHA256 f0d9aaad279ed6878616eb4513d7cf65653b25099786468f55fd745ddd39af58
MD5 678dde818b6b3d79c4c8d43aa6c78486
SHA1 c20abe571fdb64f1238699775265ece42b9600a6
SHA512 be449c8192dd188e74f13ff5bc64a303bda22017a0d1ae38a898ffe60bcbdb1ad8c372cfa70e7b5ce255cc4cf7fbf68c8adef4b87a1f9aa0f2cc78720c72d1fb
SSDEEP 768:s9diAGDVs4HnQJGyhL4E8t7wp0oY0GAMpgjFInHhb8fcg9X7cBL3Bf/ZlB:cdWZwgmL4E00p0oY0GAHBInHhwff9X7u
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/L3gion_STELAR.Form1.resources

SHA256 7a6cd19ea1570ea62c838ab8c2d4f873197dcfd3fd3e4618e099dfac8f171ba8
MD5 7485a2bb306da5ee91a57a73119a718d
SHA1 37a034fe1a7ab71bb17636621b4933c6e2dafefc
SHA512 3eed46534d05986c95c1d9200bcde768ec9f6e99ddccd2e829c1f926ce82feeeac6c48e3e9a83d8408b461f1160a23a6f00e638d69f21c1cbc7a1bf05fb5089e
SSDEEP 12288:K58Cflc9/gPMlWxiD5toX58Cflc9/gPMlWxiD5to1:SRyoPMlWxmtURyoPMlWxmtg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/L3gion_STELAR.General.resources

SHA256 92a4c0c5eb57fba5a2ae4ca23e39a0643b1699182fb23072efbb0cae5aa8f910
MD5 6b091fe32a3106067fbe810f3e724df0
SHA1 57cd2c554cb89211eac11a5c80dac306e6540444
SHA512 3c75730cc2db40994748c52d26d2f096a0cfa7980e6685a7277f2ef053c89944e7c24e99096cda5bbe627b9eaa20a9e1d272fffc46ee95316038a48e0998bed7
SSDEEP 3072:CdWZrEoEhCIeRnnmEhCIeRnnmEhCIeRnnw:C7hPeNNhPeNNhPeNw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/L3gion_STELAR.Main.resources

SHA256 7b824abad32cc8497a0dd16bd8b9eee5ff36c91256d6793aded0fba2e56922db
MD5 bbcc0b2f26b0102b0fa3d4cc4d448b3c
SHA1 4d29cb49464e45f293892ba29833ee176b885312
SHA512 d3beb486d7e163014230222c22eae1e85bb013dd630e1f0d16b2df8f380061080be128cd3de35f4506d14c465db19dc6f69dbc80073d035e5c3c33c3ba9a2138
SSDEEP 49152:Ilg2gRzPMl/tLZtwT7HGKRzPMl/twZfZL:SaFPMJ9wT7DFPMJkhL
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/L3gion_STELAR.Sver.resources

SHA256 200fe61b90c4d95fde19087db525a8f9df606cd554d8f74445221d1f6a096d19
MD5 50f4b344a9c581aadb7632817549875b
SHA1 8e24d2ee3bb6759da2bd495c83d9c9c487e1a020
SHA512 e730857e3f4e2ff3ea98ddb0ce6c65cfa3591085f6d3a02b1fa36c92f14f5a101454778d20f4359d8f05ecc684e55fb0a2dd4cea64f7d0c7c5a17d0de99e2afc
SSDEEP 12288:g0ZpWfqdHuPEny2slUPGqNujwrG8MIfh/gI1KjhPe1CJr:g0Zucny2slUPJNusq8MudgughPeWr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/L3gion_STELAR.setter.resources

SHA256 277c9a89606ef6def73bb1ea1ea675cf8a54475fd20cca6f0ce7326f91315ccd
MD5 5d21cfa1e3e0cc668cb869f188fbdb05
SHA1 1e11d82d447505d7f4cf713d61f4eb758cee84e6
SHA512 334b0641d72aae52c81be1c834fa564951e5f102ed94a4f9e93977862763640a148481757d789f141806d25d89cc20fdfb89b23e353b5c7ab559e09fc1c64e1a
SSDEEP 3072:bbUgIZY8f6EhCIeRnnAEhCIeRnnAEhCIeRnntn4iBC4Qa/8e0oYPhBwfqvYU:9IaMhPeNzhPeNzhPeNhZBUe0ZpWfqH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/legionstealer.Properties.Resources.resources

SHA256 e13ed2c59366d0eea74863fd71a81f0cb977cce1edfde304fc538690a4f6ac89
MD5 cd7dbc7abeda9893ce25793744443958
SHA1 dbbbbe2694d4b9b990881f279b4313574dbeac9b
SHA512 e880f131ff460384940248ab2ecd97189ae0b7169fe5246440dfbce32f295cbd7697ce2ee65b434a0e40be91b91c21b2c14b1f446b2b1650d0a5d94c0d4f37ef
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Debug/legionstealer.csproj.AssemblyReference.cache

SHA256 ab840a96ddd59e9a1f707389b3ae6149c49a009b23ad8a0969cec2f2edde4d53
MD5 5da509105980baa0a9d4c46fa8c6d237
SHA1 bc7060cad20a9f169e64e424d46ddec295917b25
SHA512 e0763aa282da7c253ce9e426e4a7562ac61faa52176822bf21e7de9111d446a2ed8279bf7cb2e433c2ccae67a1058a0c7c750f846be3fd0265ae9cb44a8354e6
SSDEEP 768:tq5+lEoye5oB8ZIQdkNQ64okwrhWVrsXOO+bCADyLTgGpIEYS5uv8z+wHumkVXjL:B8ETL7iDRpdFkLg8+unWjfxsD
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Debug/legionstealer.csproj.CoreCompileInputs.cache

SHA256 5baa3dbee934612ee9bd72ef537de3d9d29e175ab0d31b12838ef417d9f5d611
MD5 2996c51b71a93cf1c6d76b54bb7f763b
SHA1 67610f5e196f646bb0489d3e59bba1a32aea78fa
SHA512 ab64c6f1813ffc04a41669e9e49de6da950843790eedf31bfc318a5e2399be1613313ec2f0ecb684673a81d385e83d7234594008e10b2d4bc1651b6e3e17654c
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Debug/legionstealer.csproj.FileListAbsolute.txt

SHA256 9c31f976dd18da11edb6c276569f88a1c5a1483db3a5a2f0a20da736c0627ef8
MD5 fb6d14da5a058186e66b211136f59401
SHA1 56779b652a2fd23a5c85e9de59b431d8a1462f5c
SHA512 0b729513fcdb915724c2107241f69eb7b8f9f28b3cc0faf629d4ba6bf9fba34e4c721528a3dd51f28cbc2d68569280e7a80a0b092b02f5ae0670e70175a09832
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Debug/legionstealer.csproj.Fody.CopyLocal.cache

SHA256 785d9b0b34bc712d6f5c43ca677a3f00fa31b049261382609aeafe612cb95f19
MD5 d3717c90b476f89a19b362b4115cdb92
SHA1 6f68fc42cd400c0400cfb571cde7872a3b64366c
SHA512 6b53f7b70719156847f665a8d49899ccfbbb2bdfc9fbba5e50a9c15e6980f9c0c0398fd864ef8e6abdee8da4139f8ae7450dd9a5b5e3df87ae0bfe370ca90832
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Debug/legionstealer.csproj.GenerateResource.cache

SHA256 8c3e949243697347a92d2707609e42c294ae8e335a58262310615a3f1fac2101
MD5 b402a08be219c65f5c729c5d916ad7c4
SHA1 21d3deaaf4e0a5a7332017e01cda33bad9bf8c16
SHA512 40398909bede2fec6027c3de34f29c14d89c66b877005cdd21c0f86d0fb36961ace3414106fc51ed7625c7e0c604fe229337deac8bb9727f88f72de26d680351
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Debug/legionstealer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5f4a0a9db28d595c4035c380e2a5d4d39a284232aa46dd0ddb91baad021abd76
MD5 4e3b1a3fbe54f485df9b449f85b2c761
SHA1 6450824ac372584e5066be766ef503fac3189a09
SHA512 bdcf379cfa1a0ff02126e298db15cd2c9f3d9041ebb934aeb96142ba099926fd2ed3a5a53b271e7ab9d6c4d80cd66a6eb3d3438c34a45b33902afbce98c5dc43
SSDEEP 98304:e0FPMJ2FPMJcaFPMJ9wT7DFPMJkhzHdV5RPdnASGuA+i1iK8P:dgxV5Rm9uAmf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4603182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\L3gion_Recovery\legionstealer\obj\Debug\legionstealer.pdb

LegionStealer V1 SRC/obj/Debug/legionstealer.pdb

SHA256 e33c364b9190adac414fc7c8303bb06f2f0e1aa1f9d647dc2d32a06da2bdcd1f
MD5 b26d6f34a5684fb79392ba03a9699ed7
SHA1 0dd70bb5cea1a96c45ee25ac18ec44cc23c7c754
SHA512 844389d11b9767623a25de5b4ef253595fedbbb74c778f1aaf1a3cd14a18c25c311dc5434dba9d81f82b3a3b5ae0bcf5cfba7c21f07f00f67a3c43e8b3593d31
SSDEEP 3072:Wn09rG4ANIj/LH4CkPGHCkrDav5RQQIyihP:W0l1EIjjH49uNrDaRWkih
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/.NETFramework,Version=v4.7.2.AssemblyAttributes.cs

SHA256 621199557e90fb1661e401cc9a973163c850b4b7e65bbc8d100f67f6699eef70
MD5 896ab120ac6b6af2895fdb71c452b9d3
SHA1 eb545ccd7a1bafcdf31ad0f32c09ac505744aa39
SHA512 834f53444444cee5c348da44674a2b8e6ce51f21a7565a23629001a5c535533c78a4dff8663176d982bab24f0dd272868cfc5c2fadeccc9b97a14f6946766dee
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Release/Costura/105D65BFBC12E8E9C27D6DDE9484BC85E7A7F77E.costura.jose-jwt.dll.compressed.compressed

SHA256 56ec522a1158d24782465b5dd7f8101a0f6ad5364cb2d6357a2d485c88a266ea
MD5 7e4e5e16ed417ad4cec0fb93c89f80c0
SHA1 e6e3aecfc431c75b3d4c3bae00691af70dac19d9
SHA512 a1fea15f0a844fd525c8ffeaca6a6903f566a54a857026f327135c4272720a934b102eb94c5dc5f1f7e3dd0ae709187675e2275186679cdaa3dd9429bc59d16b
SSDEEP 768:oOSFKD1vBCJEZLXOdKNiB0PhsVzbMgCM28Hzc9GMMTvDNmQ:oOSYhvBuEvieSVzbMgl2YzcM7T7h
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/14995E7F1D12498606D9D209D78D55FE6FD87802.costura.siticone.ui.dll.compressed.compressed

SHA256 d5f0dfdace6b7809eeb1587c26d2d9fa31ad1fd3374f499a47943d1bea00b9a2
MD5 845f5b188c2b2dcd89850dea8033dd30
SHA1 530a7c8c1bee00f26fcbc3dc303e5cabf0f5b638
SHA512 a6f922e5d932bab8efe3d317d724c3a0736584844dbeaaa1215ec011f6ca1bf948edeafb4d2ba6674e9a118c0fcc546f3d74db2cf554bb849ca8074b5caf2384
SSDEEP 6144:wtZoAkWJEZ1mGyFQlQ7ckn/Uo+dW03T7b+iq+FvnSsxAXboBnK5dka2UdnCetvyF:wDXMZ6GQ6ov2m+UtbVkGDvAd1p
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/19B2A8967106DDDBDB60D09D6012BAE36D0D17EA.costura.mono.cecil.mdb.dll.compressed.compressed

SHA256 a0a2a74aabda8765e26dd5c23d29f0f6a10d31a8b8781559056ec0dfa615d4fb
MD5 db4b6391f9aa487b200706e8c2833e05
SHA1 5c0738a10d6c7b191bc3a2d68eaa6c87397e4ef1
SHA512 55a220d4ab3fdebe3de11061c08bff1d7f42ca66bb45280ecdd23021cf7a49510215e1e065289d8bdab2db53eca0876af9c7adbbac117a710e4e28253228b248
SSDEEP 384:Q+2K12x0V+ilJiW4OFowDVrA36mb2yOna9tiwF0kYa9q3HJQwOSyVQPDg5QGAY1:QWV+iviW3pVk36/yOa9TkawHWIyMGAY1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/3F82ECBE123C783B24705862C066018F827355B6.costura.mono.cecil.dll.compressed.compressed

SHA256 cd328b7d21f6ff879d82d49ae6265d2051c375d937999a076e901affe754d22b
MD5 9125cd3500ab199dbb1ae7be37d35e63
SHA1 b693dabdec9711737a479c42da17a2259cc07198
SHA512 bb6f64f288ad633b3de10aa295c0dc745d0a728d478368c0760902f61fec4de4a41a2ffad41b1d0c29077624d5cf08d1af47531994bec527a35d439d1fd790e4
SSDEEP 3072:JZSB7DnVoMXZKe47q74lsvqw8Yf29xJKbh7By0zMRzvpO/kbxG3k0NEysf:/SxDnWkKd7quDxJKFo0A9vpO/uxGNwf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/4A2620EE8EADB5E8ABA6905EA4F769BA30C52AE0.costura.mono.cecil.rocks.pdb.compressed.compressed

SHA256 f581295b364b79a6518dd9f69fbf68431f33e4a53cd1bb78e086b66748a18b09
MD5 7908b0fb29d1987953f3e5cc3ac09875
SHA1 a866cb96014a8696539389b7add997b9d937f8d7
SHA512 580d05dcf4d8476df9c29e665ef0befd3fd74f988fe66f30ac2b8c762ba672fbb99a244689c94baca15f25b84a17ad02a894a176d3e713a57a049aa35af5c942
SSDEEP 96:4yURdBT7IkH1jDtKq0MAsKIUF12Xn6d+b9rlInI/gcEoUt+x2H3:4ycvIkHttK9yKhs6d+bBlII42M3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/5FE276894DD8622A389E503CACCCBE8AD89AE0CC.costura.mono.cecil.pdb.pdb.compressed.compressed

SHA256 5fe4da19f4941f9c35aec5070f1398703f46af0bd14ec0e683170dfdc69b41c6
MD5 84eb8036e93baade50743bd80c5a04f3
SHA1 2b327396eb89a90d66b5b3d35a8e51f8ced70fa9
SHA512 a8d8b57ad52841b61382c9a2bc160d771ba5d9739b577e850a9e83765a7fcdf12e599c6eb834e0a1f7aba5ef1f0ec83e5362229fd84fdcce384d864a967dbf89
SSDEEP 384:pdbY1v1sJY64ULX7EEshIbTRwS2kR4Dv6:E1tJ3OTRJ2M4e
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/6C6000A5EAF8579850AB82A89BD6268776EB51AD.costura.costura.pdb.compressed.compressed

SHA256 fbaa489666a278edc8ba51a9963f48e4dfe4c2d7a02f5454543fb87510b5dc7c
MD5 b5767ad39b384c21d677cc9e6955512f
SHA1 b92a52dca7aa6ad26eb143896dff54534153aadb
SHA512 8695fb5a7bae767fd05617bfbc36cf875b281ca7f006482cdf960b01a857b23eb27cf7dca87033e2dfa76341e5ca12e8929342c09dc52b8c1f9be3d50182b439
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Release/Costura/85DC92EDD4B0049ED9049E075C4DEF8A3D64E43B.costura.system.diagnostics.diagnosticsource.dll.compressed.compressed

SHA256 484bfd73e9877178bb82a8963305ebd8422beff3157a3ac7ee29229c967b9a09
MD5 ef497d95f8db18306b5605fd8a633958
SHA1 b65ed0db54f13ff7f2b0e9fc3fbbfbfe07bb66e7
SHA512 0fe5cd7198ca27f5efb38954c6bcba77777733b3e7bad255911b6ef495fdd0b6980862ffe4572877856ff89182062eabaaa588b789063afcb531503a5866329e
SSDEEP 384:GXFTOZC9hI9i9sOVKreONqtH5uq78Vn7tJF2badft8uFgIWFO0P:GQ29sOcqtH5uqanxJF2bCfSuCjQm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/8E69BA2487B8DC373CD39FE360E867269DE9AF19.costura.mono.cecil.pdb.compressed.compressed

SHA256 52603150682617542bc9d37c4e07b920f4060eed566aa2e66e8947c0e47a47da
MD5 24f695fe20cfed5cfd30adb668326903
SHA1 d433654db1eb265e3ee2e7733e3b51ac118056e7
SHA512 d87013634f81c511bf59c99731cfde50261520a7a9b67d1ea910d0fb6e831580754f502b8cdb833bfe944990121dcb4f62be97dacc988e82eab96fb61f6bd645
SSDEEP 1536:8/uHvy/EcyoWo6yZtU+m294RRRgOZv3+b7FKr7wjIPdtdB1GEDsNvFZV:Zv30d6IihjRgsQZuwsPdtxGJFFZV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/9C9EEBB17D714CA4AC1FF6EC7B0B28FF4F90D46B.costura.mono.cecil.mdb.pdb.compressed.compressed

SHA256 31ae4e94480980383e1c9fb6081dc3b5b327be3c2708f82175faf545f7db1f17
MD5 02edd59f9c5102c71a3867fed55e7986
SHA1 d4fc3291e2530f4cdc7b011ebb48844606b52c9a
SHA512 fa260e04fc77bd6219f3ac637d99388a95f71482d63ac26b9d1e14f3d9067ec052ec4a35e36036012cc21e378a5ca781b666aff9254f68c7278b1c6091738e00
SSDEEP 192:RW+rwl1YgONqVgoghtFzGBnxfCF5a0pUscoAtYs+Zt3ZxPYF:RJrG4YVhKvGnmwQU1CtpRW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/A1936AC79C987A5BA47CA3D023F740401F73529B.costura.vestris.resourcelib.dll.compressed.compressed

SHA256 7470f98df853be3fc739d38f4dd439788e15dfa940302e0c761f3be66ba760bd
MD5 31dcceabf0473cfbe99f7ead973a42bf
SHA1 223132fee0ffc3d5ebcba52cd53b4756f946aacd
SHA512 92728f2c231520c806a747fccb61dc8f9c7117df0bfc95569860601803c236850509842c3d99affa0db6831d4737354b33741331636f77d7204f01dce3b891f0
SSDEEP 768:8yJnqm0rkIU3uZOhhyx0UCYaZFdiagkvQDE53+q6qHGCfHm:8xhVzo4mLHZFdiKYDMJmQm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/BE0A3453276AE078D66EEBED4F3516F246805CEF.costura.mono.cecil.pdb.dll.compressed.compressed

SHA256 6ed1e4114a05acfd3d79391f965b9ff52f0453c165c4942d6f08b133891408f5
MD5 47b8e7299ee5fb6238793c5bc6540da5
SHA1 db1b71149d3befac723dd2d73f2c3e92b7fceff1
SHA512 904a326ac00a259e318d4d12792cb405cbffdf08b3b4eabc290135f5db21a677c8a0a444486df50e2e94bcea633851d4acd24511d2182eeb07068947120fedc0
SSDEEP 768:FVawZUMF5oyKv2ByNGcEPKAWB1dBRa7WA6XDbhGyH8MBG5rUxI3AjtOeWc/7:FV3UK5oyCFNbEiJLaGTtfGxH3AME/7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/D9D26753C23FAB955BB20289A20E37A1812888DC.costura.mono.cecil.rocks.dll.compressed.compressed

SHA256 c1e2e4ccdac41dde58f3adc0e0257d2c9da6dc75043da809498603b6987f11ad
MD5 9a1a0b8300b95332a175751c52b3e121
SHA1 edc7093204b03ea95f09419ba02d9fd39f25800f
SHA512 ec67cb3ee8aaf847645d9008ae9c938d2644c87e17ffac8bd71158a64236790a5e1e79784c97af0d343ac74ec665b8430c82416024a7331a09153a2de05f5030
SSDEEP 192:GunskT/JZetQjcxIGpoBsQyaUa03RZE+hC6WmaZvwevzDowlazdk6tcohtD7QEcZ:StQjRGe3yO0wr7Z4OJmk6n7QcS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/Costura/F1F25C01F6ACF33BDD62C4F82D3EF078E76F0906.costura.costura.dll.compressed.compressed

SHA256 74291771dd1f0338517e85182e062a96279f6e4ab8251502b8f7d1c33c6ce655
MD5 786a1377c3a7d94f8294f48f1f20abbc
SHA1 115046c4ec98cdd48f141f4d086dc6b896287714
SHA512 aac4fb8b94af5eacbbaf65181e036005ab6a4285529ba7d9010261f15588854630f2804a6764c6e09f715d4bff0adaa22d94a1a7ce5d8369afad183b75ea8f6c
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Release/DesignTimeResolveAssemblyReferences.cache

SHA256 4a20ee37ea3495c2559a63636e1ed09a171ae45b70f3cdba77efd7b3c4bc5014
MD5 71e2074eccd900f83ddd2afc3a9e90fb
SHA1 b36dff13eac698b62dd1005815584866a814ce47
SHA512 6233084ad2dcd724a786272ab8d84d50bb0d6185d32a4865b3853913ec4871cc6514a4269b5a622ec19076ed3f699bfbc3de602b6e5a924b75088359134d7f2e
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Release/DesignTimeResolveAssemblyReferencesInput.cache

SHA256 116913a9dcd3d0f99ac979bec921e869db974b9b696728403374f49819ffacd4
MD5 11aa3ed88dcc13d4fac44d14d4895559
SHA1 6b1ac3ee0f91ec8bed68349495b114512387805e
SHA512 c54b7b34f56d52719c53847df3274b33f0e3f0688e4e5093c72f0e464d8b8a0479405920ced819b71137fcc2ba9270a3a738c5cd38fb3477c88b14d0261b8d71
SSDEEP 192:v/uuMZApb9McHaj3s8CiKickB2xH6OOV8PmD:vmuMZAphMcHaj3s8CiXck4xH6OOV8Pm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/L3GION_STEALER.Exploits.resources

SHA256 5e6a24a30a7d295219892db76cc0da8f18e3685cb2de2661e33dc35a1e9b4e85
MD5 909770d46fc0ee283ac142fe65bf2df2
SHA1 ecee65d794a4863103b6c02a2971e523b8b0ee38
SHA512 ddd72b9b7be57914d31dbc92d7b732fd5b89d48687905e2f753b2eee7564dd8475221da0c2759172bf8c677e44a2fb32173b55dad899377c2a79d7377d109611
SSDEEP 768:i5CeXg6ghgCDSxZy5zealDE9mY4UNQcbvudMO3eD9M3eD93:zJhgKSxZ6zeUDE9mBU1buqOyqy5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/L3GION_STEALER.asamlby.resources

SHA256 f0d9aaad279ed6878616eb4513d7cf65653b25099786468f55fd745ddd39af58
MD5 678dde818b6b3d79c4c8d43aa6c78486
SHA1 c20abe571fdb64f1238699775265ece42b9600a6
SHA512 be449c8192dd188e74f13ff5bc64a303bda22017a0d1ae38a898ffe60bcbdb1ad8c372cfa70e7b5ce255cc4cf7fbf68c8adef4b87a1f9aa0f2cc78720c72d1fb
SSDEEP 768:s9diAGDVs4HnQJGyhL4E8t7wp0oY0GAMpgjFInHhb8fcg9X7cBL3Bf/ZlB:cdWZwgmL4E00p0oY0GAHBInHhwff9X7u
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/L3gion_STELAR.Form1.resources

SHA256 18828d45cc8c46c319919fd5fb92500d67a9589668eb076820b2c6380f15cd9f
MD5 997ba98cc23f8e3ff823a0d618b2d1b3
SHA1 4200235a5ecabfd12055954722bd9e35741d3baf
SHA512 d4e992bc4dee8552523d4d7d9da6f921909ccfc62b03cbfe644a74d6a89a6387923fa5a957655cd47b3c7fdb4cbd0b8511bdd27fa4ab02a24b5e356a9c7ebaf5
SSDEEP 12288:z58Cflc9/gPMlWxiD5toW58Cflc9/gPMlWxiD5to1:lRyoPMlWxmtTRyoPMlWxmtg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/L3gion_STELAR.General.resources

SHA256 e13ed2c59366d0eea74863fd71a81f0cb977cce1edfde304fc538690a4f6ac89
MD5 cd7dbc7abeda9893ce25793744443958
SHA1 dbbbbe2694d4b9b990881f279b4313574dbeac9b
SHA512 e880f131ff460384940248ab2ecd97189ae0b7169fe5246440dfbce32f295cbd7697ce2ee65b434a0e40be91b91c21b2c14b1f446b2b1650d0a5d94c0d4f37ef
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Release/L3gion_STELAR.Main.resources

SHA256 7b824abad32cc8497a0dd16bd8b9eee5ff36c91256d6793aded0fba2e56922db
MD5 bbcc0b2f26b0102b0fa3d4cc4d448b3c
SHA1 4d29cb49464e45f293892ba29833ee176b885312
SHA512 d3beb486d7e163014230222c22eae1e85bb013dd630e1f0d16b2df8f380061080be128cd3de35f4506d14c465db19dc6f69dbc80073d035e5c3c33c3ba9a2138
SSDEEP 49152:Ilg2gRzPMl/tLZtwT7HGKRzPMl/twZfZL:SaFPMJ9wT7DFPMJkhL
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/L3gion_STELAR.Sver.resources

SHA256 210fff1da7a2625f824d7c2e6d2717e05f63fcb12cbc6bedaf41ab4d6de68834
MD5 a1f99d123f4c41e06fc5b2baa4e5f6a9
SHA1 ff88c906b172fe9e161874700b3d54a99a81d06b
SHA512 d62417d43c1e5d61d03d149163cada06e6bf3ab1f5e3e88d0583827a8f0444e64516c0dc8467941fb6b643d090f8e91ca56a86f3c78ead4ce537c2a9f7c0604b
SSDEEP 12288:g0ZpWfqNHuPEny2slUPGqNujwrG8MIfh/gI1KjhPe1CJr:g0Zecny2slUPJNusq8MudgughPeWr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/L3gion_STELAR.setter.resources

SHA256 79a6e51ab808c9f7ce850e2670a3de3b891639976da7cd0e6319edaf2b5f5e23
MD5 353f2f2dc1fd41e1e6c577f8bdaad5c1
SHA1 7f66e6467fb29ca0d6e0c7d55acc076478196902
SHA512 21913e2e9c4be0de2d54b26a0749dbee803b0ef167ab31797cdae5df9335dae1bdfaddb7fcfb06c1a69d64dc80d78200d89823476cf4da2239dcdad379fd8538
SSDEEP 3072:XbUgIZY8fOE+UyNO5FE+UyNO5UE+UyNO5Nn4iBC4Qa/8V0oYPhBwfqvtU:xIaKmNiemNinmNiBZBUV0ZpWfqi
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/legionstealer.Properties.Resources.resources

SHA256 e13ed2c59366d0eea74863fd71a81f0cb977cce1edfde304fc538690a4f6ac89
MD5 cd7dbc7abeda9893ce25793744443958
SHA1 dbbbbe2694d4b9b990881f279b4313574dbeac9b
SHA512 e880f131ff460384940248ab2ecd97189ae0b7169fe5246440dfbce32f295cbd7697ce2ee65b434a0e40be91b91c21b2c14b1f446b2b1650d0a5d94c0d4f37ef
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Release/legionstealer.csproj.AssemblyReference.cache

SHA256 ab840a96ddd59e9a1f707389b3ae6149c49a009b23ad8a0969cec2f2edde4d53
MD5 5da509105980baa0a9d4c46fa8c6d237
SHA1 bc7060cad20a9f169e64e424d46ddec295917b25
SHA512 e0763aa282da7c253ce9e426e4a7562ac61faa52176822bf21e7de9111d446a2ed8279bf7cb2e433c2ccae67a1058a0c7c750f846be3fd0265ae9cb44a8354e6
SSDEEP 768:tq5+lEoye5oB8ZIQdkNQ64okwrhWVrsXOO+bCADyLTgGpIEYS5uv8z+wHumkVXjL:B8ETL7iDRpdFkLg8+unWjfxsD
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/obj/Release/legionstealer.csproj.CoreCompileInputs.cache

SHA256 860953cbb83917d08ab356a00631ec9e54f054b9725cefac9917d33b7308c4ba
MD5 114163626cf240344c9db2121c1dd616
SHA1 1153830ec1f0e23cd54d9d3ba168a3c54c857596
SHA512 6d04f415c1e6f3f64f1fbd2c899fc39e919f699fb86c6606c38b3b6e984df3a8dc8f5280fbca8431bfbb0e9cc3cd20d7741022f6285e107b5789f7ffd90f5c7f
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Release/legionstealer.csproj.FileListAbsolute.txt

SHA256 07a3456fcebc249cf98f4ed663545e853287023fd98a6d5ff6ebb9bdd728d9aa
MD5 e861c9c69279976eeba66b077227cb65
SHA1 a9eef1e4adecc23329f8d74162863e3815b882bf
SHA512 f2a463cdfa865b001cb9524b97303176112caec4743c56d631a85119775351d9abd5057dade0d57522fa546343f02a5c4f760664077b910ce50fa481d7f81699
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Release/legionstealer.csproj.Fody.CopyLocal.cache

SHA256 785d9b0b34bc712d6f5c43ca677a3f00fa31b049261382609aeafe612cb95f19
MD5 d3717c90b476f89a19b362b4115cdb92
SHA1 6f68fc42cd400c0400cfb571cde7872a3b64366c
SHA512 6b53f7b70719156847f665a8d49899ccfbbb2bdfc9fbba5e50a9c15e6980f9c0c0398fd864ef8e6abdee8da4139f8ae7450dd9a5b5e3df87ae0bfe370ca90832
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Release/legionstealer.csproj.GenerateResource.cache

SHA256 89d50a8bedc342e8055266d3251e296fba0f6c7619b96e60bde9521d737b4a1c
MD5 360348eaf4def052c1e8f70647b02f68
SHA1 f2b514d9b9d15dd4469205cee73e5b9cad87200b
SHA512 bac5ea4babf143d43f781607b4172bd6d38f2dbebc95ec53c73d017d2b454d0b4706e51e439a690f9fe53be12afad22c2d9d771ce967807290521e1af2509754
MD5 SHA1 SHA512

LegionStealer V1 SRC/obj/Release/legionstealer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8b336346ba44e4a6db56070eeffd741234f6557a213fd72bc0efa705930e7de2
MD5 547bb91afa2e38b63bbc57f0adf8583f
SHA1 cc6c6cebc870f63a1a40a57d9b8ce3cbe8ce36a2
SHA512 20a31dba79c4cb858891264f70f1a4cddde353e7d7bd8bb753b74551d2efdac8d65cb20635fcf56bb1b8df3bd0162dd449b63cc926152e61994593fd9a480863
SSDEEP 98304:l0FPMJ2FPMJcaFPMJ9wT7DFPMJkhzHdV5RPdnASGuA+i1iK8P:8gxV5Rm9uAmf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

.NET Reactor proctector

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4595758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\L3gion_Recovery\legionstealer\obj\Release\legionstealer.pdb

LegionStealer V1 SRC/obj/Release/legionstealer.pdb

SHA256 ca00bd04b05459283a8ce6261c1d62809081f360d52cedc9f21e6d3fdf1f659f
MD5 4f20a7103e94c1c1542c3290f25cdb93
SHA1 0188c308582fa95f17c4b5be93e955e1928c38ab
SHA512 460c63fde33101198d43c8112d4c712a1b2eafbd12270e8c9ce66b80faccedee72a819dbf373e9bc72a7388338e9f7c681c3d03441d632f6164505998c2da1fa
SSDEEP 1536:LwblW6Rj3uTJlBgbQ2nZ+PSKzFMohXub7KGImJEKV4HBwfCT+s2NZg3qSCZRcL3L:LMuTJQbBnw+/KbWEK02x2b9rr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages.config

SHA256 304f83ca6ffa374667df2d0fa36d7038b5957d1c91604f79d4f54686b46a73b3
MD5 d5376cf1454986949f69ee2644cd642c
SHA1 a7f4b6198889ab78977e62935146482ddae47528
SHA512 a04642583a41eae5859e33555d45134cf44c5c1c9a6a7e4e0c715b19c1ea94c63a415a26c76ace47572058aa2da6eb6d995f26d4f0a6fe08c8fa808f75dbb0b7
SSDEEP 96:zIHOHlHwHzOHzeHX6H/H0H1hH18H1FH7HOHnH+HrHaHSHWHdHzHJHoHxH9HTHlHY:zIuFQii36fUVhV8VFbuHeL6y29TpIRd6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/.signature.p7s

SHA256 72145bcf2097a4b4c053ff86752e901777b8db6f8ee47c770442287825c4f677
MD5 150d71ae5352add327c63224bd0c297c
SHA1 14fe97f0ae68062d601dee915d1302d3d761cb05
SHA512 1e624fcae73e8512714da19acc9786a39cfaea0f2fb3ab47016801fddd01cdbaef7a469135f15bfae0e231518ee6d66d1c67ea4d6329fa949880993b153e227c
SSDEEP 192:xdn7x0KDWpHiX1x3i1+GDH0JOqsmVgz28WhBqQNjZ:jlvDG6w1+GoJN77hhrNjZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/Costura.Fody.5.7.0.nupkg

SHA256 81fcc69e121910d1fa9caa5a9925baa054dc5f8c51d9445c6631b4b5bb63cb35
MD5 bd2fe1fdd4587222981bd1a78a5c1b8e
SHA1 cb170e824f28343d8f2b6ac9673dd40b9eb7fcbd
SHA512 1e1bb8e77745c87695f12eabf29b15638f4064e2d1542653f8a93f0493b0a54e125badfd807fb5c9f24df6aa82c7aa3fa2f0e4de79d51af9adb44c844db9ae49
SSDEEP 3072:2x5xIO6/sDzI0HKxnbRW7ZnqTzhrRCrJp9uAy7xH1lu7TaRPq1HFawduAnGsjZNl:2xYJCgw7uRC/AAy7xHfu7GdeHgwUAhjl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/build/Costura.Fody.props

SHA256 c236200cd8882365e7a045311de18bb6aa77194d0094e3c6aa0088828b440c28
MD5 495c54ae2cfd43f40a420053abedb0a2
SHA1 73b7ebf914647ea63686afb4a67980ff195e74e5
SHA512 102cfac39756bfa927c211f6dd0555682a22a4ec2d8fd2220a1cc43bbab7e60adb4000e7a0ff6066d1935b1fdc87fbca73f62c396beb5d8d4246596cfdf71f73
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/build/Costura.Fody.targets

SHA256 a0962921529eda4ef0ebf5e7e0b907baff1425926236182dd46609138dc0e8f8
MD5 307ddf9f6cf5a14d0b10c9406a19e5ba
SHA1 09bca78b138706ef5d22a808329e9289e5934a11
SHA512 f32a8a0b6074ee424e7bb94c4e1458e53a8a84abb8ed772cc49a9a5c119eb99c6caafad1d1f2d604b45d8a8ebe3f48dffb6aa68df9266f89e80d2536eb525488
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/icon.png

SHA256 385bdd476d1c98e2167f647a341824e0f0d18da3cde8800998b05274bb38400a
MD5 0e1e0712ae2d30c298eba0631f92fae3
SHA1 c4dd929e4a9f39c0a0b675a2f66f0d9092ba7230
SHA512 375663fee23729ea0178618abb2e2fa044d13c248955b4c8656861f0dff8f68e7e5d82b2d052ba6f5bfbb0db7942d009e27909cf74dee8e040edbd806a960698
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/lib/netstandard1.0/Costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41bb464ac7c0d192641077e44a59d7d89860c3c620a59961f2fc4a4be47deae3
MD5 501981c7fc457d59238eb99780efb615
SHA1 f1f25c01f6acf33bdd62c4f82d3ef078e76f0906
SHA512 5921d0662add6c8aa075106878cc56335ccbf059d8bc7f359fe9e02a52ec657c3e5df1c718929564c09f205e4bd299b086f3e7424141f5e55ed0d756f65ee1e8
SSDEEP 48:6F+lni2qJfjVRPGwzCo4MhTN0KDdilETrVsH4/QWk1qyFVT2IbG:7g7KedGEiYIWM2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\198629\Source\Costura_Fody\src\Costura\obj\Release\netstandard1.0\Costura.pdb

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/lib/netstandard1.0/Costura.pdb

SHA256 89b13aa6efbc0b04745a00bb5fcf05b7a4e3537095bde974ed3490a9cf582d17
MD5 34b42a5776a3ad022b429124d55e576d
SHA1 6c6000a5eaf8579850ab82a89bd6268776eb51ad
SHA512 c24bf10e1d95a07fcd65c1f7841d2d4bdf25c5db02f5f4912286c8d6c077fe8bd3fc564cb249cb4ae01aed10889f25cc22a48bd9698499ed556560d0621a64f4
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/lib/netstandard1.0/Costura.xml

SHA256 22026564fc951d60816c6689dd4b1825f07fb3c8c4495041b52056f397468297
MD5 fd011713c0a2dbc1d90507a54e9c7b3b
SHA1 edd14b69941c44e8914f23cda1fddf9ee617c5db
SHA512 8b7504f19f0b304d9d513d8138aa92aa6421a26c505f7ec7e9cd39d867d9cbd57ee1063a4b5e770234834d2351a6343537e9898135b4f9f603e43cda4a3f9c93
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/netclassicweaver/Costura.Fody.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f925017acb08ca6f8e99cd28cd6140c153efe5b241111de36b8b917a302794fa
MD5 d6ef4e35f96629ba9f9176cfc4d93b38
SHA1 2adee63def25e2a5993ea793180634a1d2946fd7
SHA512 d7abb5932d7b0521816137c946a80400cf573a5047c440b9a78c4670b6926e7ae130608e6b2fa0b5e65478bf986d0e089168a80e13770a0bf91ea7a5529dd715
SSDEEP 3072:y+bjLBzNAiYBnAjJuCxp8kvyUUs38lsDJ5Qt/Dxk4HA7lmmVtGzGzxnzmoMi:y+bjdzNA64DlAX2zGzpzm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

203810

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Costura.Fody.pdb

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/netclassicweaver/Costura.Fody.xcf

SHA256 8dc4d029096621feb54d78458803c0d2d1c6df115d0ba4de3369e1a8dc19ffba
MD5 4047d201a975a9babaae5a4eb023921c
SHA1 ff94fd0cd1ee2b9a7b99a28685c38377c767ca78
SHA512 0def1302147e0be9ba5390bff27f3f579407a96774cffe76c4d0828a0a7c5cb05e4b3ad3d9bfbc659ec8af31cc3d3937943ab6a908983ed330684a2b8f25da74
SSDEEP 96:PGyYPyU40JHQa0pvcRLajMoCyytNXwytTXvTP8u:P8Jwa0pvcRLajMoCztJTvTb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/netstandardweaver/Costura.Fody.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f8d0bbf51d54411c96b26fcee9a60d73b1170c40acb5586c9112f5bee6a23acc
MD5 cc6fe95d22242e0eaecc751647bb58af
SHA1 1aaa019f088fdd20862f97217bd347331b5bd714
SHA512 7e6df47eef146a9a87633ba6183121e1fffd1c3e330a2cc22bb0d915d54e162d589b8250ce867c3002fd49668f704adc0cb465afd8deed1efe7710b6e7eaacec
SSDEEP 3072:t+b5zlAkYBmrJuCxp8kvyUUs38lsDJ5Qt/Dxk4HA7lmmVtGzGzeIq5zhou:t+b5zlAS4DlAX2zGz1qla
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

206498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Costura.Fody.pdb

LegionStealer V1 SRC/packages/Costura.Fody.5.7.0/netstandardweaver/Costura.Fody.xcf

SHA256 8dc4d029096621feb54d78458803c0d2d1c6df115d0ba4de3369e1a8dc19ffba
MD5 4047d201a975a9babaae5a4eb023921c
SHA1 ff94fd0cd1ee2b9a7b99a28685c38377c767ca78
SHA512 0def1302147e0be9ba5390bff27f3f579407a96774cffe76c4d0828a0a7c5cb05e4b3ad3d9bfbc659ec8af31cc3d3937943ab6a908983ed330684a2b8f25da74
SSDEEP 96:PGyYPyU40JHQa0pvcRLajMoCyytNXwytTXvTP8u:P8Jwa0pvcRLajMoCztJTvTb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Fody.6.5.5/.signature.p7s

SHA256 275ec762d5ae4eeebe61e2b466b58eb6f0f01c239291bfeba30bf86555780e8e
MD5 a73cbd48b3178a4009ae5db5cc392579
SHA1 16ee5e40ebeb60a9d576629e068b16c3aa7efc7b
SHA512 2977eac13d120fcf62caff727bbf7f0d31b2c906100a1381de064eb9ee2b8972ca3943d9ea521f2b5b34a9194aa72a928f3d8b13250662f7b11a16261facd8db
SSDEEP 192:Id97x0KDWpHiX1x3iVkN7GDH0JOqsmVgz28WhBqPv:QfvDG6wCNGoJN77hhav
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Fody.6.5.5/Fody.6.5.5.nupkg

SHA256 9b2a6037f41f4d31488fb91b735f73925dd36c8d77ebf3e862a00c5ab366b45c
MD5 e123b11b6c958a1d01a8f9521d69c8c9
SHA1 42f92787afbc43c63ce86373a4b8beba2806da48
SHA512 84739822943b6ab6189b337f99ac5fdc5ae290ea85debe8f1e44bec5c2f175db5ce17bf9b62dac6c49e502028514bcdd6eb4dc948528c67e5aa5e1d80da1678c
SSDEEP 24576:J3hsvvKnHVhgPo+YhL3/OSfZynH+6ObSAK9rLHibcuAV+s:J3hsChgw+q2ShX5K9rjik+s
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Fody.6.5.5/License.txt

SHA256 967178895ccc4c3a45b7c76c430df06ec567c361f085a4569e8ca8d2ee16f25c
MD5 447298b16e32dd1c2fb8b6277f35672f
SHA1 e6eb7588c26cd5c70ecb9a03171e261794612c5f
SHA512 a8e3b577307de9310ff09ef29d3a24c914da2b19c30be8a981f53f773de3501182e89d029b320516ccc984c2b9189d40041ed746d976213a9435ba8bd708e62a
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Fody.6.5.5/build/Fody.targets

SHA256 9dd30bde37e90226dce988da30b707ce8df038cb6f9e0825c114983bc8cbc765
MD5 dd49b0d987669a20c0279c47e724a7e4
SHA1 983418de01ae17d498e1c69ee924184769fe6c72
SHA512 aa0148eaf6ed7fb8837e90a87be6e0c7fa7c642553e3b67974a95f4c8bff12b538c2d1c398d83079f68e9ca5039f5edb01f79e54cd5b42702fe20d681806d46f
SSDEEP 96:+ljGTPR6cXU1crocl9hXP3olOq9Ejd+Z/6/tNbrjg:NLwcroGzf+9Ad+Z/6/jrjg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/Fody.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9c3d1a0091a603d537aa318b8bac80189de93a4e376e9f6ec15390c323fd5338
MD5 eebccd5445e6718327dc9ddeec0a05fd
SHA1 536be78f16d80b9ff4c988aa4240d6f3a5398750
SHA512 0a15b71cbfd150f04cb0ab9832c2042cebff569ee75285a74d9dcfffe1c23b1887d2fcf88805a24159855d2399cffb59fdb83bf3864ed0d91b5a52a9de5adb88
SSDEEP 1536:2GUgeGh52TCdBtbqleegmPMLKtNpQLqfHy+xgZ/TT8CZNhdr:2GUdKqfHzI/T9Z9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

61126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Fody.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/FodyCommon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 04f9116467f2f894d48f0033c39a36a6813a37d4784a6d7a4d2df925511d51e0
MD5 02b4adaa2495e04ab3a6fd03f0468efb
SHA1 bebbfceec09b37e7fceaa0a5867563396fae0afb
SHA512 95a673973c91f472b714eeac74d94053ce717052118fc6e1cdb5bb27c4fefe380697ad5fcac6d132915420a1dcdd1829386b33e8888558d53b0e167727f658e7
SSDEEP 384:jeiGwElUsXsVJlFmd89kMLCLcfKy0K13DBnZYVhB:jeiGwElUsXsVJl8QvCIPxrnZYDB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

22522

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

FodyCommon.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/FodyHelpers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 26418e5dfc750c152f6884851b504a2f5d3ca2afc934d4b39b753f4b7b362caa
MD5 ec8aa2f38c6fa83becd691f63307094b
SHA1 14bd22d0784b96d73c0f1e40e64b10e882578d47
SHA512 81db04019805335cdfba38461eaf0bd945ec028fe1352412148883b601c116ff4b06e845b34ddea71afc2d4ca9ef69082c0717183d02a18569de500fb0d8196f
SSDEEP 768:uhBgN7xSVi92FHlW47zSTKd8dbpuJqytRzbRHKrem:uhBgN7xSVsUqQ/Zm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

56858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

FodyHelpers.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/FodyIsolated.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1dd081bd37cb4b6b2ef5b84793ff6191f5841028648a5db7a566e9dad7dead0b
MD5 059cb694f1ce247c96e7e318a42cdaf4
SHA1 12cfa96e9e797c644899cab98acdc2a5d11255c3
SHA512 900316a92dd33476c2882fe8fa35e77a09ac36bd94141a5fed988c496d5d1273e68302fa0c704a4503ef474dd6c0ec8bf0044e33fd4010b99b1e20ff580e960d
SSDEEP 768:yS6l9mpchJs+3NKHlPKYmpplcmq4HgFhj5mxD:J6lMchJR32lP+pplG4HgTj5mxD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

47498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

FodyIsolated.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/Mono.Cecil.Pdb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 883725203076127e02adea2750e83d88b3e4635ae84098f1a08fe995992d093c
MD5 797be332f0278dd9cf9506c6bd7398f3
SHA1 14acbd89258e7653fd2fd8b044a4b13fc0190726
SHA512 5cf0550c61bab52d10d9c73a9e445c5877294698e71aa0830ea76b67854842bccad73fdaac3066806e825dc4b3adc3e6210204377af971c09b3fa1fca91ac3fb
SSDEEP 1536:0OCAsdBo+am5OMwr5IFALYKXgAJGsZhajrmvjCXeq:vCjta0OMuIFArVJGqa/mveXeq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

94986

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Code\Fody\cecil\symbols\pdb\obj\Release\net40\Mono.Cecil.Pdb.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/Mono.Cecil.Pdb.pdb

SHA256 e7e31b7197725facdc1a09bcef48a5e5c647e532f500f471b3be1d6395d17c5b
MD5 13fe68b4bb1170526946eea354b457a4
SHA1 7958c2b5f97f623826224733704b8fe83638fdea
SHA512 9e51faaba75e2318fd3141229bbacfd881086baf380b8c0a080002c59ff2d867fbf18e2951eab64a59696032cf92fc1d79deeffdd7d02f1be2fb7fe7a9db9aba
SSDEEP 384:RywobrKZv4MIakMhVPwH2afs1Ns/zayACH8edTWhmt3sqMW35OQ9nBZsgLOmQVsZ:RywoPskcVPwHXIsmy5XdcmaWzdsgiI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/Mono.Cecil.Rocks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d05912f97fba499aab4ea6d55b51434d8033f92ee0d7b95319432b84c7d2c088
MD5 42646e3430c03805ea4803887419e2ac
SHA1 2f812ae7514350aa9ff60bfdf58ca84cc7d3b5a3
SHA512 e99e70d7211110248700ff8ff848a9cc9c73aa026d2f8fa5b56c95d082b0f5ea680fe71014ed024d3b0bca532048aa3222f226eb43cb67ad3f5e99f44e106459
SSDEEP 384:N0vJ8JOuJ8iC7n2NwxEfCnoS+TXcMeDz8PmR1ugLoaeuLMBG9UphJAprjE0uFLIs:N+11iCyrfOWA8uRssveum1pZFLqFlD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

33578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Code\Fody\cecil\rocks\obj\Release\net40\Mono.Cecil.Rocks.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/Mono.Cecil.Rocks.pdb

SHA256 3c12e74e1dc4fd1dab2e3e0569970c902c1e53fb6772dec4d99b4a33eef1ecd8
MD5 0232246871a06c898b2702dcff936e8b
SHA1 c3d5325a197927b31eec7b4ea07b14688ea9855a
SHA512 03fe179ad3cd436674a1474aee0d7357001722d60a610f3373a7eecbbe8a1f6eb69efb94d765909902a66c92687448fac37abf6d9d926a5e979d3b63d23a7d1f
SSDEEP 192:WsbC3/dSeMDK5YQyvNigdQm1MqxauoKi+BEyKKJYVx2P:dClFevggp1MqxnoZ+e08C
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/Mono.Cecil.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b3e4d337d31dd4bd12f0e0191a247812e5e6ba423e517b472795fdc1e8da8588
MD5 31f740702e2085f70189bf9fbe0d6511
SHA1 af0866fa8eac947684201c06a7bc90a1cd955555
SHA512 c9160443f819fe5e807122a7cf9197afbcb2b21359d9361ecd3c8a625fabd205c2895dbff79751f2449eb1bfb3de92d56252d5ee0e5605e358bc8286305e6f00
SSDEEP 3072:wa37Xees6DxVIryfGFzktTV6pZ3JelN+0ND0XJac+hF+Ba6SqWSTICEoX2hCnFHS:wgues6DxiSTV6ViDnqWeEomhUF5zm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

362202

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Code\Fody\cecil\obj\Release\net40\Mono.Cecil.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netclassictask/Mono.Cecil.pdb

SHA256 d847fe244afcb9ac8fb314101e6559fa71c2bdeae9b93f7b2f69cc3ae38ce4e1
MD5 e54fc19e265eac470f0667b972d74ae0
SHA1 b45ec74ee8932231eac236441b18a0359a6ba2aa
SHA512 e057babc1e00572378823a7ab70bdbc1fae82cc613df50bc92818e2cacc7ae8452e37e03f36e7825cbb242b365004fedacadad269ec24fcabd85a50915a789ad
SSDEEP 3072:wcZO/HCKlRVQDzR0abVUq0Ihfhq5rJ/s4MQCHCKB:w1CkRVpIdM1jKB
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/Fody.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b154efbbe3b25f19881f79677252869208d64b84570519e8050930b967b8f060
MD5 54af513a66e0c8eeb72e49b10d9fc35a
SHA1 ccb0d7422d347161996d98eb1d14cd545f96c375
SHA512 6c38518bba279ac626cb55fc93ddf664a816916491268b73685065a1b0eb0d6adcf51d800fb52f6de2eeab100c15f692dee00e76423a3ecbcbfb79afc6cfb077
SSDEEP 1536:GGUgeGh52TCdBtbqleegmPMLK4QSJpW+JgchTVqm3Utdr:GGUdAfhTJ0d
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

64438

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

Fody.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/FodyCommon.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e0bf03e386d8ad436d7f95b671a437a33321cd7c6835eaeb1c95ffdc129802ef
MD5 bf609dcc92653505915e5765bef5dd23
SHA1 2751df396de14c5d7effbc2c20447212641e3508
SHA512 60d2270f39579b060f8b435c2cdb122fe8166f3fe5514871ef8e46ffdb561b0b186f94bdac848a7196e264860b02edb2e1c3b6e8283ef9a5a987a3b84cf8f248
SSDEEP 384:LmuF9FYgA5XOGkUQGDlWq/Fg7/hcYWIH80RhB:Lmu14XTEjhbWPqB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

25634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

FodyCommon.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/FodyHelpers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 26418e5dfc750c152f6884851b504a2f5d3ca2afc934d4b39b753f4b7b362caa
MD5 ec8aa2f38c6fa83becd691f63307094b
SHA1 14bd22d0784b96d73c0f1e40e64b10e882578d47
SHA512 81db04019805335cdfba38461eaf0bd945ec028fe1352412148883b601c116ff4b06e845b34ddea71afc2d4ca9ef69082c0717183d02a18569de500fb0d8196f
SSDEEP 768:uhBgN7xSVi92FHlW47zSTKd8dbpuJqytRzbRHKrem:uhBgN7xSVsUqQ/Zm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

56858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

FodyHelpers.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/FodyIsolated.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 613b3c2926d41fb998cfe2813f331063eb9d26f5dcf824855e84e3c88b7e7c01
MD5 8c356aa84a807570625cc6f2dae889ff
SHA1 e80d7f98706d37c1ea6787cf61ca9433b30c15e4
SHA512 4a22ed19af9f864060497bf56f09910d5eb85fc250cc90797691030090ed711f96c5858fb240849226e8cdb60fd03a18e688cda768a358c0e26273df1cfd02be
SSDEEP 768:pdZppmh/fWokm2vyWMs1Ksm8pppBdlstv7acAg0VR+MaAD:p7pp2/NYqWpssppBrs17abgfAD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

50346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

FodyIsolated.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/Mono.Cecil.Pdb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c9455b3a53a71b7c9e24125d74e4e6a07dddf83610124763da887890909d24ef
MD5 0ee46c7a4e8f97c75de70845ac5eebd7
SHA1 f322f33e38716c541a417d39ed2b2ce18055836f
SHA512 fe2106ed7947109253f65bc46cd870ae099d0b472678ef694cd2c215afc9817cab6596ed9b6173ef093e66b26abefe64b254d3f9c6bdf582273084cfd77af03b
SSDEEP 1536:DOTXdiVgzDKG2fNRck9FRcXRHr5vsALYKXNgJGsZ9ijravjCXeq:CT0W2fjvm9uArWJGci3aveXeq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

94978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Code\Fody\cecil\symbols\pdb\obj\Release\netstandard2.0\Mono.Cecil.Pdb.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/Mono.Cecil.Pdb.pdb

SHA256 9ae2ce6effb5956c523a115b7c87943ca66bac1e44d940a20a310aa45bf315ea
MD5 b8e0ea4e696b2f7b3dfd7e17d58a2362
SHA1 2ac02a049bd6da48316d81b46784c04cb5015db6
SHA512 79f72255afbc8b99dac6271e0e741c9dadb0e09f6eb67c063aedb92a2382441bf97dde8a7c8bdafa576e394c248ffa6338d2e3912a06e6ceb6f24ccf852f0c59
SSDEEP 768:RN9PPPPPPPAkcVP5+6Fgsmy59uqQToOwu6n7MdcmGchnskbx:N333ov+6FgsCU7Fmbhh9
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/Mono.Cecil.Rocks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6c51e878f015ec912b7f0767b290bfb695d5686a22f63265b2e27da948901595
MD5 f309641eb0f212fe99fa2c71f71d349e
SHA1 714a93b58b0a6ac9940b89822f687fec05dcb963
SHA512 2c0d60448376139e343151ab79985507740d9f496b520db339e16ffaf8cd4556420ede575cc6e654a74dc7fa4171a1f0a5e8ffcae63702a7889526f3e77b8209
SSDEEP 384:lWAOZBPQa5nFlULQUqc9H55lk3jubXcVXD9PmROMLUBLMWG1UX8JvbrjES1Ouweh:sVtHq5qcrk3ZuROoUBBLXXS6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

30674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Code\Fody\cecil\rocks\obj\Release\netstandard2.0\Mono.Cecil.Rocks.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/Mono.Cecil.Rocks.pdb

SHA256 26d2a2623abedafeded61e6f11ff9654afed6334bf0d4a6994aa1e85f3d65bf9
MD5 3651713ae2788c2a763514fd6bad623a
SHA1 fcb799801c43cc5055c1d92d661c7336a062e944
SHA512 cdbe7363eb3e9052a8a0de23263ae14a5e38bee4c6a9c22b7fdf305768c27b66133cf12e8f7742ef5d7d9216d4367782713f809849f54a8387ad89b0d6b64d74
SSDEEP 384:BCAFevggv2qN6jMai+NLy5nj4SCm5Mz6QkOAHOuXch8hoqxnuZ+X0e:oAzgv2qQToOwu6n7LxN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/Mono.Cecil.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c07648367d29e366b89588aa743cf7606f00ebaddcd4717a449b0d9ce3ec3385
MD5 8c82390a26b4f0115a616977a78ee65e
SHA1 305937b9856d8954b43d4ac94c3f7827dcc68a86
SHA512 e1521c2622b55d83efc4c24e6de25c86ea4fc39bd711e4638db610fd6c2ede6b91acb2a3fa4353b8099c17bc86d009c9bbbba9367540d36f05bbf127300e8247
SSDEEP 6144:k4nW05aYyN6Ng0dLANxYc81qeomZeFZ6tJi:fnGsNjdLANXeMFZi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

362410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Code\Fody\cecil\obj\Release\netstandard2.0\Mono.Cecil.pdb

LegionStealer V1 SRC/packages/Fody.6.5.5/netstandardtask/Mono.Cecil.pdb

SHA256 8ca54ecbe62e5d6a3a3224eb2a3d2c82b7960c2a1a60d3bcfe90c5e6bb75548d
MD5 b9713e5aaa2bf91681f13b1f35ce8918
SHA1 dcc83c6bef2765785e15705894d6b95226e3e84e
SHA512 a31f56e3208e2e4ac3a0fe0f8dd0a4cf06a0d6a6c46b2bfa53ce78c08502352ccfa3a34ec8e6d8d0b7d7e3817e08cd826eca84148b884f9591dfc4aa19634cea
SSDEEP 1536:miSSIa3YFrEuKlei7nV65/LjlawcG2wd6pQEMDrQl+P1JwAeBHfXJ1T7wme8xtic:xSdZKlRV6T5hIXfhqTXTbsFHXqrkX9l
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Microsoft.NETCore.Platforms.1.1.0/.signature.p7s

SHA256 60e7915d337f2e4b53d530fcdf4d60cc0b11c1c698f4f0ad2f0718c9879f3bc8
MD5 2dcf42c564e3e8d797879cb37a4a82e3
SHA1 27558e7a013483e63f93909e39c7ea4c341922c1
SHA512 0bd69bce9f68f65ee9f394f5d3147e55d5fca22d9e6b31ac8cdfd2a4b2614530d66f4e799e4da3b3c23cebacdec9de80eb958daf6476247d7f65dc67e453d4bf
SSDEEP 192:xds7x0KDWpHhXZCVzV07VrZ3oGDH0JOqsmVgz28WhBq0lw:jWvDGGVpcoGoJN77hhFG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Microsoft.NETCore.Platforms.1.1.0/Microsoft.NETCore.Platforms.1.1.0.nupkg

SHA256 15e338d24b5c39b4099389cc612841eb51ff13c07bb4829f97d39b27420e7023
MD5 cca9ed659ebfaac51ebd470acff84e2d
SHA1 75d5b7cb644c86346e6e5eb251b64f96723a25a3
SHA512 6bf892c274596fe2c7164e3d8503b24e187f64d0b7bec6d9b05eb95f04086fceb7a85ea6b2685d42dc465c52f6f0e6f636c0b3fddac48f6f0125dfd83e92d106
SSDEEP 384:ALZnx6vqhrU2/kR2H7TA5nmd/WWvDGGVpcoGoJN77hhF9c:Wnx6vq5U2sEfu3QDG7zI3hHC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Microsoft.NETCore.Platforms.1.1.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Microsoft.NETCore.Platforms.1.1.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Microsoft.NETCore.Platforms.1.1.0/runtime.json

SHA256 da44ad585c0150fba072f621df6282483f8a6bdfe9cbd62ceaca4baa9c451eef
MD5 912338c617e52bc5682100c39044d59c
SHA1 1a6e13053c56d2b23a0f9757b1fc09020b99f09b
SHA512 7f9c304f265bff90a6821647e8d9fd5c5096c509945cfd32b953cff49606c4cbfd99f9e84c830516367e8f1789cb9c98d95b7a214e117ead230d644d311659b7
SSDEEP 96:NEUd9f9ylNkZbu6GYBIgqtV0cqd+q0q4Q/+a6oU:NEMfglNkdtGYzqgz/RU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/.signature.p7s

SHA256 50bf80e6f69e1d727d9e843cb1bbdf5dd344f9c5316b932027b5c2faf05edf5e
MD5 afcfabaeb41e0c49d9cd1d8b9d341419
SHA1 f7c80ebd49244d4e30996e8d55f867da14c28bb1
SHA512 f5285329d32a387bc6d60249833bcb52a0dae10e5519d6db0035432817a940681c30b345e6cc9c6686662bc9b91d5ccc546e9a54d1ea922ec1212cea07e26de8
SSDEEP 192:8df7x0KDWpHhXZCVzV07xrm4rZ9DH0JOqNG8Fp28Wh8niG:E9vDGGVpJ4rZ9oJNNzFwhhi/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/Microsoft.Win32.Primitives.4.3.0.nupkg

SHA256 98134398f5cd4d6e785cb9cf014c0146f90839114ceff8f40f42364b240f0c48
MD5 0a37b91ad094a365ad4787d84351cf74
SHA1 63bc9708e1c73786dcb7868abc7b5395b56529d5
SHA512 366f07a79d72f6d61c2b7c43eaa938dd68dfb6b83599d1f6e02089b136fa82bec74b6d54d6e03e08a3c612d51c5596e3535cbc2b29f39b97a827b3e7c79826f0
SSDEEP 1536:SEx6voUvg/OcGaBSOcGaB1HlLiPkBMnjm8z0tPb5ghoLlrc:SEx6Aa4X4DkkBoYtbpLlrc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/lib/net46/Microsoft.Win32.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e281d04d35118b7f3a2406014333e0581b74ea4b62f4f2388ad3ad8b32223c83
MD5 9e12d3a3500f09d1ded5fe6830e4f8db
SHA1 afa308c0166d8cbdd1d5e6fdaa8c9b87eb9184e7
SHA512 459c90a4942b6014ec90a311c7ae45370e0d49ca4be3961570a2f50d340637ade1b6def90aa4722a91e3cedb0d14e5f8802c02745e72c5bcf705ac6499ae396e
SSDEEP 384:ybha4YH9Whs3W2W/Z3WUQ7q0GftpBjcERHRN7DlJrv:ybwJ+EieEBHb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

79:e6:b9:41:3c:a3:55:9b:02:73:88:0d:10:32:5d:ee:7b:3e:bc:9f:49:d1:a6:4b:83:2c:e1:aa:3d:06:1a:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

78:ae:20:47:88:89:68:17:c0:8f:d0:e2:8f:c4:01:0d:ad:78:c7:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10778

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/Microsoft.Win32.Primitives/net46\Microsoft.Win32.Primitives.pdb

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/net46/Microsoft.Win32.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e281d04d35118b7f3a2406014333e0581b74ea4b62f4f2388ad3ad8b32223c83
MD5 9e12d3a3500f09d1ded5fe6830e4f8db
SHA1 afa308c0166d8cbdd1d5e6fdaa8c9b87eb9184e7
SHA512 459c90a4942b6014ec90a311c7ae45370e0d49ca4be3961570a2f50d340637ade1b6def90aa4722a91e3cedb0d14e5f8802c02745e72c5bcf705ac6499ae396e
SSDEEP 384:ybha4YH9Whs3W2W/Z3WUQ7q0GftpBjcERHRN7DlJrv:ybwJ+EieEBHb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

79:e6:b9:41:3c:a3:55:9b:02:73:88:0d:10:32:5d:ee:7b:3e:bc:9f:49:d1:a6:4b:83:2c:e1:aa:3d:06:1a:56

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

78:ae:20:47:88:89:68:17:c0:8f:d0:e2:8f:c4:01:0d:ad:78:c7:9b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10778

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/Microsoft.Win32.Primitives/net46\Microsoft.Win32.Primitives.pdb

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/netstandard1.3/Microsoft.Win32.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 edba0dc2e965c9894c1c294861202c469eb6b5fd63d4c3783b90e224e50c217b
MD5 abe81e2313b3d4c82e8a9a0884218e05
SHA1 6f956a79ebabf3fb54a3a3914735f70b0da8dffd
SHA512 ca30a8c9661f6f59df12dd801984f7c045817e50f430972baed7101b0c070847ddc0f0a09a572b22006cc14439fc15f740f89ee64c4d8f48aaf6f84021b804dd
SSDEEP 384:0nwUmuGWhk3WbQpbMA0GftpBjsEERHRN7//ldlH8:AwUlmajiTEBLN8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

af:1f:e7:9e:61:fc:2d:d2:31:ac:cd:b3:c7:4c:a8:1b:3a:83:4a:62:71:cb:43:99:78:13:5e:7c:ae:85:c2:bc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

e3:b1:28:68:5f:fe:87:d9:3a:d8:7b:c1:25:6c:17:af:0a:f3:43:33

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10794

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\Microsoft.Win32.Primitives\4.0.1.0\Microsoft.Win32.Primitives.pdb

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/netstandard1.3/Microsoft.Win32.Primitives.xml

SHA256 6a5f287ffd48574cbedc3e02e3c593f54dabbb6222bdb942cd0a246610d7b04a
MD5 72fbb003bf06d5d64e049af633aea88a
SHA1 efda2cc6e9082f8366f56f957d29166fd23ed533
SHA512 0efeaa21659d426c616077de9c01c58c9e23e401d4e7d97702f0f134a3a24a9e1ad720beb19a52e19f6459b9d253db0609955d281c2d298b15db0fbefe8209db
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/netstandard1.3/de/Microsoft.Win32.Primitives.xml

SHA256 9f9df6f6c256fb2d4d8890edf4d03f67f8fe20a60717d9b579d04f79957c13f7
MD5 497093cfb6953dfc0f0e8f3fb6168034
SHA1 9432ba7c6160343d975e2b5727dd19005c6294c5
SHA512 eecd4218f785e0a4cf2477034f28302a7eb0b9ce2db6a1d677cfb3bb520a711d3c1fd37ba120d09d4a8fdfc8bcb5dbe68602bd909bd3648b19404bd42f17792e
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/netstandard1.3/es/Microsoft.Win32.Primitives.xml

SHA256 b21cb8151124789c41ebe66d2eb6a1f4809a766c5c852cf64a464f477a5ad9b6
MD5 607b81e504497422e30a9805b25c03e0
SHA1 230bac73283364151939ef875e52864f739d2464
SHA512 481c9d849b4b0c1553a8e2626e1febc9c76fd28093a0d6e78cf85c4a16f5ea7692705326884cf7d29a8096168a68b0a0da0876821188e3a6eae813c18f3f713c
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/netstandard1.3/fr/Microsoft.Win32.Primitives.xml

SHA256 87abf33c98e74d1d4c635157af27347139f887314699099cb88eb8a65c4f2b72
MD5 ba9b98cea8c21ac0d6c0267771e51945
SHA1 71766fb74c83fe8b1ddcca0ad8941c9acb2efb74
SHA512 728c32c6d41e2b3817d9ef3377016462caebb123d25dc7f1006e3f43773deeeb103b60e9fd481be1b675ba024cabbf38aa083b787926c0b8ae9f083f82e745d9
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/netstandard1.3/it/Microsoft.Win32.Primitives.xml

SHA256 3deefd205007340aa1a70db6a42eefc9cf44922dd7259f83b1c1c0b78b52b5ea
MD5 892ddab0951a4281dc24ef7a04564b11
SHA1 2abfe49be2b2ebfdebc27001906b21acb7c75b58
SHA512 fff1d2d392fc8beadad5583dcdc77647d7922bf255253616bcbb1bb78c18997054ebafc7f2d3837c0961e606807ec45b7f5a42734fb27312092315afede31f9d
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/netstandard1.3/ja/Microsoft.Win32.Primitives.xml

SHA256 a821e89393ee5f53391d68381ec41ee0a88362347ab8c5ae41ff33a27cef0e75
MD5 0770f202e7aafa34fd5e3b47c988958e
SHA1 a1215f3c1590baf1c193ab4c99555195d9707ad5
SHA512 92762c3a1a227fedf9b1cc548519a688d3dfda19cc592df25a27aa821b6a58574aa65a8da7a1e7380533e0928281499b446935f3d3ed0d9272726d32f08960dc
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/netstandard1.3/ko/Microsoft.Win32.Primitives.xml

SHA256 9f9b582d38db14075e1ec77c3ec07bfdc2fac339eb995ee78aafe285cfada153
MD5 d0ac6402ab3adef045e6f9da757ba832
SHA1 ce3045f5dab87c0db3abdda5cab8da8c214a9e17
SHA512 be02a63c04984764f4f6b8cdbc1a5597fecd8710eef58c56fc28e17e74913801cbf3b2061327c1624c1586841df7246e3c3adc88c2934dc8ab649ab947afc33b
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/netstandard1.3/ru/Microsoft.Win32.Primitives.xml

SHA256 11ee0031f03241129ebf7b694a778786d3b23d040bcf5a1b764558ac36f00b64
MD5 8e2020218ae3c5988db12034d912c0f8
SHA1 715542eb4055602f063ae4536ffd9db3704388e5
SHA512 6fc412b5ca129501e354f5873142b7c80adc4f087e90bd573d1b75754a97bd8c90ef29d3772b91d639b6ed958b97c4e645f23d8a19530cdc0df15a3c5901d854
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/netstandard1.3/zh-hans/Microsoft.Win32.Primitives.xml

SHA256 d58fcffb5d2cbba2a020d7582b108e6b7922ac897b67078ef9f88014d8be5362
MD5 93b6c7edefacacdb4b19363cb023ec3a
SHA1 301df9211cf0c96a2a8d8c6affc65d2b6d79cdf9
SHA512 0a07d1d9176b9672f258719f4f8feb5e134c0e78d646e01fe54ae77b04af5025e1016206b9c2e7ff9ffb4be1625bb37dd8e7c6f8dcbcba4dd9d6a239dc8b6b7d
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Microsoft.Win32.Primitives.4.3.0/ref/netstandard1.3/zh-hant/Microsoft.Win32.Primitives.xml

SHA256 ee48ffcf3827baab26e03b278a82f8546a889b51815b3be250336dd5eda87f5e
MD5 ad5ee9cb901d5e4d51cea4ef4ce3bc64
SHA1 3ca5f2107692563d98630977e1ed5ce0e0821552
SHA512 67a4a59bbf5347d5bd3e981440667f773146050f1ad1b4d6a45b0ec004e3e7f7c5d4d91f9341f856c07c44ee619288fe4cbfbefd5c81d17b5805577c3a2b5397
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/.signature.p7s

SHA256 33a477b09d773bc2231089b30e0a67c348c5d65cc63fe401a230dc9a786cf049
MD5 1e197a1a5dba80f25eee79af7904e2ab
SHA1 891031d3d5e98e55832a0369856ed64ae9212e7e
SHA512 918963633ffd6b13c9dcd14a54c50325193bd95b2d44336d7034bd0dd95dcd11d51efb3d0cbfbebdc0ff5e275d4f4a8fe96a844028c4be3e2e81229efc693059
SSDEEP 192:fdNK7x0KDWpHiX1x3ifV7x02Nyby2sE9jBF2+noPOJB3Y4ltU5:VNQvDG6wfXJNyb8E9VFDPxYwm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/Mono.Cecil.0.11.5.nupkg

SHA256 9cf1706f35b4f209c28da7417608bed7a307621b0f0179c52258af78bc4668d0
MD5 43245df500334e4e3a190ec33017b216
SHA1 6ea03b322dece2a971d60e5527e01a53bdf705ce
SHA512 a03f273cdbf9da73b119a9381519a5e12c2fc96aa89c39da88fc1d6afe6d326e959e2ab7703f6668215db170989b9dbcad4036ebc5fb7470ee5964c0739e0caa
SSDEEP 12288:Z6nP6GuDxestijfY6IidQZu3wcmgsa4Yd++GwhVMw+1NR7qLuHCrS2AIVO:wnSGuDxestijw6IiOIwza1d++Gw3MwM1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.Mdb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d65e445a02dc2d2a189d19745f14368c6a24d05914e36bbc7ed9732962998ea5
MD5 a97d8b05414aaaa056d6aec577ab15a8
SHA1 19b2a8967106dddbdb60d09d6012bae36d0d17ea
SHA512 be05b237d8beaa52ae22a97a27280341a5eab3f88e59816c9c699ca9fe74ac22b0e5e8611cf4ddce1f13d5f8afc2153422906fe08dffc74c742529dd4358dc25
SSDEEP 768:Yr5EYZep98C87KHeBUZwrEe9EAnlF+em5Kktn4CRIcZwMRTIzCuAtpx:Yr59g98C87KHeBUbTAnXGVXdwMRTOAtr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

49134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\symbols\mdb\obj\Release\net40\Mono.Cecil.Mdb.pdb

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.Mdb.pdb

SHA256 a39544801392aa28d0061a2570e0f85c58c268fe41aa9c314d263c66878f9e66
MD5 fadcd29d4ca06ec44e6d08a2af0ce82a
SHA1 9c9eebb17d714ca4ac1ff6ec7b0b28ff4f90d46b
SHA512 826b032990b09d8fc762acba1a5211f2ff17615b78d9d8c3c032371f8ab61b09e84be5286ccf5167d398423fc5dc9e6e32c7f5502839feca0a1f542eec1000f2
SSDEEP 384:A9NdBvkE/zECNLuSY5oA/+yj7j02r6u9K2tmrNvnmBXizuXNYpkUeB8ukOVgDq/k:ABBvkE/znuSOtj7j/DF3B8uqK7g
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.Pdb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8e221211df8a917d69145239b71b71c87e61761fb0c96d5e997964c172dda4c0
MD5 358ee793e3f5139ec1f835f0cf306baf
SHA1 be0a3453276ae078d66eebed4f3516f246805cef
SHA512 b48a78e55573c29ea925138753f4996309929cf1ada435e1c88ae3b9f97b13eaaccb2e756f929b341ab9110204f85b5d024e65364e023e286fe2f8e50c7d712c
SSDEEP 1536:ifCEVETXo3f+yAvaDvNaPS/vSC6GOALYKXgAJGsZAhcbcvjCXej:kuiQPwvH6rArVJGXh+cveXej
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

94910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\symbols\pdb\obj\Release\net40\Mono.Cecil.Pdb.pdb

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.Pdb.pdb

SHA256 e21e21ea1417f9f488311c39778afaa1666d5ae3176a595d7ff27c84cef86f90
MD5 62455ea634b851e6c1caf5507ff144ab
SHA1 5fe276894dd8622a389e503cacccbe8ad89ae0cc
SHA512 4319a24c0ebe4b6926c06775fd518e961458d00f06a631926a9fea44c5f148bca48360aa250340b23cd90b97c4bec74496afa44d516f1b543f7b12ea594858d1
SSDEEP 384:Rt7ZdhNC72Xtqp5dZ+li1NjEOsG0TSLJdTWhmtBsqMK13BwzCsLWpOyesLiRQkef:RR/CWwZtjDsGGQdcmUK1ohsuU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.Rocks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9db3edaa8bc6ccd7ac6e2517c743591658bd6bdd436a146e0eda101d30a1332e
MD5 6fcdf77e1f173f269ff56752f273f094
SHA1 d9d26753c23fab955bb20289a20e37a1812888dc
SHA512 84f87537685ff55a681bf2acb4e35f77ea6ef3afc3cfb6257b7a72a62ba7f27e6a580fda89ddde2d8f9c22cce6a94622b58fe344d8fa52ff163d7cbc7d7a1804
SSDEEP 768:7gVxLIKwiowt0j1KODTq7/hRssvewJ1pfFpFo:s/6wtm1J3Wjssvew3o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

35326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\rocks\obj\Release\net40\Mono.Cecil.Rocks.pdb

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.Rocks.pdb

SHA256 dfd4428bc7cc44796355de0b7baa65ce8ea7ecda5c75131e2a65a279000f9207
MD5 f20f8df203d6bf60baf93b1673ef77b3
SHA1 4a2620ee8eadb5e8aba6905ea4f769ba30c52ae0
SHA512 62fb132eb7d0a84d6f5d15ab2a12739d36976e9e4017c713c986cfbbc0992fa04ebc0f477ff22dbdc29baf4e85b86049e50974d88a3ea749882b8e8aaa7a1216
SSDEEP 192:+3GYL4JSGEMUm10L6Nn5MNMtT9RS68Y4h0BKld9Mi0DEyKKJ2VjF+n:EnySGERN+9R7Qh0BKp7040AFa
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 71c8b01208ab37a5164f5bacd69054899db9fc00f2da87dbd07dc1ee40fc06a8
MD5 037dbbacc199b24bc0ee91f60a561f06
SHA1 3f82ecbe123c783b24705862c066018f827355b6
SHA512 dfa108f22e5e9250d0fdecb91317278c6212773d87b9fa36ab896c3f7a66a549da3d57f71b24778fe0727408eab89cc078f260dfd245c8738a0fe78b9c812549
SSDEEP 6144:krsdKY7ap3A+oQ8suUmk/yC/tyPyJH+dIz1R:gpY7YuXAyPysIz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

364286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\obj\Release\net40\Mono.Cecil.pdb

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/net40/Mono.Cecil.pdb

SHA256 c7f81c42b072979c73bf57731079125766252e2fa352d2763ac309aeeafdab45
MD5 44c278b56dbb3b5aa973906678156233
SHA1 8e69ba2487b8dc373cd39fe360e867269de9af19
SHA512 297b73621e784dcb57f20aeeaec34183c480e9da9b27b3b92bdf67e6e78f473d470aaea296a4c6085f591af1010653ecad94503feb57d14d1e1508f385b56856
SSDEEP 3072:j2DACw9iCUWQZQz9VldIas3I3uSZyMQ4kGeUG5svuXlTb:qD2kCUWX9NTAIeStmCvvuV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.Mdb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2bda97fc302904bf235d631e698a0c81324872dfad2a38e63ef66389155bfcf4
MD5 0c2d7a3d146e193d7b8e50f0fe398568
SHA1 bf0a6ab31388eab1ffd3cd87fae62b45e90cba24
SHA512 5fdc45ae536955e6f66970b35008ce15c5c5624d0b31bd41c79d6548d0d1b950042f51fe7dbbbc33a6256f90f5db23bf0070abe24502a050505be66f086d6df0
SSDEEP 768:ArF3HuZyOt78PeWSTkazhOOgfGNOV/pVxPRpaCCrHpTFuzL4oWB:ArFecOt78PeWC8OgfGkVh6pTcL4oWB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

45154

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\symbols\mdb\obj\Release\netstandard2.0\Mono.Cecil.Mdb.pdb

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.Mdb.pdb

SHA256 be9a1bd3ed8de96c1df5c027dc9e5592f729fbd6e03193a1de26470873840863
MD5 fac28421cf43cf8443dc882b6e7a165d
SHA1 6100b566c9fb03a3cddeb31704143e6eed64e088
SHA512 2a80d6ca628a3e972a8cb911267e5d82511914fa5fdea662c0da8a09a0e1740c920bd4092d9f8db8cc328c0f4d77ed598c2704deb7567749336ec23c4d784512
SSDEEP 384:N81ZdbtCUxMBp4+cE2+hjrjXq36jMai+NLy5nj4SCm5Mz6QkOAHOuXch8CPY7LTL:NEbCUxM+E1jrjXqWToOwu6n7orq+OuwH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.Pdb.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 333397769114ffd13046a25b9cfffd41c44a3450ea9ea1fd13b76eec28e1a815
MD5 625ce2e8be214194a161fe80e6eca7d0
SHA1 58944e03ee249618e9440545623c4545777377f7
SHA512 c324ea36e4a89a6052f685e4f96527323ab6f4eea4f4c70c71f08a84df2d46332d91c3f289463502887d9b098dc6e69036c322630b770531927d5329873b250f
SSDEEP 1536:mffXkeOyX+6C5S6R7nQSALYKXNgJGsZaBcLevjCXeo:ao5S6R7nNArWJGPBEeveXeo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

94918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\symbols\pdb\obj\Release\netstandard2.0\Mono.Cecil.Pdb.pdb

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.Pdb.pdb

SHA256 3363c2ab56ea9fa5ba17dfd823145830c87cb078a79d5dcb5b08c61cd9443dc5
MD5 8987388fd0175312e7c1f477c5e3da24
SHA1 f6c6175f3755fae45cabf235f751c3f0a78834b0
SHA512 898fc9ea33f06d52816265b5403038a0552c141425011e27094686a6c0eaeeaefb8d6307ebe3603f8b8a09e39808babaf7f120e835abc8da7116c6ef3be2a23c
SSDEEP 768:RM/C5wZ6ov3XjDsGG/qWToOwu6n7hdcm39RLseN:iK5sfX8GWU7YmNRV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.Rocks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a6d3e6eab8d89dbd6fcf34268a08a6544ea142b6bcc5f665bee62317786b7892
MD5 6fc634673b94c7ddde6e2ba277f7e7c7
SHA1 f29feb86a8595d104b3b1b4be809f6e9fbc8f042
SHA512 51f4782d7a8e2b3ffbb8fedddcfe85379e5adc499a2fd55c29e29628ca9519c33a33daf806eb3b8d01cfc10c964c1cd2558152c000c7ed2a8584f36c58f31c51
SSDEEP 768:tkU1iy+QMBCocUuk0ThROoUheLXG99gmIt:tkUCCo/KjOoUhpg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

32450

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\rocks\obj\Release\netstandard2.0\Mono.Cecil.Rocks.pdb

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.Rocks.pdb

SHA256 5fff6c7256c6f9b817aa9fd37269db8a0693a9d5dce71a09601f28fa5532aabf
MD5 fd22e27ca7a9b1ea4593a11da5e7f13f
SHA1 bb31036b2165706bb908880d5d5e33ea42095f8f
SHA512 328aec5288458bb079c77a160afe325e914c6801c066f05137f68a911b87297b36e63bf5a418761542bb6fd9519c558e1bde89ae993f4c24211fa0d33a397664
SSDEEP 384:0SjSGER+9R7zq36jMai+NLy5nj4SCm5Mz6QkOAHOuXch81WBKl70Q0FY:04ERQzqWToOwu6n7XB
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9c2908709da6761e9b5b9d4d46102d65851145bac987787d6c5a05ffe5689487
MD5 6d8d43c5d7dbe36ec01ff8b951cf1e0a
SHA1 d6b8214419870770e1ce398ca06a6a9f0e9e62a3
SHA512 221955b05d83513fadcb79721c96fd467ea871cfa401b279dc8ade426c88df4cadc884dae7a9c418c1012af202263f31ce8b63ca919e1f725eb7c7e8008c3a57
SSDEEP 6144:eCDxMlG40kOSV1L6RWDv2F2AEJHwBI+aB:rG1J1LQFLE0I+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

363046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\src\cecil\obj\Release\netstandard2.0\Mono.Cecil.pdb

LegionStealer V1 SRC/packages/Mono.Cecil.0.11.5/lib/netstandard2.0/Mono.Cecil.pdb

SHA256 453e62ee31d95f4aabf70ecee1c9fa52a57d756e1bd1904f599f335ed549fbc4
MD5 0380953ef9b18bb335bf2bd224ad53d5
SHA1 df0dbd8c47b0712d0a0db61f140d656c4849895e
SHA512 f281ffff745e81b865812d2d4900469e0cfa1be49e39f2f10b449ea29ebd9177e27d89f7d056762d4f73d1cdda8637890642c26b12d0e4e5cf01cc1bc78706c4
SSDEEP 3072:Xgb74osNcC9iCqVGroM3JBxIXuSZAsWDkKaGqdJQfD/S:wbUoYVkCyVkhI+S35iKQf+
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/NETStandard.Library.1.6.1/.signature.p7s

SHA256 59f9b7029cd1a18e5e79b86718c78001ab7a432143aea153f9656496676a5e02
MD5 43b4c2952cf439faaa24c62fe5c2a611
SHA1 e16efff91a5b1195b6be49f55e1c2532ca3e92dc
SHA512 a99750687d702707745f379d4ccd190b5a34a4943f60f009e92c3ce0879f4b4379b28e20cb8a52fd2c29d1f3c6e1e4c5f6a7bffe1bc69554edbfde4822272e3d
SSDEEP 192:8dxs7x0KDWpHhXZCVzV07xrqeE4vGDH0JOqsmVgz28WhBquJ:EkvDGGVp3B4vGoJN77hh/J
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/NETStandard.Library.1.6.1/NETStandard.Library.1.6.1.nupkg

SHA256 88d6a7d62c7b46d9dc1960bd023019dac93bd03a313ac9843a0435d1f5e6e0fc
MD5 d131f5455d07a292fa2f09e9ca881815
SHA1 41e41f84bc1db186ec2cf2c7fbaeaabcf29db936
SHA512 0972dc2dbb4925e896f62bce2e59d4e48639320ee38ad3016dcd485fbd6936a0ed08073ad5eef2a612dff05dfc390f3930fff9e79d87a06070eeb8128277cbd0
SSDEEP 384:7h4D7nx6vqhrU2/kR2g7TA5nso0kvDGGVp3B4vGoJN77hh/Ub:7ufnx6vq5U2sEOuSqDGruI3hdUb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/NETStandard.Library.1.6.1/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/NETStandard.Library.1.6.1/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/.signature.p7s

SHA256 7f99726493d7025c95259d7abbeace95bfda5c190d82db28bcfa3fe8c9ea6b36
MD5 59bdff6dacfe96e18fb8098458e9e871
SHA1 b852bb4897bff71c5ca7b0d449a575c8283b1bac
SHA512 f6c0d3e8ab5d53ea02c6b00996feac68d111ceafbff01be2160210795d79653ce86ee9d4b8cd1799f806b545c0c0f5b05095c1d3af0a3e3386f2dba8f4a7d98d
SSDEEP 192:tdU7x0KDWpHhXZCVzV07Rr/h8GDH0JOqsmVgz28WhBq+z:vevDGGVpUh8GoJN77hhXz
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/System.AppContext.4.3.0.nupkg

SHA256 ca0f792cd40ec05940d6d5b15dd42457226a4f8027a0373e0029ab36fcc68998
MD5 3337e2f6571c07ca8f7a82f0200c46dc
SHA1 06be33eeca7796ea61ad6ddee9a92c64052b6259
SHA512 0d6ea63006304708feae2cc0590d2cdd99327b682210822bb2803ac842fdf4d8d57170d7947c006eec4b5687c942768478a7ec109745472f3946d230732483e8
SSDEEP 3072:sx6AYC43+nxVjjm0C4h+nxyKkBKY5ohC2ZUZNOyZv:sUu434jm4hJmUZNHZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/lib/net46/System.AppContext.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ea3a3003e10f44280074810934261b61a209c1ec1e9029b932742c853bde743e
MD5 b906366572177d428a8c3218b203b417
SHA1 c9a0c7200ad55960a1e1824b04718cbf6ca84581
SHA512 adb0d6f982e9f586d49eec0b8d775b98c87515e5c540968fd919864285ae6f970d00af7f8f5d0bdcce29b4c77f7fcf3247f461821781b020aa1413d2fa8b1282
SSDEEP 384:99JjWvfWJSUA0GftpBjY+ILKHRN71UlBRAhHvH:9Dgiiem1qRAhvH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

df:9f:e7:eb:4b:17:df:d5:23:35:a6:bd:a6:cb:4c:b1:8d:6e:68:c6:83:3e:b6:be:64:c7:3c:86:37:bb:61:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

35:92:d4:14:ac:68:a0:c7:e8:ed:93:9f:cb:66:07:cb:dd:db:76:bd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

9602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/lib/net463/System.AppContext.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 54508702f2af059594d21f24a513e3be570eafc0b3a7eeb20e0fe243c284349a
MD5 3bf5f78fbe8b07a20457d9c84bb5a137
SHA1 723f43afb7f31e6df600a764697c91ad11478437
SHA512 99117b5fbbc7388c353b6bcb75952b5546e17bd69a170802b038fde431b7d793d2ad415d70f36d2764f012f9a9df1b9f5bdeaa57642bb27f6d052dba0f99390e
SSDEEP 384:YtWq6AWLFWgWqFW6Q7q0GftpBjPy9uq7cERHRN7LJl78oWCmtw:YgxllkiFy9NcEBLPe6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

84:65:d8:08:6b:f8:60:69:53:d1:57:bc:30:df:d5:7c:db:2c:5d:38:2e:56:fd:63:37:c3:fc:85:21:d4:5e:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

33:02:63:07:f4:38:5a:36:44:d6:23:2b:84:82:9a:9d:68:5d:c8:d0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.AppContext/net463\System.AppContext.pdb

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/lib/netcore50/System.AppContext.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 661c437a2ab70cbd7d3877a34fba48a230f325227f591c9a3b4611353588ed13
MD5 bb91a13e6dece15d3b905ced566afdc2
SHA1 a72121c7f77c7ac0b3664d656227a3beb9b672f2
SHA512 60ce44c41b0f5b4735939dbbf964d2e88943f6bd5833015027c485abb5ff55046a22487122ea51a5c29113acd911ce04580c2a2c04d94ead0987379e4022b9e6
SSDEEP 384:qXjXe6WLFWwWQfWCQ7q0GftpBjoJ0yERHRN7BqaQl78oWCmtW:qXCXj6iynEB4aCes
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

83:fa:bf:96:ea:ca:95:1c:cf:08:b0:c3:e4:dc:8c:c7:4e:8a:e4:b3:b4:aa:8c:fd:4f:96:49:8b:7d:12:4e:bd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a1:eb:00:db:13:53:16:7e:98:21:43:03:ec:ae:46:51:88:c8:dc:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10274

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.AppContext/netcore50\System.AppContext.pdb

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/lib/netstandard1.6/System.AppContext.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2e62eae79b7f3e23e3458fd7f4229f2eb80fc594a641a6dafb50f83a5336695e
MD5 8f1f6f1aa9d5e965ea91b1f3eab38764
SHA1 72b741cfa682b317bdcd6ff6530898393fdf15ec
SHA512 5979ce683756cd5929a41c8072311fcfee8321d956e999dcecb7bca2ec7f49b4c2e085d597c492c3c433216ccbca12c37d9f96cfad34ff38413bfc58e81529f4
SSDEEP 384:HtD6jdWLFWgWqFWtTMq0GftpBjALLYERHRN7GlJrvUH:HR6alguiaLLYEBCbO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

e4:55:0d:a0:9e:c7:11:1a:29:56:69:8b:24:2c:eb:50:93:34:69:fb:49:bb:6a:dd:ba:e9:f1:5a:71:62:64:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

5d:98:79:d2:70:d8:02:19:8d:48:7a:0e:3f:f7:78:3e:57:0e:e2:17

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.AppContext\System.AppContext.pdb

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/net46/System.AppContext.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ea3a3003e10f44280074810934261b61a209c1ec1e9029b932742c853bde743e
MD5 b906366572177d428a8c3218b203b417
SHA1 c9a0c7200ad55960a1e1824b04718cbf6ca84581
SHA512 adb0d6f982e9f586d49eec0b8d775b98c87515e5c540968fd919864285ae6f970d00af7f8f5d0bdcce29b4c77f7fcf3247f461821781b020aa1413d2fa8b1282
SSDEEP 384:99JjWvfWJSUA0GftpBjY+ILKHRN71UlBRAhHvH:9Dgiiem1qRAhvH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

df:9f:e7:eb:4b:17:df:d5:23:35:a6:bd:a6:cb:4c:b1:8d:6e:68:c6:83:3e:b6:be:64:c7:3c:86:37:bb:61:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

35:92:d4:14:ac:68:a0:c7:e8:ed:93:9f:cb:66:07:cb:dd:db:76:bd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

9602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/net463/System.AppContext.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 54508702f2af059594d21f24a513e3be570eafc0b3a7eeb20e0fe243c284349a
MD5 3bf5f78fbe8b07a20457d9c84bb5a137
SHA1 723f43afb7f31e6df600a764697c91ad11478437
SHA512 99117b5fbbc7388c353b6bcb75952b5546e17bd69a170802b038fde431b7d793d2ad415d70f36d2764f012f9a9df1b9f5bdeaa57642bb27f6d052dba0f99390e
SSDEEP 384:YtWq6AWLFWgWqFW6Q7q0GftpBjPy9uq7cERHRN7LJl78oWCmtw:YgxllkiFy9NcEBLPe6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

84:65:d8:08:6b:f8:60:69:53:d1:57:bc:30:df:d5:7c:db:2c:5d:38:2e:56:fd:63:37:c3:fc:85:21:d4:5e:86

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

33:02:63:07:f4:38:5a:36:44:d6:23:2b:84:82:9a:9d:68:5d:c8:d0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.AppContext/net463\System.AppContext.pdb

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.3/System.AppContext.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bd0895826707fdd1e2a1425d2ef170536532c3b3d98ebb929a2aca19aac24e59
MD5 65d7c63cd6eae38a8dfefaedd3db4c1f
SHA1 8074f8f93ecdb97a6167ea3566e073c17b0366dc
SHA512 04df8530f38b544af489c749adf3fa0480d63e9255040cb1d69297153b488e8e2570b3c68a33516d5eaf9fcb5860e69988d953cb9991752266103f1df832ac8d
SSDEEP 384:GEuBhAWtfWMSUA0GftpBjaIHP+ILKHRN7rKlI66nt9:GrBRjiFPmrT66X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

9f:54:35:a6:6f:14:f3:b1:e3:1c:d0:45:04:fb:7c:50:fe:46:eb:7e:7d:e1:62:d9:e0:30:46:19:42:37:39:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

3c:4a:4b:80:b3:53:8e:11:04:f6:9b:90:bb:ad:bc:05:52:5c:b7:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.AppContext\4.0.0.0\System.AppContext.pdb

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.3/System.AppContext.xml

SHA256 948dbb7461b6a5084243cebdce2dbec2fbcab12f6d5dccec5bc65f180f31f272
MD5 6e65d9cd3885ce1c1960b4f9880db49b
SHA1 e0b509f51e29496b9d2b02f5bc3b9a13c941b25a
SHA512 11c598a353a3218f223651aee747a1d89434d1e4f3acf211c9da5d8c8fa938281b9186ae6fdb6774ecdb2e5dfea110dcbacc46d6a954f4c016f8a3a7a14c4516
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.3/de/System.AppContext.xml

SHA256 bae2ef6254184752adbc03b04d34d8d59e6690e5fc75a0aae0888b4db6b7ecc5
MD5 efb54228e0a5b3e0143124d0184a7d51
SHA1 537dc2bff4bee4128b0777f72382ea2550cff8a0
SHA512 b0fabc471d5a8229696f44b507294bf0894847a93542863f98ffc896495ad0402ad033fed3e5446145d4f3d634421e3daa8afe83fd081b57466a51a82f5c0716
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.3/es/System.AppContext.xml

SHA256 85058dd4cdb2bea70a0117233c2d413595800adb91619add8bfdf301c84c6503
MD5 4999efa74b6925cd7e2ce82d369c161c
SHA1 f021a468323b5249b45b5e10ac7175ebe87432ac
SHA512 62ff7482800045ab459ed56ebf7edaacd83a9f8bf902592f7e9bf58289e9784a733fbd737281b169b46ce07a7140510c70081889ec0c490a6859bf7b6eb20704
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.3/fr/System.AppContext.xml

SHA256 8da10b03a1f7a0778eebbbaf9243b3986861c8bdae8c46a8bb98bd0b7f29f08d
MD5 a09a915cdf1b5afa64064023416c6acf
SHA1 988b98e3593483f12bd99e6240679c2ea1b27e0c
SHA512 0b2756a4eeeec2dd58b12c558dea6bdf3b316a3c7de72e53f18b1cbf947721d5d0bb2c82a989eee48be3c6d065a1bebe7d0ae7176165e2a3adce7331c84193a8
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.3/it/System.AppContext.xml

SHA256 acc06aa39c2f6b80b5fb08466b1d876fcfb9d5d62c4de83f0c8d6adbba6e231b
MD5 a9c397d6c3ce994d0658f32310b8ec5e
SHA1 523af82ebbab57f1dc6856c7f8afb7a1525b3e75
SHA512 886d385ca34a29be40a0b794c8b1537e0b0cf8ff55cee3e1e1d86d79d0aa1c212c7f0682a557ff133885d5b88d5ef6932012191eb79df459b8dd96a6b1e79437
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.3/ja/System.AppContext.xml

SHA256 9aa87b204a0dc5b2769ccae8d4e0fa7e9616333aa7dfdee1ea0666a0653d0678
MD5 c0c0043acaec469902a772669e3feee6
SHA1 0a04e7ccafde69365df3496883e6358e320bea1a
SHA512 7bec2851971b1390bbaa78d2197a3e1fdbbb1cbc60c6db16d9a1b3437df426f10e447d58a28f14c013e67a8443a5126b4ce36aa319734ea1c039dfd5138311e0
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.3/ko/System.AppContext.xml

SHA256 cfc35bb038797d46020a81659af53bf6ced56aa45b76ac601862347b46436b8a
MD5 dda479050fe4a234f3e11582ca27326e
SHA1 61ecc394660844c2ccf8130b2f06e4f5e1c09dd5
SHA512 aba48ef48c6a2dd5b1a8d0e6c9753cd3c8838f9e4609eac6b75336c8c62a8ddb5d2df815cc85778b52b36471731d3cded372a9a78b22d77534e9e54a82ed340b
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.3/ru/System.AppContext.xml

SHA256 1c93dfceac35c81100c92117504dbf63c9d5def5ea88b46298292930f6004f56
MD5 70e279de53f7fb93241863f2a925d9ad
SHA1 21d48b13931cb5065047dd32b36f543e9c75fac7
SHA512 057704b0d2196a225d983c62d96d262e116f3217cb262cd4c12b55d4d3ec5ca9136e54b37ebd742c77fb4ba28ddb7a9450811bc174f92a1729474147e340c538
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.3/zh-hans/System.AppContext.xml

SHA256 6fa536d18f7fc9d6ed7ed970887f0a38273bc238211d88bbe1d8fc1d4b3b89e3
MD5 ec4ac6e85fe08ca335e74e151fdd07f9
SHA1 ff712c0c6e70a69c3168c63eb538923b085e0d0a
SHA512 e90d17c38032c9268b3cb93e06ee8c98faf03799e8022af6e5ebd694cf3a3bb41ba56bb51bc3a1b0d7c05f40016e7ffd3d8a25cf87d39875b0755757ef135b11
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.3/zh-hant/System.AppContext.xml

SHA256 a4eec32114e94a3610443a964913f96b7aa5eb2842461c280c992da74fbcba49
MD5 914e720c41c8e92e7822ce7b4d1e9702
SHA1 5c8b82d9c6e9fa68cdc429952990fd44d7e3f874
SHA512 de3525a530019692b085a8721cab7cfe9b1c11be35264afcb998b0376b21a202d4eb417f1031c84d708145bbbe7bc9958039ac03c53c036f202ed1191f089738
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.6/System.AppContext.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c2179560766221eb4e3241f0597d81a29aeceda255ea668536f6f2d394ab6db7
MD5 b648f8ad2988b8b7941d87ae1d409342
SHA1 b04437cee0f5b39a108f9f9846e5d3c79b17f4cb
SHA512 aa4f880f95f2b02f72c0a81fb4dfd2faeece420007a5bb3293d1855eeb66c7c45d6ac18434a8d07b8c937a6fb8e497738c7743a73d85384459c47069ff3d824a
SSDEEP 384:6bahuvZWTFWYfEgA0GftpBjEO+vERHRN7tlfkq:6WLBviK5vEB8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

09:50:57:cd:85:6e:9a:be:8b:34:d8:a4:7d:3d:e6:32:bf:9e:a3:76:8b:df:0a:ec:4c:a6:3b:77:5f:62:95:bc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

7c:2e:ac:fb:f2:4a:30:25:64:fe:d9:1a:e6:e9:74:93:93:8f:59:1d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ac:63:16:e7:e3:46:55:b3:1c:00:00:00:00:00:ac

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2016 - Aug 3, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10782

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.AppContext\4.1.0.0\System.AppContext.pdb

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.6/System.AppContext.xml

SHA256 948dbb7461b6a5084243cebdce2dbec2fbcab12f6d5dccec5bc65f180f31f272
MD5 6e65d9cd3885ce1c1960b4f9880db49b
SHA1 e0b509f51e29496b9d2b02f5bc3b9a13c941b25a
SHA512 11c598a353a3218f223651aee747a1d89434d1e4f3acf211c9da5d8c8fa938281b9186ae6fdb6774ecdb2e5dfea110dcbacc46d6a954f4c016f8a3a7a14c4516
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.6/de/System.AppContext.xml

SHA256 bae2ef6254184752adbc03b04d34d8d59e6690e5fc75a0aae0888b4db6b7ecc5
MD5 efb54228e0a5b3e0143124d0184a7d51
SHA1 537dc2bff4bee4128b0777f72382ea2550cff8a0
SHA512 b0fabc471d5a8229696f44b507294bf0894847a93542863f98ffc896495ad0402ad033fed3e5446145d4f3d634421e3daa8afe83fd081b57466a51a82f5c0716
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.6/es/System.AppContext.xml

SHA256 85058dd4cdb2bea70a0117233c2d413595800adb91619add8bfdf301c84c6503
MD5 4999efa74b6925cd7e2ce82d369c161c
SHA1 f021a468323b5249b45b5e10ac7175ebe87432ac
SHA512 62ff7482800045ab459ed56ebf7edaacd83a9f8bf902592f7e9bf58289e9784a733fbd737281b169b46ce07a7140510c70081889ec0c490a6859bf7b6eb20704
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.6/fr/System.AppContext.xml

SHA256 8da10b03a1f7a0778eebbbaf9243b3986861c8bdae8c46a8bb98bd0b7f29f08d
MD5 a09a915cdf1b5afa64064023416c6acf
SHA1 988b98e3593483f12bd99e6240679c2ea1b27e0c
SHA512 0b2756a4eeeec2dd58b12c558dea6bdf3b316a3c7de72e53f18b1cbf947721d5d0bb2c82a989eee48be3c6d065a1bebe7d0ae7176165e2a3adce7331c84193a8
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.6/it/System.AppContext.xml

SHA256 acc06aa39c2f6b80b5fb08466b1d876fcfb9d5d62c4de83f0c8d6adbba6e231b
MD5 a9c397d6c3ce994d0658f32310b8ec5e
SHA1 523af82ebbab57f1dc6856c7f8afb7a1525b3e75
SHA512 886d385ca34a29be40a0b794c8b1537e0b0cf8ff55cee3e1e1d86d79d0aa1c212c7f0682a557ff133885d5b88d5ef6932012191eb79df459b8dd96a6b1e79437
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.6/ja/System.AppContext.xml

SHA256 9aa87b204a0dc5b2769ccae8d4e0fa7e9616333aa7dfdee1ea0666a0653d0678
MD5 c0c0043acaec469902a772669e3feee6
SHA1 0a04e7ccafde69365df3496883e6358e320bea1a
SHA512 7bec2851971b1390bbaa78d2197a3e1fdbbb1cbc60c6db16d9a1b3437df426f10e447d58a28f14c013e67a8443a5126b4ce36aa319734ea1c039dfd5138311e0
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.6/ko/System.AppContext.xml

SHA256 cfc35bb038797d46020a81659af53bf6ced56aa45b76ac601862347b46436b8a
MD5 dda479050fe4a234f3e11582ca27326e
SHA1 61ecc394660844c2ccf8130b2f06e4f5e1c09dd5
SHA512 aba48ef48c6a2dd5b1a8d0e6c9753cd3c8838f9e4609eac6b75336c8c62a8ddb5d2df815cc85778b52b36471731d3cded372a9a78b22d77534e9e54a82ed340b
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.6/ru/System.AppContext.xml

SHA256 1c93dfceac35c81100c92117504dbf63c9d5def5ea88b46298292930f6004f56
MD5 70e279de53f7fb93241863f2a925d9ad
SHA1 21d48b13931cb5065047dd32b36f543e9c75fac7
SHA512 057704b0d2196a225d983c62d96d262e116f3217cb262cd4c12b55d4d3ec5ca9136e54b37ebd742c77fb4ba28ddb7a9450811bc174f92a1729474147e340c538
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.6/zh-hans/System.AppContext.xml

SHA256 6fa536d18f7fc9d6ed7ed970887f0a38273bc238211d88bbe1d8fc1d4b3b89e3
MD5 ec4ac6e85fe08ca335e74e151fdd07f9
SHA1 ff712c0c6e70a69c3168c63eb538923b085e0d0a
SHA512 e90d17c38032c9268b3cb93e06ee8c98faf03799e8022af6e5ebd694cf3a3bb41ba56bb51bc3a1b0d7c05f40016e7ffd3d8a25cf87d39875b0755757ef135b11
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/ref/netstandard1.6/zh-hant/System.AppContext.xml

SHA256 a4eec32114e94a3610443a964913f96b7aa5eb2842461c280c992da74fbcba49
MD5 914e720c41c8e92e7822ce7b4d1e9702
SHA1 5c8b82d9c6e9fa68cdc429952990fd44d7e3f874
SHA512 de3525a530019692b085a8721cab7cfe9b1c11be35264afcb998b0376b21a202d4eb417f1031c84d708145bbbe7bc9958039ac03c53c036f202ed1191f089738
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.AppContext.4.3.0/runtimes/aot/lib/netcore50/System.AppContext.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b15025438a4b5cca394c91660d60b50c7ad1f5ee70efaac2ec6889671ae1dcd9
MD5 4ab64248b077319d473df1477360fc53
SHA1 d1aa846525c3fa9e124aded76d79cb14d73e9888
SHA512 71c7547f33ccca436a9ffa1da79785a30b7b406217a3e67c74fdbfacdd7253e5d51b289322a7772831faddbd8dc543e0fc4726882799a26bc61332cde1ed5585
SSDEEP 384:IJnnIQMyqWJhFCOHZWLFWwvT1Nq0GftpBjEQaERHRN71VlBPVUl:IJLF3+p1viuQaEB1JGl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

95:03:68:aa:34:a9:63:a0:0a:eb:01:5b:fd:ca:92:77:37:b4:2a:01:40:07:a4:81:92:7b:1e:47:7b:3c:38:30

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

6c:54:aa:9d:fc:ce:76:ac:f9:d9:1d:95:56:38:1b:af:e7:3c:f4:b1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.AppContext\netcore50aot\System.AppContext.pdb

LegionStealer V1 SRC/packages/System.Collections.4.3.0/.signature.p7s

SHA256 dbc95048cfc98f67f389fd34e162248174ca992b13003dd793f04e8e8b638ae6
MD5 65e9f1197b9c909408fb3d3c2761deb7
SHA1 e0d66b0978e00369563830a4934c0d4c913f199f
SHA512 2ea1c83684c327a02aeebf1d29baf917cf7a0a39eac610b93892897f06705b039c0ef162dbfaa626b130cb8c2f797c796370ea27239cd12cc1376617ec6d21fb
SSDEEP 192:8dg7x0KDWpHhXZCVzV07xrPGDH0JOqsmVgz28WhBqdpkZ:EyvDGGVpmGoJN77hh0pK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/System.Collections.4.3.0.nupkg

SHA256 69f63b554b43eb0ff9998aab71ef2442bbc321f4b61970c834387bdc88f124a7
MD5 786a948ae3b9890ab3df4e0af8201142
SHA1 1cdb93ccd0fbf8a7e8d8a9b460eb530152774c7c
SHA512 ca7b952d30da1487ca4e43aa522817b5ee26e7e10537062810112fc67a7512766c39d402f394bb0426d1108bbcf9bbb64e9ce1f5af736ef215a51a35e55f051b
SSDEEP 24576:7+11+PdV6PI97bHKk11lLdO3jI9diHQ11oXdXchI9ujH2:aqP2PM7b/JLAjMdiwMXihMujW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Collections.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netcore50/System.Collections.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b5e780ed3a3d8ec831708be7f093d99626ecb835d3cba8ae1624f2c56149c705
MD5 b35c8228cfebdc0ce7286e9b3fe58cc2
SHA1 a92d88eed2878048dd52979e98cfde3b9e338003
SHA512 83f2076bf97a50d0cb8716d08ace4868386823f3fcae120dd0a6d8c5030e773479da384523ee66bf86884a53630fa6647b703fae76e71bdcd249643cb0d8f466
SSDEEP 384:g5BWPSCc9ReDhcc68gtNKOVoZbYRX7/WUymKUqZQG8wUj38uUBJ7PWqaC1ZUsbhB:JPO9cWtNFv2PblcUibEBF9Vft
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

14:dd:b3:dc:c2:a7:a3:13:55:75:58:ee:af:c6:23:ac:bc:20:bf:e1:9d:f5:9f:67:96:fb:46:2d:f1:e8:4c:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

ca:29:92:75:1d:4a:30:bd:c6:d6:fb:cb:af:e8:24:6f:f5:11:5a:c8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

32902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Collections\4.0.10.0\System.Collections.pdb

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netcore50/System.Collections.xml

SHA256 a7a3e22bd3b01c9702919f58881a07be9e895f921c05099915d519182f2d92a1
MD5 494d83ca42f99e54b13402cfe16ebfdb
SHA1 8b2fc5175738afd527284fc57b0d852661c10b8e
SHA512 6fa9b056fddea5d8e001160ce274219ac018607a11bccaddf29d19e4a6517ae0b4d816c7b455b761eec7a69b87afbcd50f440a760be55304eec8f9cb3ed40ae2
SSDEEP 6144:ttYI/pFSEqzkMz6oZTwkLTG9dINNfyrbEzKitW97sa:ttYI/pFSEqzkMz6oZTwkLTG9dINNfyrp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netcore50/de/System.Collections.xml

SHA256 6f28b3d7a32aa5f2c027e2a85b96d3f51a2a7a361837b4710bda5e21aee4cf6b
MD5 c57edaeecfdffe5e2879763ad0d541e2
SHA1 a5be9281d490ecf862ff0fe03a35c27cd67681d2
SHA512 5beab27a2b2b28c7c8050a171d93b77c622fe088a8a3ba1a1ac1a286453018b9cd71e6e50d51dfeb57bf921ae3c860b065d12bab487ba8bbabfb1b6215733b64
SSDEEP 6144:FA2lwBiCDoWh3JgqvdOHhpT51VwefW7JjCMThYxTM9PsFINQmAA7KClDIfwDfpLe:FA2lwBiCDoWh3JgqvdOHhpT51VwefW7k
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netcore50/es/System.Collections.xml

SHA256 c0daf5783ebe07fa5cbb8d19aefda403e540bb56ffd04e9a6d0bd8d0c219a792
MD5 135f5198632eccf501ed363f2496b8a2
SHA1 4136f6244af3af456c2de0889cc9a1d5c3990df9
SHA512 906f888173df6273eb86a34617039b9e5b2cbf821e97363989ced3b1d809c1c3203661a9f5069d8d679f8965aeabe12c982bdc2bacc5cc9cfa852d30c31a6519
SSDEEP 6144:wRMmhx2UCdDD+/JmrVH/OcyPUOAxI0RSUQ/ZIRja+k:wRMmhx2UCdDD+/JmrVH/OcyPUOAxI0Rg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netcore50/fr/System.Collections.xml

SHA256 22270f6544e4e26741f8293398f4ea19fbd7f78ab916ce062d7c00e56383c8f6
MD5 af170dd648b75de07e32d1b7d2817a86
SHA1 31077b2da80507c6fc58e2772ba8fb0efa0cfe88
SHA512 d9c52fb29061662381d01e4e134b990c81864dd88d672ee4d60965263e367c7802351830ffb57d08d298fe8a5e0e2959e67df480d369a767fe6a19ef3ca22bcc
SSDEEP 6144:cDyNLFKoOgVhqLEofJm9IV67XB+win/Ji8X4KILnzch:cDyNLFKoOgVhqLEcJm9IV67XB+win/Jj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netcore50/it/System.Collections.xml

SHA256 1e10f259aca48fa9457696bea1a6a6180827dc809e7059e916a479a1c04607a3
MD5 19e131bed1e1ea23f9b032ae6ccd7482
SHA1 275e84732f86386de2529a779650fe96365f841b
SHA512 1cd32d9529a874e7e45035efe9526bb961f49c36b2f5f8fe8ac97d3bbb19adab9e4fd3dedb212bbcc6ba755099f15bd6b919f809f3e52a133202eaba298e1d96
SSDEEP 6144:6Je3nUwkpTZAWZ8mCoeiX2sfDDfcN3//VhqYba7stKodpI/sAz8s6fgLYfCjfCO/:wb8mCP0DDfothqYYcL/11GihX2xEQb1r
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netcore50/ja/System.Collections.xml

SHA256 24152ad449af6ff2a89e3c0d74af3f999646700dc5a3fd2a50aeaa170c8d2a59
MD5 49cd0faf7b40529e0984eea6f9af0902
SHA1 a3dc5cd8938cfd5206d82f8e4cebd7de0200fd1d
SHA512 bf7d75d37f7af72a824384e3250e92f966de30337a70bb69c80f050e9bb19a4abc81d93ed2d79e5452f7d9f5038656778e80aa2a7a467d6e079a591459af2cd5
SSDEEP 6144:5amp7HcYQwUIzCRokDNbGaTFraf/6T6S1oToaaybhGp:kmp7HcYQwUIzCRokDNbGaTFraf/6T6Sr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netcore50/ko/System.Collections.xml

SHA256 0add30340c81751aa971a6de6f93505cf10ab0b553ef4e3ddac73052c3164a10
MD5 8c0d3aaae53f22b88ffbbff2701af929
SHA1 ab0762aa07a6daf450e811d934c4e9bcd900d797
SHA512 2f8a996dd0d9e339c1b62d6148a74157f163d5fc1acbca237c2ac36773dbc88ee4f28c52da4a1e35e1c52c97d97ea9cdb93903fb4565948e3bfebb4248288e40
SSDEEP 6144:PTdfPydC68AjBy7m85V65sBIxw1FeDPHuvzVzwCx5hs2R6RzkTeCOR6u6jSUbfVT:PTdfPydC68AjBy7m85V65sBIxw1FeDPm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netcore50/ru/System.Collections.xml

SHA256 a5d544efe75cf82e66fc05e9795d242dcc66f63fe14d66f00ca8041693426b9a
MD5 c7a2515c865ace772e9ec06d383c041c
SHA1 2807635a49e7ab7aaf68da7a9f90a3c19a00bec9
SHA512 982362ca527a21770ebba4d7b2d27852e05cdfa38e6ed5d0b8a0940f889c5d22af59150c9726ab220b8386df6cdf4eff20164e25ee66ed4c98ad30cb54861a1a
SSDEEP 12288:Vte58tQTO8eYjf2bGvHTwIUeC1R5Z/lQKkoZ5q555YoNS/G8VmEI7tTOUfomDclH:z
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netcore50/zh-hans/System.Collections.xml

SHA256 352af63342e5ec1ef484e8f113907c73eea33fcd1b5f7c38c0899b025b2128d1
MD5 33dd1fc0d7d0bee398554136a5cb7715
SHA1 25509b85f52b7be32e6a0c91331c2c5287b787fc
SHA512 99c630b9ad8274a96a97b48083f65e7f6b1c977e5165b2019a04934b4054ee9ab8b4c35e7bd1f53c79b6ec0cb754a24b2101b45fffeb17cdce7cb1c8b4eaa494
SSDEEP 6144:W6B4ZLSJVOzab6E8fVjOXjX3RUHXNNylJfS3Q0O8TQfDbzvx7geen8gH19R/CgzF:W6B4ZLSJVOzab6E8fVjOXjnRoXNNyjSz
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netcore50/zh-hant/System.Collections.xml

SHA256 8d6adc6b72eb2e455762fedea7ad5674665a3cee04c253af48d225297e6298a7
MD5 6d8c871c79be2c747a7520abe9eafd65
SHA1 9a4c2d2dfbb34a11e14f25e860957f4b308f5907
SHA512 13b06bd664d08e637a57a51abcd27ef00812d31007fde1add2c252936e8d0f62be3d8af984de9886117c4ade8d85a711ceb0bcbee5f3736c7065ac825bb4d2db
SSDEEP 6144:pcPVQfe2u3AaD/v3R0BHayeibDn7N/5Kq/jck1tpYEMzGFqFYkI0MI2hqQJNoNer:pcPVQfe2u3AaD/v3R0BHayeibDn7N/w6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.0/System.Collections.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5937ef02739c862dfe6e319dcc0e31b9c8d785c8e9bcce91cb7e45010bc520a3
MD5 4ecf3dd3bb3f5a38de25fa892a451610
SHA1 318b8de09057035d9cf2fe112126a25605cbca8f
SHA512 16ef89e8b9fb850e0d1803f882335616ddeffd63e6eb2ed8fc80732a03bc1afd5c783ade469ad4aed1bd8d1ced99b032579a117b4ecb971d0d8e12826ced2515
SSDEEP 384:UQ3vPyy4X8KNrKfT6jVcShr8EuWurljyqus/7u9K8/kn8SP4/WWyZKEVak8rqGxu:UQXyyy0Tqzt8+bs42vfRacgWiQDOra
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

43:cc:5f:9b:34:7e:b7:5d:5c:dc:a7:e5:93:d9:85:3b:eb:0e:21:62:08:a3:43:8b:3e:bc:b0:4b:56:20:2a:15

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8e:47:d5:f4:47:7a:f8:f9:0f:94:31:57:d0:b7:ea:8b:a7:45:60:a8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

32718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.0/System.Collections.xml

SHA256 a7a3e22bd3b01c9702919f58881a07be9e895f921c05099915d519182f2d92a1
MD5 494d83ca42f99e54b13402cfe16ebfdb
SHA1 8b2fc5175738afd527284fc57b0d852661c10b8e
SHA512 6fa9b056fddea5d8e001160ce274219ac018607a11bccaddf29d19e4a6517ae0b4d816c7b455b761eec7a69b87afbcd50f440a760be55304eec8f9cb3ed40ae2
SSDEEP 6144:ttYI/pFSEqzkMz6oZTwkLTG9dINNfyrbEzKitW97sa:ttYI/pFSEqzkMz6oZTwkLTG9dINNfyrp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.0/de/System.Collections.xml

SHA256 6f28b3d7a32aa5f2c027e2a85b96d3f51a2a7a361837b4710bda5e21aee4cf6b
MD5 c57edaeecfdffe5e2879763ad0d541e2
SHA1 a5be9281d490ecf862ff0fe03a35c27cd67681d2
SHA512 5beab27a2b2b28c7c8050a171d93b77c622fe088a8a3ba1a1ac1a286453018b9cd71e6e50d51dfeb57bf921ae3c860b065d12bab487ba8bbabfb1b6215733b64
SSDEEP 6144:FA2lwBiCDoWh3JgqvdOHhpT51VwefW7JjCMThYxTM9PsFINQmAA7KClDIfwDfpLe:FA2lwBiCDoWh3JgqvdOHhpT51VwefW7k
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.0/es/System.Collections.xml

SHA256 c0daf5783ebe07fa5cbb8d19aefda403e540bb56ffd04e9a6d0bd8d0c219a792
MD5 135f5198632eccf501ed363f2496b8a2
SHA1 4136f6244af3af456c2de0889cc9a1d5c3990df9
SHA512 906f888173df6273eb86a34617039b9e5b2cbf821e97363989ced3b1d809c1c3203661a9f5069d8d679f8965aeabe12c982bdc2bacc5cc9cfa852d30c31a6519
SSDEEP 6144:wRMmhx2UCdDD+/JmrVH/OcyPUOAxI0RSUQ/ZIRja+k:wRMmhx2UCdDD+/JmrVH/OcyPUOAxI0Rg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.0/fr/System.Collections.xml

SHA256 22270f6544e4e26741f8293398f4ea19fbd7f78ab916ce062d7c00e56383c8f6
MD5 af170dd648b75de07e32d1b7d2817a86
SHA1 31077b2da80507c6fc58e2772ba8fb0efa0cfe88
SHA512 d9c52fb29061662381d01e4e134b990c81864dd88d672ee4d60965263e367c7802351830ffb57d08d298fe8a5e0e2959e67df480d369a767fe6a19ef3ca22bcc
SSDEEP 6144:cDyNLFKoOgVhqLEofJm9IV67XB+win/Ji8X4KILnzch:cDyNLFKoOgVhqLEcJm9IV67XB+win/Jj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.0/it/System.Collections.xml

SHA256 1e10f259aca48fa9457696bea1a6a6180827dc809e7059e916a479a1c04607a3
MD5 19e131bed1e1ea23f9b032ae6ccd7482
SHA1 275e84732f86386de2529a779650fe96365f841b
SHA512 1cd32d9529a874e7e45035efe9526bb961f49c36b2f5f8fe8ac97d3bbb19adab9e4fd3dedb212bbcc6ba755099f15bd6b919f809f3e52a133202eaba298e1d96
SSDEEP 6144:6Je3nUwkpTZAWZ8mCoeiX2sfDDfcN3//VhqYba7stKodpI/sAz8s6fgLYfCjfCO/:wb8mCP0DDfothqYYcL/11GihX2xEQb1r
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.0/ja/System.Collections.xml

SHA256 24152ad449af6ff2a89e3c0d74af3f999646700dc5a3fd2a50aeaa170c8d2a59
MD5 49cd0faf7b40529e0984eea6f9af0902
SHA1 a3dc5cd8938cfd5206d82f8e4cebd7de0200fd1d
SHA512 bf7d75d37f7af72a824384e3250e92f966de30337a70bb69c80f050e9bb19a4abc81d93ed2d79e5452f7d9f5038656778e80aa2a7a467d6e079a591459af2cd5
SSDEEP 6144:5amp7HcYQwUIzCRokDNbGaTFraf/6T6S1oToaaybhGp:kmp7HcYQwUIzCRokDNbGaTFraf/6T6Sr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.0/ko/System.Collections.xml

SHA256 0add30340c81751aa971a6de6f93505cf10ab0b553ef4e3ddac73052c3164a10
MD5 8c0d3aaae53f22b88ffbbff2701af929
SHA1 ab0762aa07a6daf450e811d934c4e9bcd900d797
SHA512 2f8a996dd0d9e339c1b62d6148a74157f163d5fc1acbca237c2ac36773dbc88ee4f28c52da4a1e35e1c52c97d97ea9cdb93903fb4565948e3bfebb4248288e40
SSDEEP 6144:PTdfPydC68AjBy7m85V65sBIxw1FeDPHuvzVzwCx5hs2R6RzkTeCOR6u6jSUbfVT:PTdfPydC68AjBy7m85V65sBIxw1FeDPm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.0/ru/System.Collections.xml

SHA256 a5d544efe75cf82e66fc05e9795d242dcc66f63fe14d66f00ca8041693426b9a
MD5 c7a2515c865ace772e9ec06d383c041c
SHA1 2807635a49e7ab7aaf68da7a9f90a3c19a00bec9
SHA512 982362ca527a21770ebba4d7b2d27852e05cdfa38e6ed5d0b8a0940f889c5d22af59150c9726ab220b8386df6cdf4eff20164e25ee66ed4c98ad30cb54861a1a
SSDEEP 12288:Vte58tQTO8eYjf2bGvHTwIUeC1R5Z/lQKkoZ5q555YoNS/G8VmEI7tTOUfomDclH:z
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.0/zh-hans/System.Collections.xml

SHA256 352af63342e5ec1ef484e8f113907c73eea33fcd1b5f7c38c0899b025b2128d1
MD5 33dd1fc0d7d0bee398554136a5cb7715
SHA1 25509b85f52b7be32e6a0c91331c2c5287b787fc
SHA512 99c630b9ad8274a96a97b48083f65e7f6b1c977e5165b2019a04934b4054ee9ab8b4c35e7bd1f53c79b6ec0cb754a24b2101b45fffeb17cdce7cb1c8b4eaa494
SSDEEP 6144:W6B4ZLSJVOzab6E8fVjOXjX3RUHXNNylJfS3Q0O8TQfDbzvx7geen8gH19R/CgzF:W6B4ZLSJVOzab6E8fVjOXjnRoXNNyjSz
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.0/zh-hant/System.Collections.xml

SHA256 8d6adc6b72eb2e455762fedea7ad5674665a3cee04c253af48d225297e6298a7
MD5 6d8c871c79be2c747a7520abe9eafd65
SHA1 9a4c2d2dfbb34a11e14f25e860957f4b308f5907
SHA512 13b06bd664d08e637a57a51abcd27ef00812d31007fde1add2c252936e8d0f62be3d8af984de9886117c4ade8d85a711ceb0bcbee5f3736c7065ac825bb4d2db
SSDEEP 6144:pcPVQfe2u3AaD/v3R0BHayeibDn7N/5Kq/jck1tpYEMzGFqFYkI0MI2hqQJNoNer:pcPVQfe2u3AaD/v3R0BHayeibDn7N/w6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.3/System.Collections.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b5e780ed3a3d8ec831708be7f093d99626ecb835d3cba8ae1624f2c56149c705
MD5 b35c8228cfebdc0ce7286e9b3fe58cc2
SHA1 a92d88eed2878048dd52979e98cfde3b9e338003
SHA512 83f2076bf97a50d0cb8716d08ace4868386823f3fcae120dd0a6d8c5030e773479da384523ee66bf86884a53630fa6647b703fae76e71bdcd249643cb0d8f466
SSDEEP 384:g5BWPSCc9ReDhcc68gtNKOVoZbYRX7/WUymKUqZQG8wUj38uUBJ7PWqaC1ZUsbhB:JPO9cWtNFv2PblcUibEBF9Vft
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

14:dd:b3:dc:c2:a7:a3:13:55:75:58:ee:af:c6:23:ac:bc:20:bf:e1:9d:f5:9f:67:96:fb:46:2d:f1:e8:4c:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

ca:29:92:75:1d:4a:30:bd:c6:d6:fb:cb:af:e8:24:6f:f5:11:5a:c8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

32902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Collections\4.0.10.0\System.Collections.pdb

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.3/System.Collections.xml

SHA256 a7a3e22bd3b01c9702919f58881a07be9e895f921c05099915d519182f2d92a1
MD5 494d83ca42f99e54b13402cfe16ebfdb
SHA1 8b2fc5175738afd527284fc57b0d852661c10b8e
SHA512 6fa9b056fddea5d8e001160ce274219ac018607a11bccaddf29d19e4a6517ae0b4d816c7b455b761eec7a69b87afbcd50f440a760be55304eec8f9cb3ed40ae2
SSDEEP 6144:ttYI/pFSEqzkMz6oZTwkLTG9dINNfyrbEzKitW97sa:ttYI/pFSEqzkMz6oZTwkLTG9dINNfyrp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.3/de/System.Collections.xml

SHA256 6f28b3d7a32aa5f2c027e2a85b96d3f51a2a7a361837b4710bda5e21aee4cf6b
MD5 c57edaeecfdffe5e2879763ad0d541e2
SHA1 a5be9281d490ecf862ff0fe03a35c27cd67681d2
SHA512 5beab27a2b2b28c7c8050a171d93b77c622fe088a8a3ba1a1ac1a286453018b9cd71e6e50d51dfeb57bf921ae3c860b065d12bab487ba8bbabfb1b6215733b64
SSDEEP 6144:FA2lwBiCDoWh3JgqvdOHhpT51VwefW7JjCMThYxTM9PsFINQmAA7KClDIfwDfpLe:FA2lwBiCDoWh3JgqvdOHhpT51VwefW7k
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.3/es/System.Collections.xml

SHA256 c0daf5783ebe07fa5cbb8d19aefda403e540bb56ffd04e9a6d0bd8d0c219a792
MD5 135f5198632eccf501ed363f2496b8a2
SHA1 4136f6244af3af456c2de0889cc9a1d5c3990df9
SHA512 906f888173df6273eb86a34617039b9e5b2cbf821e97363989ced3b1d809c1c3203661a9f5069d8d679f8965aeabe12c982bdc2bacc5cc9cfa852d30c31a6519
SSDEEP 6144:wRMmhx2UCdDD+/JmrVH/OcyPUOAxI0RSUQ/ZIRja+k:wRMmhx2UCdDD+/JmrVH/OcyPUOAxI0Rg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.3/fr/System.Collections.xml

SHA256 22270f6544e4e26741f8293398f4ea19fbd7f78ab916ce062d7c00e56383c8f6
MD5 af170dd648b75de07e32d1b7d2817a86
SHA1 31077b2da80507c6fc58e2772ba8fb0efa0cfe88
SHA512 d9c52fb29061662381d01e4e134b990c81864dd88d672ee4d60965263e367c7802351830ffb57d08d298fe8a5e0e2959e67df480d369a767fe6a19ef3ca22bcc
SSDEEP 6144:cDyNLFKoOgVhqLEofJm9IV67XB+win/Ji8X4KILnzch:cDyNLFKoOgVhqLEcJm9IV67XB+win/Jj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.3/it/System.Collections.xml

SHA256 1e10f259aca48fa9457696bea1a6a6180827dc809e7059e916a479a1c04607a3
MD5 19e131bed1e1ea23f9b032ae6ccd7482
SHA1 275e84732f86386de2529a779650fe96365f841b
SHA512 1cd32d9529a874e7e45035efe9526bb961f49c36b2f5f8fe8ac97d3bbb19adab9e4fd3dedb212bbcc6ba755099f15bd6b919f809f3e52a133202eaba298e1d96
SSDEEP 6144:6Je3nUwkpTZAWZ8mCoeiX2sfDDfcN3//VhqYba7stKodpI/sAz8s6fgLYfCjfCO/:wb8mCP0DDfothqYYcL/11GihX2xEQb1r
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.3/ja/System.Collections.xml

SHA256 24152ad449af6ff2a89e3c0d74af3f999646700dc5a3fd2a50aeaa170c8d2a59
MD5 49cd0faf7b40529e0984eea6f9af0902
SHA1 a3dc5cd8938cfd5206d82f8e4cebd7de0200fd1d
SHA512 bf7d75d37f7af72a824384e3250e92f966de30337a70bb69c80f050e9bb19a4abc81d93ed2d79e5452f7d9f5038656778e80aa2a7a467d6e079a591459af2cd5
SSDEEP 6144:5amp7HcYQwUIzCRokDNbGaTFraf/6T6S1oToaaybhGp:kmp7HcYQwUIzCRokDNbGaTFraf/6T6Sr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.3/ko/System.Collections.xml

SHA256 0add30340c81751aa971a6de6f93505cf10ab0b553ef4e3ddac73052c3164a10
MD5 8c0d3aaae53f22b88ffbbff2701af929
SHA1 ab0762aa07a6daf450e811d934c4e9bcd900d797
SHA512 2f8a996dd0d9e339c1b62d6148a74157f163d5fc1acbca237c2ac36773dbc88ee4f28c52da4a1e35e1c52c97d97ea9cdb93903fb4565948e3bfebb4248288e40
SSDEEP 6144:PTdfPydC68AjBy7m85V65sBIxw1FeDPHuvzVzwCx5hs2R6RzkTeCOR6u6jSUbfVT:PTdfPydC68AjBy7m85V65sBIxw1FeDPm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.3/ru/System.Collections.xml

SHA256 a5d544efe75cf82e66fc05e9795d242dcc66f63fe14d66f00ca8041693426b9a
MD5 c7a2515c865ace772e9ec06d383c041c
SHA1 2807635a49e7ab7aaf68da7a9f90a3c19a00bec9
SHA512 982362ca527a21770ebba4d7b2d27852e05cdfa38e6ed5d0b8a0940f889c5d22af59150c9726ab220b8386df6cdf4eff20164e25ee66ed4c98ad30cb54861a1a
SSDEEP 12288:Vte58tQTO8eYjf2bGvHTwIUeC1R5Z/lQKkoZ5q555YoNS/G8VmEI7tTOUfomDclH:z
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.3/zh-hans/System.Collections.xml

SHA256 352af63342e5ec1ef484e8f113907c73eea33fcd1b5f7c38c0899b025b2128d1
MD5 33dd1fc0d7d0bee398554136a5cb7715
SHA1 25509b85f52b7be32e6a0c91331c2c5287b787fc
SHA512 99c630b9ad8274a96a97b48083f65e7f6b1c977e5165b2019a04934b4054ee9ab8b4c35e7bd1f53c79b6ec0cb754a24b2101b45fffeb17cdce7cb1c8b4eaa494
SSDEEP 6144:W6B4ZLSJVOzab6E8fVjOXjX3RUHXNNylJfS3Q0O8TQfDbzvx7geen8gH19R/CgzF:W6B4ZLSJVOzab6E8fVjOXjnRoXNNyjSz
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.4.3.0/ref/netstandard1.3/zh-hant/System.Collections.xml

SHA256 8d6adc6b72eb2e455762fedea7ad5674665a3cee04c253af48d225297e6298a7
MD5 6d8c871c79be2c747a7520abe9eafd65
SHA1 9a4c2d2dfbb34a11e14f25e860957f4b308f5907
SHA512 13b06bd664d08e637a57a51abcd27ef00812d31007fde1add2c252936e8d0f62be3d8af984de9886117c4ade8d85a711ceb0bcbee5f3736c7065ac825bb4d2db
SSDEEP 6144:pcPVQfe2u3AaD/v3R0BHayeibDn7N/5Kq/jck1tpYEMzGFqFYkI0MI2hqQJNoNer:pcPVQfe2u3AaD/v3R0BHayeibDn7N/w6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/.signature.p7s

SHA256 f76592a424132077e79217c25bd32a2afe992716b5887ef5983d5450ca6b83dc
MD5 20cc5a738de8ffc443d8adbb7bd9f952
SHA1 b1405f8d0878869cdf967cd4628a66f7aa3193a0
SHA512 e62bf2dab2a6cbcdf994b0b4a4a15e1b343ec3228311ac616a8159f5e39f14b8b161fc29efb5b084ebad5cbcd161daeede1f220ddc8c8ea8a9f0a3477b902d34
SSDEEP 192:8dqs7x0KDWpHhXZCVzV07xrxu9DH0JOqNG8Fp28Wh8n7JmA:E5vDGGVpIu9oJNNzFwhhi78A
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/System.Collections.Concurrent.4.3.0.nupkg

SHA256 28c6390df2670de22c6b5dc3a6abf237c36445e644300167966360955a052172
MD5 04ab7f149e6601d06695ad02e32f9efe
SHA1 cac1e57d28053df557290f63a44bdd008279edc6
SHA512 35c1aa3e636216fe5dc2ebeb504293e69ad6355d26e22453af060af94d8279faa93bdcfe127aecb0b316c7e7d9185bcac72e994984efdb7f2d8515f1f55cf682
SSDEEP 12288:er+/ohbrvcVYYxR6x9DNrHX634dR0xbToJ4rHX9/RqxxPiTwS:er+/+bofa7Nr7oZhrtoXrS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/lib/netcore50/System.Collections.Concurrent.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4e627550d12c8af30597432aa4c859b62592e0800e290545d063b1f4a1e30981
MD5 72b5e403bf2f746939862d6b88694f3a
SHA1 a7024b37d842b5cc52cfd0620d831261a87f924f
SHA512 30d4dfdc4bceeaee4ddddece05f864c560ee0bf09ade0198d951727fc7b5f287dd83e199e8afc14404180314983e9cf466e389330ab42db7f54c04e7ed932a2c
SSDEEP 1536:YdQHTRtcMrxRnUQCKHqygYtMU8gza7FwkGSulimJEAvOBUwDyQrpG6dV2g90yO2C:PRrAHukGSu5JE1BUwDyQrA6dV2g90yOL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

65:e9:ac:25:cb:c6:fc:a3:06:3f:96:99:2e:a2:b2:e5:de:e1:e0:78:c4:fb:c3:cc:76:1f:67:37:b4:fb:c5:61

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

11:62:e3:60:03:7f:b5:ae:1d:2f:be:3c:66:be:aa:0b:26:95:ca:c0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

83214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\\FxCore\x86ret\System.Collections.Concurrent\System.Collections.Concurrent.pdb

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/lib/netstandard1.3/System.Collections.Concurrent.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3423f79a2226b9969d93ec7a7ee7a64f0f64f89ec39a3f78a401829cb3ed427a
MD5 8ee4c9897b58bf93cb2a77afdf861b2d
SHA1 5c9974c132931c857c5200143c9dfe9efee5dbbf
SHA512 a2256ef55670ecfd577f53a1f950c2e9d3f88c07cb511e5b188df884ed47224aaba6912298196dc6a3565329a7da29202218dc9fbc85ec19c72f1450dd34a420
SSDEEP 1536:Je6tGAF7WCBPyRDDGHJPAwDUQr/G4PV+g90yO2dLbnUQyVAi6zB4EBAbbL:btGnb5xwDUQre4PV+g90yO2RUQyOlzBc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d1:98:52:ce:51:bc:7a:3f:e3:11:3e:ad:8d:81:5b:27:d0:5f:00:c7:6d:27:07:04:c0:97:16:b8:da:e7:7c:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

38:47:d9:79:1b:cf:66:67:9e:e5:6f:ca:59:ea:79:a8:03:b9:eb:f9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

82442

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Collections.Concurrent\System.Collections.Concurrent.pdb

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netcore50/System.Collections.Concurrent.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8ac18a4d36f2ac4944b24887723c48d7d25d07ec83bd026b637f371ce122bf60
MD5 f0ca5dc84ea44e3f0321219e20bda16d
SHA1 9102972ef69fe1875e54d2d84ce5a0da872eaf21
SHA512 6372208ee22b1e4dc8d998be4e539c36af8cf14b8f71d43dd2b5ad3b459593f4ecc229becee4c317eeb4583d09e489f84e750db810aa01d07e88a9aaa07f93d5
SSDEEP 384:6UCp+vgOZrW3NoZbAFjWndZQRt3dNsPq+DrZUkzcbIJukQlZZlTg9021rsa5QXN4:VG8fZlabg902gkCjicEBI1RT+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

c9:e4:17:92:cc:44:7e:99:37:81:7f:4c:f6:72:cc:58:d5:2b:d4:d0:3d:5b:fa:cd:00:c6:32:e4:f0:fa:bd:73

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

73:13:0e:30:35:2d:79:2a:85:94:05:4d:4e:df:aa:32:83:17:ac:1e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

20498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Collections.Concurrent\4.0.10.0\System.Collections.Concurrent.pdb

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netcore50/System.Collections.Concurrent.xml

SHA256 6e0284817cbe7fb1a95579deed14c1f33f14e24b686593ad64b0110179d4fe0c
MD5 4d987efd146109cac1e1fab2aaf9cc75
SHA1 ff769e2fee39bbe15f6cb9aa0f9cdedab837b339
SHA512 f2932ab8193c0d583cbba810af0d00e4f36538537234f54965bf1cbf6d1ea34c2bd53f0c867afbae867c6acdca94528ecb9fa8c664ed975b1e2c2514d801e256
SSDEEP 1536:ri5EmQaolHjJDMpZhb+mxzLzOVNot7hkeg+jL0xIlX04MuvEdWJMgSShbFSufdc3:ou+jQIKUuvgzftIz
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netcore50/de/System.Collections.Concurrent.xml

SHA256 c5b74064c914290d3c01294b8e29f28fb008595a48720111fb0b53d381be759a
MD5 8ccae9e4d4ba347fdc390cb258be59a8
SHA1 3c64ff677705882b2bb5aacdf229cea404ddf0eb
SHA512 170e9344810d4193e78e2571190bcb4a0ec97ec40543dc3f5f176bf4c1e6e76c8b98351523d8e2fb1d1c84db246d7dd554da76e7d837413e2840a4c9fc14c6eb
SSDEEP 1536:qpKbRWerkkOqQ/jQ26tOypUPPSC0WVB7lr7uRXpwgFiZiHjWyThUXd8i:BbSQNOypUPxNuRXpdw8DWyGXd8i
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netcore50/es/System.Collections.Concurrent.xml

SHA256 bcbf0e0542f1bdcc70dc003e0e1c5a48c66ad2fd91c9484a4170fbd37c494614
MD5 db8df04da28a37b8c0794252e63cdfe5
SHA1 18386495b7940b089f1270ba606cb3d774640274
SHA512 d2c93e115208598d61c44ba058da2f0e296b430cf149183feb79816ae51e7d73470ac61c67418f22ab38e1bd795a104f64ce1cca34b5797c589afacc3ffef79b
SSDEEP 1536:nd0PLupkj1BoHWZECPAv3cyfd5u+kKn/N5D18oPZ/IvXU8LIaZzn/IH//IX2z1BW:6uu+kKn7THIOMxvd4g
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netcore50/fr/System.Collections.Concurrent.xml

SHA256 c91cf8d042ac061d662c3b27a55756f106973f27057e0bee6ed35f15d67c0fc9
MD5 d05cb88111bcfed0a1be1cc6126887d3
SHA1 1aa6c734645bb065cebd9aa5bd69eeb535799545
SHA512 c0c01e42c0aaf493bd5faac82b20feb9fd1d5dcc78a0192ccffdaa7ff0ee136b29f66e2a4dbc2e6eb0d3529197dec3966909e34e53e5f252b5c87b7e184ccc65
SSDEEP 768:Yu989gaWz9IahB/rOyLHWMXPjoWNI8wy+1Eg4hWhZrrr3n3rlV3Kv:Z9894f8WNTfWbrrr3n3rlV3Kv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netcore50/it/System.Collections.Concurrent.xml

SHA256 f0d00039823d8e59726d705c2febcfba1918412ab2dac140e6464b8d28aaba24
MD5 7471ed5d2e2795e1a6162bda65b4e29c
SHA1 97c2b89886c115f92fe8be4976a264e4f639182d
SHA512 86898ae0ac47517bfdd8927d2458312e3b44a078db17738c23b7c1d38dec4a0794c3b96119ddd7a6bfcda06e4fad7671015e779034190a5db3278347949359b9
SSDEEP 3072:/q/VoMY3uFdB3JBHAeo59y3nvfOLfC/jAxnJRdqImKnBvCTHRe5rpY1y/1a3i:/q/VoMY3uFdB3JBHAeo59y3nvfOLfC/s
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netcore50/ja/System.Collections.Concurrent.xml

SHA256 3f01d5540c57fea9ed5587a6d3f6b526e447190c5a8e7384c2f237ddc8aa7423
MD5 ee64d6d8151bc2bee72e05b6e7572fc9
SHA1 51bce908b3c689eff57165af8436a7c3a01dbd6b
SHA512 48d395fead30f1e003a390848f01280b3fccbb0e1cd156f5d370db19d390dc7e137c3049a345c9b425f682c3b79d11b6de41f26ca54b58af637737467d32ac4b
SSDEEP 768:YkUJgBvCP//njDmEU+k2UXp96MSaXrjvW9IuxShm0Qp6t7ByBp6uNpEHfDf7DGge:287r7jW9rOgXpEH7zDGg/dQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netcore50/ko/System.Collections.Concurrent.xml

SHA256 8c6d3e3d5610c414d0f918f5f16f833cbbaa1f68197d56a46fcce0949f17146e
MD5 005af6a489e3c49af08d0523b513c159
SHA1 0e2c3e10ec6feaa680878681a3e72cb638ed55e0
SHA512 b0b7d6f69eb71b2732bc802d746c67aec6ad89b193bbe2345c5dc151901742b56655d507ab978787a0c9d5c7b96b443649184cc63d0af6382b49f720b8decf57
SSDEEP 3072:1OeNahxq+KKVLHTkAXl28M0orW4fCIPfCT/DI4qq9rkqirolFpuqaVUD8U1GW+4u:1OeNahxq+KKVLHTkAXl28M0orW4fvPfv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netcore50/ru/System.Collections.Concurrent.xml

SHA256 948da7ff9aa5e73ead860f3edd7bc8f5c638fc618f70025d5f10cccb54ef4d2e
MD5 162253b4ceb9e8688a6b89b8043ec068
SHA1 ccea599da60affecea0da4bcafd927bb4d0cddce
SHA512 373b72bc66169eab08bf176622eec2c3b7c0a686c39e32e299f92c4acd4bd53e2855a38928ef1adc9b2642071528798373b49d1f84f16165ae03c7b69b266754
SSDEEP 3072:QN+MNY0gNCPQlYECxP6hHF4OQCwRQjcmYzVbB4UVudLLB62kzojbED6h1Id+fZqr:QN+MNtgkQlYECxEF4OQCwRQjz+4UVud6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netcore50/zh-hans/System.Collections.Concurrent.xml

SHA256 3db76ca0e7828f666b304a5b03142737afce145eed1e1916ff8ffc212b1765aa
MD5 b7c8f05adde3d01161ca95ea56e1f76f
SHA1 a3a5827d0461a7a911d205ff45c11975075b8968
SHA512 12690f8f5e55cdcbebf75192dc45c1f8bd3efbdf3b3beabbdfbe92f02d9e488e04a2718dc981f8fa1b16008839408ce6a359e410c43a9cce62f2aa7c9c60335f
SSDEEP 1536:f20k2CW0JTwa2jsvGWn/JlwoVwwwPIzly+6wivEywTR9jWieXyu:f20k2CJX2wvGWn//jVjKIzl2D6KieXyu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netcore50/zh-hant/System.Collections.Concurrent.xml

SHA256 a9faab19252be1346e1f5f335472a5fa58a22f0cf24e0f849db57acf31d15cb0
MD5 690b8cd6c97c8d34f072e9a037f74365
SHA1 580535e47650f50386878b3fc617c14fb93b98cc
SHA512 5e85c9cbc7ae809414a7a5a0a054e13bdef6b0ef31b42a3d9f19cbf124a43e9e70d93f6a862788443b14b1f443b984060c515922392064a08739301e94f60939
SSDEEP 1536:QekFiTvjMpkACPC/axEzaBGsfUHSl1S6x8l0frcuBldYf:QeJTbSk1PC/axEzaBG4UHSl1l8Ofr5Yf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.1/System.Collections.Concurrent.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b27a52f8fcd386331c7f0dc3934ff8066c59246267cc2776837d14152972b5ab
MD5 0a9f4078b4c426587858e7fb6c1dd303
SHA1 bd3717140a5b0e19dbc293cedbaa7816d73aa89d
SHA512 0f0541fa91f3a15250151f0ae07a3b3ec77ed000cceb8aafa62351256c34704b42a9079c3709d6e84cb00cc1e480a6d2994076f3a8c37c82b457bd4981397866
SSDEEP 384:UJJy0rVuVCSO3QBOWISomFg1xWV2ZK8rqGxxZbZyZUZgAR/o+oZa3uPsaq9QhpIH:UPjSfu9QhpIjBrrWiI8DFWJe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d1:38:b9:d5:9b:47:86:87:9d:82:9e:3a:2d:03:53:49:61:64:47:f7:2d:82:8f:5c:23:d1:29:a5:a9:9b:0c:7a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

f9:53:b1:ce:05:a4:8a:cc:c3:7d:32:2d:32:cd:38:e2:b1:57:98:4f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

20686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.1/System.Collections.Concurrent.xml

SHA256 6e0284817cbe7fb1a95579deed14c1f33f14e24b686593ad64b0110179d4fe0c
MD5 4d987efd146109cac1e1fab2aaf9cc75
SHA1 ff769e2fee39bbe15f6cb9aa0f9cdedab837b339
SHA512 f2932ab8193c0d583cbba810af0d00e4f36538537234f54965bf1cbf6d1ea34c2bd53f0c867afbae867c6acdca94528ecb9fa8c664ed975b1e2c2514d801e256
SSDEEP 1536:ri5EmQaolHjJDMpZhb+mxzLzOVNot7hkeg+jL0xIlX04MuvEdWJMgSShbFSufdc3:ou+jQIKUuvgzftIz
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.1/de/System.Collections.Concurrent.xml

SHA256 c5b74064c914290d3c01294b8e29f28fb008595a48720111fb0b53d381be759a
MD5 8ccae9e4d4ba347fdc390cb258be59a8
SHA1 3c64ff677705882b2bb5aacdf229cea404ddf0eb
SHA512 170e9344810d4193e78e2571190bcb4a0ec97ec40543dc3f5f176bf4c1e6e76c8b98351523d8e2fb1d1c84db246d7dd554da76e7d837413e2840a4c9fc14c6eb
SSDEEP 1536:qpKbRWerkkOqQ/jQ26tOypUPPSC0WVB7lr7uRXpwgFiZiHjWyThUXd8i:BbSQNOypUPxNuRXpdw8DWyGXd8i
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.1/es/System.Collections.Concurrent.xml

SHA256 bcbf0e0542f1bdcc70dc003e0e1c5a48c66ad2fd91c9484a4170fbd37c494614
MD5 db8df04da28a37b8c0794252e63cdfe5
SHA1 18386495b7940b089f1270ba606cb3d774640274
SHA512 d2c93e115208598d61c44ba058da2f0e296b430cf149183feb79816ae51e7d73470ac61c67418f22ab38e1bd795a104f64ce1cca34b5797c589afacc3ffef79b
SSDEEP 1536:nd0PLupkj1BoHWZECPAv3cyfd5u+kKn/N5D18oPZ/IvXU8LIaZzn/IH//IX2z1BW:6uu+kKn7THIOMxvd4g
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.1/fr/System.Collections.Concurrent.xml

SHA256 c91cf8d042ac061d662c3b27a55756f106973f27057e0bee6ed35f15d67c0fc9
MD5 d05cb88111bcfed0a1be1cc6126887d3
SHA1 1aa6c734645bb065cebd9aa5bd69eeb535799545
SHA512 c0c01e42c0aaf493bd5faac82b20feb9fd1d5dcc78a0192ccffdaa7ff0ee136b29f66e2a4dbc2e6eb0d3529197dec3966909e34e53e5f252b5c87b7e184ccc65
SSDEEP 768:Yu989gaWz9IahB/rOyLHWMXPjoWNI8wy+1Eg4hWhZrrr3n3rlV3Kv:Z9894f8WNTfWbrrr3n3rlV3Kv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.1/it/System.Collections.Concurrent.xml

SHA256 f0d00039823d8e59726d705c2febcfba1918412ab2dac140e6464b8d28aaba24
MD5 7471ed5d2e2795e1a6162bda65b4e29c
SHA1 97c2b89886c115f92fe8be4976a264e4f639182d
SHA512 86898ae0ac47517bfdd8927d2458312e3b44a078db17738c23b7c1d38dec4a0794c3b96119ddd7a6bfcda06e4fad7671015e779034190a5db3278347949359b9
SSDEEP 3072:/q/VoMY3uFdB3JBHAeo59y3nvfOLfC/jAxnJRdqImKnBvCTHRe5rpY1y/1a3i:/q/VoMY3uFdB3JBHAeo59y3nvfOLfC/s
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.1/ja/System.Collections.Concurrent.xml

SHA256 3f01d5540c57fea9ed5587a6d3f6b526e447190c5a8e7384c2f237ddc8aa7423
MD5 ee64d6d8151bc2bee72e05b6e7572fc9
SHA1 51bce908b3c689eff57165af8436a7c3a01dbd6b
SHA512 48d395fead30f1e003a390848f01280b3fccbb0e1cd156f5d370db19d390dc7e137c3049a345c9b425f682c3b79d11b6de41f26ca54b58af637737467d32ac4b
SSDEEP 768:YkUJgBvCP//njDmEU+k2UXp96MSaXrjvW9IuxShm0Qp6t7ByBp6uNpEHfDf7DGge:287r7jW9rOgXpEH7zDGg/dQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.1/ko/System.Collections.Concurrent.xml

SHA256 8c6d3e3d5610c414d0f918f5f16f833cbbaa1f68197d56a46fcce0949f17146e
MD5 005af6a489e3c49af08d0523b513c159
SHA1 0e2c3e10ec6feaa680878681a3e72cb638ed55e0
SHA512 b0b7d6f69eb71b2732bc802d746c67aec6ad89b193bbe2345c5dc151901742b56655d507ab978787a0c9d5c7b96b443649184cc63d0af6382b49f720b8decf57
SSDEEP 3072:1OeNahxq+KKVLHTkAXl28M0orW4fCIPfCT/DI4qq9rkqirolFpuqaVUD8U1GW+4u:1OeNahxq+KKVLHTkAXl28M0orW4fvPfv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.1/ru/System.Collections.Concurrent.xml

SHA256 948da7ff9aa5e73ead860f3edd7bc8f5c638fc618f70025d5f10cccb54ef4d2e
MD5 162253b4ceb9e8688a6b89b8043ec068
SHA1 ccea599da60affecea0da4bcafd927bb4d0cddce
SHA512 373b72bc66169eab08bf176622eec2c3b7c0a686c39e32e299f92c4acd4bd53e2855a38928ef1adc9b2642071528798373b49d1f84f16165ae03c7b69b266754
SSDEEP 3072:QN+MNY0gNCPQlYECxP6hHF4OQCwRQjcmYzVbB4UVudLLB62kzojbED6h1Id+fZqr:QN+MNtgkQlYECxEF4OQCwRQjz+4UVud6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.1/zh-hans/System.Collections.Concurrent.xml

SHA256 3db76ca0e7828f666b304a5b03142737afce145eed1e1916ff8ffc212b1765aa
MD5 b7c8f05adde3d01161ca95ea56e1f76f
SHA1 a3a5827d0461a7a911d205ff45c11975075b8968
SHA512 12690f8f5e55cdcbebf75192dc45c1f8bd3efbdf3b3beabbdfbe92f02d9e488e04a2718dc981f8fa1b16008839408ce6a359e410c43a9cce62f2aa7c9c60335f
SSDEEP 1536:f20k2CW0JTwa2jsvGWn/JlwoVwwwPIzly+6wivEywTR9jWieXyu:f20k2CJX2wvGWn//jVjKIzl2D6KieXyu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.1/zh-hant/System.Collections.Concurrent.xml

SHA256 a9faab19252be1346e1f5f335472a5fa58a22f0cf24e0f849db57acf31d15cb0
MD5 690b8cd6c97c8d34f072e9a037f74365
SHA1 580535e47650f50386878b3fc617c14fb93b98cc
SHA512 5e85c9cbc7ae809414a7a5a0a054e13bdef6b0ef31b42a3d9f19cbf124a43e9e70d93f6a862788443b14b1f443b984060c515922392064a08739301e94f60939
SSDEEP 1536:QekFiTvjMpkACPC/axEzaBGsfUHSl1S6x8l0frcuBldYf:QeJTbSk1PC/axEzaBG4UHSl1l8Ofr5Yf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.3/System.Collections.Concurrent.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8ac18a4d36f2ac4944b24887723c48d7d25d07ec83bd026b637f371ce122bf60
MD5 f0ca5dc84ea44e3f0321219e20bda16d
SHA1 9102972ef69fe1875e54d2d84ce5a0da872eaf21
SHA512 6372208ee22b1e4dc8d998be4e539c36af8cf14b8f71d43dd2b5ad3b459593f4ecc229becee4c317eeb4583d09e489f84e750db810aa01d07e88a9aaa07f93d5
SSDEEP 384:6UCp+vgOZrW3NoZbAFjWndZQRt3dNsPq+DrZUkzcbIJukQlZZlTg9021rsa5QXN4:VG8fZlabg902gkCjicEBI1RT+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

c9:e4:17:92:cc:44:7e:99:37:81:7f:4c:f6:72:cc:58:d5:2b:d4:d0:3d:5b:fa:cd:00:c6:32:e4:f0:fa:bd:73

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

73:13:0e:30:35:2d:79:2a:85:94:05:4d:4e:df:aa:32:83:17:ac:1e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

20498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Collections.Concurrent\4.0.10.0\System.Collections.Concurrent.pdb

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.3/System.Collections.Concurrent.xml

SHA256 6e0284817cbe7fb1a95579deed14c1f33f14e24b686593ad64b0110179d4fe0c
MD5 4d987efd146109cac1e1fab2aaf9cc75
SHA1 ff769e2fee39bbe15f6cb9aa0f9cdedab837b339
SHA512 f2932ab8193c0d583cbba810af0d00e4f36538537234f54965bf1cbf6d1ea34c2bd53f0c867afbae867c6acdca94528ecb9fa8c664ed975b1e2c2514d801e256
SSDEEP 1536:ri5EmQaolHjJDMpZhb+mxzLzOVNot7hkeg+jL0xIlX04MuvEdWJMgSShbFSufdc3:ou+jQIKUuvgzftIz
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.3/de/System.Collections.Concurrent.xml

SHA256 c5b74064c914290d3c01294b8e29f28fb008595a48720111fb0b53d381be759a
MD5 8ccae9e4d4ba347fdc390cb258be59a8
SHA1 3c64ff677705882b2bb5aacdf229cea404ddf0eb
SHA512 170e9344810d4193e78e2571190bcb4a0ec97ec40543dc3f5f176bf4c1e6e76c8b98351523d8e2fb1d1c84db246d7dd554da76e7d837413e2840a4c9fc14c6eb
SSDEEP 1536:qpKbRWerkkOqQ/jQ26tOypUPPSC0WVB7lr7uRXpwgFiZiHjWyThUXd8i:BbSQNOypUPxNuRXpdw8DWyGXd8i
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.3/es/System.Collections.Concurrent.xml

SHA256 bcbf0e0542f1bdcc70dc003e0e1c5a48c66ad2fd91c9484a4170fbd37c494614
MD5 db8df04da28a37b8c0794252e63cdfe5
SHA1 18386495b7940b089f1270ba606cb3d774640274
SHA512 d2c93e115208598d61c44ba058da2f0e296b430cf149183feb79816ae51e7d73470ac61c67418f22ab38e1bd795a104f64ce1cca34b5797c589afacc3ffef79b
SSDEEP 1536:nd0PLupkj1BoHWZECPAv3cyfd5u+kKn/N5D18oPZ/IvXU8LIaZzn/IH//IX2z1BW:6uu+kKn7THIOMxvd4g
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.3/fr/System.Collections.Concurrent.xml

SHA256 c91cf8d042ac061d662c3b27a55756f106973f27057e0bee6ed35f15d67c0fc9
MD5 d05cb88111bcfed0a1be1cc6126887d3
SHA1 1aa6c734645bb065cebd9aa5bd69eeb535799545
SHA512 c0c01e42c0aaf493bd5faac82b20feb9fd1d5dcc78a0192ccffdaa7ff0ee136b29f66e2a4dbc2e6eb0d3529197dec3966909e34e53e5f252b5c87b7e184ccc65
SSDEEP 768:Yu989gaWz9IahB/rOyLHWMXPjoWNI8wy+1Eg4hWhZrrr3n3rlV3Kv:Z9894f8WNTfWbrrr3n3rlV3Kv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.3/it/System.Collections.Concurrent.xml

SHA256 f0d00039823d8e59726d705c2febcfba1918412ab2dac140e6464b8d28aaba24
MD5 7471ed5d2e2795e1a6162bda65b4e29c
SHA1 97c2b89886c115f92fe8be4976a264e4f639182d
SHA512 86898ae0ac47517bfdd8927d2458312e3b44a078db17738c23b7c1d38dec4a0794c3b96119ddd7a6bfcda06e4fad7671015e779034190a5db3278347949359b9
SSDEEP 3072:/q/VoMY3uFdB3JBHAeo59y3nvfOLfC/jAxnJRdqImKnBvCTHRe5rpY1y/1a3i:/q/VoMY3uFdB3JBHAeo59y3nvfOLfC/s
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.3/ja/System.Collections.Concurrent.xml

SHA256 3f01d5540c57fea9ed5587a6d3f6b526e447190c5a8e7384c2f237ddc8aa7423
MD5 ee64d6d8151bc2bee72e05b6e7572fc9
SHA1 51bce908b3c689eff57165af8436a7c3a01dbd6b
SHA512 48d395fead30f1e003a390848f01280b3fccbb0e1cd156f5d370db19d390dc7e137c3049a345c9b425f682c3b79d11b6de41f26ca54b58af637737467d32ac4b
SSDEEP 768:YkUJgBvCP//njDmEU+k2UXp96MSaXrjvW9IuxShm0Qp6t7ByBp6uNpEHfDf7DGge:287r7jW9rOgXpEH7zDGg/dQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.3/ko/System.Collections.Concurrent.xml

SHA256 8c6d3e3d5610c414d0f918f5f16f833cbbaa1f68197d56a46fcce0949f17146e
MD5 005af6a489e3c49af08d0523b513c159
SHA1 0e2c3e10ec6feaa680878681a3e72cb638ed55e0
SHA512 b0b7d6f69eb71b2732bc802d746c67aec6ad89b193bbe2345c5dc151901742b56655d507ab978787a0c9d5c7b96b443649184cc63d0af6382b49f720b8decf57
SSDEEP 3072:1OeNahxq+KKVLHTkAXl28M0orW4fCIPfCT/DI4qq9rkqirolFpuqaVUD8U1GW+4u:1OeNahxq+KKVLHTkAXl28M0orW4fvPfv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.3/ru/System.Collections.Concurrent.xml

SHA256 948da7ff9aa5e73ead860f3edd7bc8f5c638fc618f70025d5f10cccb54ef4d2e
MD5 162253b4ceb9e8688a6b89b8043ec068
SHA1 ccea599da60affecea0da4bcafd927bb4d0cddce
SHA512 373b72bc66169eab08bf176622eec2c3b7c0a686c39e32e299f92c4acd4bd53e2855a38928ef1adc9b2642071528798373b49d1f84f16165ae03c7b69b266754
SSDEEP 3072:QN+MNY0gNCPQlYECxP6hHF4OQCwRQjcmYzVbB4UVudLLB62kzojbED6h1Id+fZqr:QN+MNtgkQlYECxEF4OQCwRQjz+4UVud6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.3/zh-hans/System.Collections.Concurrent.xml

SHA256 3db76ca0e7828f666b304a5b03142737afce145eed1e1916ff8ffc212b1765aa
MD5 b7c8f05adde3d01161ca95ea56e1f76f
SHA1 a3a5827d0461a7a911d205ff45c11975075b8968
SHA512 12690f8f5e55cdcbebf75192dc45c1f8bd3efbdf3b3beabbdfbe92f02d9e488e04a2718dc981f8fa1b16008839408ce6a359e410c43a9cce62f2aa7c9c60335f
SSDEEP 1536:f20k2CW0JTwa2jsvGWn/JlwoVwwwPIzly+6wivEywTR9jWieXyu:f20k2CJX2wvGWn//jVjKIzl2D6KieXyu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Collections.Concurrent.4.3.0/ref/netstandard1.3/zh-hant/System.Collections.Concurrent.xml

SHA256 a9faab19252be1346e1f5f335472a5fa58a22f0cf24e0f849db57acf31d15cb0
MD5 690b8cd6c97c8d34f072e9a037f74365
SHA1 580535e47650f50386878b3fc617c14fb93b98cc
SHA512 5e85c9cbc7ae809414a7a5a0a054e13bdef6b0ef31b42a3d9f19cbf124a43e9e70d93f6a862788443b14b1f443b984060c515922392064a08739301e94f60939
SSDEEP 1536:QekFiTvjMpkACPC/axEzaBGsfUHSl1S6x8l0frcuBldYf:QeJTbSk1PC/axEzaBG4UHSl1l8Ofr5Yf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/.signature.p7s

SHA256 01ffa8144dfe2e1c4c019dc5545cbcb0f3ac7cd65d517700aa06a0166645f1f0
MD5 029ab377a99d7ad3c763fb20a31dfdef
SHA1 55172b5617ec0cfa9402024965e9a56865896488
SHA512 349bea89b6ea0b13d117903d2a0db499ac84e9d0257d0b838047b1efb76f84e02d942d44ea4ef527c24595af06d25661494a93eb640e56531b29c366d5857f8f
SSDEEP 192:xdV7x0KDWpHhXZCVzV07Vr29DH0JOqNG8Fp28Wh8n0ix:jXvDGGVp99oJNNzFwhhi0ix
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/System.Console.4.3.0.nupkg

SHA256 5e1dcf3c166bd290db0da2bc0041db746cfb78f2ba622d59c91588d4933a99ba
MD5 5b5c46d7948cf5c5b1cd08eed2a56174
SHA1 8be488d483ba405b481bf628bda176fe8351484c
SHA512 a08a684a583c9b3278ce32be1007dae495f9d87254666392f794ef1203079f333cd7d388c28944ffa36fb49f0c8bb21f42c70f6e1d7c1c03920df6d0d1130c82
SSDEEP 1536:mx6voUvIjnKPQ0nlr/nKPQ0nlrQheSRr+RkDx8EVbxwfzVlnOkeR+knpycpYmicq:mx6APsnlDsnlsiODxklezDiONc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Console.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/lib/net46/System.Console.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 083f8649db8063f231eb38af39a450cc4cb9c8d381804bd189bcf589eb9f0951
MD5 f6b8a8fe0174e9657c3544b0a4aca494
SHA1 b5102629939ebdd4bcd0f407a92828dee5f2b565
SHA512 f8fdbfec7882239689d2a6efd9b6e59ec68b3075eae153f11bdcc203a7d207a3762765b89d3001efac7d10934e9d6c923900720b85376d6b0a95a584761cb6b7
SSDEEP 384:q88mvx0rdouZ7RX7yvDgipjwjd5zhiNiN/W6EWFWFEW93rq0GftpBjp6tERHRN7y:L3OhouVWbIf7a5ij6tEBEb1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

63:98:53:fd:58:3b:c0:d8:22:57:59:c3:f0:bd:6f:c2:05:39:85:16:67:3f:f6:47:d7:87:09:b8:af:1d:41:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

23:99:73:c7:84:36:fb:8c:cd:39:38:e0:71:c6:1c:23:4e:67:bd:01

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

23006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Console/net46\System.Console.pdb

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/net46/System.Console.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 083f8649db8063f231eb38af39a450cc4cb9c8d381804bd189bcf589eb9f0951
MD5 f6b8a8fe0174e9657c3544b0a4aca494
SHA1 b5102629939ebdd4bcd0f407a92828dee5f2b565
SHA512 f8fdbfec7882239689d2a6efd9b6e59ec68b3075eae153f11bdcc203a7d207a3762765b89d3001efac7d10934e9d6c923900720b85376d6b0a95a584761cb6b7
SSDEEP 384:q88mvx0rdouZ7RX7yvDgipjwjd5zhiNiN/W6EWFWFEW93rq0GftpBjp6tERHRN7y:L3OhouVWbIf7a5ij6tEBEb1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

63:98:53:fd:58:3b:c0:d8:22:57:59:c3:f0:bd:6f:c2:05:39:85:16:67:3f:f6:47:d7:87:09:b8:af:1d:41:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

23:99:73:c7:84:36:fb:8c:cd:39:38:e0:71:c6:1c:23:4e:67:bd:01

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

23006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Console/net46\System.Console.pdb

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/netstandard1.3/System.Console.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 488acb42f7f41d7f9fdf9670d41d034a3dad99d963f258bd980c7d6bf72867f2
MD5 fa12c649cbb1519a070e6ed1b648acb3
SHA1 c317b7d92c9a3e271665b413d67f035d35299949
SHA512 6af8baefaea80d88307d0c03de0f37d0b614cfbd37701ff83fbe46f0582b4ef8b142b7ae600dd7741dbad47d1f13c99ebc3d1e581b9546bfea0863577432bf64
SSDEEP 384:/tplhSHicYUdxLpd/4ht9JzMQ+md3WSEWkQpbMA0GftpBj31aERHRN7bblfkqj4:Vkkt9JzMeyjiraEBb2A4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

26:0f:53:20:c8:58:db:ae:60:c7:6a:57:0f:ca:c1:be:8f:76:17:04:c6:58:02:b7:03:ad:ed:5f:cd:4c:f1:1a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

0e:c4:78:e8:35:25:bb:9b:6e:58:35:35:82:99:2b:9b:25:c4:ee:60

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

18750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Console\4.0.0.0\System.Console.pdb

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/netstandard1.3/System.Console.xml

SHA256 5c69be50acef0cacf5a503cba47292240d263c37cb8dbd300f1b034d77f92a81
MD5 d6cb5d9af46018918946d2ed95193669
SHA1 dcf61f9c3c6a7b26bf5b9b620be99c8725657bae
SHA512 cfca456a40a6d987de125070f8ffabee680f3b3d233d4972fcdf43d00379126c149f0e85a418314809a40a933951c17416324714f611e39576ff61fb50f4fee5
SSDEEP 384:Y60yXoK2LfPN7NC0K24UaYg7EKI2mHmemACOdtnug4kzSr7m4IPI6IscQDzbA2ks:YchO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/netstandard1.3/de/System.Console.xml

SHA256 157f560dfe03ab2d2ad3c72ded33a4875f073408b01dcb9f860afa3b63ff6ddb
MD5 bcb196fb4cd3f17c645a05ea4ced2bf3
SHA1 77f6b52a760cb8ad37a6cca569997137becc71d8
SHA512 06e9c356c21947b764bdbfc4688aa6b96da795c5f745f4cb923ba33a776612ff94d721ab10d96a5e4fa1ed06cf8303fc6a0e81ef23de0523fa3748c52ed4aee1
SSDEEP 384:Y60g2udVlzkNWvFkXVyDT5bOwoMoLEIqIefutM0DX8Bi8zSmamFmaDKnaBaJ97fg:YNuaWBoMowIqIeGjkeeAgga08Cgyyh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/netstandard1.3/es/System.Console.xml

SHA256 c0e397b21dd8af2f26e8eb4878d0e046cf5760f9ec4d61b634924ea70f260b94
MD5 22b3aa2a7b339f341ef47dd90b9559cf
SHA1 33e233ad45fcb762629ce0bc0eaf4c4f1519f233
SHA512 2d69bc3fc4be7131ac9a40ac3c93b61cd6e594261830a63b57cd01e666749c6e209ac034999694d0f494e772a7c20347f7c5f3927babe5fa1ce9ea6c76892dff
SSDEEP 384:Y60Y/ztunoMIIb+6oV0stoZ531Ya1IsmnmGmgli2q/a0s6sVdxEdItIhIxG91JyY:Ymg111rW1SQm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/netstandard1.3/fr/System.Console.xml

SHA256 54f59f5846498e82a2643873968405234aed404e084a32212b12ae8a5c420de7
MD5 14e313d8959ba7557f5ca2ecbfc50005
SHA1 305baa31e305d4697ab8d0f735ad1e9f2a7d528a
SHA512 87eaf200fcfbd5314cc29472407485446540ec555a397eaf6c3fb99741e344d9afd7a67f7c920003c73829faf0ab730d7fbbfda286cde303b4c19fc7e8f34716
SSDEEP 384:Y60bhVqVkC2ICA6gu9mAx363Za6dJSmJmpmAAFVR8pdYmZA7/Td1I6IVIUXYAkaf:YDXv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/netstandard1.3/it/System.Console.xml

SHA256 de5c7dd627cf01a72219a399fca18a39a1d78b859200c274c6992c58082e6982
MD5 a4718f6ed4c114c468f421146e2420de
SHA1 8ae76a5a4631d6847add899eb83a73bef76c7a9d
SHA512 d88f8ac738dcf5e845a67e0a1b856f464d098d3727bcb43d97c307a6589997c46050312287b5fe146720a305ddaba5e8640319fe84b5f07f45eda8d918e82c45
SSDEEP 768:YWO3UruSelow2GKOcY5cOY8+gYFra4bakJZeS9apYlpOYKfx5aOV7IlZcIHeBj4y:dyUruSZzGKGq8+gYFra4bakJZeS9//KJ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/netstandard1.3/ja/System.Console.xml

SHA256 d4e8d22f141bb7e764410b95553fb36e27eed6f449bf1a7bd827537e98a537bc
MD5 481a23c74d1d3b9d2ef8e4269acc6b9e
SHA1 041d0b6fe78140f43211eef102042ad4ca2d55d2
SHA512 9d552d94c93bbf26b28cce9a6eba17420aa976e395c35b5e9f0c6b5312bc83900017d97f31794cb3ffc090c78f062197fa1db785918c224a82b74d6f5fd888a8
SSDEEP 384:Y6081vi7pQxDtmYiotssMvsJIYWx4EhB1utjvNMmGmrmxvy6jZjr9LkxBzDBceIF:YgTsZs+W9X5N/cAE
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/netstandard1.3/ko/System.Console.xml

SHA256 5b1b9142d84a30ab1ff2034eb2506c6225c867380523c5cfd7b364512b57cdfb
MD5 dace2f1b3870657f06f598e8239c77c2
SHA1 4cd0497f33490c3db58b650b47aeaf6e98a60d53
SHA512 f3268180c6cce86c741effad398c11277c433034653f36dcc0654ccb036e56356feb1c14d07ff8309347093cab49945ee27c4c182bcd00719457d0f1677cafa9
SSDEEP 384:Y602lPpISyzckggC4hNdEZQJTF7E4ILFz8mMm4mcuD7RJRhxA0POJchMBx5GZI3J:YzWoFjG8fTR
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/netstandard1.3/ru/System.Console.xml

SHA256 f7218ab4839f84ec42ea8e3c8d0754b07ca1dc38c2a4584654f5de77a0b6474b
MD5 e9f1c91e8408903dad7b4b0aaf0990b5
SHA1 c556cea311067d058dd444287960df72bffd37f0
SHA512 cc9d10b8cda3d3c2bbf2c4315e6fe9d29aeb4cb0a928d084d64e01bd62c9409ef979578b4491a5c8bc268319fcc30d723f02d2cda587aea1add558a86baeaac5
SSDEEP 384:Y60hMqPIPYhmb1yPkCc6mDcRho3/4eSXL3XQAXvm+mVmon9PLZ5WFxdUxLUGxBtU:YVMyuOEeC95v8OoYnYIClfRyEJkC/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/netstandard1.3/zh-hans/System.Console.xml

SHA256 f068a3caaf15ee12a7a5985cb320b1742a7b09e9a285893cb4352b5ee3849a15
MD5 11d5701208dc8da7f785cca73d0f0aa6
SHA1 9213ad5d79c0b010d4bd8e6b9a7d47f6fe393e40
SHA512 1cd367fbbf5d3e299875afd071e7c37f4630b3e5f1e5f35bc971219fed02688a26af3a7048f92d57119de199de65d9206d196b5f350dc4886b4cf53e4e660928
SSDEEP 384:Y60Zy+WU+4rTfE1Twi1V44dy2SKCYfEavR8Ool/M1nz7HmiHmLm2CKHaHHaH9aHF:YJkNomqmpjoXD6UGfik
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Console.4.3.0/ref/netstandard1.3/zh-hant/System.Console.xml

SHA256 ccc8e2be093e7e2c211777a7fd0d913f4810d6a7bab1a428aa99a67e5238cb28
MD5 e84c18f98d7b324c4bd9db0727d24798
SHA1 c71e6dbc56434935d377b8e33dd63a97458efbfe
SHA512 b6957b8928097cd929516dfa68b0549088773ffa742d1ef9bba23ffeca617243cb37039e7b591c7ea1f55f5e8bde90b7e3498268821f82c9a5a596065353d5a5
SSDEEP 384:Y60WFua5FWcys8jTFRqxx5lqS6uIxJxa3cmMmcmhwi5lO129VvzYsov1Ys4ovOTf:YCFpbsNGgB0dghcZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/.signature.p7s

SHA256 ccb699cb7a8a93199d6dbc762f5fb70770986feaeeb2441fde4ab2f6efca5ad6
MD5 70bbb5b30fc2f5f30d582795b4b58074
SHA1 6c354de8e7072e4d5aa06e594901165eb9350b2b
SHA512 b0f5e862f17218b3e7b2be9d623cb233852d15adee723ed29405cc70f094bcc6e1a8e66612f34f7a13065f78ae4217d1dfc684be3c852aa341103a488df86782
SSDEEP 192:8d27x0KDWpHhXZCVzV07xrTp9DH0JOqNG8Fp28Wh8n7ip:E0vDGGVpCp9oJNNzFwhhiup
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/System.Diagnostics.Debug.4.3.0.nupkg

SHA256 7e403bf528cf6d27a211cadb6d4b1bef4bbd07bc2a6ec74cf6cd4b9e82a3d203
MD5 1ce781f96a103270c3122416cdc0af33
SHA1 31feaa7db29fd7548f421aee03bc628191b492c3
SHA512 6c58fe1e3618e7f87684c1cea7efc7d3b19bd7df8d2535f9e27b62c52f441f11b67b21225d6bcd62f409e02c2a16231c4db19be33b8fab5b9b0a5c8660ddab24
SSDEEP 3072:Tx6AEyvAAOH1J8g9uPZSqzyS533GuPs1J8gxyRguR0euPcP+:TUOv08g9uY/SEuW8goRNul
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netcore50/System.Diagnostics.Debug.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 df36f0918fa149ad7af958a13858ade8650acaccb6fa13d50b8d6c256498f752
MD5 be226713e86abb912a9460a1519ac859
SHA1 f630d51497ad47f1bf506038a8d6e02c8db9ee0c
SHA512 0ae351781a68f3ffece7cac1cb9a051625b4d688f1dcba2c012672e6953bd502d07825d90cb386ae580d024bad69b2192ac25f04fec1503e6202476cce557b4b
SSDEEP 384:HNs888mb8neT/mWUoWYsyAA0GftpBjplZERHRN7tWoTldlHx:ln60jiHDEB7Nx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

89:44:ae:fc:8a:77:88:82:23:fa:81:f2:a7:18:dd:60:bf:6d:21:31:a7:15:0e:24:5e:b9:16:9d:fe:05:d3:b0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

78:07:6a:f1:b3:24:70:64:54:eb:72:c1:28:53:4a:c6:b8:7d:bf:22

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Diagnostics.Debug\4.0.10.0\System.Diagnostics.Debug.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netcore50/System.Diagnostics.Debug.xml

SHA256 b8da460ba03eb246a72bd289c7cf6680c928ff818e2c87eb2b64c3e054ecca5b
MD5 a25ffafa441df01f15dbf65920b715de
SHA1 1975d3cc2e78ac0b17b75cdb3673ab1ff2729467
SHA512 8cb4ff0f4540686f762dab6db53e89d68f98976359472e13f90046cdf350acc66cf882caeaa17ff53823a5b59e2a41a56c17f3a4a7844d75dd45ce67a4d057dd
SSDEEP 192:YLyMdqOmEWrwq9ZXpQ+OEYIH6Jqt6V1JZZyHb:YuMdqOmEWVnpJOEYIH6JHJIb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netcore50/de/System.Diagnostics.Debug.xml

SHA256 58be664248a829fbbf5cbbcb5bccd5b813b9b2c48649561c2db04af89f2437fa
MD5 24957b03bb9237cba831f226be0ace20
SHA1 7997762f02663b455a7631c2ac34a3900ba4884a
SHA512 1b093d8cb7618fd8a9e05683bd8943f8e0f760d0d7e01e7944d4a4a2aa8a808836ac518cb2243b39d9cd5dd5b56d3e27afe1da598462aec7eec3df37a4c84827
SSDEEP 192:YCbihsU/VIFAVmrkjDaCG8SRjIR0QRxRcUiVIFwmjDPGdRjIRFRMKRVEULZjQ2x:YCW/CFkiCFLR7MO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netcore50/es/System.Diagnostics.Debug.xml

SHA256 c9fb4a472d7e18bf9e6137e83501bed7b8be595f0fc8fd157d8d92d0ff6d9134
MD5 a9689992bf5167a77e65bfcd1634078c
SHA1 4920c60ad035d30fa89660d1692d6e418cc8971a
SHA512 39c591d7b72151fd4773af2b930dd7ac011c7ef40d1ebe14283d3e2b2183fc4900013921ed1fe818703025fe5ceab24b0e329aaaff43568357e6d9db37bd374e
SSDEEP 192:YgqIdBVNNo3ydswtGTNN2stkma2reHsvs8z7VWHrhg:Yg1NcN3a2rcsvs8z7Vwrhg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netcore50/fr/System.Diagnostics.Debug.xml

SHA256 96db2d608b096fa27b9a4e83b53b17b0e02aa7732cda0695a438dcc2942c82d9
MD5 510a085800112eb60f1de6ea921d88ba
SHA1 95812f59c1dc08eeb83c0b049379675c0deab345
SHA512 e95d6c7212b61bbb402c791ad38a79f3097e96993855ca85b3b55f424d2d18ee2739bf5366bf4baa60061150590093e20463fab4b2eb257f1cc5fa7f62a22f35
SSDEEP 768:YxR2lyn4E05Aq5vyyL4/NiJQ0KC5AI5vwyLWlwn:in4E0mqxyM4ViJQ0KCmIxwMWW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netcore50/it/System.Diagnostics.Debug.xml

SHA256 cef9c5c8eb837153374f4b9f3a4d6ca839d660585d6c14f285666a0065230a8e
MD5 1b323d15ddd0faf1b462bebe7548f642
SHA1 9b74d9d706a87fcfd4f40e4076147c1b0cd8d13e
SHA512 b204b6db28daf90d980520fe87fb0dfd598cc3cbd1217253d6fb0cb47da4b6601b9381982d95bcea48d34be75cc2f808843f4a0723247401a8bb24c8bdb84d08
SSDEEP 384:YpH3upmNLNO4msH0bosAERNLay5aZeELFsky79UMnyeWl:YpH3upcO4msH0bosAEWy5aZn+BM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netcore50/ja/System.Diagnostics.Debug.xml

SHA256 0b52c590ddef58504500d1ac2f8c7705e8fcca4e9b9b14e7e75ae9b2a632c9b4
MD5 a201aa558cdc9bc8a7f0739b36d5f392
SHA1 c2e96a7a99258692afe127cc94a599ce709c2c7e
SHA512 e8ba3f1e22830cde33716da0661c233345af099ac12c0b481f66ed491bd61547990313038d0a96dacb8ea1018b5853f846b54e1aa7301b37574dd4a7fdf700df
SSDEEP 192:YrcFKWhGlYHCH42glXla/CLRjOkr9jBcNAmkMuZKkM5pk3df7vn:YrcFKWhGl1/CEkplcNAmkMZkM5pk3dDP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netcore50/ko/System.Diagnostics.Debug.xml

SHA256 1dd5e8d9ceb5a3bd3203e3ad7cada16c577627787b6555c3877c0b24259d81b7
MD5 a9aeaa4278d0bd42f0c0083fc1a1f323
SHA1 a6832a7c3e94c834e00bb5b101a656ca77af01a2
SHA512 61b6c058dd11e9d001ebb6b10c6145db5cbbcccde409adcd0dfe42fa10a1fee2f6dd33a2ed5c1178b2a8744e7bd8a2124e6d028bc3c47bc9a3596a05569ab871
SSDEEP 768:YZm8+81V8olBXdEkZ0pyZeprZipkZPpEBDHDzyZ0pQZeplZipCZNUeUcN:q31eoLXdEWuw0lwWxEBDHXwu60DwgD7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netcore50/ru/System.Diagnostics.Debug.xml

SHA256 702c423aacec5b039433984ee74b5682f8e6593a8cde946dcc36b7b5037e6b31
MD5 e809d2a2dc8ef8775ef2c5f69ce96ec1
SHA1 b8e1a2c47ad88faf4a6bcd81708c4dfa9240a67c
SHA512 95ac6acd846ba7cb7dd08b04a9f33a83824e2e18679501000c06c3bb77eaf61cd24a525337eb9aec636ca6c057c3d2b9a8f12cb8ffcd3577101da68070e2863b
SSDEEP 192:YgQH8NNGsOasbFKpNkQR5PFlaBQN8D2jPEzK0G+6WirxlS:YgQH8NNG4qKpNkQ3PJ9j+C+6WirxlS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netcore50/zh-hans/System.Diagnostics.Debug.xml

SHA256 36349128bebb8662dd547e2939f6fce5350757661063bdffd4fef8791e3a66b1
MD5 327a88745f3a454c3de87518db0c2267
SHA1 0cf26ed5596b4a6418d5e87946727a03068553e6
SHA512 39680d9bb49fb39c719c5637e7bde759dab02b260b7bb2fc15d3b35555b4e1ee573701f92a188d130906eef5cfcea29b6bfc2f52eedf214051ce4e24e05b2f8d
SSDEEP 384:YPNxaUSWGlhLEwpv5f4vWqK+b6nsPT1b9:YPNxaUul6wffR+V
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netcore50/zh-hant/System.Diagnostics.Debug.xml

SHA256 18aa7b9e341c0759329ad8879d2075634b77a47189c900b2d58b7ced9f78318d
MD5 48f5fc9e111de59ef55ce98ec6ffa8e9
SHA1 801ac0311e7a4f6a24c4e0df0f46acc073e3395e
SHA512 7b8aef2141c3aaceb28bc6214ac232cebc19fc843363217e079cbcc0f200f1ee3a811b02cc48b092d59b973f0983095e5aa53a08e7f45340011f7b507a44af29
SSDEEP 384:YV4p4m9CsqPxaDBa0tv/kBvbBZcqVxIB4qnv/WBfvgLRM5i:Yxu1pHK1ZcHnHQfvgLRci
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.0/System.Diagnostics.Debug.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 028f4657dcd87eaf6f14e6d42df86846ffb8b4d4e7f4bad0d5ff6907850b5dbd
MD5 2046e08643e66cb73e422e4175a23d51
SHA1 99b72b741211069571701df0841d7373503cf383
SHA512 33dae8825ad75e158bf8dfa48bcb0e05d8522b1a58b957fc45728e5b1967dfff43eafa4a53c23f40fe5e0d462fcc974d709166ada17d27d3dcd7c24fe40df20c
SSDEEP 384:KoZvAYWuoWG1LHB0GftpBj0DHRN7zlXxH4efeW:zeE4WieDLYkeW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

75:e8:03:d8:1e:92:f7:57:b2:08:07:78:11:3a:aa:45:9e:1b:fe:13:bd:5a:d9:e8:ac:0e:a6:1d:75:8b:c0:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

2f:d7:db:39:03:76:ae:07:e6:9b:8b:d5:6e:ef:c8:e2:57:90:c6:c9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

12318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.0/System.Diagnostics.Debug.xml

SHA256 b8da460ba03eb246a72bd289c7cf6680c928ff818e2c87eb2b64c3e054ecca5b
MD5 a25ffafa441df01f15dbf65920b715de
SHA1 1975d3cc2e78ac0b17b75cdb3673ab1ff2729467
SHA512 8cb4ff0f4540686f762dab6db53e89d68f98976359472e13f90046cdf350acc66cf882caeaa17ff53823a5b59e2a41a56c17f3a4a7844d75dd45ce67a4d057dd
SSDEEP 192:YLyMdqOmEWrwq9ZXpQ+OEYIH6Jqt6V1JZZyHb:YuMdqOmEWVnpJOEYIH6JHJIb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.0/de/System.Diagnostics.Debug.xml

SHA256 58be664248a829fbbf5cbbcb5bccd5b813b9b2c48649561c2db04af89f2437fa
MD5 24957b03bb9237cba831f226be0ace20
SHA1 7997762f02663b455a7631c2ac34a3900ba4884a
SHA512 1b093d8cb7618fd8a9e05683bd8943f8e0f760d0d7e01e7944d4a4a2aa8a808836ac518cb2243b39d9cd5dd5b56d3e27afe1da598462aec7eec3df37a4c84827
SSDEEP 192:YCbihsU/VIFAVmrkjDaCG8SRjIR0QRxRcUiVIFwmjDPGdRjIRFRMKRVEULZjQ2x:YCW/CFkiCFLR7MO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.0/es/System.Diagnostics.Debug.xml

SHA256 c9fb4a472d7e18bf9e6137e83501bed7b8be595f0fc8fd157d8d92d0ff6d9134
MD5 a9689992bf5167a77e65bfcd1634078c
SHA1 4920c60ad035d30fa89660d1692d6e418cc8971a
SHA512 39c591d7b72151fd4773af2b930dd7ac011c7ef40d1ebe14283d3e2b2183fc4900013921ed1fe818703025fe5ceab24b0e329aaaff43568357e6d9db37bd374e
SSDEEP 192:YgqIdBVNNo3ydswtGTNN2stkma2reHsvs8z7VWHrhg:Yg1NcN3a2rcsvs8z7Vwrhg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.0/fr/System.Diagnostics.Debug.xml

SHA256 96db2d608b096fa27b9a4e83b53b17b0e02aa7732cda0695a438dcc2942c82d9
MD5 510a085800112eb60f1de6ea921d88ba
SHA1 95812f59c1dc08eeb83c0b049379675c0deab345
SHA512 e95d6c7212b61bbb402c791ad38a79f3097e96993855ca85b3b55f424d2d18ee2739bf5366bf4baa60061150590093e20463fab4b2eb257f1cc5fa7f62a22f35
SSDEEP 768:YxR2lyn4E05Aq5vyyL4/NiJQ0KC5AI5vwyLWlwn:in4E0mqxyM4ViJQ0KCmIxwMWW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.0/it/System.Diagnostics.Debug.xml

SHA256 cef9c5c8eb837153374f4b9f3a4d6ca839d660585d6c14f285666a0065230a8e
MD5 1b323d15ddd0faf1b462bebe7548f642
SHA1 9b74d9d706a87fcfd4f40e4076147c1b0cd8d13e
SHA512 b204b6db28daf90d980520fe87fb0dfd598cc3cbd1217253d6fb0cb47da4b6601b9381982d95bcea48d34be75cc2f808843f4a0723247401a8bb24c8bdb84d08
SSDEEP 384:YpH3upmNLNO4msH0bosAERNLay5aZeELFsky79UMnyeWl:YpH3upcO4msH0bosAEWy5aZn+BM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.0/ja/System.Diagnostics.Debug.xml

SHA256 0b52c590ddef58504500d1ac2f8c7705e8fcca4e9b9b14e7e75ae9b2a632c9b4
MD5 a201aa558cdc9bc8a7f0739b36d5f392
SHA1 c2e96a7a99258692afe127cc94a599ce709c2c7e
SHA512 e8ba3f1e22830cde33716da0661c233345af099ac12c0b481f66ed491bd61547990313038d0a96dacb8ea1018b5853f846b54e1aa7301b37574dd4a7fdf700df
SSDEEP 192:YrcFKWhGlYHCH42glXla/CLRjOkr9jBcNAmkMuZKkM5pk3df7vn:YrcFKWhGl1/CEkplcNAmkMZkM5pk3dDP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.0/ko/System.Diagnostics.Debug.xml

SHA256 1dd5e8d9ceb5a3bd3203e3ad7cada16c577627787b6555c3877c0b24259d81b7
MD5 a9aeaa4278d0bd42f0c0083fc1a1f323
SHA1 a6832a7c3e94c834e00bb5b101a656ca77af01a2
SHA512 61b6c058dd11e9d001ebb6b10c6145db5cbbcccde409adcd0dfe42fa10a1fee2f6dd33a2ed5c1178b2a8744e7bd8a2124e6d028bc3c47bc9a3596a05569ab871
SSDEEP 768:YZm8+81V8olBXdEkZ0pyZeprZipkZPpEBDHDzyZ0pQZeplZipCZNUeUcN:q31eoLXdEWuw0lwWxEBDHXwu60DwgD7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.0/ru/System.Diagnostics.Debug.xml

SHA256 702c423aacec5b039433984ee74b5682f8e6593a8cde946dcc36b7b5037e6b31
MD5 e809d2a2dc8ef8775ef2c5f69ce96ec1
SHA1 b8e1a2c47ad88faf4a6bcd81708c4dfa9240a67c
SHA512 95ac6acd846ba7cb7dd08b04a9f33a83824e2e18679501000c06c3bb77eaf61cd24a525337eb9aec636ca6c057c3d2b9a8f12cb8ffcd3577101da68070e2863b
SSDEEP 192:YgQH8NNGsOasbFKpNkQR5PFlaBQN8D2jPEzK0G+6WirxlS:YgQH8NNG4qKpNkQ3PJ9j+C+6WirxlS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.0/zh-hans/System.Diagnostics.Debug.xml

SHA256 36349128bebb8662dd547e2939f6fce5350757661063bdffd4fef8791e3a66b1
MD5 327a88745f3a454c3de87518db0c2267
SHA1 0cf26ed5596b4a6418d5e87946727a03068553e6
SHA512 39680d9bb49fb39c719c5637e7bde759dab02b260b7bb2fc15d3b35555b4e1ee573701f92a188d130906eef5cfcea29b6bfc2f52eedf214051ce4e24e05b2f8d
SSDEEP 384:YPNxaUSWGlhLEwpv5f4vWqK+b6nsPT1b9:YPNxaUul6wffR+V
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.0/zh-hant/System.Diagnostics.Debug.xml

SHA256 18aa7b9e341c0759329ad8879d2075634b77a47189c900b2d58b7ced9f78318d
MD5 48f5fc9e111de59ef55ce98ec6ffa8e9
SHA1 801ac0311e7a4f6a24c4e0df0f46acc073e3395e
SHA512 7b8aef2141c3aaceb28bc6214ac232cebc19fc843363217e079cbcc0f200f1ee3a811b02cc48b092d59b973f0983095e5aa53a08e7f45340011f7b507a44af29
SSDEEP 384:YV4p4m9CsqPxaDBa0tv/kBvbBZcqVxIB4qnv/WBfvgLRM5i:Yxu1pHK1ZcHnHQfvgLRci
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.3/System.Diagnostics.Debug.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 df36f0918fa149ad7af958a13858ade8650acaccb6fa13d50b8d6c256498f752
MD5 be226713e86abb912a9460a1519ac859
SHA1 f630d51497ad47f1bf506038a8d6e02c8db9ee0c
SHA512 0ae351781a68f3ffece7cac1cb9a051625b4d688f1dcba2c012672e6953bd502d07825d90cb386ae580d024bad69b2192ac25f04fec1503e6202476cce557b4b
SSDEEP 384:HNs888mb8neT/mWUoWYsyAA0GftpBjplZERHRN7tWoTldlHx:ln60jiHDEB7Nx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

89:44:ae:fc:8a:77:88:82:23:fa:81:f2:a7:18:dd:60:bf:6d:21:31:a7:15:0e:24:5e:b9:16:9d:fe:05:d3:b0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

78:07:6a:f1:b3:24:70:64:54:eb:72:c1:28:53:4a:c6:b8:7d:bf:22

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13078

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Diagnostics.Debug\4.0.10.0\System.Diagnostics.Debug.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.3/System.Diagnostics.Debug.xml

SHA256 b8da460ba03eb246a72bd289c7cf6680c928ff818e2c87eb2b64c3e054ecca5b
MD5 a25ffafa441df01f15dbf65920b715de
SHA1 1975d3cc2e78ac0b17b75cdb3673ab1ff2729467
SHA512 8cb4ff0f4540686f762dab6db53e89d68f98976359472e13f90046cdf350acc66cf882caeaa17ff53823a5b59e2a41a56c17f3a4a7844d75dd45ce67a4d057dd
SSDEEP 192:YLyMdqOmEWrwq9ZXpQ+OEYIH6Jqt6V1JZZyHb:YuMdqOmEWVnpJOEYIH6JHJIb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.3/de/System.Diagnostics.Debug.xml

SHA256 58be664248a829fbbf5cbbcb5bccd5b813b9b2c48649561c2db04af89f2437fa
MD5 24957b03bb9237cba831f226be0ace20
SHA1 7997762f02663b455a7631c2ac34a3900ba4884a
SHA512 1b093d8cb7618fd8a9e05683bd8943f8e0f760d0d7e01e7944d4a4a2aa8a808836ac518cb2243b39d9cd5dd5b56d3e27afe1da598462aec7eec3df37a4c84827
SSDEEP 192:YCbihsU/VIFAVmrkjDaCG8SRjIR0QRxRcUiVIFwmjDPGdRjIRFRMKRVEULZjQ2x:YCW/CFkiCFLR7MO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.3/es/System.Diagnostics.Debug.xml

SHA256 c9fb4a472d7e18bf9e6137e83501bed7b8be595f0fc8fd157d8d92d0ff6d9134
MD5 a9689992bf5167a77e65bfcd1634078c
SHA1 4920c60ad035d30fa89660d1692d6e418cc8971a
SHA512 39c591d7b72151fd4773af2b930dd7ac011c7ef40d1ebe14283d3e2b2183fc4900013921ed1fe818703025fe5ceab24b0e329aaaff43568357e6d9db37bd374e
SSDEEP 192:YgqIdBVNNo3ydswtGTNN2stkma2reHsvs8z7VWHrhg:Yg1NcN3a2rcsvs8z7Vwrhg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.3/fr/System.Diagnostics.Debug.xml

SHA256 96db2d608b096fa27b9a4e83b53b17b0e02aa7732cda0695a438dcc2942c82d9
MD5 510a085800112eb60f1de6ea921d88ba
SHA1 95812f59c1dc08eeb83c0b049379675c0deab345
SHA512 e95d6c7212b61bbb402c791ad38a79f3097e96993855ca85b3b55f424d2d18ee2739bf5366bf4baa60061150590093e20463fab4b2eb257f1cc5fa7f62a22f35
SSDEEP 768:YxR2lyn4E05Aq5vyyL4/NiJQ0KC5AI5vwyLWlwn:in4E0mqxyM4ViJQ0KCmIxwMWW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.3/it/System.Diagnostics.Debug.xml

SHA256 cef9c5c8eb837153374f4b9f3a4d6ca839d660585d6c14f285666a0065230a8e
MD5 1b323d15ddd0faf1b462bebe7548f642
SHA1 9b74d9d706a87fcfd4f40e4076147c1b0cd8d13e
SHA512 b204b6db28daf90d980520fe87fb0dfd598cc3cbd1217253d6fb0cb47da4b6601b9381982d95bcea48d34be75cc2f808843f4a0723247401a8bb24c8bdb84d08
SSDEEP 384:YpH3upmNLNO4msH0bosAERNLay5aZeELFsky79UMnyeWl:YpH3upcO4msH0bosAEWy5aZn+BM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.3/ja/System.Diagnostics.Debug.xml

SHA256 0b52c590ddef58504500d1ac2f8c7705e8fcca4e9b9b14e7e75ae9b2a632c9b4
MD5 a201aa558cdc9bc8a7f0739b36d5f392
SHA1 c2e96a7a99258692afe127cc94a599ce709c2c7e
SHA512 e8ba3f1e22830cde33716da0661c233345af099ac12c0b481f66ed491bd61547990313038d0a96dacb8ea1018b5853f846b54e1aa7301b37574dd4a7fdf700df
SSDEEP 192:YrcFKWhGlYHCH42glXla/CLRjOkr9jBcNAmkMuZKkM5pk3df7vn:YrcFKWhGl1/CEkplcNAmkMZkM5pk3dDP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.3/ko/System.Diagnostics.Debug.xml

SHA256 1dd5e8d9ceb5a3bd3203e3ad7cada16c577627787b6555c3877c0b24259d81b7
MD5 a9aeaa4278d0bd42f0c0083fc1a1f323
SHA1 a6832a7c3e94c834e00bb5b101a656ca77af01a2
SHA512 61b6c058dd11e9d001ebb6b10c6145db5cbbcccde409adcd0dfe42fa10a1fee2f6dd33a2ed5c1178b2a8744e7bd8a2124e6d028bc3c47bc9a3596a05569ab871
SSDEEP 768:YZm8+81V8olBXdEkZ0pyZeprZipkZPpEBDHDzyZ0pQZeplZipCZNUeUcN:q31eoLXdEWuw0lwWxEBDHXwu60DwgD7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.3/ru/System.Diagnostics.Debug.xml

SHA256 702c423aacec5b039433984ee74b5682f8e6593a8cde946dcc36b7b5037e6b31
MD5 e809d2a2dc8ef8775ef2c5f69ce96ec1
SHA1 b8e1a2c47ad88faf4a6bcd81708c4dfa9240a67c
SHA512 95ac6acd846ba7cb7dd08b04a9f33a83824e2e18679501000c06c3bb77eaf61cd24a525337eb9aec636ca6c057c3d2b9a8f12cb8ffcd3577101da68070e2863b
SSDEEP 192:YgQH8NNGsOasbFKpNkQR5PFlaBQN8D2jPEzK0G+6WirxlS:YgQH8NNG4qKpNkQ3PJ9j+C+6WirxlS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.3/zh-hans/System.Diagnostics.Debug.xml

SHA256 36349128bebb8662dd547e2939f6fce5350757661063bdffd4fef8791e3a66b1
MD5 327a88745f3a454c3de87518db0c2267
SHA1 0cf26ed5596b4a6418d5e87946727a03068553e6
SHA512 39680d9bb49fb39c719c5637e7bde759dab02b260b7bb2fc15d3b35555b4e1ee573701f92a188d130906eef5cfcea29b6bfc2f52eedf214051ce4e24e05b2f8d
SSDEEP 384:YPNxaUSWGlhLEwpv5f4vWqK+b6nsPT1b9:YPNxaUul6wffR+V
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Debug.4.3.0/ref/netstandard1.3/zh-hant/System.Diagnostics.Debug.xml

SHA256 18aa7b9e341c0759329ad8879d2075634b77a47189c900b2d58b7ced9f78318d
MD5 48f5fc9e111de59ef55ce98ec6ffa8e9
SHA1 801ac0311e7a4f6a24c4e0df0f46acc073e3395e
SHA512 7b8aef2141c3aaceb28bc6214ac232cebc19fc843363217e079cbcc0f200f1ee3a811b02cc48b092d59b973f0983095e5aa53a08e7f45340011f7b507a44af29
SSDEEP 384:YV4p4m9CsqPxaDBa0tv/kBvbBZcqVxIB4qnv/WBfvgLRM5i:Yxu1pHK1ZcHnHQfvgLRci
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/.signature.p7s

SHA256 4e34fc2b6029542a370480df3f34052f06b97f50a54ee8e9dfb90ca009841f62
MD5 eb87d2b3b02ad7a3de31801cef4d049d
SHA1 18ebdb1987c0937058a5f38e743a4930c59e2e28
SHA512 90f69832941dd26a52a4fe262e61e14edcd8813a0351f0e75b540f5217cb6787ac5f3e8df739e4748ea3efc1dac7f6bd0dd69f9a7f850df30db65aa22808576b
SSDEEP 192:8dR7x0KDWpHhXZCVzV07xrtJ+a9DH0JOqNG8Fp28Wh8nTq:ELvDGGVpg9oJNNzFwhhiTq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/System.Diagnostics.DiagnosticSource.4.3.0.nupkg

SHA256 3852516f4ca07a9d19df20c12f002033f4e47ece09083b6c361c031fd71dd57c
MD5 bf222bfe0f6fbfd2ee9ce5d3d4599d53
SHA1 0e3b347230fe92e71ed6690e0eb95826f8f439aa
SHA512 8f54df5ff382b6650e2e10d1043863a24bf49ff0714e779e837cd7073e46fb2635bcfcdcf99d7c4a9d95f35ebffd86ab0ca068305f4b245072e08303b917b34d
SSDEEP 3072:WHrx6Az22gaxH2zNY2inu/HUgGVlQ22gaxH2zVY2i7u/HUKGVljFJ:WrUbaxHUQu9GVDaxHUISxGVV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/lib/net46/System.Diagnostics.DiagnosticSource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
MD5 8d9df432109f1cfdd86723b5f171e3d7
SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d6:fb:4d:67:72:14:08:d2:75:46:a0:06:cb:be:f9:d3:5f:db:20:bd:97:db:cd:de:3c:cd:a0:78:2f:b1:93:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

bc:c6:7a:ba:4c:c6:19:72:95:75:c0:52:c5:b2:9c:4b:5f:0f:69:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

24690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\System.Diagnostics.DiagnosticSource.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/lib/net46/System.Diagnostics.DiagnosticSource.xml

SHA256 1784132ae3698467a0985b2507d63bdcf19a7970afe3a39d86e36c018c98b29d
MD5 5e91fe301415aced2f304f136a8ebd82
SHA1 31d457e46227f16286f7b52b728208de8970abbf
SHA512 6f99fccc2e35e4ba8d2054d4cb5787bb48ba4364d5181d59825400e6ed9f6a1318197810b3b908e726173ccfd4f23a1871417045174e160c7073c7adca831add
SSDEEP 384:VsKIrXkz1ukSA8Q3vK0mN2I5IiIjI7ImIWIHHtL90/6q6M:VsLA8Q3vK0HY6rM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/lib/netstandard1.1/System.Diagnostics.DiagnosticSource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a83a46fe737c51694b9dad4e0ccd004a3c0b3e6e3bd5d595ea1f1d4b14bab417
MD5 e420f9b08dc6f2dc5347fdbec71ed523
SHA1 c4d265ab43a8edb710409fcefc6fe4b03f8f469d
SHA512 35788ffe1450b7a944849e1ce1a60acd1068740e62a8f610d4897843136745bc5c88fd991a225ecc007b49741b68d3ffc18c1674f7e9fb76f84ebb55c980861e
SSDEEP 384:luMc+PVo0TkTPLj7oUwQsqmJIQISd5MlLmWJbWBC77q0GftpBj6kERHRN7FxlBPv:VrVd4TPLjwQt+YSdyJidEBFNv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

2e:fd:91:16:f5:70:ee:83:1a:3b:c6:45:c0:92:68:3f:c0:ac:bc:7e:e4:8d:0a:84:a3:13:89:50:0b:ce:66:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

1a:a2:21:ac:7b:62:61:02:67:59:a1:1d:35:b6:12:a2:33:8d:57:c5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

23338

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\netstandard1.1\System.Diagnostics.DiagnosticSource.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/lib/netstandard1.1/System.Diagnostics.DiagnosticSource.xml

SHA256 d0da84ec032a02c3ebc1b319bc990b79cadae202f034f058ea2689b8bf425fc5
MD5 1d33622904d33c6425ea36cfcec41caa
SHA1 fe6dab34666b7004bcd98ab08dca7f455b26ec06
SHA512 6996e3d152b52e7d84a1a6f5677f0af29cc032c7c2b5215260e81caa49f19139b6b08b7440dc54315c26b362ba2fac4f3d73bcd7e7c5f9ba79276161850e7faf
SSDEEP 384:VsKIrXkz1ukSA8Q3vK0mNRIwHtL90/6q6M:VsLA8Q3vK0SY6rM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/lib/netstandard1.3/System.Diagnostics.DiagnosticSource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d22133818a30313e0becf010d78a556a56b34ea361dbd33588c9817631fed540
MD5 8d9df432109f1cfdd86723b5f171e3d7
SHA1 85dc92edd4b0049ed9049e075c4def8a3d64e43b
SHA512 5c83303934eecfa61c43a071d29c98e5804d37a5dc7f7b035772d6a168b0c5e65dfabef20b46214e65493c4bda44831cafee83615498fbe9e718c884f4650edf
SSDEEP 384:iQobG82oiaPaf/gn5LQ0+0zdQUv2CtyW8fiFISWbW9pWJbWivT1Nq0GftpBjAvnC:nA299fI5dxzL2CC11vimvnEBBNFT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d6:fb:4d:67:72:14:08:d2:75:46:a0:06:cb:be:f9:d3:5f:db:20:bd:97:db:cd:de:3c:cd:a0:78:2f:b1:93:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

bc:c6:7a:ba:4c:c6:19:72:95:75:c0:52:c5:b2:9c:4b:5f:0f:69:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

24690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\System.Diagnostics.DiagnosticSource.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/lib/netstandard1.3/System.Diagnostics.DiagnosticSource.xml

SHA256 1784132ae3698467a0985b2507d63bdcf19a7970afe3a39d86e36c018c98b29d
MD5 5e91fe301415aced2f304f136a8ebd82
SHA1 31d457e46227f16286f7b52b728208de8970abbf
SHA512 6f99fccc2e35e4ba8d2054d4cb5787bb48ba4364d5181d59825400e6ed9f6a1318197810b3b908e726173ccfd4f23a1871417045174e160c7073c7adca831add
SSDEEP 384:VsKIrXkz1ukSA8Q3vK0mN2I5IiIjI7ImIWIHHtL90/6q6M:VsLA8Q3vK0HY6rM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/lib/portable-net45+win8+wpa81/System.Diagnostics.DiagnosticSource.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a83a46fe737c51694b9dad4e0ccd004a3c0b3e6e3bd5d595ea1f1d4b14bab417
MD5 e420f9b08dc6f2dc5347fdbec71ed523
SHA1 c4d265ab43a8edb710409fcefc6fe4b03f8f469d
SHA512 35788ffe1450b7a944849e1ce1a60acd1068740e62a8f610d4897843136745bc5c88fd991a225ecc007b49741b68d3ffc18c1674f7e9fb76f84ebb55c980861e
SSDEEP 384:luMc+PVo0TkTPLj7oUwQsqmJIQISd5MlLmWJbWBC77q0GftpBj6kERHRN7FxlBPv:VrVd4TPLjwQt+YSdyJidEBFNv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

2e:fd:91:16:f5:70:ee:83:1a:3b:c6:45:c0:92:68:3f:c0:ac:bc:7e:e4:8d:0a:84:a3:13:89:50:0b:ce:66:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

1a:a2:21:ac:7b:62:61:02:67:59:a1:1d:35:b6:12:a2:33:8d:57:c5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

23338

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Diagnostics.DiagnosticSource\netstandard1.1\System.Diagnostics.DiagnosticSource.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.DiagnosticSource.4.3.0/lib/portable-net45+win8+wpa81/System.Diagnostics.DiagnosticSource.xml

SHA256 d0da84ec032a02c3ebc1b319bc990b79cadae202f034f058ea2689b8bf425fc5
MD5 1d33622904d33c6425ea36cfcec41caa
SHA1 fe6dab34666b7004bcd98ab08dca7f455b26ec06
SHA512 6996e3d152b52e7d84a1a6f5677f0af29cc032c7c2b5215260e81caa49f19139b6b08b7440dc54315c26b362ba2fac4f3d73bcd7e7c5f9ba79276161850e7faf
SSDEEP 384:VsKIrXkz1ukSA8Q3vK0mNRIwHtL90/6q6M:VsLA8Q3vK0SY6rM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/.signature.p7s

SHA256 917e10d90b9ed0145f1770006d0587c581c8c1ddfa6f8fdd50acb59fbeefd256
MD5 487532fc0895664ac80318eb93f020f3
SHA1 f443fd65ff19bd99deb07c42b95a71551217dbf5
SHA512 8a6d1fd20f5626d6250dab5d962e8139b2d5f213d5653ca9ef3652e0c0183fecbbbda7f9d852245d221cbf85ecb10784cfdc8de1fbe57a06900e62b3633d9238
SSDEEP 192:8dF7x0KDWpHhXZCVzV07xrgFy2Y9DH0JOqNG8Fp28Wh8n+3:EnvDGGVp/Fg9oJNNzFwhhi0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/System.Diagnostics.Tools.4.3.0.nupkg

SHA256 8153afd522ba0297b415084256534e77d72f40a06f331457f4ad093d58bcc346
MD5 7e8a7efbead45b9c201865e36a5d6760
SHA1 0e9c5663e63773c5318dece1dc62f298c3ee57be
SHA512 164d6977e721cbceb44ede7bfd75b03b8d9771e0426aefa5d40c71867e964092fdc6a6808bcbc5559ed73ec2c532ca657d6476af79a49ca3ad879b8366f13d90
SSDEEP 1536:kx6voUvpxM0sgXCZooCJ2OsgXCZooj0ES2+NRghc:kx6A0mkCZoT21kCZoq22+NB
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netcore50/System.Diagnostics.Tools.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 da3c0b9d37e995ed6030f69b0da6e4b7f51baf121ed6453642b8e3bcf0ad0fc7
MD5 81d228eabeb4a1a4523d9622af53e717
SHA1 f97027f9ada12c1e7649c590391af24fc90af44d
SHA512 747c44fb08d7c83ac6d8b9fb1bdbad5c249ee680cd928b5b2ac5d20d982e97f7041ca9ffa554830847a6987162187ad2066f25d734f99239c584035d1e6337bd
SSDEEP 384:PYKehWEaWtaCIcPA0GftpBjtiuzG5ERHRN7A1Rtwl2IwnbJz4:g5hiycG5EBWLIY4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

1a:f4:e2:57:6a:51:3e:48:0d:1a:7e:e9:9a:69:b2:22:1b:84:86:f6:10:22:ca:66:c9:af:1b:84:2c:8d:dc:cf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

14:b6:67:8e:b7:15:c0:c3:55:8e:91:ee:e1:d2:36:86:8a:01:3e:04

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11450

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Diagnostics.Tools\4.0.0.0\System.Diagnostics.Tools.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netcore50/System.Diagnostics.Tools.xml

SHA256 ba1b8da76f502ba9efaf83f85b94da84cc50385f30544ef756165fa963e2b6ef
MD5 841df1d0858cca834100126327d6707e
SHA1 b1a1728e3902f19a56efa9db557b8ee7c8abda34
SHA512 9f3aab37a43739893bbb48c3693a93c96431efa10f9ef329bafec21230bff7c09b6c373462153b8e4171b1db1db17b6ad43ae3630379b6f4f185139592b9fcc7
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netcore50/de/System.Diagnostics.Tools.xml

SHA256 6d0602068d4b1ac7bbc5b15c0b3c6fae9e877a863a01127ef5f9c45b57496ba3
MD5 c911ca8fb307a112149cf0b45b487339
SHA1 c793c938bd5de941933f2c42b6367af2a6b91b60
SHA512 c6abf66f58c972c05d12c4c7c39013239b6f5bc2fffa7e8980db8bdf944cb678ee7c4cb01dee2d691c827d2fb07e32e3614de8389fd296694bc2392794a7ec15
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netcore50/es/System.Diagnostics.Tools.xml

SHA256 fe8c8ef8df24993050c38034b09110d32454d6cdc8f136018603941a96519d88
MD5 d3533795b6748dcf527dce35dde96f06
SHA1 8e7dd81e94cab26bd3b79f67dae944af627c77d7
SHA512 6dbd7f61b1ac62a141bfbe7d336e0dede1b337fa3602c8ccf4824cc581254c32381415dcab758c649137b3c6d91fec4396e69b866500ae679a0aacc6d67f23b7
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netcore50/fr/System.Diagnostics.Tools.xml

SHA256 923afd7eee98c08ab0c978133c9abccb6f211f9b358d8592dee582ec1bb4717f
MD5 4c9f1efaa2527fdf295e47040a64b7dd
SHA1 3debd8b18ed1cc490f8adebf5a7728ac94ce83f0
SHA512 4ef5af62097bbe5ec4a544c268a10fe8cde09317634f170af8b6840bd8b8eda96fee0c05ad970c5a56ec49a8422457fb760a0b733e14817fd33bb8e8bd2561f9
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netcore50/it/System.Diagnostics.Tools.xml

SHA256 e6ba339475797b9558da937512fc8c8cf76e4fbf6085a5c54cda4f15dee5e72e
MD5 a225454308f592d28597632aa105c4da
SHA1 12d7b9da03cc50dcaccbf8d750780c06f7c03bc3
SHA512 fb2f1cc5b0aa51fab42a577cff20914947e8dc0a0042357147d2044910a7313e7d4963e657b195deb70323e59256a429c3792d6b3f92d13e213ada70d4ba352d
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netcore50/ja/System.Diagnostics.Tools.xml

SHA256 27c3837b31e188ca5989422c321c45bdef7058be7336ab1f46e46f43c20371dd
MD5 8b7b453e061ff128366db42dd3ad7cf9
SHA1 7b572b8786d900cd65e339259ee1e028fed0f293
SHA512 098a1c1a723da5e4616ca4728077daacfc674130037ec99f832956b8f528242181ff75f4c3797f3f88ad17250eb6de05501e57e7919b94ad1476be59fcab9b49
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netcore50/ko/System.Diagnostics.Tools.xml

SHA256 f230a34dca4c804c3571c5cc695ce7d67be01bc63bfcb9f163b1dcfad00fc1b3
MD5 86d86e40bada407e9f0059f5e05ec5ab
SHA1 994f2e96998d22e1aa9b18e5a1a659fd09de59ad
SHA512 4a36309ce55806de5deb85ca034e5dcb76e16ce04be88955e2c45f9707329fa2f1bb21277edf5e4099db148dd5f45986d77a2b6147ed3355e2be60bdc043ac9b
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netcore50/ru/System.Diagnostics.Tools.xml

SHA256 f7b0e7d1167bf9543d2c0b1575416403a6e95c88b3b47cf49978d62ed243c8cf
MD5 64bba69b22093fd74d06e593310221e0
SHA1 6eb114ceca46e448b4e676ef941104e1ba6d68ba
SHA512 b65fd77cdafb8eeb07149b5c44f870b814890d1a467eb310b32e6af1063ea27a3fa265e260c8464d54a8d040cc8f3e8c48f82e893152028fd4385f4453a48a95
SSDEEP 48:3IRvh2gGw5n0o/GzDm3rdgkQ8rxGpcL0o/Gj7fNRERTSVRTuQ87ezWNIhuVM4huE:Y72gPgS7BMcgf7kTSnTdx/huVPhuE
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netcore50/zh-hans/System.Diagnostics.Tools.xml

SHA256 f2fd13b33f05f734a7cee202a35bb7294fa4aeb9e93627af05aafa70d35f0db6
MD5 fda6a2e591e981d3dafa43127a2b3bc1
SHA1 a9d26ac81902bceba083a608b1eebd64c0d6a986
SHA512 826469de895ca536a079853baac9411878a97d45f949fa289fd91b1b392ec069513e65ceace91ca22cc192d37bf460ab8bc4e57c9c601dbb50616609437076a3
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netcore50/zh-hant/System.Diagnostics.Tools.xml

SHA256 d4ff65b92040c82543a15d217bb0a4f81e13ff62c5ac0784d26a7be7bb916609
MD5 cccfef43741236e1eb2aca3af0730bf5
SHA1 b9c1b974fb60786ebc2b08a1ed19e0aabf514c3c
SHA512 46d6ac28ba091c161a521244a9e8345479dc425cef1f30f09354a4095750acd9fdca462910d9d4f1ed1c847baa8a5eace4fab1ad19b98f9b71bd655c99e12e1b
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netstandard1.0/System.Diagnostics.Tools.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 da3c0b9d37e995ed6030f69b0da6e4b7f51baf121ed6453642b8e3bcf0ad0fc7
MD5 81d228eabeb4a1a4523d9622af53e717
SHA1 f97027f9ada12c1e7649c590391af24fc90af44d
SHA512 747c44fb08d7c83ac6d8b9fb1bdbad5c249ee680cd928b5b2ac5d20d982e97f7041ca9ffa554830847a6987162187ad2066f25d734f99239c584035d1e6337bd
SSDEEP 384:PYKehWEaWtaCIcPA0GftpBjtiuzG5ERHRN7A1Rtwl2IwnbJz4:g5hiycG5EBWLIY4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

1a:f4:e2:57:6a:51:3e:48:0d:1a:7e:e9:9a:69:b2:22:1b:84:86:f6:10:22:ca:66:c9:af:1b:84:2c:8d:dc:cf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

14:b6:67:8e:b7:15:c0:c3:55:8e:91:ee:e1:d2:36:86:8a:01:3e:04

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11450

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Diagnostics.Tools\4.0.0.0\System.Diagnostics.Tools.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netstandard1.0/System.Diagnostics.Tools.xml

SHA256 ba1b8da76f502ba9efaf83f85b94da84cc50385f30544ef756165fa963e2b6ef
MD5 841df1d0858cca834100126327d6707e
SHA1 b1a1728e3902f19a56efa9db557b8ee7c8abda34
SHA512 9f3aab37a43739893bbb48c3693a93c96431efa10f9ef329bafec21230bff7c09b6c373462153b8e4171b1db1db17b6ad43ae3630379b6f4f185139592b9fcc7
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netstandard1.0/de/System.Diagnostics.Tools.xml

SHA256 6d0602068d4b1ac7bbc5b15c0b3c6fae9e877a863a01127ef5f9c45b57496ba3
MD5 c911ca8fb307a112149cf0b45b487339
SHA1 c793c938bd5de941933f2c42b6367af2a6b91b60
SHA512 c6abf66f58c972c05d12c4c7c39013239b6f5bc2fffa7e8980db8bdf944cb678ee7c4cb01dee2d691c827d2fb07e32e3614de8389fd296694bc2392794a7ec15
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netstandard1.0/es/System.Diagnostics.Tools.xml

SHA256 fe8c8ef8df24993050c38034b09110d32454d6cdc8f136018603941a96519d88
MD5 d3533795b6748dcf527dce35dde96f06
SHA1 8e7dd81e94cab26bd3b79f67dae944af627c77d7
SHA512 6dbd7f61b1ac62a141bfbe7d336e0dede1b337fa3602c8ccf4824cc581254c32381415dcab758c649137b3c6d91fec4396e69b866500ae679a0aacc6d67f23b7
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netstandard1.0/fr/System.Diagnostics.Tools.xml

SHA256 923afd7eee98c08ab0c978133c9abccb6f211f9b358d8592dee582ec1bb4717f
MD5 4c9f1efaa2527fdf295e47040a64b7dd
SHA1 3debd8b18ed1cc490f8adebf5a7728ac94ce83f0
SHA512 4ef5af62097bbe5ec4a544c268a10fe8cde09317634f170af8b6840bd8b8eda96fee0c05ad970c5a56ec49a8422457fb760a0b733e14817fd33bb8e8bd2561f9
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netstandard1.0/it/System.Diagnostics.Tools.xml

SHA256 e6ba339475797b9558da937512fc8c8cf76e4fbf6085a5c54cda4f15dee5e72e
MD5 a225454308f592d28597632aa105c4da
SHA1 12d7b9da03cc50dcaccbf8d750780c06f7c03bc3
SHA512 fb2f1cc5b0aa51fab42a577cff20914947e8dc0a0042357147d2044910a7313e7d4963e657b195deb70323e59256a429c3792d6b3f92d13e213ada70d4ba352d
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netstandard1.0/ja/System.Diagnostics.Tools.xml

SHA256 27c3837b31e188ca5989422c321c45bdef7058be7336ab1f46e46f43c20371dd
MD5 8b7b453e061ff128366db42dd3ad7cf9
SHA1 7b572b8786d900cd65e339259ee1e028fed0f293
SHA512 098a1c1a723da5e4616ca4728077daacfc674130037ec99f832956b8f528242181ff75f4c3797f3f88ad17250eb6de05501e57e7919b94ad1476be59fcab9b49
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netstandard1.0/ko/System.Diagnostics.Tools.xml

SHA256 f230a34dca4c804c3571c5cc695ce7d67be01bc63bfcb9f163b1dcfad00fc1b3
MD5 86d86e40bada407e9f0059f5e05ec5ab
SHA1 994f2e96998d22e1aa9b18e5a1a659fd09de59ad
SHA512 4a36309ce55806de5deb85ca034e5dcb76e16ce04be88955e2c45f9707329fa2f1bb21277edf5e4099db148dd5f45986d77a2b6147ed3355e2be60bdc043ac9b
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netstandard1.0/ru/System.Diagnostics.Tools.xml

SHA256 f7b0e7d1167bf9543d2c0b1575416403a6e95c88b3b47cf49978d62ed243c8cf
MD5 64bba69b22093fd74d06e593310221e0
SHA1 6eb114ceca46e448b4e676ef941104e1ba6d68ba
SHA512 b65fd77cdafb8eeb07149b5c44f870b814890d1a467eb310b32e6af1063ea27a3fa265e260c8464d54a8d040cc8f3e8c48f82e893152028fd4385f4453a48a95
SSDEEP 48:3IRvh2gGw5n0o/GzDm3rdgkQ8rxGpcL0o/Gj7fNRERTSVRTuQ87ezWNIhuVM4huE:Y72gPgS7BMcgf7kTSnTdx/huVPhuE
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netstandard1.0/zh-hans/System.Diagnostics.Tools.xml

SHA256 f2fd13b33f05f734a7cee202a35bb7294fa4aeb9e93627af05aafa70d35f0db6
MD5 fda6a2e591e981d3dafa43127a2b3bc1
SHA1 a9d26ac81902bceba083a608b1eebd64c0d6a986
SHA512 826469de895ca536a079853baac9411878a97d45f949fa289fd91b1b392ec069513e65ceace91ca22cc192d37bf460ab8bc4e57c9c601dbb50616609437076a3
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tools.4.3.0/ref/netstandard1.0/zh-hant/System.Diagnostics.Tools.xml

SHA256 d4ff65b92040c82543a15d217bb0a4f81e13ff62c5ac0784d26a7be7bb916609
MD5 cccfef43741236e1eb2aca3af0730bf5
SHA1 b9c1b974fb60786ebc2b08a1ed19e0aabf514c3c
SHA512 46d6ac28ba091c161a521244a9e8345479dc425cef1f30f09354a4095750acd9fdca462910d9d4f1ed1c847baa8a5eace4fab1ad19b98f9b71bd655c99e12e1b
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/.signature.p7s

SHA256 0735d167c923d215bb90f7bc3ab83d39406289faea9b2a7d85bad984ad4bdb24
MD5 6b5eae8f6cc0ab8cc82877b7150e73dd
SHA1 5bc721814978f3082253bc5e5e69bdc5ca6847a0
SHA512 dec62dc5a3e5ab2393d8c85db9adbb817c12f38be68d3398664834d9f89cf09f491f796a63be5baaaca1490eea9a5fbb5b38acdfae0f1ea8d12322e40e495111
SSDEEP 192:xdi7x0KDWpHhXZCVzV07Vrcn9DH0JOqNG8Fp28Wh8nwlF:jovDGGVp59oJNNzFwhhiwlF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/System.Diagnostics.Tracing.4.3.0.nupkg

SHA256 8421136691c719584f62f6f80b47e1e33b3ef33bf818fa22c5a8242d98e96bd4
MD5 f233cd43697c7187640ce6d18dc4a009
SHA1 a942fc3a716c20b07462c020fd68c18f7fac6ddb
SHA512 d0a5d30e261cd45b7dfab02b7ffbd76b64e0c9b892ed826ea61481c983c0208b05b69981cd79e91cd4e5811e1cd4c3cea06a1afce05811ece58be5e4c20169ea
SSDEEP 12288:xAMd6XGiADckiyXaY03ihXhzbuiwXw2OJRueX2EQTS:x+dGrTRUaBq9xIRDxcS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/lib/net462/System.Diagnostics.Tracing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3a7f44e3b20a03cef6fe8b164a5c193d50bd30ee0aab26a7857d6b1944da64fd
MD5 89c684edaadcecf78c53e45dae62e97e
SHA1 5340b1fc77e793d1fdde49b14b7b426d0e448870
SHA512 c3f99c1979a91beb0216b00fbadd4ed44f74978e7562ae9f8a199cd7a7d025234181fb8101b16464a9b2f7396d4ca878a0b23c260e95e504d75766b055e0b899
SSDEEP 768:ASGcOlllllllllWOkdOpy690Ai8CqNteFlT6HDStQzFX4UiNiEBBh:cMKJX4UQiEBBh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

81:ec:39:b3:d2:95:b3:23:47:4e:07:a4:2e:1a:24:63:6b:f7:a0:f2:ce:66:61:45:77:47:05:76:09:e6:4e:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8b:19:a6:1f:e1:79:97:e2:69:d4:9b:4c:86:5b:ef:af:a7:6e:cd:ef

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

25126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.Tracing/net462\System.Diagnostics.Tracing.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/net462/System.Diagnostics.Tracing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3a7f44e3b20a03cef6fe8b164a5c193d50bd30ee0aab26a7857d6b1944da64fd
MD5 89c684edaadcecf78c53e45dae62e97e
SHA1 5340b1fc77e793d1fdde49b14b7b426d0e448870
SHA512 c3f99c1979a91beb0216b00fbadd4ed44f74978e7562ae9f8a199cd7a7d025234181fb8101b16464a9b2f7396d4ca878a0b23c260e95e504d75766b055e0b899
SSDEEP 768:ASGcOlllllllllWOkdOpy690Ai8CqNteFlT6HDStQzFX4UiNiEBBh:cMKJX4UQiEBBh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

81:ec:39:b3:d2:95:b3:23:47:4e:07:a4:2e:1a:24:63:6b:f7:a0:f2:ce:66:61:45:77:47:05:76:09:e6:4e:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8b:19:a6:1f:e1:79:97:e2:69:d4:9b:4c:86:5b:ef:af:a7:6e:cd:ef

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

25126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Diagnostics.Tracing/net462\System.Diagnostics.Tracing.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netcore50/System.Diagnostics.Tracing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0c283c695f2ff9e79626205434f8b649b94e2da5381cad92edb3428691f25c05
MD5 42c397c4fa19ec49573e05bb3b731eef
SHA1 ebd645c888f19e91093e08f15b6d090e3755d3bf
SHA512 a5491dac55c3506b0b3fc12e73edf4f4bc4b2a50ffed9bf00218ca7fcd4997b494bf8ff0b5e45266344cae6615079c11437d732b1ceac1a217e4364abf1b9593
SSDEEP 384:o+PNdcdxMhEwWVhh/0nHbdzeQjBVyW1zwMXli+0OHbsyW8HWygbCA0GftpBj++IZ:rNdExMUd0HhzeQl4ANl2OHbsYy8iAmf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

61:90:fc:e7:87:38:32:28:09:69:6c:58:a8:0b:ce:ef:38:6d:71:2c:31:55:a7:86:0e:f2:dc:c7:49:c5:93:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

e7:2a:8a:f3:cb:9d:39:4c:b4:eb:76:b8:73:11:31:3e:38:f9:d6:2a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

19386

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Diagnostics.Tracing\4.0.20.0\System.Diagnostics.Tracing.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netcore50/System.Diagnostics.Tracing.xml

SHA256 7b578e46d847a69090a7fba007c48710766bb1bc2ab04249032069ed312fd6e4
MD5 46cf4054fc8480123840e54fe1b7f875
SHA1 2006d9b0a2fe71dcaa7a102b157e5feb6e5d12be
SHA512 92dee27da324930236adff032a94060ab9e190ffbf76d8df0de71de1af782d77daaf754d99478e398ec60f0cc5c97fb6ef4a52bd8071b84610b01cea4d691f0d
SSDEEP 384:YwF2Kp6tbmHCr+n+gMMV53JHQ8ESE0HouYqr9av3dje9HuLs8uOAty+nlPr0Mw9:YwcOirCvZHQ8jRHouYlv3ZdsdPr29
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netcore50/de/System.Diagnostics.Tracing.xml

SHA256 ed113b8b59b39dbb382cb6e93b85556ffab02c7354d4088e359969d6f20fdd6a
MD5 dfa1fa61ab50c3d2f5ff7d480f2b9402
SHA1 9313f8ca9d53b9ffce39fa684f6fbe01dc5962dd
SHA512 0f25ab4ed8858fd4742b62c9a77006b783511c68e0b20f98e3783b7b74b924a462cee44891a42318d2a8180652aa50c030c587d31a2e7b7d77ea2e18fcb8f449
SSDEEP 768:YNprtnoFD515m51TgSQqYryYozZbKsg1gPStRlcuKC8t:atnoHqYryBFt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netcore50/es/System.Diagnostics.Tracing.xml

SHA256 9359c78c14614fb18151cb184f95b3804ddee43855c9e80cff91acac3cf0caca
MD5 2ac1e1ffd7c19db0b82f6af7be99e6f5
SHA1 ca4ea0756285e3dbc7b2edc3269bea78a5586527
SHA512 51db9e0996a6470fb55cb7e91c632d17401b665cf6a9e1f711f12fcf7fee02971ee4d6d1ad3dfdd0d7c2076675efd4937940aa3d37d8a9fc060dece5b09889ee
SSDEEP 1536:vU0QRVgKUrOVnj534KG4kkVNQuQC4SKa51/yZ++9+:8pG4kR+
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netcore50/fr/System.Diagnostics.Tracing.xml

SHA256 b8ffcdc8bda1276acb2c8be3cf7176cc276accfa2eaa5376935dd2945e4694e4
MD5 f9afaadc685616f0d68eb786210b9e31
SHA1 2a0072feb40fdb8883605dc9c7932a2a589f8ea5
SHA512 d8cd2c23f91fd68bd0a03f8e9c8d2d45f11ef4aa1c68a1839e94b6a9d989c9be60cd114885f71c72a8e75555153e850007ecb7ccfce788247e210ad6d2da64a5
SSDEEP 384:YpSkr4ND5dEeGKq/+jZ1M3irYtTvE8NjsJ5h+y2upmxBhs1g80:Y4keGKqibvrY9E8NjsJ5hw72I
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netcore50/it/System.Diagnostics.Tracing.xml

SHA256 9755d5931a3185771a62e3fa0461ad15df1f8ee24fc76f8d7362edf33b4db54c
MD5 14bdf24f86c1dd7375826abcd40b07bb
SHA1 f9c013c12d0ccaaaccf892b6755e593be2ca21f3
SHA512 5635c01c3ce980a8c336f155dca232e98492beabb669a822eee65eaba848129bee5f8f5aed82f04c8f44cd424fe6bc01bfe3c95e6ae953801d6936f78254f59a
SSDEEP 1536:wAVl6DyNeneseaBc3BgJcL7Ey1p+KvybU1FQ:RVl6DyNeneseaaQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netcore50/ja/System.Diagnostics.Tracing.xml

SHA256 e0ebf527fd801d01d71b97f6eba1871b25c47f66e5bb5eebbe86dcdf44eb9816
MD5 36162441a4ed316785b1e69199f1775a
SHA1 399a0af58089ea758039ad62043120b2f7424caf
SHA512 e2dbac1026e1458b5338aea3e0dd01cc56854ab140643c7929a53de8f204c216feac19886907cda011e74080fe7ec6c421c068639c82d79bf50ef3fe944e6bcb
SSDEEP 384:YVk9HhQblY49+TQ6Z0B5U2esZ2WD3ptu3VkKAKxGVDpNvH5Vd:YVk9H4lYBZGU5W7XuFkKAKxQNvR
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netcore50/ko/System.Diagnostics.Tracing.xml

SHA256 2a2679b4d6fb42c29f1fb09509a78057051198d03091a41a3e0e020304544ddd
MD5 00146083050bd61f4698461efef596f4
SHA1 21115b1e6bd3e1704713ea398e691ca33957a152
SHA512 d7b6c0f0797ebc61498b41a70294a3c7b035237c8c5b6047dd46628cfe14067bc246c040b150441be9ae1f6abfc3ea7355313bef0af13048d7d5e118dce06bcf
SSDEEP 768:YyqVHR9ZCEfe86KVsynL1bImYfY9ZXYqdAVE9sCL:TK39aO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netcore50/ru/System.Diagnostics.Tracing.xml

SHA256 856f1632377338fa4e821c7e7ddafe83d2ec3084d61a8092522d3c73716a1cad
MD5 426353ddf4a4171dc9b92f186f57d741
SHA1 f3e186a20b30d3d26b566a669c1d4390d80c75e9
SHA512 ddbe2ce59c45105846fb38238da5e93622bcfa4e208d15ed6924b9a8da3278d7b3e53b349b2a8f4699ade264e7891e3c5652f77b4cac335feb1721312ae0f1b9
SSDEEP 768:YUPN+lEJZXV7SJaQlzrFzjP2mDrSfg38uIVfeIfFm6TWk4HirmfGzprUb+NHzeFW:7N6EZXV7gOmKPbVtUb+NHNmi4Y
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netcore50/zh-hans/System.Diagnostics.Tracing.xml

SHA256 a1078073eb82e620b0f13a4f0ae3548381e81ddd50f6f1f0c8ecfef79f6556e7
MD5 2bfc13a308382f594ebe3e41dec3e50c
SHA1 4440d7ec3d64bf012277129f4cd397af859f93bd
SHA512 363596c9f12bfc170aecdb208517dc8107e0192cc352040e9bf7d173b92f33f020ca2a302527016ea52bd1b95e11c8274e73d0a755d980acfb6b48b14ad572e2
SSDEEP 768:YMIaQEBiDC/aj8RgknY8LUDbCZEfNhpqSBSoSjSEXQ:CaQEBiDC/rgwtLU64hESBSoSjSv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netcore50/zh-hant/System.Diagnostics.Tracing.xml

SHA256 8a39ac9acd89b650c227f230771eb07a6bd9e66885f969b5ca5c8ce025321527
MD5 e0de655a15a5cf2f402463004d0590bf
SHA1 9c60f4223beb051d7e644effad221d95f9ee011e
SHA512 b8a28c4df67b3b7249e51db19eea4c799aef4c2814a9ca3360be45458dccc06c51c36f1985102a56f10895e0edee470af2082823325eca6b0257f84e43d161fb
SSDEEP 768:YxUhMF/ruMzXe3WNhnavAgn1Uox5uxRUe7aESxCeMs:Dq/ruMzXe3WNBaIaGxRUe7aESh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.1/System.Diagnostics.Tracing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 22c3353d31eb339e27388f962ca4fd6ee31b0d39a5084ef755da685f2af071ba
MD5 e977af772a69fa90ca91881e58d10332
SHA1 b363ce11e8b25e45cf8911df240ec72e7fc47604
SHA512 41f00a58abd46d555d656b0d90419ec1520dd6ebe6a8558fbc478705bc6fa3d6799b08e262c4ae10fd131b0eb5fd521dd5bc89f21899912e89f70eee3eea46b7
SSDEEP 384:BixizWdB5v/X3FdMdWsdWF1LHB0GftpBjpSDHRN7ElGBPj0w:BiIUX/HnMdYWifSDhBh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

89:1c:44:92:a5:13:af:e2:de:51:28:5b:16:75:90:e2:0f:ac:75:84:fe:73:a2:d2:fd:8b:81:df:88:25:95:3a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a2:f6:31:91:c4:f5:62:e2:8a:27:57:11:c2:f9:2b:d8:56:5e:58:87

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

15998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.1/System.Diagnostics.Tracing.xml

SHA256 7b578e46d847a69090a7fba007c48710766bb1bc2ab04249032069ed312fd6e4
MD5 46cf4054fc8480123840e54fe1b7f875
SHA1 2006d9b0a2fe71dcaa7a102b157e5feb6e5d12be
SHA512 92dee27da324930236adff032a94060ab9e190ffbf76d8df0de71de1af782d77daaf754d99478e398ec60f0cc5c97fb6ef4a52bd8071b84610b01cea4d691f0d
SSDEEP 384:YwF2Kp6tbmHCr+n+gMMV53JHQ8ESE0HouYqr9av3dje9HuLs8uOAty+nlPr0Mw9:YwcOirCvZHQ8jRHouYlv3ZdsdPr29
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.1/de/System.Diagnostics.Tracing.xml

SHA256 ed113b8b59b39dbb382cb6e93b85556ffab02c7354d4088e359969d6f20fdd6a
MD5 dfa1fa61ab50c3d2f5ff7d480f2b9402
SHA1 9313f8ca9d53b9ffce39fa684f6fbe01dc5962dd
SHA512 0f25ab4ed8858fd4742b62c9a77006b783511c68e0b20f98e3783b7b74b924a462cee44891a42318d2a8180652aa50c030c587d31a2e7b7d77ea2e18fcb8f449
SSDEEP 768:YNprtnoFD515m51TgSQqYryYozZbKsg1gPStRlcuKC8t:atnoHqYryBFt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.1/es/System.Diagnostics.Tracing.xml

SHA256 9359c78c14614fb18151cb184f95b3804ddee43855c9e80cff91acac3cf0caca
MD5 2ac1e1ffd7c19db0b82f6af7be99e6f5
SHA1 ca4ea0756285e3dbc7b2edc3269bea78a5586527
SHA512 51db9e0996a6470fb55cb7e91c632d17401b665cf6a9e1f711f12fcf7fee02971ee4d6d1ad3dfdd0d7c2076675efd4937940aa3d37d8a9fc060dece5b09889ee
SSDEEP 1536:vU0QRVgKUrOVnj534KG4kkVNQuQC4SKa51/yZ++9+:8pG4kR+
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.1/fr/System.Diagnostics.Tracing.xml

SHA256 b8ffcdc8bda1276acb2c8be3cf7176cc276accfa2eaa5376935dd2945e4694e4
MD5 f9afaadc685616f0d68eb786210b9e31
SHA1 2a0072feb40fdb8883605dc9c7932a2a589f8ea5
SHA512 d8cd2c23f91fd68bd0a03f8e9c8d2d45f11ef4aa1c68a1839e94b6a9d989c9be60cd114885f71c72a8e75555153e850007ecb7ccfce788247e210ad6d2da64a5
SSDEEP 384:YpSkr4ND5dEeGKq/+jZ1M3irYtTvE8NjsJ5h+y2upmxBhs1g80:Y4keGKqibvrY9E8NjsJ5hw72I
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.1/it/System.Diagnostics.Tracing.xml

SHA256 9755d5931a3185771a62e3fa0461ad15df1f8ee24fc76f8d7362edf33b4db54c
MD5 14bdf24f86c1dd7375826abcd40b07bb
SHA1 f9c013c12d0ccaaaccf892b6755e593be2ca21f3
SHA512 5635c01c3ce980a8c336f155dca232e98492beabb669a822eee65eaba848129bee5f8f5aed82f04c8f44cd424fe6bc01bfe3c95e6ae953801d6936f78254f59a
SSDEEP 1536:wAVl6DyNeneseaBc3BgJcL7Ey1p+KvybU1FQ:RVl6DyNeneseaaQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.1/ja/System.Diagnostics.Tracing.xml

SHA256 e0ebf527fd801d01d71b97f6eba1871b25c47f66e5bb5eebbe86dcdf44eb9816
MD5 36162441a4ed316785b1e69199f1775a
SHA1 399a0af58089ea758039ad62043120b2f7424caf
SHA512 e2dbac1026e1458b5338aea3e0dd01cc56854ab140643c7929a53de8f204c216feac19886907cda011e74080fe7ec6c421c068639c82d79bf50ef3fe944e6bcb
SSDEEP 384:YVk9HhQblY49+TQ6Z0B5U2esZ2WD3ptu3VkKAKxGVDpNvH5Vd:YVk9H4lYBZGU5W7XuFkKAKxQNvR
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.1/ko/System.Diagnostics.Tracing.xml

SHA256 2a2679b4d6fb42c29f1fb09509a78057051198d03091a41a3e0e020304544ddd
MD5 00146083050bd61f4698461efef596f4
SHA1 21115b1e6bd3e1704713ea398e691ca33957a152
SHA512 d7b6c0f0797ebc61498b41a70294a3c7b035237c8c5b6047dd46628cfe14067bc246c040b150441be9ae1f6abfc3ea7355313bef0af13048d7d5e118dce06bcf
SSDEEP 768:YyqVHR9ZCEfe86KVsynL1bImYfY9ZXYqdAVE9sCL:TK39aO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.1/ru/System.Diagnostics.Tracing.xml

SHA256 856f1632377338fa4e821c7e7ddafe83d2ec3084d61a8092522d3c73716a1cad
MD5 426353ddf4a4171dc9b92f186f57d741
SHA1 f3e186a20b30d3d26b566a669c1d4390d80c75e9
SHA512 ddbe2ce59c45105846fb38238da5e93622bcfa4e208d15ed6924b9a8da3278d7b3e53b349b2a8f4699ade264e7891e3c5652f77b4cac335feb1721312ae0f1b9
SSDEEP 768:YUPN+lEJZXV7SJaQlzrFzjP2mDrSfg38uIVfeIfFm6TWk4HirmfGzprUb+NHzeFW:7N6EZXV7gOmKPbVtUb+NHNmi4Y
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.1/zh-hans/System.Diagnostics.Tracing.xml

SHA256 a1078073eb82e620b0f13a4f0ae3548381e81ddd50f6f1f0c8ecfef79f6556e7
MD5 2bfc13a308382f594ebe3e41dec3e50c
SHA1 4440d7ec3d64bf012277129f4cd397af859f93bd
SHA512 363596c9f12bfc170aecdb208517dc8107e0192cc352040e9bf7d173b92f33f020ca2a302527016ea52bd1b95e11c8274e73d0a755d980acfb6b48b14ad572e2
SSDEEP 768:YMIaQEBiDC/aj8RgknY8LUDbCZEfNhpqSBSoSjSEXQ:CaQEBiDC/rgwtLU64hESBSoSjSv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.1/zh-hant/System.Diagnostics.Tracing.xml

SHA256 8a39ac9acd89b650c227f230771eb07a6bd9e66885f969b5ca5c8ce025321527
MD5 e0de655a15a5cf2f402463004d0590bf
SHA1 9c60f4223beb051d7e644effad221d95f9ee011e
SHA512 b8a28c4df67b3b7249e51db19eea4c799aef4c2814a9ca3360be45458dccc06c51c36f1985102a56f10895e0edee470af2082823325eca6b0257f84e43d161fb
SSDEEP 768:YxUhMF/ruMzXe3WNhnavAgn1Uox5uxRUe7aESxCeMs:Dq/ruMzXe3WNBaIaGxRUe7aESh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.2/System.Diagnostics.Tracing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 da14079e26a5b6936ee23b0d91254e45eae077133566fe8e5b30f0ca94159879
MD5 029af054b180ff9a63088847bcdfe2cd
SHA1 d37c9a301c9808dd7167ebe5aa592ce20321197b
SHA512 10d54d0ad14335910a4316e222cba8f68ee4215c5dae7e19de58c50ed0e0b2e22feba959585421b3fe4774d3c2398be881128a0eae189a8a2ea68e316b2aca8a
SSDEEP 384:K54+U511B3mfBnrOfFdcrEWWdWhvXS9//0GftpBjsFtAHRN7NlYaCcRAz:K5pU5BSB0ncr4M+8iZoag
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

c4:e4:44:7e:a8:14:cc:45:11:04:0e:9e:d0:14:bc:1a:ad:8c:54:7a:60:01:aa:68:cf:a0:4e:90:3c:4f:c8:30

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

6f:2b:23:1d:a5:c9:f0:d6:70:c0:fb:44:e9:b2:ac:94:49:6a:af:a8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 3, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 7, 2012 - Oct 7, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

17534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.2/System.Diagnostics.Tracing.xml

SHA256 7b578e46d847a69090a7fba007c48710766bb1bc2ab04249032069ed312fd6e4
MD5 46cf4054fc8480123840e54fe1b7f875
SHA1 2006d9b0a2fe71dcaa7a102b157e5feb6e5d12be
SHA512 92dee27da324930236adff032a94060ab9e190ffbf76d8df0de71de1af782d77daaf754d99478e398ec60f0cc5c97fb6ef4a52bd8071b84610b01cea4d691f0d
SSDEEP 384:YwF2Kp6tbmHCr+n+gMMV53JHQ8ESE0HouYqr9av3dje9HuLs8uOAty+nlPr0Mw9:YwcOirCvZHQ8jRHouYlv3ZdsdPr29
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.2/de/System.Diagnostics.Tracing.xml

SHA256 ed113b8b59b39dbb382cb6e93b85556ffab02c7354d4088e359969d6f20fdd6a
MD5 dfa1fa61ab50c3d2f5ff7d480f2b9402
SHA1 9313f8ca9d53b9ffce39fa684f6fbe01dc5962dd
SHA512 0f25ab4ed8858fd4742b62c9a77006b783511c68e0b20f98e3783b7b74b924a462cee44891a42318d2a8180652aa50c030c587d31a2e7b7d77ea2e18fcb8f449
SSDEEP 768:YNprtnoFD515m51TgSQqYryYozZbKsg1gPStRlcuKC8t:atnoHqYryBFt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.2/es/System.Diagnostics.Tracing.xml

SHA256 9359c78c14614fb18151cb184f95b3804ddee43855c9e80cff91acac3cf0caca
MD5 2ac1e1ffd7c19db0b82f6af7be99e6f5
SHA1 ca4ea0756285e3dbc7b2edc3269bea78a5586527
SHA512 51db9e0996a6470fb55cb7e91c632d17401b665cf6a9e1f711f12fcf7fee02971ee4d6d1ad3dfdd0d7c2076675efd4937940aa3d37d8a9fc060dece5b09889ee
SSDEEP 1536:vU0QRVgKUrOVnj534KG4kkVNQuQC4SKa51/yZ++9+:8pG4kR+
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.2/fr/System.Diagnostics.Tracing.xml

SHA256 b8ffcdc8bda1276acb2c8be3cf7176cc276accfa2eaa5376935dd2945e4694e4
MD5 f9afaadc685616f0d68eb786210b9e31
SHA1 2a0072feb40fdb8883605dc9c7932a2a589f8ea5
SHA512 d8cd2c23f91fd68bd0a03f8e9c8d2d45f11ef4aa1c68a1839e94b6a9d989c9be60cd114885f71c72a8e75555153e850007ecb7ccfce788247e210ad6d2da64a5
SSDEEP 384:YpSkr4ND5dEeGKq/+jZ1M3irYtTvE8NjsJ5h+y2upmxBhs1g80:Y4keGKqibvrY9E8NjsJ5hw72I
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.2/it/System.Diagnostics.Tracing.xml

SHA256 9755d5931a3185771a62e3fa0461ad15df1f8ee24fc76f8d7362edf33b4db54c
MD5 14bdf24f86c1dd7375826abcd40b07bb
SHA1 f9c013c12d0ccaaaccf892b6755e593be2ca21f3
SHA512 5635c01c3ce980a8c336f155dca232e98492beabb669a822eee65eaba848129bee5f8f5aed82f04c8f44cd424fe6bc01bfe3c95e6ae953801d6936f78254f59a
SSDEEP 1536:wAVl6DyNeneseaBc3BgJcL7Ey1p+KvybU1FQ:RVl6DyNeneseaaQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.2/ja/System.Diagnostics.Tracing.xml

SHA256 e0ebf527fd801d01d71b97f6eba1871b25c47f66e5bb5eebbe86dcdf44eb9816
MD5 36162441a4ed316785b1e69199f1775a
SHA1 399a0af58089ea758039ad62043120b2f7424caf
SHA512 e2dbac1026e1458b5338aea3e0dd01cc56854ab140643c7929a53de8f204c216feac19886907cda011e74080fe7ec6c421c068639c82d79bf50ef3fe944e6bcb
SSDEEP 384:YVk9HhQblY49+TQ6Z0B5U2esZ2WD3ptu3VkKAKxGVDpNvH5Vd:YVk9H4lYBZGU5W7XuFkKAKxQNvR
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.2/ko/System.Diagnostics.Tracing.xml

SHA256 2a2679b4d6fb42c29f1fb09509a78057051198d03091a41a3e0e020304544ddd
MD5 00146083050bd61f4698461efef596f4
SHA1 21115b1e6bd3e1704713ea398e691ca33957a152
SHA512 d7b6c0f0797ebc61498b41a70294a3c7b035237c8c5b6047dd46628cfe14067bc246c040b150441be9ae1f6abfc3ea7355313bef0af13048d7d5e118dce06bcf
SSDEEP 768:YyqVHR9ZCEfe86KVsynL1bImYfY9ZXYqdAVE9sCL:TK39aO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.2/ru/System.Diagnostics.Tracing.xml

SHA256 856f1632377338fa4e821c7e7ddafe83d2ec3084d61a8092522d3c73716a1cad
MD5 426353ddf4a4171dc9b92f186f57d741
SHA1 f3e186a20b30d3d26b566a669c1d4390d80c75e9
SHA512 ddbe2ce59c45105846fb38238da5e93622bcfa4e208d15ed6924b9a8da3278d7b3e53b349b2a8f4699ade264e7891e3c5652f77b4cac335feb1721312ae0f1b9
SSDEEP 768:YUPN+lEJZXV7SJaQlzrFzjP2mDrSfg38uIVfeIfFm6TWk4HirmfGzprUb+NHzeFW:7N6EZXV7gOmKPbVtUb+NHNmi4Y
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.2/zh-hans/System.Diagnostics.Tracing.xml

SHA256 a1078073eb82e620b0f13a4f0ae3548381e81ddd50f6f1f0c8ecfef79f6556e7
MD5 2bfc13a308382f594ebe3e41dec3e50c
SHA1 4440d7ec3d64bf012277129f4cd397af859f93bd
SHA512 363596c9f12bfc170aecdb208517dc8107e0192cc352040e9bf7d173b92f33f020ca2a302527016ea52bd1b95e11c8274e73d0a755d980acfb6b48b14ad572e2
SSDEEP 768:YMIaQEBiDC/aj8RgknY8LUDbCZEfNhpqSBSoSjSEXQ:CaQEBiDC/rgwtLU64hESBSoSjSv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.2/zh-hant/System.Diagnostics.Tracing.xml

SHA256 8a39ac9acd89b650c227f230771eb07a6bd9e66885f969b5ca5c8ce025321527
MD5 e0de655a15a5cf2f402463004d0590bf
SHA1 9c60f4223beb051d7e644effad221d95f9ee011e
SHA512 b8a28c4df67b3b7249e51db19eea4c799aef4c2814a9ca3360be45458dccc06c51c36f1985102a56f10895e0edee470af2082823325eca6b0257f84e43d161fb
SSDEEP 768:YxUhMF/ruMzXe3WNhnavAgn1Uox5uxRUe7aESxCeMs:Dq/ruMzXe3WNBaIaGxRUe7aESh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.3/System.Diagnostics.Tracing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0c283c695f2ff9e79626205434f8b649b94e2da5381cad92edb3428691f25c05
MD5 42c397c4fa19ec49573e05bb3b731eef
SHA1 ebd645c888f19e91093e08f15b6d090e3755d3bf
SHA512 a5491dac55c3506b0b3fc12e73edf4f4bc4b2a50ffed9bf00218ca7fcd4997b494bf8ff0b5e45266344cae6615079c11437d732b1ceac1a217e4364abf1b9593
SSDEEP 384:o+PNdcdxMhEwWVhh/0nHbdzeQjBVyW1zwMXli+0OHbsyW8HWygbCA0GftpBj++IZ:rNdExMUd0HhzeQl4ANl2OHbsYy8iAmf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

61:90:fc:e7:87:38:32:28:09:69:6c:58:a8:0b:ce:ef:38:6d:71:2c:31:55:a7:86:0e:f2:dc:c7:49:c5:93:aa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

e7:2a:8a:f3:cb:9d:39:4c:b4:eb:76:b8:73:11:31:3e:38:f9:d6:2a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

19386

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Diagnostics.Tracing\4.0.20.0\System.Diagnostics.Tracing.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.3/System.Diagnostics.Tracing.xml

SHA256 7b578e46d847a69090a7fba007c48710766bb1bc2ab04249032069ed312fd6e4
MD5 46cf4054fc8480123840e54fe1b7f875
SHA1 2006d9b0a2fe71dcaa7a102b157e5feb6e5d12be
SHA512 92dee27da324930236adff032a94060ab9e190ffbf76d8df0de71de1af782d77daaf754d99478e398ec60f0cc5c97fb6ef4a52bd8071b84610b01cea4d691f0d
SSDEEP 384:YwF2Kp6tbmHCr+n+gMMV53JHQ8ESE0HouYqr9av3dje9HuLs8uOAty+nlPr0Mw9:YwcOirCvZHQ8jRHouYlv3ZdsdPr29
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.3/de/System.Diagnostics.Tracing.xml

SHA256 ed113b8b59b39dbb382cb6e93b85556ffab02c7354d4088e359969d6f20fdd6a
MD5 dfa1fa61ab50c3d2f5ff7d480f2b9402
SHA1 9313f8ca9d53b9ffce39fa684f6fbe01dc5962dd
SHA512 0f25ab4ed8858fd4742b62c9a77006b783511c68e0b20f98e3783b7b74b924a462cee44891a42318d2a8180652aa50c030c587d31a2e7b7d77ea2e18fcb8f449
SSDEEP 768:YNprtnoFD515m51TgSQqYryYozZbKsg1gPStRlcuKC8t:atnoHqYryBFt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.3/es/System.Diagnostics.Tracing.xml

SHA256 9359c78c14614fb18151cb184f95b3804ddee43855c9e80cff91acac3cf0caca
MD5 2ac1e1ffd7c19db0b82f6af7be99e6f5
SHA1 ca4ea0756285e3dbc7b2edc3269bea78a5586527
SHA512 51db9e0996a6470fb55cb7e91c632d17401b665cf6a9e1f711f12fcf7fee02971ee4d6d1ad3dfdd0d7c2076675efd4937940aa3d37d8a9fc060dece5b09889ee
SSDEEP 1536:vU0QRVgKUrOVnj534KG4kkVNQuQC4SKa51/yZ++9+:8pG4kR+
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.3/fr/System.Diagnostics.Tracing.xml

SHA256 b8ffcdc8bda1276acb2c8be3cf7176cc276accfa2eaa5376935dd2945e4694e4
MD5 f9afaadc685616f0d68eb786210b9e31
SHA1 2a0072feb40fdb8883605dc9c7932a2a589f8ea5
SHA512 d8cd2c23f91fd68bd0a03f8e9c8d2d45f11ef4aa1c68a1839e94b6a9d989c9be60cd114885f71c72a8e75555153e850007ecb7ccfce788247e210ad6d2da64a5
SSDEEP 384:YpSkr4ND5dEeGKq/+jZ1M3irYtTvE8NjsJ5h+y2upmxBhs1g80:Y4keGKqibvrY9E8NjsJ5hw72I
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.3/it/System.Diagnostics.Tracing.xml

SHA256 9755d5931a3185771a62e3fa0461ad15df1f8ee24fc76f8d7362edf33b4db54c
MD5 14bdf24f86c1dd7375826abcd40b07bb
SHA1 f9c013c12d0ccaaaccf892b6755e593be2ca21f3
SHA512 5635c01c3ce980a8c336f155dca232e98492beabb669a822eee65eaba848129bee5f8f5aed82f04c8f44cd424fe6bc01bfe3c95e6ae953801d6936f78254f59a
SSDEEP 1536:wAVl6DyNeneseaBc3BgJcL7Ey1p+KvybU1FQ:RVl6DyNeneseaaQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.3/ja/System.Diagnostics.Tracing.xml

SHA256 e0ebf527fd801d01d71b97f6eba1871b25c47f66e5bb5eebbe86dcdf44eb9816
MD5 36162441a4ed316785b1e69199f1775a
SHA1 399a0af58089ea758039ad62043120b2f7424caf
SHA512 e2dbac1026e1458b5338aea3e0dd01cc56854ab140643c7929a53de8f204c216feac19886907cda011e74080fe7ec6c421c068639c82d79bf50ef3fe944e6bcb
SSDEEP 384:YVk9HhQblY49+TQ6Z0B5U2esZ2WD3ptu3VkKAKxGVDpNvH5Vd:YVk9H4lYBZGU5W7XuFkKAKxQNvR
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.3/ko/System.Diagnostics.Tracing.xml

SHA256 2a2679b4d6fb42c29f1fb09509a78057051198d03091a41a3e0e020304544ddd
MD5 00146083050bd61f4698461efef596f4
SHA1 21115b1e6bd3e1704713ea398e691ca33957a152
SHA512 d7b6c0f0797ebc61498b41a70294a3c7b035237c8c5b6047dd46628cfe14067bc246c040b150441be9ae1f6abfc3ea7355313bef0af13048d7d5e118dce06bcf
SSDEEP 768:YyqVHR9ZCEfe86KVsynL1bImYfY9ZXYqdAVE9sCL:TK39aO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.3/ru/System.Diagnostics.Tracing.xml

SHA256 856f1632377338fa4e821c7e7ddafe83d2ec3084d61a8092522d3c73716a1cad
MD5 426353ddf4a4171dc9b92f186f57d741
SHA1 f3e186a20b30d3d26b566a669c1d4390d80c75e9
SHA512 ddbe2ce59c45105846fb38238da5e93622bcfa4e208d15ed6924b9a8da3278d7b3e53b349b2a8f4699ade264e7891e3c5652f77b4cac335feb1721312ae0f1b9
SSDEEP 768:YUPN+lEJZXV7SJaQlzrFzjP2mDrSfg38uIVfeIfFm6TWk4HirmfGzprUb+NHzeFW:7N6EZXV7gOmKPbVtUb+NHNmi4Y
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.3/zh-hans/System.Diagnostics.Tracing.xml

SHA256 a1078073eb82e620b0f13a4f0ae3548381e81ddd50f6f1f0c8ecfef79f6556e7
MD5 2bfc13a308382f594ebe3e41dec3e50c
SHA1 4440d7ec3d64bf012277129f4cd397af859f93bd
SHA512 363596c9f12bfc170aecdb208517dc8107e0192cc352040e9bf7d173b92f33f020ca2a302527016ea52bd1b95e11c8274e73d0a755d980acfb6b48b14ad572e2
SSDEEP 768:YMIaQEBiDC/aj8RgknY8LUDbCZEfNhpqSBSoSjSEXQ:CaQEBiDC/rgwtLU64hESBSoSjSv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.3/zh-hant/System.Diagnostics.Tracing.xml

SHA256 8a39ac9acd89b650c227f230771eb07a6bd9e66885f969b5ca5c8ce025321527
MD5 e0de655a15a5cf2f402463004d0590bf
SHA1 9c60f4223beb051d7e644effad221d95f9ee011e
SHA512 b8a28c4df67b3b7249e51db19eea4c799aef4c2814a9ca3360be45458dccc06c51c36f1985102a56f10895e0edee470af2082823325eca6b0257f84e43d161fb
SSDEEP 768:YxUhMF/ruMzXe3WNhnavAgn1Uox5uxRUe7aESxCeMs:Dq/ruMzXe3WNBaIaGxRUe7aESh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.5/System.Diagnostics.Tracing.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7da143b2d5e3a40a2773b03cf7f782286f7e34a6e4af3f8d72753d476c360001
MD5 4e078b744e980916d8b435086ad6fe78
SHA1 bf5c626003fd422d8f6b15a47db6644d50cb9b4d
SHA512 397482a7729e155605f852ba6da4ac8601e71546a8b4263b1f60b35280048d6bfb3fa1f7ea04f40152560e235405a31c48d23406cc0369832f4d072ca69c9a12
SSDEEP 384:/nkOhbZdAfuGI7znMVli+0ghRNAWOdWSMIA0GftpBjGT24ERHRN7oTIl2IwnnLa:cOJZdAmLcl2ghUkqi4jEBozId
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

5c:c3:e7:99:10:51:32:c6:51:73:46:d1:3d:10:71:77:37:75:c5:e6:8b:c6:eb:98:d1:38:1a:6b:6e:ed:e4:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

bb:21:30:54:78:79:c1:8e:ad:43:81:44:ce:f2:df:55:b1:71:06:84

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

19530

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Diagnostics.Tracing\4.1.0.0\System.Diagnostics.Tracing.pdb

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.5/System.Diagnostics.Tracing.xml

SHA256 7b578e46d847a69090a7fba007c48710766bb1bc2ab04249032069ed312fd6e4
MD5 46cf4054fc8480123840e54fe1b7f875
SHA1 2006d9b0a2fe71dcaa7a102b157e5feb6e5d12be
SHA512 92dee27da324930236adff032a94060ab9e190ffbf76d8df0de71de1af782d77daaf754d99478e398ec60f0cc5c97fb6ef4a52bd8071b84610b01cea4d691f0d
SSDEEP 384:YwF2Kp6tbmHCr+n+gMMV53JHQ8ESE0HouYqr9av3dje9HuLs8uOAty+nlPr0Mw9:YwcOirCvZHQ8jRHouYlv3ZdsdPr29
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.5/de/System.Diagnostics.Tracing.xml

SHA256 ed113b8b59b39dbb382cb6e93b85556ffab02c7354d4088e359969d6f20fdd6a
MD5 dfa1fa61ab50c3d2f5ff7d480f2b9402
SHA1 9313f8ca9d53b9ffce39fa684f6fbe01dc5962dd
SHA512 0f25ab4ed8858fd4742b62c9a77006b783511c68e0b20f98e3783b7b74b924a462cee44891a42318d2a8180652aa50c030c587d31a2e7b7d77ea2e18fcb8f449
SSDEEP 768:YNprtnoFD515m51TgSQqYryYozZbKsg1gPStRlcuKC8t:atnoHqYryBFt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.5/es/System.Diagnostics.Tracing.xml

SHA256 9359c78c14614fb18151cb184f95b3804ddee43855c9e80cff91acac3cf0caca
MD5 2ac1e1ffd7c19db0b82f6af7be99e6f5
SHA1 ca4ea0756285e3dbc7b2edc3269bea78a5586527
SHA512 51db9e0996a6470fb55cb7e91c632d17401b665cf6a9e1f711f12fcf7fee02971ee4d6d1ad3dfdd0d7c2076675efd4937940aa3d37d8a9fc060dece5b09889ee
SSDEEP 1536:vU0QRVgKUrOVnj534KG4kkVNQuQC4SKa51/yZ++9+:8pG4kR+
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.5/fr/System.Diagnostics.Tracing.xml

SHA256 b8ffcdc8bda1276acb2c8be3cf7176cc276accfa2eaa5376935dd2945e4694e4
MD5 f9afaadc685616f0d68eb786210b9e31
SHA1 2a0072feb40fdb8883605dc9c7932a2a589f8ea5
SHA512 d8cd2c23f91fd68bd0a03f8e9c8d2d45f11ef4aa1c68a1839e94b6a9d989c9be60cd114885f71c72a8e75555153e850007ecb7ccfce788247e210ad6d2da64a5
SSDEEP 384:YpSkr4ND5dEeGKq/+jZ1M3irYtTvE8NjsJ5h+y2upmxBhs1g80:Y4keGKqibvrY9E8NjsJ5hw72I
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.5/it/System.Diagnostics.Tracing.xml

SHA256 9755d5931a3185771a62e3fa0461ad15df1f8ee24fc76f8d7362edf33b4db54c
MD5 14bdf24f86c1dd7375826abcd40b07bb
SHA1 f9c013c12d0ccaaaccf892b6755e593be2ca21f3
SHA512 5635c01c3ce980a8c336f155dca232e98492beabb669a822eee65eaba848129bee5f8f5aed82f04c8f44cd424fe6bc01bfe3c95e6ae953801d6936f78254f59a
SSDEEP 1536:wAVl6DyNeneseaBc3BgJcL7Ey1p+KvybU1FQ:RVl6DyNeneseaaQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.5/ja/System.Diagnostics.Tracing.xml

SHA256 e0ebf527fd801d01d71b97f6eba1871b25c47f66e5bb5eebbe86dcdf44eb9816
MD5 36162441a4ed316785b1e69199f1775a
SHA1 399a0af58089ea758039ad62043120b2f7424caf
SHA512 e2dbac1026e1458b5338aea3e0dd01cc56854ab140643c7929a53de8f204c216feac19886907cda011e74080fe7ec6c421c068639c82d79bf50ef3fe944e6bcb
SSDEEP 384:YVk9HhQblY49+TQ6Z0B5U2esZ2WD3ptu3VkKAKxGVDpNvH5Vd:YVk9H4lYBZGU5W7XuFkKAKxQNvR
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.5/ko/System.Diagnostics.Tracing.xml

SHA256 2a2679b4d6fb42c29f1fb09509a78057051198d03091a41a3e0e020304544ddd
MD5 00146083050bd61f4698461efef596f4
SHA1 21115b1e6bd3e1704713ea398e691ca33957a152
SHA512 d7b6c0f0797ebc61498b41a70294a3c7b035237c8c5b6047dd46628cfe14067bc246c040b150441be9ae1f6abfc3ea7355313bef0af13048d7d5e118dce06bcf
SSDEEP 768:YyqVHR9ZCEfe86KVsynL1bImYfY9ZXYqdAVE9sCL:TK39aO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.5/ru/System.Diagnostics.Tracing.xml

SHA256 856f1632377338fa4e821c7e7ddafe83d2ec3084d61a8092522d3c73716a1cad
MD5 426353ddf4a4171dc9b92f186f57d741
SHA1 f3e186a20b30d3d26b566a669c1d4390d80c75e9
SHA512 ddbe2ce59c45105846fb38238da5e93622bcfa4e208d15ed6924b9a8da3278d7b3e53b349b2a8f4699ade264e7891e3c5652f77b4cac335feb1721312ae0f1b9
SSDEEP 768:YUPN+lEJZXV7SJaQlzrFzjP2mDrSfg38uIVfeIfFm6TWk4HirmfGzprUb+NHzeFW:7N6EZXV7gOmKPbVtUb+NHNmi4Y
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.5/zh-hans/System.Diagnostics.Tracing.xml

SHA256 a1078073eb82e620b0f13a4f0ae3548381e81ddd50f6f1f0c8ecfef79f6556e7
MD5 2bfc13a308382f594ebe3e41dec3e50c
SHA1 4440d7ec3d64bf012277129f4cd397af859f93bd
SHA512 363596c9f12bfc170aecdb208517dc8107e0192cc352040e9bf7d173b92f33f020ca2a302527016ea52bd1b95e11c8274e73d0a755d980acfb6b48b14ad572e2
SSDEEP 768:YMIaQEBiDC/aj8RgknY8LUDbCZEfNhpqSBSoSjSEXQ:CaQEBiDC/rgwtLU64hESBSoSjSv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Diagnostics.Tracing.4.3.0/ref/netstandard1.5/zh-hant/System.Diagnostics.Tracing.xml

SHA256 8a39ac9acd89b650c227f230771eb07a6bd9e66885f969b5ca5c8ce025321527
MD5 e0de655a15a5cf2f402463004d0590bf
SHA1 9c60f4223beb051d7e644effad221d95f9ee011e
SHA512 b8a28c4df67b3b7249e51db19eea4c799aef4c2814a9ca3360be45458dccc06c51c36f1985102a56f10895e0edee470af2082823325eca6b0257f84e43d161fb
SSDEEP 768:YxUhMF/ruMzXe3WNhnavAgn1Uox5uxRUe7aESxCeMs:Dq/ruMzXe3WNBaIaGxRUe7aESh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/.signature.p7s

SHA256 51e008dfbe080bcf131c143d51a2152c00395669987049cbd16cabe0a96e9cdf
MD5 a094797613a9161188f5069a6384ab64
SHA1 0117239cb0890f818dfa9c7c9b954510c891e981
SHA512 ba4704d194f0289c8919a055b20a5996ad2e25fd2b8c351adf8e98f439b84ea1441ceb97e985b906d06c6e9168108f7a3b7714c8d30d93bad592b0963084fea7
SSDEEP 192:xdv7x0KDWpHhXZCVzV07VrZ1/eGDH0JOqsmVgz28WhBq/pCd:jtvDGGVpOGGoJN77hhmpy
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/System.Globalization.4.3.0.nupkg

SHA256 71a2f4a51985484b1aa1e65e58de414d0b46ac0b5a40fc058bc60e64f646e6b2
MD5 7e1b96ab5b08df8cbf0789685dd3c120
SHA1 f342e309f3b94883461763309cbbfb3806401658
SHA512 823d2ba308cb073b40a3146ecccd0d9fd7b1615ac3fbefb16f73d873e411fd81c3bdc87df206d3dc7e2f14c9cd53aafca684a3570c25471280aada8de805ece2
SSDEEP 12288:iQwMx0Tzj5mhxpvTgwRM3T0j1mhxwvbwUDcTJjmmhxRvf:iQb+TYhUsITlObJITPJf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netcore50/System.Globalization.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2c25296c91a213ea23f9289b0f7aa05b229385d3480ae0e266ee12d83a10fd0a
MD5 c481520a478dc704f80f25fd3894b563
SHA1 879325a6b71bbdea6f2d2f9d85311559653b4f11
SHA512 47e7a79a08a83cd31260caf584beec49f570b6d85366ac18dcc237233f45237cbebb3011ac67ec2048f14180dbaba3d10ce865791d750265f826a55aa27abefd
SSDEEP 768:9ES5yOvBynA6fJX00eJuNqiii2EBBcViTF:9ES5yOvBynAgJX0MqvEBsAF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

8f:77:bd:ee:03:03:bd:59:76:0a:83:a1:ad:04:95:5b:a1:b4:01:05:55:b3:3c:a5:74:7f:f5:f2:29:e9:f5:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d6:95:54:f8:9a:54:fd:0a:c5:5c:0b:4c:79:76:88:96:90:f6:78:3a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

24402

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Globalization\4.0.10.0\System.Globalization.pdb

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netcore50/System.Globalization.xml

SHA256 e8f2d2e1c77a852325122f479ed000813d7a56cd14197574bf362baea9bd947c
MD5 4fe886b0090c10438c5bb543f6c5d2dc
SHA1 71564073dcf48c24a740273807d9ffa2e8a561c1
SHA512 ae35cc147917b76448c0c0c132a3bd3132ed85f0bda41114769ac7004a95d6950f32965a526da8c8d26f51f493f7e3998be323b15d653a472620804079f68fcf
SSDEEP 1536:Q9ZeLg0gLe2OBAav2SgA+K5rftvi5TMtRa0Uq0bNO/M2QyyCNYSP+qOC3ekmC7qX:7Lg0gLtwZj4Df
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netcore50/de/System.Globalization.xml

SHA256 a30626d7ff25dc1458ca72183d39deac82860223df17779d7cb102a77856dd72
MD5 1ac187d1c24e59af866837ee8239a79c
SHA1 22ae3ada9772bb1e27c457e068dcfaaa8bcb662e
SHA512 42887aaee57da07e8b05712361d44179835df9841e32657a9f8bd41de319023fa0b68e0510df9ac1412324183c1e26f8f4948f292c1218c215b4f07642a2b368
SSDEEP 6144:fWWdUWdSmWdkWdymFnMEZfOIh+mMPkBiUZuMuW/e4FZ/yryeSszrl:ezjmBTmFnMEZfOIh+mMPkBiUZuMuW24M
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netcore50/es/System.Globalization.xml

SHA256 f7bbbd4e66dd3930316e937c93f11caf104fec096c17efc023fb60e8b9f21e5f
MD5 b6f6ade3994d858aca7618775aaf40d2
SHA1 5da83bd1fcfacf7d6e6c501b9b3648d3f86135af
SHA512 2aaea701feaad695a620433f715e524e0224c49c7fb778b05011ccd8b601fc16524b6b8aa478fdcba424b26701ca27fae02f3d3f14fc5a50e59dd860a1aa16b7
SSDEEP 1536:oMH/tPqyT14m0ocUoK+2kQ6i8SFdiN+6r6DpZd+dIwu9zafSMMGebaIv7PhyTVhK:/2SLvj3ODcOfR0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netcore50/fr/System.Globalization.xml

SHA256 2d9bbdd8a0a3e65346bf9532be23c39b3aeb25674a296450a8061a05872b48f6
MD5 8cc404253cdc98e9450b027f6ec590a8
SHA1 e5639262d8908200a8a58f89c456256b1633a29d
SHA512 2ba97c9c64b04e26b2bc8268ce94a87d44c90ed5e6d36c9e055afe5d124da4a303f45a7c5ff03ca109a439687d3d457df752dfb09c8bd8d22957c28798fdb350
SSDEEP 768:YkGj/fKyMtC+WjbdBDERc+76F9h2zMz5p6NpWQHw7Yn90uQ:+j/fKyMtCT8c+mF9hyMz5p6N47490uQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netcore50/it/System.Globalization.xml

SHA256 13fa53fe9da3b59a4378d58ac75c137e66c8f33e65daa736ab7ef1893d78b96c
MD5 068098a1d63acbe85d0e08f228ba79be
SHA1 2d7048ea9d7360fa92362fc7237c1b53518e79d6
SHA512 891e66bc222913508f58d9ad86365c039fdaaea32e65b9fea815f7f5b79a976b96fb7071c68295f7def1357ed4e17ec8f7b179e91d67eba547446934be4b2bd6
SSDEEP 3072:uNrbnqNiGUf2+ofoHH5RvEGCfOoRpCGSRo6do63KoJoHeXROo62HRsuo62HRsThQ:uNrbnqNiGUf2+ofoHH5RvEGCfOoRpCGF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netcore50/ja/System.Globalization.xml

SHA256 7f14e28ba9329e5c1dd82bbd431fb780346065cbbad270af9d7bf2bbfa57278d
MD5 e810f4e9e6028b4c432b41c05ebad6c2
SHA1 a848e00d99308336c0066b30972be0d8acb0ff5a
SHA512 2009ee3e2acff151797ef5cb3f751d7b60403b3d10e1f45f133000b89b7c86885568b4a0e2baead3636b3db45652be49b16db4f07448802d34132a876c961df8
SSDEEP 768:YuHiZDisfl3XMFLsjEpbabBI13/EYbDP81l1WagN2pD3vdKOS52LjM2HAZo526i:TDI1LpD3AOSwMzZK26i
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netcore50/ko/System.Globalization.xml

SHA256 17be09b8ace4e5ec1665a5c137655764b5296f6fec1cf70ae31cc1dd2150dbdb
MD5 4282b9f0103629108714f370b6e1222f
SHA1 632d95186fa7f021a9bce7f24c8d26c43e30c0a8
SHA512 596f4df00d2e8f2e0061f5a452a8626cd1dd01c4376486e92f5304ff7f33aa6e10be95c51365c50a5139a0fa73954c17229e48b3408a6ca8973c36532172926f
SSDEEP 1536:CVlEy/8y7jPgI/dICUfAVImmIzkIUZIFxGIxCkIG7rAr6lilnS5gl0MnSQ0c/xl/:HoXVcv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netcore50/ru/System.Globalization.xml

SHA256 9d255f34020572fc0bd2b9f67b1395f93f11c9ae11328a9407b89e3f0868ff3d
MD5 efc817df6de191d88301ecea957ac825
SHA1 846bcd342893de6facdd183691782f4185272313
SHA512 2444e49c53c96335fd55cf80d51955fd42934a08020760d7c59bed44bf170c28608e87b17962415d7e65dd666df93c623e687743875b42515b07cd6be3c1d7e1
SSDEEP 6144:OPQjLPQjN2Jqr7y2bqr7U22q72EqwKmKbc00lesTxL2sC05FH:OPQjLPQjN2Jqr7y2bqr7U22q72EqwKmZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netcore50/zh-hans/System.Globalization.xml

SHA256 fb86466914ade9d77fd2d44f49e041932801db324d4117c635c449fde13c6c23
MD5 f3c1491ef616a2a563eb83e08f2092cf
SHA1 6ddb09a5f1c13acd2a2242c4492fdab14eea959b
SHA512 95f30ab43381ba19b70e2c03b2083a632506e50418650f40f7be45bd22fcde87800a4dfafef1353c36215b89ae907b929050a6f441d4179297bd761dba534dfd
SSDEEP 1536:9A5DEfHfyjHkx3p3hk1jyd59Rb0na3yH22jn17+7D6zjHkqi1GMSkV2P3h1i1tA4:1fHfFx3K22jnI7D6H128B4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netcore50/zh-hant/System.Globalization.xml

SHA256 d709c8407e412ae7f3bca4b51ae38bbc3f5ec99b59feed7735f33dd2fde18825
MD5 11da607afc3c07782540e8fe719153c7
SHA1 ec06d8b60b81eb33ab84abd5bf63f4525737aefe
SHA512 1d2bb802bc660054535fb686cbf81c8063e5585d3a8694e80ebd4ae3a771afd5c8372f582f418ed55e3ee472d3921b31c4b6aa4a9910bd86842a7f970750a082
SSDEEP 1536:aQkbCXeuQKQEutqRzuYxJEkufMo0tL968nlM8ZIq+3hIWgt:fv0+RpZIq+3hA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.0/System.Globalization.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7b3b9be7dd90419503113acb3cb797f77c24faba3f9bdf4fe91d57dd616d6d39
MD5 849f648b4f96278669f6410f8c159f94
SHA1 fc66f3384835722177dc523e100574bd06c45725
SHA512 6d861de4896cf6ce40aef607b7af32908dbefd64b18ebfcac7344f5e09b671b607a33b5a01d70eb5e2afa14aeb4ecea152b235c59aa304e07f09cef878f7ee94
SSDEEP 384:znnsAcN2vBvla2F9jQC5Kzdo+viPtChAbYmbPqQ/3Cjuy8u92YCT0FRRWHRgRJ0c:zns9BQQziVy92YfDMyJuMWi5SrDJ+6w
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

86:6d:ba:60:8a:40:37:69:64:5d:cd:c4:92:89:59:86:02:ef:ad:0d:d5:fe:d6:5a:2c:a6:5a:99:74:61:be:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

77:6f:30:e6:e3:33:46:12:86:4e:43:06:eb:2b:c8:01:7f:14:d2:25

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

26430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.0/System.Globalization.xml

SHA256 e8f2d2e1c77a852325122f479ed000813d7a56cd14197574bf362baea9bd947c
MD5 4fe886b0090c10438c5bb543f6c5d2dc
SHA1 71564073dcf48c24a740273807d9ffa2e8a561c1
SHA512 ae35cc147917b76448c0c0c132a3bd3132ed85f0bda41114769ac7004a95d6950f32965a526da8c8d26f51f493f7e3998be323b15d653a472620804079f68fcf
SSDEEP 1536:Q9ZeLg0gLe2OBAav2SgA+K5rftvi5TMtRa0Uq0bNO/M2QyyCNYSP+qOC3ekmC7qX:7Lg0gLtwZj4Df
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.0/de/System.Globalization.xml

SHA256 a30626d7ff25dc1458ca72183d39deac82860223df17779d7cb102a77856dd72
MD5 1ac187d1c24e59af866837ee8239a79c
SHA1 22ae3ada9772bb1e27c457e068dcfaaa8bcb662e
SHA512 42887aaee57da07e8b05712361d44179835df9841e32657a9f8bd41de319023fa0b68e0510df9ac1412324183c1e26f8f4948f292c1218c215b4f07642a2b368
SSDEEP 6144:fWWdUWdSmWdkWdymFnMEZfOIh+mMPkBiUZuMuW/e4FZ/yryeSszrl:ezjmBTmFnMEZfOIh+mMPkBiUZuMuW24M
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.0/es/System.Globalization.xml

SHA256 f7bbbd4e66dd3930316e937c93f11caf104fec096c17efc023fb60e8b9f21e5f
MD5 b6f6ade3994d858aca7618775aaf40d2
SHA1 5da83bd1fcfacf7d6e6c501b9b3648d3f86135af
SHA512 2aaea701feaad695a620433f715e524e0224c49c7fb778b05011ccd8b601fc16524b6b8aa478fdcba424b26701ca27fae02f3d3f14fc5a50e59dd860a1aa16b7
SSDEEP 1536:oMH/tPqyT14m0ocUoK+2kQ6i8SFdiN+6r6DpZd+dIwu9zafSMMGebaIv7PhyTVhK:/2SLvj3ODcOfR0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.0/fr/System.Globalization.xml

SHA256 2d9bbdd8a0a3e65346bf9532be23c39b3aeb25674a296450a8061a05872b48f6
MD5 8cc404253cdc98e9450b027f6ec590a8
SHA1 e5639262d8908200a8a58f89c456256b1633a29d
SHA512 2ba97c9c64b04e26b2bc8268ce94a87d44c90ed5e6d36c9e055afe5d124da4a303f45a7c5ff03ca109a439687d3d457df752dfb09c8bd8d22957c28798fdb350
SSDEEP 768:YkGj/fKyMtC+WjbdBDERc+76F9h2zMz5p6NpWQHw7Yn90uQ:+j/fKyMtCT8c+mF9hyMz5p6N47490uQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.0/it/System.Globalization.xml

SHA256 13fa53fe9da3b59a4378d58ac75c137e66c8f33e65daa736ab7ef1893d78b96c
MD5 068098a1d63acbe85d0e08f228ba79be
SHA1 2d7048ea9d7360fa92362fc7237c1b53518e79d6
SHA512 891e66bc222913508f58d9ad86365c039fdaaea32e65b9fea815f7f5b79a976b96fb7071c68295f7def1357ed4e17ec8f7b179e91d67eba547446934be4b2bd6
SSDEEP 3072:uNrbnqNiGUf2+ofoHH5RvEGCfOoRpCGSRo6do63KoJoHeXROo62HRsuo62HRsThQ:uNrbnqNiGUf2+ofoHH5RvEGCfOoRpCGF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.0/ja/System.Globalization.xml

SHA256 7f14e28ba9329e5c1dd82bbd431fb780346065cbbad270af9d7bf2bbfa57278d
MD5 e810f4e9e6028b4c432b41c05ebad6c2
SHA1 a848e00d99308336c0066b30972be0d8acb0ff5a
SHA512 2009ee3e2acff151797ef5cb3f751d7b60403b3d10e1f45f133000b89b7c86885568b4a0e2baead3636b3db45652be49b16db4f07448802d34132a876c961df8
SSDEEP 768:YuHiZDisfl3XMFLsjEpbabBI13/EYbDP81l1WagN2pD3vdKOS52LjM2HAZo526i:TDI1LpD3AOSwMzZK26i
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.0/ko/System.Globalization.xml

SHA256 17be09b8ace4e5ec1665a5c137655764b5296f6fec1cf70ae31cc1dd2150dbdb
MD5 4282b9f0103629108714f370b6e1222f
SHA1 632d95186fa7f021a9bce7f24c8d26c43e30c0a8
SHA512 596f4df00d2e8f2e0061f5a452a8626cd1dd01c4376486e92f5304ff7f33aa6e10be95c51365c50a5139a0fa73954c17229e48b3408a6ca8973c36532172926f
SSDEEP 1536:CVlEy/8y7jPgI/dICUfAVImmIzkIUZIFxGIxCkIG7rAr6lilnS5gl0MnSQ0c/xl/:HoXVcv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.0/ru/System.Globalization.xml

SHA256 9d255f34020572fc0bd2b9f67b1395f93f11c9ae11328a9407b89e3f0868ff3d
MD5 efc817df6de191d88301ecea957ac825
SHA1 846bcd342893de6facdd183691782f4185272313
SHA512 2444e49c53c96335fd55cf80d51955fd42934a08020760d7c59bed44bf170c28608e87b17962415d7e65dd666df93c623e687743875b42515b07cd6be3c1d7e1
SSDEEP 6144:OPQjLPQjN2Jqr7y2bqr7U22q72EqwKmKbc00lesTxL2sC05FH:OPQjLPQjN2Jqr7y2bqr7U22q72EqwKmZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.0/zh-hans/System.Globalization.xml

SHA256 fb86466914ade9d77fd2d44f49e041932801db324d4117c635c449fde13c6c23
MD5 f3c1491ef616a2a563eb83e08f2092cf
SHA1 6ddb09a5f1c13acd2a2242c4492fdab14eea959b
SHA512 95f30ab43381ba19b70e2c03b2083a632506e50418650f40f7be45bd22fcde87800a4dfafef1353c36215b89ae907b929050a6f441d4179297bd761dba534dfd
SSDEEP 1536:9A5DEfHfyjHkx3p3hk1jyd59Rb0na3yH22jn17+7D6zjHkqi1GMSkV2P3h1i1tA4:1fHfFx3K22jnI7D6H128B4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.0/zh-hant/System.Globalization.xml

SHA256 d709c8407e412ae7f3bca4b51ae38bbc3f5ec99b59feed7735f33dd2fde18825
MD5 11da607afc3c07782540e8fe719153c7
SHA1 ec06d8b60b81eb33ab84abd5bf63f4525737aefe
SHA512 1d2bb802bc660054535fb686cbf81c8063e5585d3a8694e80ebd4ae3a771afd5c8372f582f418ed55e3ee472d3921b31c4b6aa4a9910bd86842a7f970750a082
SSDEEP 1536:aQkbCXeuQKQEutqRzuYxJEkufMo0tL968nlM8ZIq+3hIWgt:fv0+RpZIq+3hA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.3/System.Globalization.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2c25296c91a213ea23f9289b0f7aa05b229385d3480ae0e266ee12d83a10fd0a
MD5 c481520a478dc704f80f25fd3894b563
SHA1 879325a6b71bbdea6f2d2f9d85311559653b4f11
SHA512 47e7a79a08a83cd31260caf584beec49f570b6d85366ac18dcc237233f45237cbebb3011ac67ec2048f14180dbaba3d10ce865791d750265f826a55aa27abefd
SSDEEP 768:9ES5yOvBynA6fJX00eJuNqiii2EBBcViTF:9ES5yOvBynAgJX0MqvEBsAF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

8f:77:bd:ee:03:03:bd:59:76:0a:83:a1:ad:04:95:5b:a1:b4:01:05:55:b3:3c:a5:74:7f:f5:f2:29:e9:f5:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d6:95:54:f8:9a:54:fd:0a:c5:5c:0b:4c:79:76:88:96:90:f6:78:3a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

24402

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Globalization\4.0.10.0\System.Globalization.pdb

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.3/System.Globalization.xml

SHA256 e8f2d2e1c77a852325122f479ed000813d7a56cd14197574bf362baea9bd947c
MD5 4fe886b0090c10438c5bb543f6c5d2dc
SHA1 71564073dcf48c24a740273807d9ffa2e8a561c1
SHA512 ae35cc147917b76448c0c0c132a3bd3132ed85f0bda41114769ac7004a95d6950f32965a526da8c8d26f51f493f7e3998be323b15d653a472620804079f68fcf
SSDEEP 1536:Q9ZeLg0gLe2OBAav2SgA+K5rftvi5TMtRa0Uq0bNO/M2QyyCNYSP+qOC3ekmC7qX:7Lg0gLtwZj4Df
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.3/de/System.Globalization.xml

SHA256 a30626d7ff25dc1458ca72183d39deac82860223df17779d7cb102a77856dd72
MD5 1ac187d1c24e59af866837ee8239a79c
SHA1 22ae3ada9772bb1e27c457e068dcfaaa8bcb662e
SHA512 42887aaee57da07e8b05712361d44179835df9841e32657a9f8bd41de319023fa0b68e0510df9ac1412324183c1e26f8f4948f292c1218c215b4f07642a2b368
SSDEEP 6144:fWWdUWdSmWdkWdymFnMEZfOIh+mMPkBiUZuMuW/e4FZ/yryeSszrl:ezjmBTmFnMEZfOIh+mMPkBiUZuMuW24M
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.3/es/System.Globalization.xml

SHA256 f7bbbd4e66dd3930316e937c93f11caf104fec096c17efc023fb60e8b9f21e5f
MD5 b6f6ade3994d858aca7618775aaf40d2
SHA1 5da83bd1fcfacf7d6e6c501b9b3648d3f86135af
SHA512 2aaea701feaad695a620433f715e524e0224c49c7fb778b05011ccd8b601fc16524b6b8aa478fdcba424b26701ca27fae02f3d3f14fc5a50e59dd860a1aa16b7
SSDEEP 1536:oMH/tPqyT14m0ocUoK+2kQ6i8SFdiN+6r6DpZd+dIwu9zafSMMGebaIv7PhyTVhK:/2SLvj3ODcOfR0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.3/fr/System.Globalization.xml

SHA256 2d9bbdd8a0a3e65346bf9532be23c39b3aeb25674a296450a8061a05872b48f6
MD5 8cc404253cdc98e9450b027f6ec590a8
SHA1 e5639262d8908200a8a58f89c456256b1633a29d
SHA512 2ba97c9c64b04e26b2bc8268ce94a87d44c90ed5e6d36c9e055afe5d124da4a303f45a7c5ff03ca109a439687d3d457df752dfb09c8bd8d22957c28798fdb350
SSDEEP 768:YkGj/fKyMtC+WjbdBDERc+76F9h2zMz5p6NpWQHw7Yn90uQ:+j/fKyMtCT8c+mF9hyMz5p6N47490uQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.3/it/System.Globalization.xml

SHA256 13fa53fe9da3b59a4378d58ac75c137e66c8f33e65daa736ab7ef1893d78b96c
MD5 068098a1d63acbe85d0e08f228ba79be
SHA1 2d7048ea9d7360fa92362fc7237c1b53518e79d6
SHA512 891e66bc222913508f58d9ad86365c039fdaaea32e65b9fea815f7f5b79a976b96fb7071c68295f7def1357ed4e17ec8f7b179e91d67eba547446934be4b2bd6
SSDEEP 3072:uNrbnqNiGUf2+ofoHH5RvEGCfOoRpCGSRo6do63KoJoHeXROo62HRsuo62HRsThQ:uNrbnqNiGUf2+ofoHH5RvEGCfOoRpCGF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.3/ja/System.Globalization.xml

SHA256 7f14e28ba9329e5c1dd82bbd431fb780346065cbbad270af9d7bf2bbfa57278d
MD5 e810f4e9e6028b4c432b41c05ebad6c2
SHA1 a848e00d99308336c0066b30972be0d8acb0ff5a
SHA512 2009ee3e2acff151797ef5cb3f751d7b60403b3d10e1f45f133000b89b7c86885568b4a0e2baead3636b3db45652be49b16db4f07448802d34132a876c961df8
SSDEEP 768:YuHiZDisfl3XMFLsjEpbabBI13/EYbDP81l1WagN2pD3vdKOS52LjM2HAZo526i:TDI1LpD3AOSwMzZK26i
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.3/ko/System.Globalization.xml

SHA256 17be09b8ace4e5ec1665a5c137655764b5296f6fec1cf70ae31cc1dd2150dbdb
MD5 4282b9f0103629108714f370b6e1222f
SHA1 632d95186fa7f021a9bce7f24c8d26c43e30c0a8
SHA512 596f4df00d2e8f2e0061f5a452a8626cd1dd01c4376486e92f5304ff7f33aa6e10be95c51365c50a5139a0fa73954c17229e48b3408a6ca8973c36532172926f
SSDEEP 1536:CVlEy/8y7jPgI/dICUfAVImmIzkIUZIFxGIxCkIG7rAr6lilnS5gl0MnSQ0c/xl/:HoXVcv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.3/ru/System.Globalization.xml

SHA256 9d255f34020572fc0bd2b9f67b1395f93f11c9ae11328a9407b89e3f0868ff3d
MD5 efc817df6de191d88301ecea957ac825
SHA1 846bcd342893de6facdd183691782f4185272313
SHA512 2444e49c53c96335fd55cf80d51955fd42934a08020760d7c59bed44bf170c28608e87b17962415d7e65dd666df93c623e687743875b42515b07cd6be3c1d7e1
SSDEEP 6144:OPQjLPQjN2Jqr7y2bqr7U22q72EqwKmKbc00lesTxL2sC05FH:OPQjLPQjN2Jqr7y2bqr7U22q72EqwKmZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.3/zh-hans/System.Globalization.xml

SHA256 fb86466914ade9d77fd2d44f49e041932801db324d4117c635c449fde13c6c23
MD5 f3c1491ef616a2a563eb83e08f2092cf
SHA1 6ddb09a5f1c13acd2a2242c4492fdab14eea959b
SHA512 95f30ab43381ba19b70e2c03b2083a632506e50418650f40f7be45bd22fcde87800a4dfafef1353c36215b89ae907b929050a6f441d4179297bd761dba534dfd
SSDEEP 1536:9A5DEfHfyjHkx3p3hk1jyd59Rb0na3yH22jn17+7D6zjHkqi1GMSkV2P3h1i1tA4:1fHfFx3K22jnI7D6H128B4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.4.3.0/ref/netstandard1.3/zh-hant/System.Globalization.xml

SHA256 d709c8407e412ae7f3bca4b51ae38bbc3f5ec99b59feed7735f33dd2fde18825
MD5 11da607afc3c07782540e8fe719153c7
SHA1 ec06d8b60b81eb33ab84abd5bf63f4525737aefe
SHA512 1d2bb802bc660054535fb686cbf81c8063e5585d3a8694e80ebd4ae3a771afd5c8372f582f418ed55e3ee472d3921b31c4b6aa4a9910bd86842a7f970750a082
SSDEEP 1536:aQkbCXeuQKQEutqRzuYxJEkufMo0tL968nlM8ZIq+3hIWgt:fv0+RpZIq+3hA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/.signature.p7s

SHA256 4964b1bc8d1c16a8753c373dd2ad4f462a9aaa59aa86c5234c4e607951d45ef6
MD5 2523ffef00b33111efb8ff020cf82ce8
SHA1 60c3e94674f38a5649480672c40c60cbd9e94e1a
SHA512 55b08780041ebc0f0d0c9437ee624390b3e9edecf468af8e1bcb9365690e37e5a8661300fddd036edd3c3740e2696da3007eec0e07c46bf8e1fda28bd835808a
SSDEEP 192:xda7x0KDWpHhXZCVzV07VrS39DH0JOqNG8Fp28Wh8nP5f:jAvDGGVpJ9oJNNzFwhhiPV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/System.Globalization.Calendars.4.3.0.nupkg

SHA256 b8d383d043951609d2d9f30abcc884b48f5a3b0d34f8f7f2fc7faab9c01094f7
MD5 a434a47f236cc5e2fb79f7717a94f791
SHA1 791424878c510777fcabd622e1bb4ad0618393b7
SHA512 e97190231402b393774b925efc02a2bfa41d1d117a17fb87da6e399f5234546962767e9cd8f39970efa408e4f453cd1e6751a2a61e366bc97406e1b0b8a4be86
SSDEEP 3072:ax6AknTQVqce4FnTQVqce4t6Ofy18ZTnb4/yQHDOaVkA6rUDwgUow2bzXwnY57zK:aUvTyqqFTyqqnfi8ZnU4GDwNsC9
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/lib/net46/System.Globalization.Calendars.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8e5a549c6c0339a5f88217e6b5b75b745a3c20fe97081b48062b684c4fa5d441
MD5 11702033de781f5fb80aff3570db0a7b
SHA1 30ae8c8e57bcabe27ba675fa84d4da6af3c10ead
SHA512 20882a6634c4cbb93502379c43aafabc999c6280f59a63d4776ba2914d879cf182f00325f62cf4a720f0459ea9b0b23f4b64d4359c5f15af10a63ea1ee8a742c
SSDEEP 384:Id3ovRqXWDRqSRqj0RqFW5RqXWtRq6Rqq0RqFWB3rq0GftpBjZRqkPERHRN7cRqw:M3AqKqAqjuqOqAqoqquqGiBqkPEBWq8b
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

e6:9e:d1:10:b9:35:2b:63:4c:87:32:19:7d:68:b6:37:10:cc:39:cc:96:c0:71:c7:f3:bc:14:e8:06:87:80:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d2:e7:09:8a:bc:02:e1:17:9a:c7:65:7c:e7:f6:4c:19:f0:fe:aa:3d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10802

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Globalization.Calendars/net46\System.Globalization.Calendars.pdb

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/net46/System.Globalization.Calendars.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8e5a549c6c0339a5f88217e6b5b75b745a3c20fe97081b48062b684c4fa5d441
MD5 11702033de781f5fb80aff3570db0a7b
SHA1 30ae8c8e57bcabe27ba675fa84d4da6af3c10ead
SHA512 20882a6634c4cbb93502379c43aafabc999c6280f59a63d4776ba2914d879cf182f00325f62cf4a720f0459ea9b0b23f4b64d4359c5f15af10a63ea1ee8a742c
SSDEEP 384:Id3ovRqXWDRqSRqj0RqFW5RqXWtRq6Rqq0RqFWB3rq0GftpBjZRqkPERHRN7cRqw:M3AqKqAqjuqOqAqoqquqGiBqkPEBWq8b
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

e6:9e:d1:10:b9:35:2b:63:4c:87:32:19:7d:68:b6:37:10:cc:39:cc:96:c0:71:c7:f3:bc:14:e8:06:87:80:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d2:e7:09:8a:bc:02:e1:17:9a:c7:65:7c:e7:f6:4c:19:f0:fe:aa:3d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10802

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Globalization.Calendars/net46\System.Globalization.Calendars.pdb

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/netstandard1.3/System.Globalization.Calendars.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 010ef610317badcdfb11ccc20279fd5afa4cab12f2ee632444fdccb539e04ebd
MD5 889c639527890caf2dcbc0ec83ba2ae7
SHA1 9e9d15dd4e4900e1c84385e573152f2c0ec3303e
SHA512 60022bd84508733da706325ca3f49cdb5a4aaccda9d75d9817a7370916a6c81246c8be0ac3ea1e81c83ff279994e2e4594bbefefa774735e71159fa15dfc9b8b
SSDEEP 384:6gyrOej+nU93LERqXWDRqqRqj0RqFWGyAA0GftpBjJRqPoERHRN7sRqilraGT1B:mrOejv3KqKqYqjuqFiRqPoEBmqQb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

15:a8:13:5e:e5:2e:13:22:4c:69:22:29:d7:19:28:fe:3a:b8:13:37:20:97:3c:bd:19:1d:32:b7:8d:62:07:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

f2:8b:1b:f9:1c:ba:1a:9c:3f:73:85:d8:26:1c:c8:85:a3:b2:e8:76

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

20910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Globalization.Calendars\4.0.1.0\System.Globalization.Calendars.pdb

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/netstandard1.3/System.Globalization.Calendars.xml

SHA256 6db417fe8326f08ca04ad3653d517a06f238dd01d1686033c83756753b53f93c
MD5 809d39fbe911ff5999ce848ee2149149
SHA1 652f0d9927c826d882eedef1d83e4f9c6640f8b4
SHA512 358c09141e9d7506163d753543908688c258459b7f29215cb2e07205fc941378ae3ab6646120a78b470f5ab22455154bddc28d0b700c0df2ee09bccd26471ad1
SSDEEP 384:YRjzoLiYhwPhgGFLDqwCZlsGvlz2cT7tJUb85MwwtdAC4xtGookDsJ89GUs7ZChN:YzF0fGt40/3Xl5aBPEukZIuVBaTue
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/netstandard1.3/de/System.Globalization.Calendars.xml

SHA256 397610a391a9a93ea6004d9628a4206622df6a16b796c6417d1e82920ce1ca1d
MD5 6ba43eb9570a44eb81e3110f8cfa66a8
SHA1 1b21be4270463978281bb887b7758ad7c9716f50
SHA512 792452238252086a2489839c6647bdab8a326f392ea90c1c3fdad0aa81b82935e32a7b630ba2ce38123570d08acad4def391176a230f6bf5047bdc728c856da5
SSDEEP 768:YfFIRejXuDFIgturGjmHFumspnU3kSue7uGBgKk9ue51PWHIH+uwFyZuJPQ0H5u+:rXMxsZGGW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/netstandard1.3/es/System.Globalization.Calendars.xml

SHA256 977b3f9043f52df41908da97ae375416b2089488b6e9928bc7b1c375e0a701df
MD5 20b16681e65e19d2c4d89982d04217d0
SHA1 dc34e00c050fe335749fed9cefc8310286565b76
SHA512 70e22aa827388388b13a5e93bef11b30d3b18dc66a066d0c72276d7b18cd42a36dddbca48cc2dc6ae996bb15650eda13aa846fbdb2831c4e29dfaef5c4f9b3a3
SSDEEP 1536:eUd6bieed5eB43mhTBp/eL3kgrAe3djeFdKemddOUhrLeIdQefdRqSRVkra0:S43m8rqj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/netstandard1.3/fr/System.Globalization.Calendars.xml

SHA256 207cb84134f5e885dd4df90a744703dddf6d4d5e4f5c5259adf6d37c4d570bfc
MD5 c689633add66179641b58bc442b6d136
SHA1 01ed6214c6e99f15cebd334cba5b26765c32694b
SHA512 5a48081ebdb5b11dd14e2e09ab133009b5c8be666d72f1488b246c3aa2d5afbc89012df81b00e59846bd4df786d2f1a23fedf6025fd4e17b8235b1072a7a2dd1
SSDEEP 3072:B8rIBT30tL+Wgx/LCiylwcj4kqLRJ0kdh1NqELQwRHeLGneNBgdYrvYDwJH4LSlP:6j
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/netstandard1.3/it/System.Globalization.Calendars.xml

SHA256 3d59ea6c4f1f976c61db17ff8b548228afe09b8af1dcf9d5f9fda4a43762ec1a
MD5 6472b46d7e2349f60e5a8cb93bae86eb
SHA1 f1c01de5a88164de2f9c1122eca9dc7a723b1a4e
SHA512 ada3e25e3371d7c1144d19cf48f916ae270a329c944673aff7cc16d24a967f43b440a946c849e17e2fa8c241ccd9004972a3531dbac4be4f21234b0f90dace65
SSDEEP 6144:rTh7fmgRuHgREJt7RKt+tn3gtHgRLtnNYaJTk0h3pmabhH+RdCWRWuhI39hH5RZU:v
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/netstandard1.3/ja/System.Globalization.Calendars.xml

SHA256 173ff3be6ff7a96671426f891c11f364c9f0df300f7f73fe2d46faa62ae9fba3
MD5 37a802e1c3d8657aeb32cc337c90ff7f
SHA1 ab767c77debec18bf65eda7f13cc752bf57ecdbf
SHA512 710a08d6367edb0ede4abe52d23c5f1fad4852a7f9337bcfd68ea5372fb4745a0b8edb0978f4af25d860fcd6b34e28a07311824eda66f945dac83e88ec995dbc
SSDEEP 384:YT/OZp+Cs+7d7yEwJWHMYZwSINSqSESIqSpSTSILSDxqBhDUj/jh0fWAgjo2WA3G:YT/OUbR41Wkx3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/netstandard1.3/ko/System.Globalization.Calendars.xml

SHA256 c0f8f6983232595139d5ec53270911b1fa33def4c7f1bf061ca523c8615ba5f5
MD5 ec0d12e42cd4c2dbd309653e8486f220
SHA1 3e7a1205e2b702960e82ccb656ed41075a166ded
SHA512 bfbcc8457ad1a3ad60cc72857797e8e299152dfca0ddccbc28543b07946cfdf00838c658c91290a15db74383229969eac7a73beec414bce91e422c2bf50aab67
SSDEEP 3072:1xWD1troWi4w3TK8P7HdOEWvd2cgr7s6X79fmCE:2
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/netstandard1.3/ru/System.Globalization.Calendars.xml

SHA256 31b154e5e51261de9da67e0bb42e2f402d4a0acd6b3eafe4ff08d4f87cc24cc6
MD5 d3a9e6b0116906eed63ab846c8900e8e
SHA1 22a9938d42c586028f8d818414131844f45a284b
SHA512 d71c7dca8359b369491eb76cbbdbcbc6cfefa09908a5a4c43299f8381135d559ca33771bcd1786f20c26c734414eec82132cd5f1372d7dbb579de6f6c2856474
SSDEEP 6144:fL5X/HTDIBCNk9PQjC2J7ihU5J1iYcPQjSf2sPQjnBePQjOZ8PQj5icoX+X3t85W:fL5X/HTDIBCNk9PQjC2J7ihU5J1iYcPr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/netstandard1.3/zh-hans/System.Globalization.Calendars.xml

SHA256 f0f31056b65b35e7a0c69d1f5bcbbd9ab29c95d3ee9d86c6af10fa259544ab45
MD5 980547df326682b21bab5b5aea33362e
SHA1 6e10f9f0b2737d82d28c9597b50c67334ac5450f
SHA512 8050e451c07dbc4075683778458ad858941ea330a1bea2f06367e0ae08b42b8d609187ebdd17483b7b053e65ebd06bee5d60589a8137c6d666ef4e2941d9b986
SSDEEP 1536:mcsdbaYPiZV14MdWxlGUpkeLyrEgeQU5716d:Ki
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Globalization.Calendars.4.3.0/ref/netstandard1.3/zh-hant/System.Globalization.Calendars.xml

SHA256 e40488211a1a832e06735e25813a0881eaf6a564747900c48371c7caef02d483
MD5 bdd6d5c377813d12e2de526afbafb9eb
SHA1 15500b29bc1b30c8f72842e1aeac309395cbefe9
SHA512 caa95327964b4687b3baf591d46d417fff38aebe5c30c8000abf55e74c9ef434c311f32640a366463504d1c1ef4c6f11cec557f0042a8a942ac87fd99bacf8bf
SSDEEP 1536:bE065XWV5pP9VgPkgIk6TKqkZ5hIo5QLa:bxiWx2NR0O
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/.signature.p7s

SHA256 492ee011959d4d9bee18197e0b76149522a271f2b91fe0f4f1085266790887c6
MD5 74320b13f2dd9e37e27e470c19f5e8f0
SHA1 e8205d79bf488d7f16efc1d674c9169efb986d18
SHA512 4e6f9e2ce89da0f1b462d2a05d15c6dd5a5452a401d3fc6b051d11a1469682b05c4e357812200b2aafb0e1c0142077368891b5520f9fd7ab4b601b474b0f58d1
SSDEEP 192:xdR47x0KDWpHhXZCVzV07VrCZDGDH0JOqsmVgz28WhBq8/:jRqvDGGVp3VGoJN77hhx/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/System.IO.4.3.0.nupkg

SHA256 aeeca74077a414fe703eb0e257284d891217799fc8f4da632b9a54f873c38916
MD5 220e68d1dc5cd51115822b954497134c
SHA1 f3b3cc1776d7bdb82c9fb99ea9e93506a191f230
SHA512 bfca5a21e3e1986b9765b13dc6fbcd6f8b89e4c1383855d1d7ef256bf1bf2f51889769db5365859dd7606fbf6454add4daeb3bab56994ffb98fd1d03fe8bc1e6
SSDEEP 12288:DEnsJqjwckfwmU3dXQqjZRxfZmlQ8xqj4Waf0mNd1uvHqj+MMf2mtx:DD/ccwZdAgRlZ4lZWe0YUjM02wx
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.IO.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/lib/net462/System.IO.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 965bb6510f6871c984a940b68ed24c6145e326e22e6fa66104d0a3bfccf9feea
MD5 ca7871ad7a6c6823a1048fab29a25f19
SHA1 ba5f2caa404ae9a283a841c08b024baf8817ba01
SHA512 7008f30b89897190e91b0189a871da5d4c5523028ee48971d1adec731e55642c92c531c6c1df534167f176f9d252981bc0498b686aeff6e1ba82cb1998cdac7a
SSDEEP 384:evwooyWzlWoWSlWOQ7q0GftpBjwk9RERHRN7lll78oWCmtF:eZolkiH9REB1ev
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a1:22:0e:26:b4:a8:cb:e7:5b:60:a5:c7:c0:0f:8b:fe:78:11:de:ab:10:6e:fb:80:db:48:12:fc:69:9c:a6:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

7a:d6:c4:f2:08:a1:9d:00:84:62:92:90:2b:1d:65:40:b1:46:59:0a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.IO/net462\System.IO.pdb

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/net462/System.IO.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 965bb6510f6871c984a940b68ed24c6145e326e22e6fa66104d0a3bfccf9feea
MD5 ca7871ad7a6c6823a1048fab29a25f19
SHA1 ba5f2caa404ae9a283a841c08b024baf8817ba01
SHA512 7008f30b89897190e91b0189a871da5d4c5523028ee48971d1adec731e55642c92c531c6c1df534167f176f9d252981bc0498b686aeff6e1ba82cb1998cdac7a
SSDEEP 384:evwooyWzlWoWSlWOQ7q0GftpBjwk9RERHRN7lll78oWCmtF:eZolkiH9REB1ev
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a1:22:0e:26:b4:a8:cb:e7:5b:60:a5:c7:c0:0f:8b:fe:78:11:de:ab:10:6e:fb:80:db:48:12:fc:69:9c:a6:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

7a:d6:c4:f2:08:a1:9d:00:84:62:92:90:2b:1d:65:40:b1:46:59:0a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.IO/net462\System.IO.pdb

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netcore50/System.IO.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6aa70d90746ca41fddb6e69e99e27f2886386ace0002e7970f0ccd93e2117180
MD5 24014550349f12284c1400a1f1d3b907
SHA1 47fced27d3653822254ff4876e11f29352cfaf4a
SHA512 64db097dfc4f51d3af8d1f58bbee4fe005838b8b401498ad4dfeb8577ec2e666fd279d9fc9010d64d270a116c1e7629f7fc458f6cae415b1b1494d945a4d9455
SSDEEP 768:MooooozQQQQQoLfuVViZVAejO8iYQmPvUha+z:3QQQQQxVUZVAejNlQmk3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

e4:a8:db:1f:1f:65:50:3e:fc:0e:9d:76:d3:21:71:a1:d2:b8:cf:2e:b9:6b:b5:46:fc:47:07:f4:56:f7:99:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

b2:f5:5b:9b:ef:b7:66:57:05:74:06:b7:88:76:8e:2d:00:67:2b:0a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

19694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.IO\4.0.10.0\System.IO.pdb

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netcore50/System.IO.xml

SHA256 e8acf733be7c9ae5a897eb8c63ab053f2434d9b02b69e2d1e8f2c3586a81b803
MD5 e97b1d0875227ad5de504fd4bc7b88fb
SHA1 cad08eb998cf862b163de93193bafcfe6abf7140
SHA512 acb5c9b85b523e35e039ecc19fec0df2499668b095a0954d6cf2b14d959459956536d6bbcd742171d974034f0bb13335b0bb0e9ed90e1df59d1d357fa3e1e7a5
SSDEEP 1536:nBfAu4zdZcMMDuz+quAKsjnaaTPgN1RpPzXkrFpMBy7i3fzFO:qb7eO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netcore50/de/System.IO.xml

SHA256 511c17d409707894f752f8400863683f607d8a5611a7bc258d27f0556bd06958
MD5 05e777c70457c6767673193c1908a6c8
SHA1 554c95e80b60c4d23f5030e943f5cc7116cfc575
SHA512 4e6a287a80d787bb8e4cf5f14175e8446bd121a42491e05b3917942205d484ac51400d53afb503663d98dbd654af14f37bc6243fd837fdca28dbc8deda82969b
SSDEEP 6144:GqKX0GEMv3kcNwzrv/nEYoJ1A0ktBjDHW8h1Ejfz+1c0eYVUIRj7g5Uzf+Q+fLBu:GqKX0GEMv3kcNwzrv/nEYoJ1A0ktBjD5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netcore50/es/System.IO.xml

SHA256 7cb9bd7be473f2329722660d816c0efe15753544e16252a567c42995310e9314
MD5 0285f41dffe6602dd895eb890010b1de
SHA1 9e1eb64d7f4bb6f2d4b6a9252c364dfe501fc313
SHA512 1436bdd037fccfabd31a34bec481533904456788b3b5a00a9e5c1ece24367d45dfe1c9efdf44e72b867c1022d7170ec452f558983b2e367aa969ad2486aa2418
SSDEEP 1536:nuSElTWvCKqMfyGQXL0pYQtxH9FTRTlhegUFFilkH4rAg9xLUH+Q3unAbTC5VmGJ:DJ7t/H9zn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netcore50/fr/System.IO.xml

SHA256 3cdc745efe3893f1667f4dcca97607d06eb36dd406460443f2df401857ce7982
MD5 819513491a5bce9bb2ad14551bd530f8
SHA1 1a7cbe3ff0fbfbdecf8a2e9c18fbab9e4cdf878a
SHA512 58271907cae59ab7884e89b2cc750c719e1c4baddd95200cdbf53a2ab552a5358efc606b9159ac071a215fe0ce10512f8225d5c0d87f6d8b8b3a1747732f3f67
SSDEEP 1536:nVTLjC8nG6zgMey3pzMnpMJicvxpLZ2R/sf7I8afyR3ouBxHWnKZfstICMonKZyr:Oa3ouBxVsto1+nU1aBbfd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netcore50/it/System.IO.xml

SHA256 879720e8af0cc7c728805a5d6fc46fc868958e5bcef8f7d2090befb59f2f316c
MD5 1981bd2cffbd70df3d6d3e45b371cb72
SHA1 e416e40d50a569c51bedeb2bc7e73f1b74f02193
SHA512 b5141500f8af9d4fb852fed2ae161f99b99830b265cfa832e57a79b3e6cb9b83dabe36de91b1d57f6384d0db83c7adc5cd61955493b63a4dd71c87c9f3330ec9
SSDEEP 6144:zNaWxpNZLWR9TMWx0SuAR4Ln3eQeBmi1y/dUdJ9e87/X2/3x2P3VzUiwjEaPoDCh:D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netcore50/ja/System.IO.xml

SHA256 09e3aaece661fa2bba7df0dd54ae0558491e9ea0248c15c66a387ae119d36b85
MD5 5ef7c405290562d9ccba1940c718a58f
SHA1 b6f804fed3a9da80f6e5d129ef044d1a5859ada8
SHA512 0cd456057c3f6aac37668b410b3dd85e12b2fa500f1cf0d849d28be42e6198427f5781effe751873d408c5e05bfd8a35ef3be1e35f6b3c87de563822d28ad8d9
SSDEEP 1536:nL/3oZHXHlf2phX2n8T4n8U1azoirowN8sd6IlMNf9aDeeEHmoEE:Kf9a2
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netcore50/ko/System.IO.xml

SHA256 0235b4d0c64cf5f2e93a9392e4d507cdfec44512f0f0266d1646c50af031d4ed
MD5 ea1120bfc5d462fba03811729551f5e4
SHA1 a0c55864bc25217b3ad57b4c8d46c768bd4d233d
SHA512 67c234ecb56e9ddf4e5023b7d2131e4ae4437d0826f9e04179fe1475f8d4cc287e9aaa064c350bffb5f9eb0974e7220493702f4a848a4d39bd2ffb692056d9b0
SSDEEP 1536:nkwxw4s13l3MpRXoQoWhRFY0vYi40GNG1HsR4TbGGG6GyG1GwG3G2GBGiGnK2/9a:rEi1q05Fvc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netcore50/ru/System.IO.xml

SHA256 16b9223527a69e5c69822b14ab9be2da71a3c4e9313be4078a558212779ab608
MD5 922084e37ee4f4624d7c5cac2031ec5b
SHA1 a60df6d63b8388952b8d0ea4ee35524b3d79ae85
SHA512 438b4fa7c274042844a0f92dfdbfde04e15fbd90966027587eff5cef56540c1e02e85496bae216ff8a151e1bf255184c5ee27b90232992dacef72b1bf58d7a7f
SSDEEP 6144:BO/kdQ3xKHcofBZLkbgaZq8KlVaPuLaRpNKSaXj3bgSwyYyIEpTIpTmsXrFpqQMo:BO/kdQ3xKHcofBZLkbgaZq8KlVaPuLa7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netcore50/zh-hans/System.IO.xml

SHA256 1d0731e846faf7185e87e8c6e15c901d691f2257d54516d1a89c96d812908613
MD5 2771412c95198f7cceaf01fb906edd8f
SHA1 4f3e013e83626d3adb3aa5d877e9b71688e2bd88
SHA512 fe6d06eb91684c229e9b637913f3ffb5cc33a8572396007de17d53d05eabcb44ef22a54cfeecc2f3a07b792aeb08d1869cf082dbf39d75d12a9268102fce2756
SSDEEP 1536:niaSJiKAW2bMgFGy6h7Ih3xFVy+c/awDE0Pe+V22bgmCg5CVK3cnyPpmydYwIi0M:mtCg5CVTnyPpmydYg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netcore50/zh-hant/System.IO.xml

SHA256 698f68f22678112b54bfe0520a2d854298395e48a7e4cd51c84b1f83e262487a
MD5 37d86d48aaedb1ccc1e3c1656c01ea6e
SHA1 78f471389ab8fbf2d63745f05140d9108814a4c3
SHA512 d5064bf390ba0c184c95be6c34dd4ae39b8bac21adfcf757d39580f3664250e1e9200358c9c68fa48bb48fa71a0afdea6dae712375bafe9d083859ea9684ff0b
SSDEEP 3072:fToIVYAYLJEcrF4Eb4M3zPOfd5xep2O/6MHRjGcSNKZMwecS:fXF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.0/System.IO.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 44c893ebc6915e59b8174742699429bb7147ba08350b2f3a1dacbfd643eb2a6c
MD5 b57924627cb89be8d2ae7ceafcfdc5c3
SHA1 a7b04fdd2409bd7e953c338603ac62169687623e
SHA512 981660097caaab82c9e4b2757007305f6f337685241ac37650a686f61a8c82a1f985c2f442d1ce6f86a5da14c5145000f43f374f82f1bb8314d4019345e929f3
SSDEEP 384:KjwXGOrXezyN2Cf7X3HWpbWLlWc1LHB0GftpBj3NDHRN7L7AlXxH7FmL5:K8GOazup2pszWiRNDL6by
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

68:69:0b:4a:5b:2b:82:cf:2e:b0:38:a9:ee:64:c9:1f:85:f1:57:dc:ae:1c:08:9e:8a:20:ed:60:6e:10:61:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

be:fd:3b:c7:1f:50:e3:c8:9d:e8:08:c7:6a:0a:d6:8c:50:e3:a9:86

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

19918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.0/System.IO.xml

SHA256 e8acf733be7c9ae5a897eb8c63ab053f2434d9b02b69e2d1e8f2c3586a81b803
MD5 e97b1d0875227ad5de504fd4bc7b88fb
SHA1 cad08eb998cf862b163de93193bafcfe6abf7140
SHA512 acb5c9b85b523e35e039ecc19fec0df2499668b095a0954d6cf2b14d959459956536d6bbcd742171d974034f0bb13335b0bb0e9ed90e1df59d1d357fa3e1e7a5
SSDEEP 1536:nBfAu4zdZcMMDuz+quAKsjnaaTPgN1RpPzXkrFpMBy7i3fzFO:qb7eO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.0/de/System.IO.xml

SHA256 511c17d409707894f752f8400863683f607d8a5611a7bc258d27f0556bd06958
MD5 05e777c70457c6767673193c1908a6c8
SHA1 554c95e80b60c4d23f5030e943f5cc7116cfc575
SHA512 4e6a287a80d787bb8e4cf5f14175e8446bd121a42491e05b3917942205d484ac51400d53afb503663d98dbd654af14f37bc6243fd837fdca28dbc8deda82969b
SSDEEP 6144:GqKX0GEMv3kcNwzrv/nEYoJ1A0ktBjDHW8h1Ejfz+1c0eYVUIRj7g5Uzf+Q+fLBu:GqKX0GEMv3kcNwzrv/nEYoJ1A0ktBjD5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.0/es/System.IO.xml

SHA256 7cb9bd7be473f2329722660d816c0efe15753544e16252a567c42995310e9314
MD5 0285f41dffe6602dd895eb890010b1de
SHA1 9e1eb64d7f4bb6f2d4b6a9252c364dfe501fc313
SHA512 1436bdd037fccfabd31a34bec481533904456788b3b5a00a9e5c1ece24367d45dfe1c9efdf44e72b867c1022d7170ec452f558983b2e367aa969ad2486aa2418
SSDEEP 1536:nuSElTWvCKqMfyGQXL0pYQtxH9FTRTlhegUFFilkH4rAg9xLUH+Q3unAbTC5VmGJ:DJ7t/H9zn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.0/fr/System.IO.xml

SHA256 3cdc745efe3893f1667f4dcca97607d06eb36dd406460443f2df401857ce7982
MD5 819513491a5bce9bb2ad14551bd530f8
SHA1 1a7cbe3ff0fbfbdecf8a2e9c18fbab9e4cdf878a
SHA512 58271907cae59ab7884e89b2cc750c719e1c4baddd95200cdbf53a2ab552a5358efc606b9159ac071a215fe0ce10512f8225d5c0d87f6d8b8b3a1747732f3f67
SSDEEP 1536:nVTLjC8nG6zgMey3pzMnpMJicvxpLZ2R/sf7I8afyR3ouBxHWnKZfstICMonKZyr:Oa3ouBxVsto1+nU1aBbfd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.0/it/System.IO.xml

SHA256 879720e8af0cc7c728805a5d6fc46fc868958e5bcef8f7d2090befb59f2f316c
MD5 1981bd2cffbd70df3d6d3e45b371cb72
SHA1 e416e40d50a569c51bedeb2bc7e73f1b74f02193
SHA512 b5141500f8af9d4fb852fed2ae161f99b99830b265cfa832e57a79b3e6cb9b83dabe36de91b1d57f6384d0db83c7adc5cd61955493b63a4dd71c87c9f3330ec9
SSDEEP 6144:zNaWxpNZLWR9TMWx0SuAR4Ln3eQeBmi1y/dUdJ9e87/X2/3x2P3VzUiwjEaPoDCh:D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.0/ja/System.IO.xml

SHA256 09e3aaece661fa2bba7df0dd54ae0558491e9ea0248c15c66a387ae119d36b85
MD5 5ef7c405290562d9ccba1940c718a58f
SHA1 b6f804fed3a9da80f6e5d129ef044d1a5859ada8
SHA512 0cd456057c3f6aac37668b410b3dd85e12b2fa500f1cf0d849d28be42e6198427f5781effe751873d408c5e05bfd8a35ef3be1e35f6b3c87de563822d28ad8d9
SSDEEP 1536:nL/3oZHXHlf2phX2n8T4n8U1azoirowN8sd6IlMNf9aDeeEHmoEE:Kf9a2
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.0/ko/System.IO.xml

SHA256 0235b4d0c64cf5f2e93a9392e4d507cdfec44512f0f0266d1646c50af031d4ed
MD5 ea1120bfc5d462fba03811729551f5e4
SHA1 a0c55864bc25217b3ad57b4c8d46c768bd4d233d
SHA512 67c234ecb56e9ddf4e5023b7d2131e4ae4437d0826f9e04179fe1475f8d4cc287e9aaa064c350bffb5f9eb0974e7220493702f4a848a4d39bd2ffb692056d9b0
SSDEEP 1536:nkwxw4s13l3MpRXoQoWhRFY0vYi40GNG1HsR4TbGGG6GyG1GwG3G2GBGiGnK2/9a:rEi1q05Fvc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.0/ru/System.IO.xml

SHA256 16b9223527a69e5c69822b14ab9be2da71a3c4e9313be4078a558212779ab608
MD5 922084e37ee4f4624d7c5cac2031ec5b
SHA1 a60df6d63b8388952b8d0ea4ee35524b3d79ae85
SHA512 438b4fa7c274042844a0f92dfdbfde04e15fbd90966027587eff5cef56540c1e02e85496bae216ff8a151e1bf255184c5ee27b90232992dacef72b1bf58d7a7f
SSDEEP 6144:BO/kdQ3xKHcofBZLkbgaZq8KlVaPuLaRpNKSaXj3bgSwyYyIEpTIpTmsXrFpqQMo:BO/kdQ3xKHcofBZLkbgaZq8KlVaPuLa7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.0/zh-hans/System.IO.xml

SHA256 1d0731e846faf7185e87e8c6e15c901d691f2257d54516d1a89c96d812908613
MD5 2771412c95198f7cceaf01fb906edd8f
SHA1 4f3e013e83626d3adb3aa5d877e9b71688e2bd88
SHA512 fe6d06eb91684c229e9b637913f3ffb5cc33a8572396007de17d53d05eabcb44ef22a54cfeecc2f3a07b792aeb08d1869cf082dbf39d75d12a9268102fce2756
SSDEEP 1536:niaSJiKAW2bMgFGy6h7Ih3xFVy+c/awDE0Pe+V22bgmCg5CVK3cnyPpmydYwIi0M:mtCg5CVTnyPpmydYg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.0/zh-hant/System.IO.xml

SHA256 698f68f22678112b54bfe0520a2d854298395e48a7e4cd51c84b1f83e262487a
MD5 37d86d48aaedb1ccc1e3c1656c01ea6e
SHA1 78f471389ab8fbf2d63745f05140d9108814a4c3
SHA512 d5064bf390ba0c184c95be6c34dd4ae39b8bac21adfcf757d39580f3664250e1e9200358c9c68fa48bb48fa71a0afdea6dae712375bafe9d083859ea9684ff0b
SSDEEP 3072:fToIVYAYLJEcrF4Eb4M3zPOfd5xep2O/6MHRjGcSNKZMwecS:fXF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.3/System.IO.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6aa70d90746ca41fddb6e69e99e27f2886386ace0002e7970f0ccd93e2117180
MD5 24014550349f12284c1400a1f1d3b907
SHA1 47fced27d3653822254ff4876e11f29352cfaf4a
SHA512 64db097dfc4f51d3af8d1f58bbee4fe005838b8b401498ad4dfeb8577ec2e666fd279d9fc9010d64d270a116c1e7629f7fc458f6cae415b1b1494d945a4d9455
SSDEEP 768:MooooozQQQQQoLfuVViZVAejO8iYQmPvUha+z:3QQQQQxVUZVAejNlQmk3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

e4:a8:db:1f:1f:65:50:3e:fc:0e:9d:76:d3:21:71:a1:d2:b8:cf:2e:b9:6b:b5:46:fc:47:07:f4:56:f7:99:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

b2:f5:5b:9b:ef:b7:66:57:05:74:06:b7:88:76:8e:2d:00:67:2b:0a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

19694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.IO\4.0.10.0\System.IO.pdb

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.3/System.IO.xml

SHA256 e8acf733be7c9ae5a897eb8c63ab053f2434d9b02b69e2d1e8f2c3586a81b803
MD5 e97b1d0875227ad5de504fd4bc7b88fb
SHA1 cad08eb998cf862b163de93193bafcfe6abf7140
SHA512 acb5c9b85b523e35e039ecc19fec0df2499668b095a0954d6cf2b14d959459956536d6bbcd742171d974034f0bb13335b0bb0e9ed90e1df59d1d357fa3e1e7a5
SSDEEP 1536:nBfAu4zdZcMMDuz+quAKsjnaaTPgN1RpPzXkrFpMBy7i3fzFO:qb7eO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.3/de/System.IO.xml

SHA256 511c17d409707894f752f8400863683f607d8a5611a7bc258d27f0556bd06958
MD5 05e777c70457c6767673193c1908a6c8
SHA1 554c95e80b60c4d23f5030e943f5cc7116cfc575
SHA512 4e6a287a80d787bb8e4cf5f14175e8446bd121a42491e05b3917942205d484ac51400d53afb503663d98dbd654af14f37bc6243fd837fdca28dbc8deda82969b
SSDEEP 6144:GqKX0GEMv3kcNwzrv/nEYoJ1A0ktBjDHW8h1Ejfz+1c0eYVUIRj7g5Uzf+Q+fLBu:GqKX0GEMv3kcNwzrv/nEYoJ1A0ktBjD5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.3/es/System.IO.xml

SHA256 7cb9bd7be473f2329722660d816c0efe15753544e16252a567c42995310e9314
MD5 0285f41dffe6602dd895eb890010b1de
SHA1 9e1eb64d7f4bb6f2d4b6a9252c364dfe501fc313
SHA512 1436bdd037fccfabd31a34bec481533904456788b3b5a00a9e5c1ece24367d45dfe1c9efdf44e72b867c1022d7170ec452f558983b2e367aa969ad2486aa2418
SSDEEP 1536:nuSElTWvCKqMfyGQXL0pYQtxH9FTRTlhegUFFilkH4rAg9xLUH+Q3unAbTC5VmGJ:DJ7t/H9zn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.3/fr/System.IO.xml

SHA256 3cdc745efe3893f1667f4dcca97607d06eb36dd406460443f2df401857ce7982
MD5 819513491a5bce9bb2ad14551bd530f8
SHA1 1a7cbe3ff0fbfbdecf8a2e9c18fbab9e4cdf878a
SHA512 58271907cae59ab7884e89b2cc750c719e1c4baddd95200cdbf53a2ab552a5358efc606b9159ac071a215fe0ce10512f8225d5c0d87f6d8b8b3a1747732f3f67
SSDEEP 1536:nVTLjC8nG6zgMey3pzMnpMJicvxpLZ2R/sf7I8afyR3ouBxHWnKZfstICMonKZyr:Oa3ouBxVsto1+nU1aBbfd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.3/it/System.IO.xml

SHA256 879720e8af0cc7c728805a5d6fc46fc868958e5bcef8f7d2090befb59f2f316c
MD5 1981bd2cffbd70df3d6d3e45b371cb72
SHA1 e416e40d50a569c51bedeb2bc7e73f1b74f02193
SHA512 b5141500f8af9d4fb852fed2ae161f99b99830b265cfa832e57a79b3e6cb9b83dabe36de91b1d57f6384d0db83c7adc5cd61955493b63a4dd71c87c9f3330ec9
SSDEEP 6144:zNaWxpNZLWR9TMWx0SuAR4Ln3eQeBmi1y/dUdJ9e87/X2/3x2P3VzUiwjEaPoDCh:D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.3/ja/System.IO.xml

SHA256 09e3aaece661fa2bba7df0dd54ae0558491e9ea0248c15c66a387ae119d36b85
MD5 5ef7c405290562d9ccba1940c718a58f
SHA1 b6f804fed3a9da80f6e5d129ef044d1a5859ada8
SHA512 0cd456057c3f6aac37668b410b3dd85e12b2fa500f1cf0d849d28be42e6198427f5781effe751873d408c5e05bfd8a35ef3be1e35f6b3c87de563822d28ad8d9
SSDEEP 1536:nL/3oZHXHlf2phX2n8T4n8U1azoirowN8sd6IlMNf9aDeeEHmoEE:Kf9a2
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.3/ko/System.IO.xml

SHA256 0235b4d0c64cf5f2e93a9392e4d507cdfec44512f0f0266d1646c50af031d4ed
MD5 ea1120bfc5d462fba03811729551f5e4
SHA1 a0c55864bc25217b3ad57b4c8d46c768bd4d233d
SHA512 67c234ecb56e9ddf4e5023b7d2131e4ae4437d0826f9e04179fe1475f8d4cc287e9aaa064c350bffb5f9eb0974e7220493702f4a848a4d39bd2ffb692056d9b0
SSDEEP 1536:nkwxw4s13l3MpRXoQoWhRFY0vYi40GNG1HsR4TbGGG6GyG1GwG3G2GBGiGnK2/9a:rEi1q05Fvc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.3/ru/System.IO.xml

SHA256 16b9223527a69e5c69822b14ab9be2da71a3c4e9313be4078a558212779ab608
MD5 922084e37ee4f4624d7c5cac2031ec5b
SHA1 a60df6d63b8388952b8d0ea4ee35524b3d79ae85
SHA512 438b4fa7c274042844a0f92dfdbfde04e15fbd90966027587eff5cef56540c1e02e85496bae216ff8a151e1bf255184c5ee27b90232992dacef72b1bf58d7a7f
SSDEEP 6144:BO/kdQ3xKHcofBZLkbgaZq8KlVaPuLaRpNKSaXj3bgSwyYyIEpTIpTmsXrFpqQMo:BO/kdQ3xKHcofBZLkbgaZq8KlVaPuLa7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.3/zh-hans/System.IO.xml

SHA256 1d0731e846faf7185e87e8c6e15c901d691f2257d54516d1a89c96d812908613
MD5 2771412c95198f7cceaf01fb906edd8f
SHA1 4f3e013e83626d3adb3aa5d877e9b71688e2bd88
SHA512 fe6d06eb91684c229e9b637913f3ffb5cc33a8572396007de17d53d05eabcb44ef22a54cfeecc2f3a07b792aeb08d1869cf082dbf39d75d12a9268102fce2756
SSDEEP 1536:niaSJiKAW2bMgFGy6h7Ih3xFVy+c/awDE0Pe+V22bgmCg5CVK3cnyPpmydYwIi0M:mtCg5CVTnyPpmydYg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.3/zh-hant/System.IO.xml

SHA256 698f68f22678112b54bfe0520a2d854298395e48a7e4cd51c84b1f83e262487a
MD5 37d86d48aaedb1ccc1e3c1656c01ea6e
SHA1 78f471389ab8fbf2d63745f05140d9108814a4c3
SHA512 d5064bf390ba0c184c95be6c34dd4ae39b8bac21adfcf757d39580f3664250e1e9200358c9c68fa48bb48fa71a0afdea6dae712375bafe9d083859ea9684ff0b
SSDEEP 3072:fToIVYAYLJEcrF4Eb4M3zPOfd5xep2O/6MHRjGcSNKZMwecS:fXF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.5/System.IO.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5db3eb54f356493caf324ac3ed5cf51310997dc29f7810f63a6a8794c66a24b0
MD5 f1578eb5fd6399676d1e6be00274ec78
SHA1 c8990697d13e3e7a107a4f528b1dc7fff2b5a51b
SHA512 1a6927150619ec1ffc93b6fa877c73c56060abf2af413669f9bec2132e426b526bf8aa0f8049b67666286820466dbbd82ea4f607e7aa411bbb6ebcaffe53490b
SSDEEP 384:ZwtRbPJjj/Qf1/1sErAkhDC/NWLlW7aCIcPA0GftpBjroERHRN7eelraGf:ZibJn/QfA4A6SWUi5oEBz/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

b4:f4:85:8a:40:45:c9:e5:2c:ed:29:ef:a1:7f:79:47:02:32:29:42:53:71:eb:b8:2b:33:92:97:f0:a1:59:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

44:5c:7b:cc:35:3e:66:5b:0d:b0:3a:94:c2:7f:87:39:93:7a:e3:3c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

19674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.IO\4.1.0.0\System.IO.pdb

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.5/System.IO.xml

SHA256 e8acf733be7c9ae5a897eb8c63ab053f2434d9b02b69e2d1e8f2c3586a81b803
MD5 e97b1d0875227ad5de504fd4bc7b88fb
SHA1 cad08eb998cf862b163de93193bafcfe6abf7140
SHA512 acb5c9b85b523e35e039ecc19fec0df2499668b095a0954d6cf2b14d959459956536d6bbcd742171d974034f0bb13335b0bb0e9ed90e1df59d1d357fa3e1e7a5
SSDEEP 1536:nBfAu4zdZcMMDuz+quAKsjnaaTPgN1RpPzXkrFpMBy7i3fzFO:qb7eO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.5/de/System.IO.xml

SHA256 511c17d409707894f752f8400863683f607d8a5611a7bc258d27f0556bd06958
MD5 05e777c70457c6767673193c1908a6c8
SHA1 554c95e80b60c4d23f5030e943f5cc7116cfc575
SHA512 4e6a287a80d787bb8e4cf5f14175e8446bd121a42491e05b3917942205d484ac51400d53afb503663d98dbd654af14f37bc6243fd837fdca28dbc8deda82969b
SSDEEP 6144:GqKX0GEMv3kcNwzrv/nEYoJ1A0ktBjDHW8h1Ejfz+1c0eYVUIRj7g5Uzf+Q+fLBu:GqKX0GEMv3kcNwzrv/nEYoJ1A0ktBjD5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.5/es/System.IO.xml

SHA256 7cb9bd7be473f2329722660d816c0efe15753544e16252a567c42995310e9314
MD5 0285f41dffe6602dd895eb890010b1de
SHA1 9e1eb64d7f4bb6f2d4b6a9252c364dfe501fc313
SHA512 1436bdd037fccfabd31a34bec481533904456788b3b5a00a9e5c1ece24367d45dfe1c9efdf44e72b867c1022d7170ec452f558983b2e367aa969ad2486aa2418
SSDEEP 1536:nuSElTWvCKqMfyGQXL0pYQtxH9FTRTlhegUFFilkH4rAg9xLUH+Q3unAbTC5VmGJ:DJ7t/H9zn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.5/fr/System.IO.xml

SHA256 3cdc745efe3893f1667f4dcca97607d06eb36dd406460443f2df401857ce7982
MD5 819513491a5bce9bb2ad14551bd530f8
SHA1 1a7cbe3ff0fbfbdecf8a2e9c18fbab9e4cdf878a
SHA512 58271907cae59ab7884e89b2cc750c719e1c4baddd95200cdbf53a2ab552a5358efc606b9159ac071a215fe0ce10512f8225d5c0d87f6d8b8b3a1747732f3f67
SSDEEP 1536:nVTLjC8nG6zgMey3pzMnpMJicvxpLZ2R/sf7I8afyR3ouBxHWnKZfstICMonKZyr:Oa3ouBxVsto1+nU1aBbfd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.5/it/System.IO.xml

SHA256 879720e8af0cc7c728805a5d6fc46fc868958e5bcef8f7d2090befb59f2f316c
MD5 1981bd2cffbd70df3d6d3e45b371cb72
SHA1 e416e40d50a569c51bedeb2bc7e73f1b74f02193
SHA512 b5141500f8af9d4fb852fed2ae161f99b99830b265cfa832e57a79b3e6cb9b83dabe36de91b1d57f6384d0db83c7adc5cd61955493b63a4dd71c87c9f3330ec9
SSDEEP 6144:zNaWxpNZLWR9TMWx0SuAR4Ln3eQeBmi1y/dUdJ9e87/X2/3x2P3VzUiwjEaPoDCh:D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.5/ja/System.IO.xml

SHA256 09e3aaece661fa2bba7df0dd54ae0558491e9ea0248c15c66a387ae119d36b85
MD5 5ef7c405290562d9ccba1940c718a58f
SHA1 b6f804fed3a9da80f6e5d129ef044d1a5859ada8
SHA512 0cd456057c3f6aac37668b410b3dd85e12b2fa500f1cf0d849d28be42e6198427f5781effe751873d408c5e05bfd8a35ef3be1e35f6b3c87de563822d28ad8d9
SSDEEP 1536:nL/3oZHXHlf2phX2n8T4n8U1azoirowN8sd6IlMNf9aDeeEHmoEE:Kf9a2
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.5/ko/System.IO.xml

SHA256 0235b4d0c64cf5f2e93a9392e4d507cdfec44512f0f0266d1646c50af031d4ed
MD5 ea1120bfc5d462fba03811729551f5e4
SHA1 a0c55864bc25217b3ad57b4c8d46c768bd4d233d
SHA512 67c234ecb56e9ddf4e5023b7d2131e4ae4437d0826f9e04179fe1475f8d4cc287e9aaa064c350bffb5f9eb0974e7220493702f4a848a4d39bd2ffb692056d9b0
SSDEEP 1536:nkwxw4s13l3MpRXoQoWhRFY0vYi40GNG1HsR4TbGGG6GyG1GwG3G2GBGiGnK2/9a:rEi1q05Fvc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.5/ru/System.IO.xml

SHA256 16b9223527a69e5c69822b14ab9be2da71a3c4e9313be4078a558212779ab608
MD5 922084e37ee4f4624d7c5cac2031ec5b
SHA1 a60df6d63b8388952b8d0ea4ee35524b3d79ae85
SHA512 438b4fa7c274042844a0f92dfdbfde04e15fbd90966027587eff5cef56540c1e02e85496bae216ff8a151e1bf255184c5ee27b90232992dacef72b1bf58d7a7f
SSDEEP 6144:BO/kdQ3xKHcofBZLkbgaZq8KlVaPuLaRpNKSaXj3bgSwyYyIEpTIpTmsXrFpqQMo:BO/kdQ3xKHcofBZLkbgaZq8KlVaPuLa7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.5/zh-hans/System.IO.xml

SHA256 1d0731e846faf7185e87e8c6e15c901d691f2257d54516d1a89c96d812908613
MD5 2771412c95198f7cceaf01fb906edd8f
SHA1 4f3e013e83626d3adb3aa5d877e9b71688e2bd88
SHA512 fe6d06eb91684c229e9b637913f3ffb5cc33a8572396007de17d53d05eabcb44ef22a54cfeecc2f3a07b792aeb08d1869cf082dbf39d75d12a9268102fce2756
SSDEEP 1536:niaSJiKAW2bMgFGy6h7Ih3xFVy+c/awDE0Pe+V22bgmCg5CVK3cnyPpmydYwIi0M:mtCg5CVTnyPpmydYg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.4.3.0/ref/netstandard1.5/zh-hant/System.IO.xml

SHA256 698f68f22678112b54bfe0520a2d854298395e48a7e4cd51c84b1f83e262487a
MD5 37d86d48aaedb1ccc1e3c1656c01ea6e
SHA1 78f471389ab8fbf2d63745f05140d9108814a4c3
SHA512 d5064bf390ba0c184c95be6c34dd4ae39b8bac21adfcf757d39580f3664250e1e9200358c9c68fa48bb48fa71a0afdea6dae712375bafe9d083859ea9684ff0b
SSDEEP 3072:fToIVYAYLJEcrF4Eb4M3zPOfd5xep2O/6MHRjGcSNKZMwecS:fXF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/.signature.p7s

SHA256 1bb3ff45cc51c709b22ff552341b6667c2df44559e4369f7b61823b34e2a12c0
MD5 ba409a849060c72b08752cbe4336b555
SHA1 64d603b94adae4ba1feb6d61b9329c5097d23584
SHA512 2387585813ffdf5a77e4d2c218e9fbb4b05e2597dfe532a2efa9caba95921762b5d786ea0a97369700496ad86025d78500ff514913054cf1ee18197c0e3ef227
SSDEEP 192:8dG7x0KDWpHhXZCVzV07xrgGDH0JOqsmVgz28WhBqmo5e:EkvDGGVphGoJN77hhnge
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/System.IO.Compression.4.3.0.nupkg

SHA256 7f93eb4254208f95e3d999c7c575bc5e23a2bda06f7ea0daa3d49be805629f20
MD5 6c27bfe56804e722eb5d67ab2a5fb537
SHA1 696291334ef379e1e181e08b91a2c7963cb5ba90
SHA512 f540ee51a3bb6941cdfbaace9a9738d7f7986a2f94770db61f45a88ecb7ef36b571d4c07417dc89cdbe9655a262b7cc599b0a4b78effea91819e186121b44807
SSDEEP 12288:bQsrv08srv0lDdqLJXiiqC9UY0wyLTu01srv0YMyVR6:bpv0Fv0nqLIiqtY0wyP2v0YHr6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/lib/net46/System.IO.Compression.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b963eb95627b5f223e813fce8a53e6c9d72891714923de7263111473faebf3ef
MD5 9661714578a06ecb815369db1d364fe9
SHA1 629ce95c12b21678d877359ec4552d431c1cfbab
SHA512 3dcfdd4916ba5af0ecc585405dd7a9ff58c79c583d8f5f62f12e75a9f12b6530e39637f4f795e39a23b2a0a9f476818f28ea9e9d1557aa5e6e14b5f5f56ac1cc
SSDEEP 1536:vUDglrO+lIFVkQT31aWzXCJ/tBvjZs1wJSGvNbZO0Wehg5aQKnfXmNo6/KwEBPD:Ugh3dBbi1wgGvIC1fWNo6/KwEtD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a5:a7:b0:36:3d:52:e4:36:b0:25:a6:d9:b0:09:06:f8:84:76:f1:ba:ee:ad:df:87:dc:8b:19:38:0b:aa:6b:65

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8f:5d:f3:b7:ed:4e:6c:e4:c3:5d:36:90:b3:bf:25:91:27:fc:d3:1a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

89214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/net46\System.IO.Compression.pdb

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/net46/System.IO.Compression.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b963eb95627b5f223e813fce8a53e6c9d72891714923de7263111473faebf3ef
MD5 9661714578a06ecb815369db1d364fe9
SHA1 629ce95c12b21678d877359ec4552d431c1cfbab
SHA512 3dcfdd4916ba5af0ecc585405dd7a9ff58c79c583d8f5f62f12e75a9f12b6530e39637f4f795e39a23b2a0a9f476818f28ea9e9d1557aa5e6e14b5f5f56ac1cc
SSDEEP 1536:vUDglrO+lIFVkQT31aWzXCJ/tBvjZs1wJSGvNbZO0Wehg5aQKnfXmNo6/KwEBPD:Ugh3dBbi1wgGvIC1fWNo6/KwEtD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a5:a7:b0:36:3d:52:e4:36:b0:25:a6:d9:b0:09:06:f8:84:76:f1:ba:ee:ad:df:87:dc:8b:19:38:0b:aa:6b:65

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8f:5d:f3:b7:ed:4e:6c:e4:c3:5d:36:90:b3:bf:25:91:27:fc:d3:1a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

89214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/net46\System.IO.Compression.pdb

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netcore50/System.IO.Compression.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d82c3b8cbdf560eb60b5b4604526d00eef7946788305bfa0d3314e3f9e50dae5
MD5 1db76908f161fb2982fa349184cd07c8
SHA1 80c1b10c24a7c850de2ffc8f711bce4661aa04d5
SHA512 17c512f49ce28d711f4e96537f03bf768fef8dc10bb9616de6ef675f7d32e4010de57f83b5d4bda246d71f8ac45c2e9a324f1e4fb04324a5b6a64b8b61ed5c6c
SSDEEP 384:ge4+88tbbc2Jr9UyCNr58HWa1WsYMIA0GftpBjSalAhERHRN7Il3rXgG:JUyGA1HqitleEBeTgG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

56:c1:06:df:5a:23:88:fc:44:1c:b6:17:c4:04:6e:ea:ca:4f:4b:e2:94:b2:18:67:0a:1f:a8:15:fa:22:35:17

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

6a:6f:f5:bb:c6:d5:60:ea:c4:d3:a1:40:76:db:13:6f:5e:97:06:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 1, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.IO.Compression\4.1.1.0\System.IO.Compression.pdb

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netcore50/System.IO.Compression.xml

SHA256 3228f6d2d83d14545a49d46691d49e1c81c9411d017bdb3f26eb6b0236e8b2f6
MD5 59e9cf29c46200cc3a11321f48a65f3d
SHA1 9eb906be2626f3f26f704535559026585a9337e6
SHA512 33295dc879b188226dbe8bee1baee822e02aee25fd74242b94e810865f824d77080d0443bc5fc098c9247c25ea36754e3ccd8cf9c4c5484204248670302407f9
SSDEEP 384:YQ7GHHpEGPmfLq9b2A+AFaR2A+AvxqDv7HhUQ/E4+KvZA+AyzQ2A+AMxqM7e5UQM:Y+8b2qkSh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netcore50/de/System.IO.Compression.xml

SHA256 462e16e105af3c76db1a3202b036ef038a0a1a208d466dadf63f195ef5bc816d
MD5 efa525b2c51f4c73a9352ea41dba5c73
SHA1 a0db0d4c7141de02618e01a1ed01c503f5d7adc9
SHA512 8eb78716adf54dd6da31e83c02ffccbe4bfaa69db53779e58631565c5c198dd594fde9ebe1d2b68154e8477ad06c573112480d11591748deef06b1845ce9c6ae
SSDEEP 384:YQNjc6SI7jc3VG6926awlPFA9A59FA9Ad0eJ4a1mPLt6zP1N7rNvshdA9A2pJFAT:YUuj9tnz5cLt6zH9cFK5t6JAzb8yGU0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netcore50/es/System.IO.Compression.xml

SHA256 5e4591e785bfb7154bbc9270f90bd65c167abee716086491e8ce993b0f2aea0d
MD5 26571a0a8078525b2805258155dee55d
SHA1 b9a8ad26ef0a4d12520d92ae7d0c8a1e19939081
SHA512 b191bd9db857686d936758ca17cda4788edf53484c16f9340710284dd948096bdc8419cd979d45401aecf2c77ceebd56861b531cba74fe632de72a16956a67ab
SSDEEP 384:YQdbITroGPnHChj8I8nIhj8I8buIK5K46cfL6EWD8I80pChj8I8uDjms6EjhQIsS:YIRcP1clRYI9z7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netcore50/fr/System.IO.Compression.xml

SHA256 fc3bb0db40e72f4416c5ae9790af8e2c051eb18a6d4796ede80abcedd1b0f143
MD5 88e14158043354df95bff97ec43ddfea
SHA1 c07926938ef32ca5e966f3286fa58bcf71111b8e
SHA512 1d7e2908478ee0379dffc53270a8c7877bf4f82fa7464208661fea2af38c1868685062ae2d6ed151a15de4286009aa35e9724a917efbb7fea6af8da56b71b9d9
SSDEEP 768:YY5kldJwwU1GQo6qNTElFTfwcJkUcYC1u1R:rOzeDdEgjTBr1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netcore50/it/System.IO.Compression.xml

SHA256 a8d32760e36365cfa92faf4598a283b60122c86c489676919b1bff7cd89608e7
MD5 d7d44b3f84d88adac7c5a77cad0eb67b
SHA1 7bf30d51e7aea1f65d8a5bfa83f2561b48c48f5e
SHA512 26ef4b58efba8b412de06dde5ae958bb32264b3ebeaed0c89c2132e27181c8ed37aedfd49eba36e47d0ee633fa12659c1fadaf9a927d93f90fdb33b8a377ae8d
SSDEEP 384:YQyAnzy4P1GBe3v+isw0bXbO/sD0bXb2BrXenSs88Iz8MjIM3i50bXbvno0bXbpH:Ye2as2sRBL3f1wMRHLMPXgbok
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netcore50/ja/System.IO.Compression.xml

SHA256 8aa7ad5cf8671d26afa27ff13c3f970f75a9c2ebbb601775dbce71a4741b11c6
MD5 9716b6f879f529408c047c21ecd8133e
SHA1 6d36ad80a9ca4ca8368256e40c748616336a0e9a
SHA512 92e388c8f8cd56882841833bc88ec8418ab68925ac70205c67bc9340ba4e901bc2b45e9ee4dc4d515208f4e4a26b26c2e0378d095599b7a21c0c200832098f3a
SSDEEP 384:YQ2TwLqGnS+pOq4C4WVq4C4KtyBszM0LZviTFIfrB8m8oySv4C4X8Oq4C4jtXfOY:YBU7YawObR
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netcore50/ko/System.IO.Compression.xml

SHA256 d4687a9adcaafd73d85308f2010ceb980e62d3728f10befe52944e70c53dc3bf
MD5 16233ea2bee9eee937a12fa58d1127e1
SHA1 4ef214740f3e864b7b6e7e59e3cdfd9ac2bbe6ea
SHA512 0a127b3ba133d917432c55dbecb4ee5607faa58230e110131e209ede450abfdcf341be7f89df6516a61873cc6a13d648e753fc309ada535b811ba5df6c7ec001
SSDEEP 384:YQ6kFwzEyD6FDFwPbhi2iswwhhi2iOdZdVzOSH23iD//FBDBPoLi2i9wDhhi2iLY:YIlqPjpzb/D+47mljtylGnY3q5Bes+8
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netcore50/ru/System.IO.Compression.xml

SHA256 6c20e43abd28ce326dd12721fe42178d2c4f7e54bed9620754284fb996eda330
MD5 bbdaeacff792d363dbc340e26f41efe5
SHA1 ca2c95b2ba5d942c7a51fa8435674cd07ddb7ee0
SHA512 1f4a51aa7044715a67576add3d1fe9c27e92c3fad80944397e3b1923bd4a8d679ebfeff035db3e8ed991c1c4aac017e4ffc4c2bebc9603772d9a0344829c5c7a
SSDEEP 384:YQ+JeOHSc3fGCJGSz676+Jzz676xJEjJduuiFd7h7HrNHyz676fSoz676cJ5jJap:Y/KpYd+HXPZai31g9
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netcore50/zh-hans/System.IO.Compression.xml

SHA256 9ce9137f13aee148a8e528fe201a97600c7e7d2a002397468af58192a4e1f393
MD5 2d18f2964c2cbbe88b2670d93b83465b
SHA1 30c360f8df3f45e813b8974be78195757b3cc0bf
SHA512 bb110a628775c560c3dcafd0fdaa8bbe1b98680fd579b2036b7d5428b9f45c007b2db8c6ee890da60fa485741f0267074863b43d37827ca68f61223c2e4d6377
SSDEEP 384:YQ9O60n6jZ+sfMMVqJq/YMVqJqU+I20yggdAzIUgQqJqsLMVqJqL+aX1hpHWErtE:Y7MXKq98FVUEpjS3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netcore50/zh-hant/System.IO.Compression.xml

SHA256 a45a9f8d2145ed936f1623131e9484cd8bfc1ac7d63b740feecc277356c06bde
MD5 3a7adc1c11f8fec29a4f1faa189ff832
SHA1 e5953f9ff857eb55948a605c762f9dc5960da23d
SHA512 3f9332b225f59ac2ef74529013e6d7e3b52dbaa8b923ca0c5f80e064947141158a175a067926b7c340305793058bd341aa3bbb88f5fe2e1921cc57d1fb88c312
SSDEEP 384:YQxnqNaFNmecXMFLlLxPMFLlLnVojNxPBodUqRLlLuZMFLlLIVuqTFCK37IxZofR:YK6LoTBK8jkK30I
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.1/System.IO.Compression.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c6b19b1579ad957409a83aca1e194ac371fad13ba0b64cb90aa122b355bff668
MD5 049281b0fa564b9b9f3666c8e4114d20
SHA1 ca6488a8c04e9653b93983c95831c33f88d2cbee
SHA512 7337bb63b49a7e99bf6debffdecbe6b88adfc52b3cb225faba508537b7832a40c246feefc5c888f724d8d38c5d5c4d6529118f3cae2e74ae98f910f7cbf1cfed
SSDEEP 384:jIfzt7uahuAqWP1WB1LHB0GftpBjRuDHRN7CV9lGBPj+n:amATAWi/uDCVmBSn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

8e:e4:5f:b8:46:e1:17:d9:ff:ba:3c:16:71:dd:20:43:71:4b:a2:fc:1f:7f:85:56:de:37:c5:58:7e:75:58:e3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

80:5c:dd:4a:db:9e:97:9b:42:56:9f:ab:d0:7a:c1:1c:5f:bd:3f:5a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.1/System.IO.Compression.xml

SHA256 3228f6d2d83d14545a49d46691d49e1c81c9411d017bdb3f26eb6b0236e8b2f6
MD5 59e9cf29c46200cc3a11321f48a65f3d
SHA1 9eb906be2626f3f26f704535559026585a9337e6
SHA512 33295dc879b188226dbe8bee1baee822e02aee25fd74242b94e810865f824d77080d0443bc5fc098c9247c25ea36754e3ccd8cf9c4c5484204248670302407f9
SSDEEP 384:YQ7GHHpEGPmfLq9b2A+AFaR2A+AvxqDv7HhUQ/E4+KvZA+AyzQ2A+AMxqM7e5UQM:Y+8b2qkSh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.1/de/System.IO.Compression.xml

SHA256 462e16e105af3c76db1a3202b036ef038a0a1a208d466dadf63f195ef5bc816d
MD5 efa525b2c51f4c73a9352ea41dba5c73
SHA1 a0db0d4c7141de02618e01a1ed01c503f5d7adc9
SHA512 8eb78716adf54dd6da31e83c02ffccbe4bfaa69db53779e58631565c5c198dd594fde9ebe1d2b68154e8477ad06c573112480d11591748deef06b1845ce9c6ae
SSDEEP 384:YQNjc6SI7jc3VG6926awlPFA9A59FA9Ad0eJ4a1mPLt6zP1N7rNvshdA9A2pJFAT:YUuj9tnz5cLt6zH9cFK5t6JAzb8yGU0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.1/es/System.IO.Compression.xml

SHA256 5e4591e785bfb7154bbc9270f90bd65c167abee716086491e8ce993b0f2aea0d
MD5 26571a0a8078525b2805258155dee55d
SHA1 b9a8ad26ef0a4d12520d92ae7d0c8a1e19939081
SHA512 b191bd9db857686d936758ca17cda4788edf53484c16f9340710284dd948096bdc8419cd979d45401aecf2c77ceebd56861b531cba74fe632de72a16956a67ab
SSDEEP 384:YQdbITroGPnHChj8I8nIhj8I8buIK5K46cfL6EWD8I80pChj8I8uDjms6EjhQIsS:YIRcP1clRYI9z7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.1/fr/System.IO.Compression.xml

SHA256 fc3bb0db40e72f4416c5ae9790af8e2c051eb18a6d4796ede80abcedd1b0f143
MD5 88e14158043354df95bff97ec43ddfea
SHA1 c07926938ef32ca5e966f3286fa58bcf71111b8e
SHA512 1d7e2908478ee0379dffc53270a8c7877bf4f82fa7464208661fea2af38c1868685062ae2d6ed151a15de4286009aa35e9724a917efbb7fea6af8da56b71b9d9
SSDEEP 768:YY5kldJwwU1GQo6qNTElFTfwcJkUcYC1u1R:rOzeDdEgjTBr1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.1/it/System.IO.Compression.xml

SHA256 a8d32760e36365cfa92faf4598a283b60122c86c489676919b1bff7cd89608e7
MD5 d7d44b3f84d88adac7c5a77cad0eb67b
SHA1 7bf30d51e7aea1f65d8a5bfa83f2561b48c48f5e
SHA512 26ef4b58efba8b412de06dde5ae958bb32264b3ebeaed0c89c2132e27181c8ed37aedfd49eba36e47d0ee633fa12659c1fadaf9a927d93f90fdb33b8a377ae8d
SSDEEP 384:YQyAnzy4P1GBe3v+isw0bXbO/sD0bXb2BrXenSs88Iz8MjIM3i50bXbvno0bXbpH:Ye2as2sRBL3f1wMRHLMPXgbok
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.1/ja/System.IO.Compression.xml

SHA256 8aa7ad5cf8671d26afa27ff13c3f970f75a9c2ebbb601775dbce71a4741b11c6
MD5 9716b6f879f529408c047c21ecd8133e
SHA1 6d36ad80a9ca4ca8368256e40c748616336a0e9a
SHA512 92e388c8f8cd56882841833bc88ec8418ab68925ac70205c67bc9340ba4e901bc2b45e9ee4dc4d515208f4e4a26b26c2e0378d095599b7a21c0c200832098f3a
SSDEEP 384:YQ2TwLqGnS+pOq4C4WVq4C4KtyBszM0LZviTFIfrB8m8oySv4C4X8Oq4C4jtXfOY:YBU7YawObR
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.1/ko/System.IO.Compression.xml

SHA256 d4687a9adcaafd73d85308f2010ceb980e62d3728f10befe52944e70c53dc3bf
MD5 16233ea2bee9eee937a12fa58d1127e1
SHA1 4ef214740f3e864b7b6e7e59e3cdfd9ac2bbe6ea
SHA512 0a127b3ba133d917432c55dbecb4ee5607faa58230e110131e209ede450abfdcf341be7f89df6516a61873cc6a13d648e753fc309ada535b811ba5df6c7ec001
SSDEEP 384:YQ6kFwzEyD6FDFwPbhi2iswwhhi2iOdZdVzOSH23iD//FBDBPoLi2i9wDhhi2iLY:YIlqPjpzb/D+47mljtylGnY3q5Bes+8
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.1/ru/System.IO.Compression.xml

SHA256 6c20e43abd28ce326dd12721fe42178d2c4f7e54bed9620754284fb996eda330
MD5 bbdaeacff792d363dbc340e26f41efe5
SHA1 ca2c95b2ba5d942c7a51fa8435674cd07ddb7ee0
SHA512 1f4a51aa7044715a67576add3d1fe9c27e92c3fad80944397e3b1923bd4a8d679ebfeff035db3e8ed991c1c4aac017e4ffc4c2bebc9603772d9a0344829c5c7a
SSDEEP 384:YQ+JeOHSc3fGCJGSz676+Jzz676xJEjJduuiFd7h7HrNHyz676fSoz676cJ5jJap:Y/KpYd+HXPZai31g9
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.1/zh-hans/System.IO.Compression.xml

SHA256 9ce9137f13aee148a8e528fe201a97600c7e7d2a002397468af58192a4e1f393
MD5 2d18f2964c2cbbe88b2670d93b83465b
SHA1 30c360f8df3f45e813b8974be78195757b3cc0bf
SHA512 bb110a628775c560c3dcafd0fdaa8bbe1b98680fd579b2036b7d5428b9f45c007b2db8c6ee890da60fa485741f0267074863b43d37827ca68f61223c2e4d6377
SSDEEP 384:YQ9O60n6jZ+sfMMVqJq/YMVqJqU+I20yggdAzIUgQqJqsLMVqJqL+aX1hpHWErtE:Y7MXKq98FVUEpjS3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.1/zh-hant/System.IO.Compression.xml

SHA256 a45a9f8d2145ed936f1623131e9484cd8bfc1ac7d63b740feecc277356c06bde
MD5 3a7adc1c11f8fec29a4f1faa189ff832
SHA1 e5953f9ff857eb55948a605c762f9dc5960da23d
SHA512 3f9332b225f59ac2ef74529013e6d7e3b52dbaa8b923ca0c5f80e064947141158a175a067926b7c340305793058bd341aa3bbb88f5fe2e1921cc57d1fb88c312
SSDEEP 384:YQxnqNaFNmecXMFLlLxPMFLlLnVojNxPBodUqRLlLuZMFLlLIVuqTFCK37IxZofR:YK6LoTBK8jkK30I
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.3/System.IO.Compression.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d82c3b8cbdf560eb60b5b4604526d00eef7946788305bfa0d3314e3f9e50dae5
MD5 1db76908f161fb2982fa349184cd07c8
SHA1 80c1b10c24a7c850de2ffc8f711bce4661aa04d5
SHA512 17c512f49ce28d711f4e96537f03bf768fef8dc10bb9616de6ef675f7d32e4010de57f83b5d4bda246d71f8ac45c2e9a324f1e4fb04324a5b6a64b8b61ed5c6c
SSDEEP 384:ge4+88tbbc2Jr9UyCNr58HWa1WsYMIA0GftpBjSalAhERHRN7Il3rXgG:JUyGA1HqitleEBeTgG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

56:c1:06:df:5a:23:88:fc:44:1c:b6:17:c4:04:6e:ea:ca:4f:4b:e2:94:b2:18:67:0a:1f:a8:15:fa:22:35:17

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

6a:6f:f5:bb:c6:d5:60:ea:c4:d3:a1:40:76:db:13:6f:5e:97:06:40

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 1, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.IO.Compression\4.1.1.0\System.IO.Compression.pdb

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.3/System.IO.Compression.xml

SHA256 3228f6d2d83d14545a49d46691d49e1c81c9411d017bdb3f26eb6b0236e8b2f6
MD5 59e9cf29c46200cc3a11321f48a65f3d
SHA1 9eb906be2626f3f26f704535559026585a9337e6
SHA512 33295dc879b188226dbe8bee1baee822e02aee25fd74242b94e810865f824d77080d0443bc5fc098c9247c25ea36754e3ccd8cf9c4c5484204248670302407f9
SSDEEP 384:YQ7GHHpEGPmfLq9b2A+AFaR2A+AvxqDv7HhUQ/E4+KvZA+AyzQ2A+AMxqM7e5UQM:Y+8b2qkSh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.3/de/System.IO.Compression.xml

SHA256 462e16e105af3c76db1a3202b036ef038a0a1a208d466dadf63f195ef5bc816d
MD5 efa525b2c51f4c73a9352ea41dba5c73
SHA1 a0db0d4c7141de02618e01a1ed01c503f5d7adc9
SHA512 8eb78716adf54dd6da31e83c02ffccbe4bfaa69db53779e58631565c5c198dd594fde9ebe1d2b68154e8477ad06c573112480d11591748deef06b1845ce9c6ae
SSDEEP 384:YQNjc6SI7jc3VG6926awlPFA9A59FA9Ad0eJ4a1mPLt6zP1N7rNvshdA9A2pJFAT:YUuj9tnz5cLt6zH9cFK5t6JAzb8yGU0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.3/es/System.IO.Compression.xml

SHA256 5e4591e785bfb7154bbc9270f90bd65c167abee716086491e8ce993b0f2aea0d
MD5 26571a0a8078525b2805258155dee55d
SHA1 b9a8ad26ef0a4d12520d92ae7d0c8a1e19939081
SHA512 b191bd9db857686d936758ca17cda4788edf53484c16f9340710284dd948096bdc8419cd979d45401aecf2c77ceebd56861b531cba74fe632de72a16956a67ab
SSDEEP 384:YQdbITroGPnHChj8I8nIhj8I8buIK5K46cfL6EWD8I80pChj8I8uDjms6EjhQIsS:YIRcP1clRYI9z7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.3/fr/System.IO.Compression.xml

SHA256 fc3bb0db40e72f4416c5ae9790af8e2c051eb18a6d4796ede80abcedd1b0f143
MD5 88e14158043354df95bff97ec43ddfea
SHA1 c07926938ef32ca5e966f3286fa58bcf71111b8e
SHA512 1d7e2908478ee0379dffc53270a8c7877bf4f82fa7464208661fea2af38c1868685062ae2d6ed151a15de4286009aa35e9724a917efbb7fea6af8da56b71b9d9
SSDEEP 768:YY5kldJwwU1GQo6qNTElFTfwcJkUcYC1u1R:rOzeDdEgjTBr1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.3/it/System.IO.Compression.xml

SHA256 a8d32760e36365cfa92faf4598a283b60122c86c489676919b1bff7cd89608e7
MD5 d7d44b3f84d88adac7c5a77cad0eb67b
SHA1 7bf30d51e7aea1f65d8a5bfa83f2561b48c48f5e
SHA512 26ef4b58efba8b412de06dde5ae958bb32264b3ebeaed0c89c2132e27181c8ed37aedfd49eba36e47d0ee633fa12659c1fadaf9a927d93f90fdb33b8a377ae8d
SSDEEP 384:YQyAnzy4P1GBe3v+isw0bXbO/sD0bXb2BrXenSs88Iz8MjIM3i50bXbvno0bXbpH:Ye2as2sRBL3f1wMRHLMPXgbok
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.3/ja/System.IO.Compression.xml

SHA256 8aa7ad5cf8671d26afa27ff13c3f970f75a9c2ebbb601775dbce71a4741b11c6
MD5 9716b6f879f529408c047c21ecd8133e
SHA1 6d36ad80a9ca4ca8368256e40c748616336a0e9a
SHA512 92e388c8f8cd56882841833bc88ec8418ab68925ac70205c67bc9340ba4e901bc2b45e9ee4dc4d515208f4e4a26b26c2e0378d095599b7a21c0c200832098f3a
SSDEEP 384:YQ2TwLqGnS+pOq4C4WVq4C4KtyBszM0LZviTFIfrB8m8oySv4C4X8Oq4C4jtXfOY:YBU7YawObR
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.3/ko/System.IO.Compression.xml

SHA256 d4687a9adcaafd73d85308f2010ceb980e62d3728f10befe52944e70c53dc3bf
MD5 16233ea2bee9eee937a12fa58d1127e1
SHA1 4ef214740f3e864b7b6e7e59e3cdfd9ac2bbe6ea
SHA512 0a127b3ba133d917432c55dbecb4ee5607faa58230e110131e209ede450abfdcf341be7f89df6516a61873cc6a13d648e753fc309ada535b811ba5df6c7ec001
SSDEEP 384:YQ6kFwzEyD6FDFwPbhi2iswwhhi2iOdZdVzOSH23iD//FBDBPoLi2i9wDhhi2iLY:YIlqPjpzb/D+47mljtylGnY3q5Bes+8
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.3/ru/System.IO.Compression.xml

SHA256 6c20e43abd28ce326dd12721fe42178d2c4f7e54bed9620754284fb996eda330
MD5 bbdaeacff792d363dbc340e26f41efe5
SHA1 ca2c95b2ba5d942c7a51fa8435674cd07ddb7ee0
SHA512 1f4a51aa7044715a67576add3d1fe9c27e92c3fad80944397e3b1923bd4a8d679ebfeff035db3e8ed991c1c4aac017e4ffc4c2bebc9603772d9a0344829c5c7a
SSDEEP 384:YQ+JeOHSc3fGCJGSz676+Jzz676xJEjJduuiFd7h7HrNHyz676fSoz676cJ5jJap:Y/KpYd+HXPZai31g9
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.3/zh-hans/System.IO.Compression.xml

SHA256 9ce9137f13aee148a8e528fe201a97600c7e7d2a002397468af58192a4e1f393
MD5 2d18f2964c2cbbe88b2670d93b83465b
SHA1 30c360f8df3f45e813b8974be78195757b3cc0bf
SHA512 bb110a628775c560c3dcafd0fdaa8bbe1b98680fd579b2036b7d5428b9f45c007b2db8c6ee890da60fa485741f0267074863b43d37827ca68f61223c2e4d6377
SSDEEP 384:YQ9O60n6jZ+sfMMVqJq/YMVqJqU+I20yggdAzIUgQqJqsLMVqJqL+aX1hpHWErtE:Y7MXKq98FVUEpjS3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/ref/netstandard1.3/zh-hant/System.IO.Compression.xml

SHA256 a45a9f8d2145ed936f1623131e9484cd8bfc1ac7d63b740feecc277356c06bde
MD5 3a7adc1c11f8fec29a4f1faa189ff832
SHA1 e5953f9ff857eb55948a605c762f9dc5960da23d
SHA512 3f9332b225f59ac2ef74529013e6d7e3b52dbaa8b923ca0c5f80e064947141158a175a067926b7c340305793058bd341aa3bbb88f5fe2e1921cc57d1fb88c312
SSDEEP 384:YQxnqNaFNmecXMFLlLxPMFLlLnVojNxPBodUqRLlLuZMFLlLIVuqTFCK37IxZofR:YK6LoTBK8jkK30I
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/runtimes/unix/lib/netstandard1.3/System.IO.Compression.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3b7a77fd7a9462892515e90298060a3d7037f384f5ec86a1e786b0f403a77ebc
MD5 854e74869be8f67b5010ef5dbb51448a
SHA1 8fd49426bc95820e281cca4105683e5a93c8d92b
SHA512 248c757348c95f126f2ac80639014e9b7ba2968b19b8e5fc52c8b154c1956c5f1af374186c8f21b85fe3528aa7e689ae674528e43faf5238867bc4577d50f54a
SSDEEP 3072:JWxH40POS+/7MmsofB8vEkvreytyXwai9D/Ew:a45XSJHxtyXly
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

6b:ca:29:f0:a8:b9:b7:59:10:a6:5a:1f:fc:c5:ed:36:0c:cc:a4:31:7f:59:1f:6a:f2:09:5f:9d:bc:4b:45:af

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

53:11:64:2b:e6:02:da:f1:c3:3c:04:05:11:18:b0:73:3f:78:48:76

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

103790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Unix.AnyCPU.Release\System.IO.Compression\System.IO.Compression.pdb

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/runtimes/win/lib/net46/System.IO.Compression.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b963eb95627b5f223e813fce8a53e6c9d72891714923de7263111473faebf3ef
MD5 9661714578a06ecb815369db1d364fe9
SHA1 629ce95c12b21678d877359ec4552d431c1cfbab
SHA512 3dcfdd4916ba5af0ecc585405dd7a9ff58c79c583d8f5f62f12e75a9f12b6530e39637f4f795e39a23b2a0a9f476818f28ea9e9d1557aa5e6e14b5f5f56ac1cc
SSDEEP 1536:vUDglrO+lIFVkQT31aWzXCJ/tBvjZs1wJSGvNbZO0Wehg5aQKnfXmNo6/KwEBPD:Ugh3dBbi1wgGvIC1fWNo6/KwEtD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a5:a7:b0:36:3d:52:e4:36:b0:25:a6:d9:b0:09:06:f8:84:76:f1:ba:ee:ad:df:87:dc:8b:19:38:0b:aa:6b:65

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8f:5d:f3:b7:ed:4e:6c:e4:c3:5d:36:90:b3:bf:25:91:27:fc:d3:1a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

89214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.IO.Compression/net46\System.IO.Compression.pdb

LegionStealer V1 SRC/packages/System.IO.Compression.4.3.0/runtimes/win/lib/netstandard1.3/System.IO.Compression.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4ea09e6d194bccb2bb424e75dc8d125ae8637e9eb4b4a09fb395104887cf1a7d
MD5 fbd52c78647072e17fdb2996325db6e4
SHA1 2cdfc93ea967d0725f1a9f371f00b950fe1dbc13
SHA512 c4ff5c8b7db196a0c1c30720dfeda9ce4d062a7212ae613b32f56fd6ea8a080b0400a842d7488a58fb1edfb46593d48f880937e68ec3a9979c921663e95ac78a
SSDEEP 3072:IMq2rkdiw3XZkWa4PMZvoSLPyeFIFBYpW6l0EUTD:VKiwfcrLPybTD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

59:63:78:76:3b:ff:39:4e:a1:f6:d1:e1:80:ff:58:6a:74:df:29:4d:33:b1:a7:f4:e1:4f:b8:ce:b6:1e:53:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

e1:bc:56:d4:14:24:79:42:62:1f:e3:8a:a0:45:3f:88:3b:33:15:cd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

111326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.IO.Compression\System.IO.Compression.pdb

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/.signature.p7s

SHA256 517116ca9bb57682da5460ce0bc3ae6bb35d6b0b2a6b70e6e18aabb409b05992
MD5 1caf0e5ae358804c975d33c8381e7506
SHA1 74f5e5e0191652de3b36c0b3288d45492b10c8dd
SHA512 3605ea4aa96ebfdfde63ef25d7718a0d23090d4a4d2a1466ab440805b2a48dda206ecd181379500ee780f0d69a63951055c80d4efc1a7d331319dfcc1b7af04e
SSDEEP 192:tdc2S7x0KDWpHhXZCVzV07RrSscGDH0JOqsmVgz28WhBqMl:v6vDGGVphscGoJN77hhRl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/System.IO.Compression.ZipFile.4.3.0.nupkg

SHA256 59097e2605acf8669131e89a8531546eb8655c81daa737294c55db46f02dbefb
MD5 8b83753e6a992e1b798e74b27cd71592
SHA1 54cbe7d35abc806ef2faa5e5b8f9be09975fc673
SHA512 1860634672767f818f0192ec2b2750693f0d39390f3b7d400cc6fd4f6e74a5cbed27bf49e5980ec85ff3e161c30f6190f700e339a1040c1699b87eb4aa7b6792
SSDEEP 3072:mx6A4vAKvsXypL1GqMvAKvnTxu/M0okSMKGARY95xGogV:mU3vAKv1pL1G7vAKvnTc/KG0Y9pq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/lib/net46/System.IO.Compression.ZipFile.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b5c12e9099643e2eda9b49edd0d98bdaed153c72a7e8e6235d8e78714402d16a
MD5 dcda916372128f13ada8b07026c1b3e7
SHA1 99d6c187de8510206a93d2eed9c65e65e0c86e72
SHA512 d66de5d61cf7090ce2e11ca8064723a44c2fdbd7ed937f1cf4198ebe13083037941b816ad9022d332bbb853666785600fa8b1faca94c498d2f82de73fe1e42f9
SSDEEP 384:dK8Y54xRiW3mWeW+mWE3rq0GftpBj52ERHRN7dldBopPI:dKfemqiuEBHoa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

2b:e3:a3:2d:f8:71:76:9b:66:a7:70:02:ef:69:91:70:2e:1d:d6:c5:f3:f4:b4:cf:e9:62:5e:c5:de:66:cf:77

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

14:b0:8e:4d:e3:ae:df:ee:dd:e1:6b:b6:23:93:9d:2a:c5:d1:47:94

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

12806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.IO.Compression.ZipFile/net46\System.IO.Compression.ZipFile.pdb

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/lib/netstandard1.3/System.IO.Compression.ZipFile.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 db7cb3cf25d563e85a287a77d0c9addf6dbc1907475330a173f4cccc1ca0e6ed
MD5 65306815825ea8652d0ee2163d123d14
SHA1 e8eaee6e9ae5fcdbd19b056856ba0d8424243e28
SHA512 cd649101439099ce741d4c1a1334ce8bd9283d6531585047b64138b533e742808d1097e9419a3936e4939e1d4193488e0451291f4d56d70931e2d87a04239646
SSDEEP 384:Our1AxpitMy7y4eCgW3mWoQ7q0GftpBj3zDvERHRN7lX1l78oWCmtPa:xr183CziprEBRzek
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

07:f0:f7:17:12:fb:26:4b:0a:0a:53:77:fb:fe:b3:98:25:d7:61:73:e0:aa:e6:b0:a3:79:a7:f1:00:d5:27:17

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8a:04:22:59:8f:94:d8:af:bd:b6:23:d5:0c:d1:92:c7:5d:40:b7:f6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

18470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.IO.Compression.ZipFile\System.IO.Compression.ZipFile.pdb

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/net46/System.IO.Compression.ZipFile.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b5c12e9099643e2eda9b49edd0d98bdaed153c72a7e8e6235d8e78714402d16a
MD5 dcda916372128f13ada8b07026c1b3e7
SHA1 99d6c187de8510206a93d2eed9c65e65e0c86e72
SHA512 d66de5d61cf7090ce2e11ca8064723a44c2fdbd7ed937f1cf4198ebe13083037941b816ad9022d332bbb853666785600fa8b1faca94c498d2f82de73fe1e42f9
SSDEEP 384:dK8Y54xRiW3mWeW+mWE3rq0GftpBj52ERHRN7dldBopPI:dKfemqiuEBHoa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

2b:e3:a3:2d:f8:71:76:9b:66:a7:70:02:ef:69:91:70:2e:1d:d6:c5:f3:f4:b4:cf:e9:62:5e:c5:de:66:cf:77

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

14:b0:8e:4d:e3:ae:df:ee:dd:e1:6b:b6:23:93:9d:2a:c5:d1:47:94

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

12806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.IO.Compression.ZipFile/net46\System.IO.Compression.ZipFile.pdb

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/netstandard1.3/System.IO.Compression.ZipFile.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 21abf0c8a5c93fbc1b662e6a4ddb825fa9b3c5cae83c7f6913f5c1e89cee8906
MD5 05678aa09e0cdd844db58484d633d49a
SHA1 fac955a640f73930fd2228489079e4acda64d944
SHA512 451e7eadcf7993fa9ecb04c6810cbec171f902c1c52b25d8244068452fe718d45d5911e09beeb9ae64d9cf20593b18e0a8a3069c1679b441a4b1119df2b7574e
SSDEEP 384:U6CYDzoEWPmWCMIA0GftpBj9VoERHRN7YlraGOl:Lc5qiBoEBCul
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

01:6c:de:6d:ce:ca:f3:95:a4:01:5d:86:3c:9b:d9:13:60:ee:9a:91:0c:5d:2e:3f:80:99:b1:f8:69:d3:d1:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

f3:4b:c7:12:0d:f5:22:85:f3:cc:a9:ae:ca:e9:37:69:a4:3c:d9:76

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.IO.Compression.ZipFile\4.0.1.0\System.IO.Compression.ZipFile.pdb

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/netstandard1.3/System.IO.Compression.ZipFile.xml

SHA256 5828ccb4943d4a75d2d49821d76cdd3339be85f1ebc72fba59845e5b666f62c3
MD5 ce452740b8a2aebf33fe809311d62258
SHA1 2e19a520dac827bc90dece0dbcb6dd9697709272
SHA512 9885abd125cb1b595516163a2e989319b7c146e6338eeade3f7461b77bb9c1e908df79fe70dd890aac430dd12435ae04387942e637d4b9ca921bdf75443cca8a
SSDEEP 384:Ys2WxfBNKwWxfUyKkWxfgSmadOKmaxhwQwQwbNVkmNdVozPDbb:YLmOMD
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/netstandard1.3/de/System.IO.Compression.ZipFile.xml

SHA256 4404ebb83cb4cdf2626b8958eafde160057122a7e5b762d29ea76bff8f7920d4
MD5 b03ee6187f8cb96bb00e6f7f197fdc64
SHA1 2ebdec27af310cf2468ad90bd2314c2985e544f3
SHA512 1a5a3faa2ad550cac4c598bcd2bae552ce8e35e3baa70a9f12d0881071da0eaf617494767bda2a5b8fd442ecef34505e36cd1e001fbb07ca60d7d96f91f2b8dd
SSDEEP 384:YBcXmrjbmrWLSfYOQft3FZTpqF9I2Lg22gmwtwP:YFqAdOY9q/I2L4PwtwP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/netstandard1.3/es/System.IO.Compression.ZipFile.xml

SHA256 e8229aa0207f761dbab5ce29777778acbe0114618ea80f2af4b4d33d60bbfc5d
MD5 052db27ecd8cb2eca1b38b6e557b65b5
SHA1 2e58d62de33d28c7721d1934083dde042317f021
SHA512 5f9db4168761e66a7f48fc3b14e17181e258c68b5991203942db680dbf4ded45d0328e5a43fa1e4412134a8dde07a09a176cdbdbe07e9d98a578947246770d1b
SSDEEP 384:YaZaitZaxXZagQG2bMOM2bhYk7m7qE719RMuORUmcGJrk:YajsgG2AOM2WkKXp9S/+mRe
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/netstandard1.3/fr/System.IO.Compression.ZipFile.xml

SHA256 2964811d6795febb064c4787f21908b3dbd0994bdcb3c91b0fcdafbe65b40eed
MD5 83bba8f1a5b999e66e132e0f8ebd747f
SHA1 ec2fc4c7625064da4a932308e40a1ea49c51896c
SHA512 dac69ddb4cb867834b53640f40a915420fff3e5e70076fb9ba922853fc7e4305106159540d3c7ac12ec1c6f975e382b34d49b91f359d9e766d05b524cdbf7c71
SSDEEP 192:YINTydcxAzTyQcZwAv4TYgHI1owJYHI18zxR3RzQzR3m/SZNZqY29mQgyw8ue5dm:YI0dUQElOw3ezJzdsqYUmQ7vN5d3NmdH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/netstandard1.3/it/System.IO.Compression.ZipFile.xml

SHA256 e7d1c9d07dadebed0fd74522afd86376ab370a19550c8204a6ee91ddace5d5ad
MD5 2fc865e518d3d3019bb8cbde158166b3
SHA1 4703852d991aca32ecbdf1417d2ecf3914f71ff7
SHA512 8a3e6b2eaac8e1a258f76e09be92af67fcc54a98e3dc3d5d45c64b8cc9fa9dd0e4928e68088d8db593f2a54c68e5b40cc323ce02d3f3ef7b9eb13d95139d5ead
SSDEEP 768:YhqOHdPkPrIHEPkPa9PkPL+rWM9PkPL+rHtM9PkPL+rq7:8u3uquanuaT6uaO7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/netstandard1.3/ja/System.IO.Compression.ZipFile.xml

SHA256 9d0bd91a939b467e9b1b3fd74d799cf8ce341d1c456a07e616c59d932c2b6962
MD5 938a5a62db42ad4626b861bc1b8fbfcf
SHA1 e18e1e79bd6848607d7c08ad796a0bedc875377d
SHA512 fe854adf33b84f0a5b8a7bf733038c1a8160d5e5d4a0d6f64e108a6b5b7c554d6b2e1927db73bd8ad38d7b72f18896669b52ae2018ed7d79a21cbda2442b950c
SSDEEP 192:YtTymt6Ty+tbGcTYGHI1oFGcHI1nCR39sG3R3fRSDccayacptkhT6aycAw8FG:YUGqUzOFcDM9cbt41ByRw0G
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/netstandard1.3/ko/System.IO.Compression.ZipFile.xml

SHA256 2890db560ef79a7bd8cfebe7a520330dd12c7e9b7c3f9ec472b2733020b40ea4
MD5 16a205c0852fc0c77acd69191740233d
SHA1 f61af36a614476679b1c816fc7d8080bbd933ea5
SHA512 d4c4ba5ed12600818af44bde81dec3e87c1fa8c57fb6eb5776b637c030ad343e221f2eed04e9c6bb35e686276dd32ba36769b8c7232aa610c8c948478068932b
SSDEEP 192:Yc8sXuTywXqBqTyFXqBCTYiGHI1oVCHI1tf8IR3TURR3Q9SKTL/pcqS773ptm9OJ:YJSN1cJYOJcQ3/pcr3pkfLTOmOAASEP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/netstandard1.3/ru/System.IO.Compression.ZipFile.xml

SHA256 00994e84c9e160306311c953519dc79257436a713cdef308b3e529c2bef64d92
MD5 5b172bcda87129543380c1dfce748c7e
SHA1 bb9a4c8ed47f3d6d55ed9a98ca7138282fb3c076
SHA512 4e4bb228d3975450374d1619d6da8c6d8ddf9d2263514ee531ff7ae1b2224f0701d214248d747aa337a5e5636a3b41adad2a82ff07101bb4613dd17678676967
SSDEEP 192:YqGxTyXAVqZTy1XAVq/grTYaHI1oBfgHHI10R3VagQR3eSAsQrqqugAAbpKc276Y:YeXcqA1Xcq/gA3OBfgIWagvrq62pTsK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/netstandard1.3/zh-hans/System.IO.Compression.ZipFile.xml

SHA256 fcc4c638d92c71b8ea977afe3706d506424d5b88dd98ac4553ffc3dbb3ffd097
MD5 d4fd2195958330c063560f6a84441fbd
SHA1 7f630db39c9f8c24d81e74a19dda4c5bfc1824f3
SHA512 dad41348ed5426de550531908d9310f16e828cc54efed94e856868258a267065f175d6abd85be90ccf6c5d0fcf62c6f53abfd8643171a2d5ead576bea254719c
SSDEEP 192:YtxvCTy7exvkjTyU4exvkT+TYrY6HI1o8YISHI1KyVR3AysFR3CyhSTFzo/L3o8Q:YfKZTQOEfcUzo/L3o1ovnoKoP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.Compression.ZipFile.4.3.0/ref/netstandard1.3/zh-hant/System.IO.Compression.ZipFile.xml

SHA256 5f70bcc57cd9538e3065a05a5675cab5fe0d6d8f0689898ed23f882e4bbddf55
MD5 20ee28d3094860d9b72b3b9b48600db0
SHA1 8a9f16d94e29bee94163b2318c0cb45f2845a4cf
SHA512 7134698395180d6bede9a7c11a1c0d76a2358ef9729d0ea0e1a33a5e2c436341c6197ebce97b9ce7f4fc56cf741c5479680325c9dbd6f12f53d1c6af8ae753d3
SSDEEP 192:Y7TyjWTyg3aTYlHI1oiOHI1LR3yxR3ddSmluQxnCQxy:Yqj7gPuO0GQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/.signature.p7s

SHA256 f484e8477f648c1c37893cea1a68b108b3992ebadb5e65595d0f039c4cc4198f
MD5 f7c72748ef4792b2adab4d216765324b
SHA1 6de989276c3017ff16b05b8ee61c4de080e7e911
SHA512 b192f891ea42ceec3e1fefd5398aed060cdc669b1944f71f74427d9254663bafab75b833051b3146315cd1f62b260eb7dd5381d7eff081e94afd68b52750145b
SSDEEP 192:8dv7x0KDWpHhXZCVzV07xrh89DH0JOqNG8Fp28Wh8nYxi:EtvDGGVpm89oJNNzFwhhiJ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/System.IO.FileSystem.4.3.0.nupkg

SHA256 bcd2189ef95acae563d167d17d82a90eb843a6d961a75a4df026269557764d7c
MD5 1a9ef981fdfe98f2d6dbf5595ba767a3
SHA1 e0f4cb96318505ad4aab2a3b4ea86c0f8c698c62
SHA512 4fb581d6f85b9529a091a0e974633752aa39e50b2be6c8a9e5eca8c2bc225cea07064ccec7778f77df9987deebf4dccec050b1a97edac0ee9107142e6a8ee7ee
SSDEEP 6144:lUiKfd8t+5YEtafspENnBhXr2t/ZJ+hHgmKO1jgPyjLWYl:iiKf59eNnBhXrMhJ+lgW1jgP6LW6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/lib/net46/System.IO.FileSystem.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2d917d520488b56673e74ac9dc610a2488ae70a7ebbbbff097c2e855ba1ef590
MD5 84abec24a10c4d4f4b10887cb85fde6a
SHA1 b46ad93384323ed4aa88e8af3cdee208a88f1f6d
SHA512 54973fd33c986714556c97fe25a6a345b3df42f8b1f3a89d52b639a98d1d58aeb535ab7e75a8df0f0fe1cf4a558ee30e62c5fa4520ce62a837aab227e5a3d443
SSDEEP 384:34Ye1WQYWgWTYWz3rq0GftpBjUVLP4ERHRN7+lXhW/aFbz:3cz3iyEEBIsaRz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a9:af:4d:7c:c1:ee:92:03:43:8d:f0:f3:6c:bd:de:aa:ca:a9:cf:b6:9f:6d:00:0f:49:e8:de:e9:7f:7b:5c:4d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d2:9d:19:50:3d:20:8f:ec:9d:80:8b:ad:c1:a7:84:55:c1:af:90:58

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.IO.FileSystem/net46\System.IO.FileSystem.pdb

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/net46/System.IO.FileSystem.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2d917d520488b56673e74ac9dc610a2488ae70a7ebbbbff097c2e855ba1ef590
MD5 84abec24a10c4d4f4b10887cb85fde6a
SHA1 b46ad93384323ed4aa88e8af3cdee208a88f1f6d
SHA512 54973fd33c986714556c97fe25a6a345b3df42f8b1f3a89d52b639a98d1d58aeb535ab7e75a8df0f0fe1cf4a558ee30e62c5fa4520ce62a837aab227e5a3d443
SSDEEP 384:34Ye1WQYWgWTYWz3rq0GftpBjUVLP4ERHRN7+lXhW/aFbz:3cz3iyEEBIsaRz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a9:af:4d:7c:c1:ee:92:03:43:8d:f0:f3:6c:bd:de:aa:ca:a9:cf:b6:9f:6d:00:0f:49:e8:de:e9:7f:7b:5c:4d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d2:9d:19:50:3d:20:8f:ec:9d:80:8b:ad:c1:a7:84:55:c1:af:90:58

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.IO.FileSystem/net46\System.IO.FileSystem.pdb

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/netstandard1.3/System.IO.FileSystem.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 085359e453dab0e45146b4021d5fc8851eb014209304a0b1b007a1d60f7dd085
MD5 d4673f47d5ff40164cb471b06723dec6
SHA1 e52fd9a091ede34613f1f73e448578f0e9998a39
SHA512 308361833b867c841a2402dc555418d09b6183bab2980b8c6b9288648b06fade3f8050cb60dc8a0e1e5b06003da3c1581d09bdbd02f69bb06c0877cb31be20b1
SSDEEP 384:z7eoRmvlJlyTT9U67MM5FbiukZLhXmXi5NW4YWOQpbMA0GftpBjKGE6ERHRN7OGG:O9s5lKlW+JojiQT6EBOZN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

ed:70:c4:ae:64:3c:dd:92:ef:d3:99:55:e1:bc:32:c0:8a:cd:1a:5d:8f:ad:c1:1f:0f:ba:6d:cc:a8:68:11:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

23:2f:f3:e4:16:ec:4c:43:22:9e:e7:3d:60:6d:13:e6:d8:72:82:1f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

19338

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.IO.FileSystem\4.0.1.0\System.IO.FileSystem.pdb

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/netstandard1.3/System.IO.FileSystem.xml

SHA256 bf122c7cf894a1ded43bad65c6bc18310f0959be759a5af1945f80026a265e8f
MD5 9955b0fa9f593405856c3c2dd14fc4a8
SHA1 962d1f7014111bd68dc91f731a6da5971c171c0a
SHA512 5e4ca392283ecbade9d6b6d8a6bda65c334c73be2b601a3a7cf61a24fb08e2a318ecfd460c95be2bce16808ebb64294200bcb699d96e6bd89e0e80d3671df40b
SSDEEP 1536:sO3fj3rK5dgNJt4w3Qr5VF2o0OZkOlYMIp/BkJ:sO3rK5yQwYe5kJ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/netstandard1.3/de/System.IO.FileSystem.xml

SHA256 efb1ea330042d31a44a951569f26ea827bcf7619ce24a76721319db6f5578c47
MD5 f6443e3b26c45b1234388b085d7b0f1c
SHA1 f18d5a574f9a262bd3241a429cc24032289edf1c
SHA512 b866ef57cdf0088548f6a7f0a2491656bcac3c8d7798c935b0aa38c711b507ec1d68f147a0dfba86616d9e69ea20e673aaeb9c3baa92eb15d03365841e0771e7
SSDEEP 6144:8D9WTA3H9Fik1U/DUWLf2BHgcPZ/dPad5iL:EWTA3H9Fik1U/DUWLf2BHgcPNdPad5iL
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/netstandard1.3/es/System.IO.FileSystem.xml

SHA256 39f3bee64397185e69f8d0c495d4c8d574cba875ef9655446c3278ad5ecc9af0
MD5 2709a28224d8291b14e1078f812e938a
SHA1 097f01022458562489fcd20128bc292b3a3d9c7c
SHA512 aa06bdabeba70a977c6bb01a5326dbccaffbd17b30aa3b614f39bbbb738b054eed2e1aefeadd08fdf5762490ebaf09ce711183a50c260498c592b9d38fdf51fa
SSDEEP 3072:3ZmZbZwZnZOZJZdZyZdZhZRZDZkZ5ZOZQZBZbZLZgZlZxZsZYZKZzZRZ0ZuZiZ7T:ao
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/netstandard1.3/fr/System.IO.FileSystem.xml

SHA256 e82f7f211bd63a16faebd4ffa89aa9f6bb6013593f442a553b2a0e6cbc54d410
MD5 b290ee7aaa47b7ab7ac77d05bf88a9b6
SHA1 35e5b2c0954eae87eb803912cd5e9926a259a0f1
SHA512 ebb27242ebc2e678a6645c3fbb21957d19cd7e98a59397424e29e4b4f8c65ff121a6c7b567adc2770b6c3283a564b526889945803f37456dc4ec817a40011042
SSDEEP 3072:RhLKFQfgvXHvMnriV/sJFpjHKLSmscayyy12181j11i1K1Q:ZI12181j11i1K1Q
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/netstandard1.3/it/System.IO.FileSystem.xml

SHA256 82f48043c3888e84bd693c8a190222d813c457aabfbf80e0a468e53a60e0ff20
MD5 b730978162a4ae9f68cff1846c7a004f
SHA1 4bd94be6de44c1edf7a797b5c8988266c6a7e1c6
SHA512 2e97eec9ced78704f87a768fa6bd8de3b60506bb56d5738254e3b1b41ee714db89f2a1922d3de048bd954a478fad7a4771049a4415b59a9441bad1c552f0e3bc
SSDEEP 6144:3owoKUwCuUhUgm1ZDIjqzDvTLLp6HU+ojk7IwQWEtDv4fAcs9ey63/hh4qhp8XSf:m
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/netstandard1.3/ja/System.IO.FileSystem.xml

SHA256 5bc1c01fde339e80e737e034161d3bb407dfb474b1feed9f22fe105ee2081b9e
MD5 64013e7c0afeb8a57410d4df25d9c99a
SHA1 86a0abac7065854491f2f5c7ffb1458233a3dc54
SHA512 798e26964ea88d18738cd15ead47a81563a3c77a361d4eb97a36667a1e59cd9bc0512df54d35099e43c9ab76654dc6ce1954bd47d99f9e3c8fd2b350c2a92fd0
SSDEEP 768:YWqaIRLMplsssexr/dlfzV2awuNFNRuJQ3bmxxYH:deLgsErZl7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/netstandard1.3/ko/System.IO.FileSystem.xml

SHA256 9aae5ba3c48c50728215f32d7b5b601e631ce744d87d242a5719eea0eefce7a2
MD5 cd25295675f215c20156c5da2b3ae8c9
SHA1 1e7e38d63b014bfe6591b29e65d50e7acfac6c11
SHA512 cb336f91b6d1f9c01f5abe89af4be580bc6b96b0b37fb4e0df27192df45d9d117ea36806a62b97cd008145b997f9ab31919d78f5fb27587397f82f356d3fe6e8
SSDEEP 6144:XXnnExUgcQsYY9l3blQLl6T6KCf1o170SjmjzyJryLi6/hUZ6j:XXnnExUgcQsYY9l3blQLl6T6KCf1o17q
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/netstandard1.3/ru/System.IO.FileSystem.xml

SHA256 85f7d50551fcdc9f76dea35ab0b8fa9bd32b19ad2b68d3ba51c11ee70e5b0623
MD5 117035162fd61de271d2f407fa45bd4d
SHA1 fb9021fcb83916fe35f602eea6f89fee7c66d3b0
SHA512 3ae6154ad67199265c5d1199d96370ae0eedfebd42f4400b807edf4749c68de00cbb307708fa4b5cb7ff9c6aea197054f9eec17d8720d7918e5c30fa114958ef
SSDEEP 12288:ZOjGrLP//CseGvGZ/GIaHzHr07WOZnETF8tvY7F1TU5fNWWn4LiG:+wP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/netstandard1.3/zh-hans/System.IO.FileSystem.xml

SHA256 6038d0bda3329c43efc51a0e158547a16c907d00a3331729a7e3c6f05d0a49df
MD5 fd9e730dde612457371e5a2e407cfcc7
SHA1 4ab9b7705c98ef501ef3dc3d4eb9c908797ead4d
SHA512 311ead92690b0e081d8b8814bcdf3364d9b78a3163f0ffa62ec2dd52a7b64bf0d7cbb85045d8ed405a09e30556fd87eb456829c101560202e13e27f2d776a7c0
SSDEEP 3072:sB4kdkkF5APZtdYI6H9tBdir8MbkcfQS/iI:sXMZtd2iweJoFI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.4.3.0/ref/netstandard1.3/zh-hant/System.IO.FileSystem.xml

SHA256 31fa40be5e70fda1ecc9a42180c40441ed5beaa1cf3d91c0e8c8fcb6cabd7b89
MD5 307ebdc4db28ecfbf815d9b77dca14a5
SHA1 dc9373b7d4724d8fdb82e78c45b9e4a4d0242038
SHA512 33b45fd28a77388ed2b8f3a366603464f1ff49e7f546c2ea970b9b778e25bfa84a63bdc3acb46033f02ee61febf4adae0f49c735bb98566cc178543b6facf9ba
SSDEEP 1536:8yvFssFTq9ZkgR+4eAGSYMuFWm6YIvHc27W78wXs35zR4IK66/:8Dv9ZkgR+4JRHvHcmI8wXs1R4IKt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/.signature.p7s

SHA256 ad2480d75401e2806aad3bfc8ff3a8b56a2bd6bd501421d0170f1be49093db45
MD5 f1a532c626baa11e5fdfb388ee4702ef
SHA1 8bd954486be962265d674ddca2ee0efcd998f4a7
SHA512 83f5a017cfde333a70d89bf8727f294b26847a18b376913c5555b3fe9267d0a2177a0f317f2ca6032d12f4eaafd01bb8ea03d4419bd326e90445aeb05d6a330d
SSDEEP 192:8dD7x0KDWpHhXZCVzV07xrOC6kGDH0JOqsmVgz28WhBqS3R:EpvDGGVp+GoJN77hhbB
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/System.IO.FileSystem.Primitives.4.3.0.nupkg

SHA256 2cc9df83c5706afb3d70c9eaf67347f085ad02d49f934fc5cb8b3846df6bd648
MD5 33ad79cab9e3d3032dabf2d6629d209d
SHA1 30bdfe189a53ddb592e41c5e059883a1f753bbb6
SHA512 5885953d09582cffd973d23a21a929064d72f2bc9518af3732d671fffcc628a8b686f1d058a001ee6a114023b3e48b3fc0d0e4b22629a1c7f715e03795ee9ee5
SSDEEP 1536:tx6voUvVMQb0unr7hWXiJQmjn6wLZLQb0unr7hBlua/6RQSGqMaIc43hZDu3:tx6ApQb0KnqCrrT9Qb0KnjnFSGE+i3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/lib/net46/System.IO.FileSystem.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 02a6f9601aa48557fc5c3bfed80e31762a0785b9f78ec568c9f2f0722eeb9c0b
MD5 17a701768a6f07f5f96a07a8a37bc8bc
SHA1 8374975ca07a300021ef0acaa4f908d5bfb102fb
SHA512 f8ee9515d4f3b15495c19e967c8eebf31cb5fc61a0e034d02ef03360515f970656ae38404f27f5dfb0fb61f423626d89ccd2dd4e08bb5f5cd7a67813f40b78c8
SSDEEP 384:7zwWdkWuW4kWrQ7q0GftpBjNJSERHRN7xl78oWCmtT:7PSEi7JSEB3eZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a6:e3:30:2f:14:9c:22:6c:30:3c:54:d8:5d:f2:bf:2f:c4:d5:cc:81:22:31:0c:e4:81:05:82:1b:03:87:16:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

08:45:03:f1:6e:a5:b9:c5:49:da:3a:fb:59:9a:39:00:cd:a5:b4:d4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.IO.FileSystem.Primitives/net46\System.IO.FileSystem.Primitives.pdb

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/lib/netstandard1.3/System.IO.FileSystem.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41827a243276042ff86263ce8a186b53f284a5660684bab98bbb0d1204de5c4a
MD5 d92a01d06b829f1e115e47e89960e8e6
SHA1 f94e16c907915350c9a7fbc49cebe7ca046e50b7
SHA512 c90ecd13a4985dcea7efee7f339fddc06cf434a723ac5708fc1e8a2383c2c98e846c47a60569279362303c63108e59362057c93c325cc791e97a7f34bbf7b7aa
SSDEEP 384:QdO4NU1WdkWq3rq0GftpBj+9OvfERHRN7J/hqldBopPzT:IBWilvfEBJ/huoJT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

fd:e8:9f:a8:8a:9f:87:cd:07:6e:a6:bd:cf:a6:f7:0a:3c:9a:2c:71:0b:61:7f:05:28:ab:4c:37:79:b9:8a:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

55:4b:36:2d:09:b5:47:27:e3:d1:97:ff:d5:9d:b0:27:a3:45:4e:f2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.IO.FileSystem.Primitives\System.IO.FileSystem.Primitives.pdb

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/net46/System.IO.FileSystem.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 02a6f9601aa48557fc5c3bfed80e31762a0785b9f78ec568c9f2f0722eeb9c0b
MD5 17a701768a6f07f5f96a07a8a37bc8bc
SHA1 8374975ca07a300021ef0acaa4f908d5bfb102fb
SHA512 f8ee9515d4f3b15495c19e967c8eebf31cb5fc61a0e034d02ef03360515f970656ae38404f27f5dfb0fb61f423626d89ccd2dd4e08bb5f5cd7a67813f40b78c8
SSDEEP 384:7zwWdkWuW4kWrQ7q0GftpBjNJSERHRN7xl78oWCmtT:7PSEi7JSEB3eZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a6:e3:30:2f:14:9c:22:6c:30:3c:54:d8:5d:f2:bf:2f:c4:d5:cc:81:22:31:0c:e4:81:05:82:1b:03:87:16:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

08:45:03:f1:6e:a5:b9:c5:49:da:3a:fb:59:9a:39:00:cd:a5:b4:d4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.IO.FileSystem.Primitives/net46\System.IO.FileSystem.Primitives.pdb

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/netstandard1.3/System.IO.FileSystem.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 59b19446736f534215a4980fbfbf35adace9ef41b90376550376ac3097a82985
MD5 f14d486a92311a98f252eee690ff127b
SHA1 6d7887d49352eb14eecfaffca47d23567b182956
SHA512 af73570d510475effc530309cd200ca426e608e67b9ba95c999c2398ad25991d064e90d5a2b9f368f013fe8a0c219a09ba215771ef62c04984f0ade9e0c9da02
SSDEEP 384:wULX/prdWlkWryAA0GftpBj+g8bERHRN75RYdlTIw31nRUd:wYtELi4EBo1Ro
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

be:e5:ab:1a:8f:20:d7:01:92:ae:a4:9f:3b:81:3c:14:0f:58:94:4c:b0:81:8f:5e:b9:71:bc:f8:c5:b4:ff:c5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

1a:b2:20:b5:1b:0f:a3:7f:0e:68:94:e1:71:fe:cd:14:7c:b4:d6:83

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11442

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.IO.FileSystem.Primitives\4.0.1.0\System.IO.FileSystem.Primitives.pdb

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/netstandard1.3/System.IO.FileSystem.Primitives.xml

SHA256 7a767d983244b0015f239a27441e9a6e733bf4c5e53785c2d5bc2ac902c9761e
MD5 993cead691633edf05fa9b87415fd0c6
SHA1 1f1015bb037a46023c301f67a15ba77c5a0b069f
SHA512 561030fbb9e59303066ec3f69ab8896c60c9a424e62967d411d0a9f5c4d3da835a31ef1e5dae21f3ac2739d7ef8945d0759624dd1bfb3ef0193b81974a6a3851
SSDEEP 192:Y68g9QcdmY34YZdpn3TmoWisWSy+ZgQAkiyf:Y68g9QccY3njN4IHyf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/netstandard1.3/de/System.IO.FileSystem.Primitives.xml

SHA256 327986dd78012d7590772e9b7769925dc03c4ef761be065cba725bc06b27ad8e
MD5 7d90a3f012222d3c22938744c6993ef0
SHA1 5d702911d2f83ab16730662307f247b2fe80e79d
SHA512 e43f19edb38672ce7eb03ae3957753e023ff33397b0469343c6950eca4901170bc8afd2eb3dee07d18badc7c01cba94d2590789dfc4d5164bcdbc0b5178dc491
SSDEEP 96:YaZ9qtAe7L3vilOvutt2izUCpQQPxj/zVlVMOKkWF2wWPvBo4x++x2Y+R4qdmEpl:Y69FEw2igClvzLWFq/6I5nsREAEWEW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/netstandard1.3/es/System.IO.FileSystem.Primitives.xml

SHA256 53ff03133e301e36274d99f7f03eeaf3bd761e7cf3559ab1920c0d91e63ea50a
MD5 73639e5073710d7863ad6a384a95bc1b
SHA1 ce005ccd93be9fef106f846bdbdee862ed30a3f3
SHA512 f599207a96cf8c7182ad72e83d7720ec20016f7e63fe6bad60ecf9b5ea3fc720d1acdb722bf94861cafa3be6eb4e40afad78cabed97ef574ce5ac35bf14505b2
SSDEEP 192:Y60Fmbx+lQB4q45/EDkWG3fHIrgzcaRbiOWixXV:Y60sbx2qReIHrOWixXV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/netstandard1.3/fr/System.IO.FileSystem.Primitives.xml

SHA256 aeced1eef72f9bb06b711d88246dad00710355d3648f0a602862a5a9c822f28e
MD5 3918b124e79709cf78a67fed53725d74
SHA1 ee424979eecba8f5558143930d91f8c3a13d094c
SHA512 d1c57ab6a8ecb705dded9d09449ee0c30f1eaf26d4266c18ffad50772312e5ae4732f1f681769e54af3a9fb0d1df38034ebb75e88a9df52d669ecb66ef94dd3f
SSDEEP 192:Y/D8fLLHzgcWC46GjvDaDOebqN51+FcU8nwnZkwC9:YSLHgcT46ybaDPb61Y8nwnZkww
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/netstandard1.3/it/System.IO.FileSystem.Primitives.xml

SHA256 b1bc9ba2dbb7d95456e7bba71c5880528acd63e279c34c589a497e9879a634ff
MD5 a08b3318557dfee6e040e770d7be1c93
SHA1 e6e8417d947767d7122e52803aca7b31393d592d
SHA512 cb6a46c10e99fd728449e8de41d710e982fec02deec61b3acddc98b1e2f9c7c1c098711182bc728353316b94cd3739972f6899a7c8b5bca5dcfd6ce4536cb6c0
SSDEEP 192:YR5oUfGwXTtqd2ghk4KKm+VaHYrtN4LJ2nxSvm2DLDZ2nVEfgu:YR5ow9Yy4HCu8bIygu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/netstandard1.3/ja/System.IO.FileSystem.Primitives.xml

SHA256 4348bdb131dccbd08c19dd6d9b404a7d0f88074ea640339fc97bf402db66cf9b
MD5 dad4198c677e638174af4caa6fedb4de
SHA1 891f64f99562d2d3dc271e8c12588c416cb372b9
SHA512 f9401459ed2af2890980f1b606f3d7dc70b18fba858295d4aade87a522458976c61eb8b0aacd379db0a7c89503a8176a36457ea389110b67b69d1453af6d34fe
SSDEEP 96:YahHDYHm3aEi7LWCjV7gO1iD+1JLq7tu7sIkpanRo0oGlEeVhBo2yTVhiYVh+mV8:YdZlQXGI2yTHiYH+mHA1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/netstandard1.3/ko/System.IO.FileSystem.Primitives.xml

SHA256 eb12251204843125c7a6d0e8e167df4592862b0e7b7fd2b28401f962e0c6e163
MD5 86e56c8e179d3836753a8ca5e232e1e6
SHA1 0bd2fff9073263170d98d30bd66269a75ed3365d
SHA512 dae70411394865c49d175d0871f4da6aa651d602423b2d71824f1bb35ecb5186969205fccd5c82daa2f7031fcf98125efe96420dcf45b64e59faade34bc9e665
SSDEEP 192:YkQnR5guRHEeuuOFJTCl4iijrXQ+VNQiVWQnVV:YkQnR+uBE3uOFJTc4iinAseA3VV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/netstandard1.3/ru/System.IO.FileSystem.Primitives.xml

SHA256 4313d770ea3a1a1c1ab62534de2462179ea1167b441a5fd71b88d5105b622710
MD5 41ffdaf4ad5b4d50db5cc686eddea2f4
SHA1 8e32408bf4a83f057ec592fece9511df752c50fe
SHA512 760c335ca7215d22398ec1f88d83b6eb3c390b8c2f763a08bcfb00c3418618408f49d46b80ad5c664897f1355b5e3bf3e1644391e7abf39c82aeddccfa006b02
SSDEEP 192:YObKFCaW5rRVB4brsGVfOLDDZNI8HpDCMiOlFcMGvs+S:YTFCairRV4lGDb0MiOlB
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/netstandard1.3/zh-hans/System.IO.FileSystem.Primitives.xml

SHA256 c59653afb98e4d66749d125b4810ed3a333763791a6eca611481d83e6ba2d451
MD5 7a94c60cbc9556b808c9b5dbdd045fb4
SHA1 b2463220e699b4ddea6f0ff4b198850fd9be5c2e
SHA512 be68266edc0b5050a04f6b99d70eeaf81a65ac513d3cb463281fea59f1d30deb8d82052ddd830e26d3301e52de19d52c999c12fa478587decb7fb6e961d703d5
SSDEEP 96:Ya4zXcaJ9j3OYsCjm2uBPHHIIvl921Nvp52+a8aSaI:Y/ca3je7Ci2uB/IO3Yps5P9I
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.IO.FileSystem.Primitives.4.3.0/ref/netstandard1.3/zh-hant/System.IO.FileSystem.Primitives.xml

SHA256 73d71cd252b3f903883eedae6e204d097358f53ac6fb1e6d08f803482c66c053
MD5 3c6cf0be5e55ccec130583d83394cfe0
SHA1 c0e5377cfa0b74a981b683abf319bb42cbae2980
SHA512 3831f58d3342e6f14d8284befc74ed3334ed1ece8cc8276de16e32e8bccac1c6ef442bbe18b1e9e6d84b80ffc4cbf1127490ddede9fed36e205f59c57a7457a5
SSDEEP 96:YagACOCfngP7LMt1nAeTmj6FVeHNPlfv/ufdLOv:YxACOCKaAeS+FVct3mfdLOv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/.signature.p7s

SHA256 a95bc1383e3092d0e17f2da46e07d881b257344118f79153cc538032b48473e5
MD5 47f3b223eb8efe34ae44f1bf44322133
SHA1 9e24f98ce221b0944cc8fcc7b8a30dedcb71654f
SHA512 fdd509340ede08fb100cc49c2408ff1c233c7f001b200b1b5c4a171dd9e71643e090d8e2e5315fde9763497a4da3e1e0527b060b38ff6feedf62067366562bb0
SSDEEP 192:xd47x0KDWpHhXZCVzV07Vr19DH0JOqNG8Fp28Wh8npWfH:jqvDGGVpy9oJNNzFwhhipWf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/System.Linq.4.3.0.nupkg

SHA256 479ba248bde5e9add7ad74922fa8f3faafcf732550cc4001ca2b9764d4aa0ff0
MD5 f0348e8e1fdf81b24275c72c14335976
SHA1 ea337ba4cccb2766a7b9b04aebc7184fdc33a7d8
SHA512 eacc7fe1ec526f405f5ba0e671f616d0e5be9c1828d543a9e2f8c65df4099d6b2ea4a9fa2cdae4f34b170dc37142f60e267e137ca39f350281ed70d2dc620458
SSDEEP 12288:UpiHwvgwGQ9yjnOCkz2e67iPnaCpDe62UZOnnWC7Le6v:UpEYgW9snNkz2egYn5pDe3ywn17Lea
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Linq.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/lib/net463/System.Linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4372c6bb9fe879f6377a0d60b52909041089aa963c1bc2903262ef56bcb4cf76
MD5 c492bdbe05984c5bf01546df151e620e
SHA1 714becd740834a132ba42f0160bb5b7e4bf9fdf5
SHA512 de589c51247f7cc48e7271e61eef04c74e633fffd5c839121cc1051b58c4edbf766a5475b071467b67d79bf59f6af5d0faff1cf4b837ed7992274d312830f4fa
SSDEEP 384:KIfzt8P6Y4gwgdTiWRRWWWkRWb3rq0GftpBjmkERHRN7Jl78oWCmtd:/LhY79x9oi1EBPez
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

ab:cc:ef:3d:55:f8:92:65:24:ea:34:3e:ed:dd:47:ac:03:1d:c5:73:ef:d5:b1:f0:e3:db:1f:a5:74:8c:eb:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d7:0d:8e:90:38:97:b2:b3:06:af:49:4a:8c:2d:85:1c:1f:c2:fe:ec

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

12638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Linq/net463\System.Linq.pdb

LegionStealer V1 SRC/packages/System.Linq.4.3.0/lib/netcore50/System.Linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0313751f70d6c3d43fe74d995e3356fc4320259964c12f6dacf786b1a1034708
MD5 3b2b45d3509312c4d796b1ddea75c900
SHA1 11252d7a7b325144751a710d69501d147890cbfc
SHA512 700b967090c4d3e227fdade2a67119dbe28ff07a89ed749b84bc656d22091f63b1c40ef43375617599af6ff4eb6c14c276ab753eaf6ea4ceea7412c81739db91
SSDEEP 1536:nPNAPFi9shLDzDRPeMM4eYVy0OnicQ8oyNm4ga:nPAFi9yRPehYXMlN4a
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

90:c2:03:c0:ad:aa:74:27:ba:ec:6a:7c:7c:27:57:8b:fc:da:26:36:a5:ac:52:0a:59:d2:eb:05:b9:58:28:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

98:b1:1e:f0:88:1c:90:78:0b:3b:ec:29:b3:63:45:3e:37:4a:15:9d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

89206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\\FxCore\x86ret\System.Linq\System.Linq.pdb

LegionStealer V1 SRC/packages/System.Linq.4.3.0/lib/netstandard1.6/System.Linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a0884cf5df50922da66e5e62d0823df4802b2982a93b92e0c4d96ac4745a79ef
MD5 e5067294dbb673c1e49e5288c49999cf
SHA1 866b9a8a7dcb00a90990b6cef915e48464ce2fd7
SHA512 7c664c505df878442e94d289ec38fdc0e6e2a8bf572514c378090647372a0b9b93466b3075360bf85497f446c6ae26166f79a99132cf039f6e0e58719ff71651
SSDEEP 3072:bxanP/dsGl5MaqqqMAgeUf693HCHVqAGEHN:Ks8Pf6JHCnN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

ca:28:25:5f:42:cf:fd:83:c8:e1:e1:c2:e9:f4:f2:99:ae:ea:90:ed:8a:0a:d7:27:f3:7f:69:4f:74:72:1a:f4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a6:85:82:38:ef:5c:8a:c7:14:c9:4c:fe:a3:97:35:d9:e1:81:fa:74

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

117842

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Linq\System.Linq.pdb

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/net463/System.Linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4372c6bb9fe879f6377a0d60b52909041089aa963c1bc2903262ef56bcb4cf76
MD5 c492bdbe05984c5bf01546df151e620e
SHA1 714becd740834a132ba42f0160bb5b7e4bf9fdf5
SHA512 de589c51247f7cc48e7271e61eef04c74e633fffd5c839121cc1051b58c4edbf766a5475b071467b67d79bf59f6af5d0faff1cf4b837ed7992274d312830f4fa
SSDEEP 384:KIfzt8P6Y4gwgdTiWRRWWWkRWb3rq0GftpBjmkERHRN7Jl78oWCmtd:/LhY79x9oi1EBPez
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

ab:cc:ef:3d:55:f8:92:65:24:ea:34:3e:ed:dd:47:ac:03:1d:c5:73:ef:d5:b1:f0:e3:db:1f:a5:74:8c:eb:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d7:0d:8e:90:38:97:b2:b3:06:af:49:4a:8c:2d:85:1c:1f:c2:fe:ec

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

12638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Linq/net463\System.Linq.pdb

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netcore50/System.Linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5d044f93bf24569a49a0871943c5e11b801875c76da96d09a4495a787d061069
MD5 f81b2d11548f481f3a078bc4b9d7ebf4
SHA1 7580fb771803ccb8f0be72c524637a2d2a30c23e
SHA512 0622604d252d0949a68f32c5f5771ca6222121fd6b30a012dd8438064e095f993561b131229bc492c691d424a69f082aadf13619af71bec3ca5b218104d2febf
SSDEEP 384:N9UhyjAqro3U8oI0/odo59kzHGhiCpoeOAPJBery2ZWhRWK1LHB0GftpBjmKDHR9:N9UTq03i6HhCpoxyBZWitDfiUt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

3e:e4:61:11:00:b2:88:8e:e6:8f:09:00:7e:91:84:4b:99:8f:5f:e2:24:b3:2f:39:ca:43:ca:3b:88:e2:f3:38

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

bb:1d:5f:96:95:9d:d0:26:63:d1:06:4c:59:49:cf:fd:88:57:0b:14

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

23518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netcore50/System.Linq.xml

SHA256 a2612416949ecec128115255b4240484371857aba2c3c745ce0a717cd1ab49d6
MD5 3760ceeddacd1e78452639b0398275c8
SHA1 e8565ba3ca3d993f76de093ef76814f869f27140
SHA512 88a9b5ba0df6c12ea4bd746bdc7f659c8bff50f42b5411e5c89cbccb041fd61c5aad7b222a2da90ac8edc0aeacea5d1e98b9d68da544068243a0389997b39d86
SSDEEP 1536:8G0Opu5tOInj5IvgJkCHXeJV/xVaV/nE/BGrlGxPDVfvnidRUjFGoux4OX1/PR4K:xw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netcore50/de/System.Linq.xml

SHA256 6a55fca7ca7b0c1ee4599af3dabefca2b50b1739c8629a36b1711bf495583135
MD5 4e6c14f2dd107b80af1bc59f15e86b7c
SHA1 3d993fd8f833eef4b4c6da42f535cc1abe3a5217
SHA512 e2ccd2648a50f1ee29541493ee125584e76763f3d711b65f3abff225951949dacded30795a4218c72bd3201c5a912ba25aeb1027b87ebbfb73506ccc80a839da
SSDEEP 1536:aVzKzfJ5vPmUai4aiv+O+uGt36id55g814Xlcngaw92RslKmgGU6XJuJTRqgY/XD:aVzKz7PmU8LvxhqU4qLQG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netcore50/es/System.Linq.xml

SHA256 364fce9a1f404e39c1c80ee59e6acbfb2ea867dbae0f02a0da0b98acf0f9d1b0
MD5 a4fd0093c474a52516be882f290fd99e
SHA1 7d9f781d9ef95c78fc1461e6f0dcfc9ab9c07e45
SHA512 30bd66b07cede144823658da7bc0ffe95fd435ebafd9dd1c6bca74f06dea559f184d92c8b236e224892b25ae4131cd9ebe0c60ff6868e7e145315460912b706e
SSDEEP 384:YnjTvCNwv57NWvDO226ETA2DeE09EGRvI1kSZE7tSsMhAHdptBKkKlvx1PG7oDbZ:YUaDrzkHGhisrZXNnSQn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netcore50/fr/System.Linq.xml

SHA256 6883712d7eccd3c2dd7619d16f8b9d6cc1e17b45bcb2f1bc93d60a0a4b8eadb8
MD5 665f88309b75cb834adfa42aaee2a237
SHA1 57f774990911584de3e51e6d0c77f96294f8640c
SHA512 8bc0e734fe0287a1b13556184ac74ebdc379769920d9e70def9bf603bfb280259accdd2a2d1cb9fd2df5d33b6d530ebf368eb19e163e3d535b330f459714ad71
SSDEEP 384:Y5mjFnuU+NIymuYCYxaNWyjVYCk6xfd+mflW+gTax+wUrAKFxSIW2hiEebCJ+kYQ:Y5Z1bjujAa+Z7LhHTi
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netcore50/it/System.Linq.xml

SHA256 f1059728fe52ceba93d137e6c646dab3a7510c50da31740eaf603b420ca7ccf1
MD5 cb2afc215a45e3ce3ffc34eac18928df
SHA1 68af2ab6e2e750720e89acebcbad3c5f01c636cd
SHA512 09f0a7d17a752e9eaa5a23c1802d46b96c96bf34fcd5f9bc9e700c9945e4c01a6bab8535f009679a8fac6ee403b0a0663966bc59cf53d1b83601abb561d94927
SSDEEP 1536:/6zKPRIY3oAvpskK0XvPBeFl7npeXV7cUt5Z:/6H0Xvd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netcore50/ja/System.Linq.xml

SHA256 ceb0eecbd8b95e170c3844b3c28fa51c5ef5e8c7af65f02b8305d448030b8c83
MD5 2076122b4fe29b64fb33527072e9dd36
SHA1 2a33d1c8065bcef1e65efdeb4ff326a656571f63
SHA512 b705d71cb7f6cff22868c807fac2a9be5f376e1ecc81131dcda847e8a8fe81bea435d1895af96e4f9b345d871e4c3accd42d676ea5c390b0b6275875fc8b7a61
SSDEEP 768:YLFZV0lKbmoy3SetXvRJYgjeobFN/wq54qvn:QV0lKbUyqvn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netcore50/ko/System.Linq.xml

SHA256 35eec1a0c302818ab124e9e0f6d7774aedeff0d3d05f20db4e24c4c309177f30
MD5 baee5969671c80966f067260c691c9d9
SHA1 87b0771061df1fe5faabdfc2698c01987ad97309
SHA512 8220f806406a17a46e047bbbdfead9b2c80bad2c8487ffa254e7d448904b1dcfbb510676df264c8ec4496cf8143788bfdcec07483713ddafb7a4e16fd1ec1509
SSDEEP 3072:ZIUrCWFXQgXRy7b8tgUIcoxtbChXTppPZxVGq+0N0CYBP710jiDy/OPSiw97Dl:9oxtbChXTpYy/OPSiw97Dl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netcore50/ru/System.Linq.xml

SHA256 2ca6a42a8efbf8148e6716eecd5573b7d3079b97d53cd99aeebdbed43291acfc
MD5 16bdce8d8f42a12340ace1590da598c8
SHA1 96977078138a64ed070722d8a3c3abe19eb13e68
SHA512 2c789b6205c3a10ef373674e26b0c12167f27e52e5ad3f6cc5a4305aaf77230e8476383a71970cb8260b33162130c83e7c1aa6f25e6e70c64bfc130919a41591
SSDEEP 6144:yXgGKL40g6lVYK9R71KPxE6b8zvQN6A8Y1J:yXgGKL40g6lVYK9R71KPxE6b8zvQN6AV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netcore50/zh-hans/System.Linq.xml

SHA256 e28e701915a565465734d4d9431367ff5ac3232d2fd418186caa2b3b9260a0d7
MD5 39f1d9c42a07511536d56a382de1a00b
SHA1 9bd8fc1f6d457e3b9663370f1cc20389698d37d0
SHA512 5d2467237a80f4ad3dc2893df4ecbaf15671383b819173f54cb126c1ea0f8cf07023b3f7c88da63ad01569739e5bc4f5f6238cd8bf10cc0574dd29b8fe73e86a
SSDEEP 1536:I7sv5VVj2KJkgmmThTkXTxTwbiGGmVzMtKQmly:Wsv5Te
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netcore50/zh-hant/System.Linq.xml

SHA256 50cdd7cacd4cee3d89ed348715ee5a02b37af4b7babc99f448c985cb5451594a
MD5 779026fdf284024ab73532931c2c83f1
SHA1 3dd4ca4b580d11bf4f32058d401579b8f58f5a4f
SHA512 7d9975044de12208f7a31184fd1865913443207b955160dc9a9a895dd04a3a826cf8ed1694bf8249e4d702bde6eba9404411adb1217fe71cc8d9d29d947dfc6e
SSDEEP 1536:nQ4g5p7MpdVs6v5vAUMssbahLxWauS6dFQL3FQjNC523Y7GgN:nQ4g5p7MpdVsbQL3FQjN0aW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.0/System.Linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5d044f93bf24569a49a0871943c5e11b801875c76da96d09a4495a787d061069
MD5 f81b2d11548f481f3a078bc4b9d7ebf4
SHA1 7580fb771803ccb8f0be72c524637a2d2a30c23e
SHA512 0622604d252d0949a68f32c5f5771ca6222121fd6b30a012dd8438064e095f993561b131229bc492c691d424a69f082aadf13619af71bec3ca5b218104d2febf
SSDEEP 384:N9UhyjAqro3U8oI0/odo59kzHGhiCpoeOAPJBery2ZWhRWK1LHB0GftpBjmKDHR9:N9UTq03i6HhCpoxyBZWitDfiUt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

3e:e4:61:11:00:b2:88:8e:e6:8f:09:00:7e:91:84:4b:99:8f:5f:e2:24:b3:2f:39:ca:43:ca:3b:88:e2:f3:38

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

bb:1d:5f:96:95:9d:d0:26:63:d1:06:4c:59:49:cf:fd:88:57:0b:14

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

23518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.0/System.Linq.xml

SHA256 a2612416949ecec128115255b4240484371857aba2c3c745ce0a717cd1ab49d6
MD5 3760ceeddacd1e78452639b0398275c8
SHA1 e8565ba3ca3d993f76de093ef76814f869f27140
SHA512 88a9b5ba0df6c12ea4bd746bdc7f659c8bff50f42b5411e5c89cbccb041fd61c5aad7b222a2da90ac8edc0aeacea5d1e98b9d68da544068243a0389997b39d86
SSDEEP 1536:8G0Opu5tOInj5IvgJkCHXeJV/xVaV/nE/BGrlGxPDVfvnidRUjFGoux4OX1/PR4K:xw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.0/de/System.Linq.xml

SHA256 6a55fca7ca7b0c1ee4599af3dabefca2b50b1739c8629a36b1711bf495583135
MD5 4e6c14f2dd107b80af1bc59f15e86b7c
SHA1 3d993fd8f833eef4b4c6da42f535cc1abe3a5217
SHA512 e2ccd2648a50f1ee29541493ee125584e76763f3d711b65f3abff225951949dacded30795a4218c72bd3201c5a912ba25aeb1027b87ebbfb73506ccc80a839da
SSDEEP 1536:aVzKzfJ5vPmUai4aiv+O+uGt36id55g814Xlcngaw92RslKmgGU6XJuJTRqgY/XD:aVzKz7PmU8LvxhqU4qLQG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.0/es/System.Linq.xml

SHA256 364fce9a1f404e39c1c80ee59e6acbfb2ea867dbae0f02a0da0b98acf0f9d1b0
MD5 a4fd0093c474a52516be882f290fd99e
SHA1 7d9f781d9ef95c78fc1461e6f0dcfc9ab9c07e45
SHA512 30bd66b07cede144823658da7bc0ffe95fd435ebafd9dd1c6bca74f06dea559f184d92c8b236e224892b25ae4131cd9ebe0c60ff6868e7e145315460912b706e
SSDEEP 384:YnjTvCNwv57NWvDO226ETA2DeE09EGRvI1kSZE7tSsMhAHdptBKkKlvx1PG7oDbZ:YUaDrzkHGhisrZXNnSQn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.0/fr/System.Linq.xml

SHA256 6883712d7eccd3c2dd7619d16f8b9d6cc1e17b45bcb2f1bc93d60a0a4b8eadb8
MD5 665f88309b75cb834adfa42aaee2a237
SHA1 57f774990911584de3e51e6d0c77f96294f8640c
SHA512 8bc0e734fe0287a1b13556184ac74ebdc379769920d9e70def9bf603bfb280259accdd2a2d1cb9fd2df5d33b6d530ebf368eb19e163e3d535b330f459714ad71
SSDEEP 384:Y5mjFnuU+NIymuYCYxaNWyjVYCk6xfd+mflW+gTax+wUrAKFxSIW2hiEebCJ+kYQ:Y5Z1bjujAa+Z7LhHTi
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.0/it/System.Linq.xml

SHA256 f1059728fe52ceba93d137e6c646dab3a7510c50da31740eaf603b420ca7ccf1
MD5 cb2afc215a45e3ce3ffc34eac18928df
SHA1 68af2ab6e2e750720e89acebcbad3c5f01c636cd
SHA512 09f0a7d17a752e9eaa5a23c1802d46b96c96bf34fcd5f9bc9e700c9945e4c01a6bab8535f009679a8fac6ee403b0a0663966bc59cf53d1b83601abb561d94927
SSDEEP 1536:/6zKPRIY3oAvpskK0XvPBeFl7npeXV7cUt5Z:/6H0Xvd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.0/ja/System.Linq.xml

SHA256 ceb0eecbd8b95e170c3844b3c28fa51c5ef5e8c7af65f02b8305d448030b8c83
MD5 2076122b4fe29b64fb33527072e9dd36
SHA1 2a33d1c8065bcef1e65efdeb4ff326a656571f63
SHA512 b705d71cb7f6cff22868c807fac2a9be5f376e1ecc81131dcda847e8a8fe81bea435d1895af96e4f9b345d871e4c3accd42d676ea5c390b0b6275875fc8b7a61
SSDEEP 768:YLFZV0lKbmoy3SetXvRJYgjeobFN/wq54qvn:QV0lKbUyqvn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.0/ko/System.Linq.xml

SHA256 35eec1a0c302818ab124e9e0f6d7774aedeff0d3d05f20db4e24c4c309177f30
MD5 baee5969671c80966f067260c691c9d9
SHA1 87b0771061df1fe5faabdfc2698c01987ad97309
SHA512 8220f806406a17a46e047bbbdfead9b2c80bad2c8487ffa254e7d448904b1dcfbb510676df264c8ec4496cf8143788bfdcec07483713ddafb7a4e16fd1ec1509
SSDEEP 3072:ZIUrCWFXQgXRy7b8tgUIcoxtbChXTppPZxVGq+0N0CYBP710jiDy/OPSiw97Dl:9oxtbChXTpYy/OPSiw97Dl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.0/ru/System.Linq.xml

SHA256 2ca6a42a8efbf8148e6716eecd5573b7d3079b97d53cd99aeebdbed43291acfc
MD5 16bdce8d8f42a12340ace1590da598c8
SHA1 96977078138a64ed070722d8a3c3abe19eb13e68
SHA512 2c789b6205c3a10ef373674e26b0c12167f27e52e5ad3f6cc5a4305aaf77230e8476383a71970cb8260b33162130c83e7c1aa6f25e6e70c64bfc130919a41591
SSDEEP 6144:yXgGKL40g6lVYK9R71KPxE6b8zvQN6A8Y1J:yXgGKL40g6lVYK9R71KPxE6b8zvQN6AV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.0/zh-hans/System.Linq.xml

SHA256 e28e701915a565465734d4d9431367ff5ac3232d2fd418186caa2b3b9260a0d7
MD5 39f1d9c42a07511536d56a382de1a00b
SHA1 9bd8fc1f6d457e3b9663370f1cc20389698d37d0
SHA512 5d2467237a80f4ad3dc2893df4ecbaf15671383b819173f54cb126c1ea0f8cf07023b3f7c88da63ad01569739e5bc4f5f6238cd8bf10cc0574dd29b8fe73e86a
SSDEEP 1536:I7sv5VVj2KJkgmmThTkXTxTwbiGGmVzMtKQmly:Wsv5Te
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.0/zh-hant/System.Linq.xml

SHA256 50cdd7cacd4cee3d89ed348715ee5a02b37af4b7babc99f448c985cb5451594a
MD5 779026fdf284024ab73532931c2c83f1
SHA1 3dd4ca4b580d11bf4f32058d401579b8f58f5a4f
SHA512 7d9975044de12208f7a31184fd1865913443207b955160dc9a9a895dd04a3a826cf8ed1694bf8249e4d702bde6eba9404411adb1217fe71cc8d9d29d947dfc6e
SSDEEP 1536:nQ4g5p7MpdVs6v5vAUMssbahLxWauS6dFQL3FQjNC523Y7GgN:nQ4g5p7MpdVsbQL3FQjN0aW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.6/System.Linq.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0601e91cd989384940075add4ec4d68f5806b74692e3d4fbea55e0f9eb2519b8
MD5 f9b84ffcd0ebeb653bd12ab5c3bb3fde
SHA1 b3878106103051557367b0108031cc0db48bb9a2
SHA512 04909b7503b0984ac17352723b9e86ce631834bb7dd412fed061dd89270f72d854fb18f0e7752eb0126dd21e4f9ca633f84f5081516925bc395e979480e8cfcf
SSDEEP 384:tqS36e06eHX2Ukl3P3HXM99WkfYlMpagKC7W5RW/C25A0GftpBjR/jERHRN7vtFd:tv6T6SGUa3P899rtspE9ifbEBV2fG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

78:bb:89:38:78:9b:32:cb:69:da:1c:66:94:68:e9:5e:a3:4c:45:1d:34:13:23:97:90:e7:f5:96:ab:6e:9f:a5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

3a:5c:62:8b:9a:e5:95:86:92:30:6e:46:e0:07:d9:fd:88:97:83:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:ec:3f:ad:b6:8b:b9:2d:d2:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2016 - Aug 3, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

23406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Linq\4.1.0.0\System.Linq.pdb

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.6/System.Linq.xml

SHA256 a2612416949ecec128115255b4240484371857aba2c3c745ce0a717cd1ab49d6
MD5 3760ceeddacd1e78452639b0398275c8
SHA1 e8565ba3ca3d993f76de093ef76814f869f27140
SHA512 88a9b5ba0df6c12ea4bd746bdc7f659c8bff50f42b5411e5c89cbccb041fd61c5aad7b222a2da90ac8edc0aeacea5d1e98b9d68da544068243a0389997b39d86
SSDEEP 1536:8G0Opu5tOInj5IvgJkCHXeJV/xVaV/nE/BGrlGxPDVfvnidRUjFGoux4OX1/PR4K:xw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.6/de/System.Linq.xml

SHA256 6a55fca7ca7b0c1ee4599af3dabefca2b50b1739c8629a36b1711bf495583135
MD5 4e6c14f2dd107b80af1bc59f15e86b7c
SHA1 3d993fd8f833eef4b4c6da42f535cc1abe3a5217
SHA512 e2ccd2648a50f1ee29541493ee125584e76763f3d711b65f3abff225951949dacded30795a4218c72bd3201c5a912ba25aeb1027b87ebbfb73506ccc80a839da
SSDEEP 1536:aVzKzfJ5vPmUai4aiv+O+uGt36id55g814Xlcngaw92RslKmgGU6XJuJTRqgY/XD:aVzKz7PmU8LvxhqU4qLQG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.6/es/System.Linq.xml

SHA256 364fce9a1f404e39c1c80ee59e6acbfb2ea867dbae0f02a0da0b98acf0f9d1b0
MD5 a4fd0093c474a52516be882f290fd99e
SHA1 7d9f781d9ef95c78fc1461e6f0dcfc9ab9c07e45
SHA512 30bd66b07cede144823658da7bc0ffe95fd435ebafd9dd1c6bca74f06dea559f184d92c8b236e224892b25ae4131cd9ebe0c60ff6868e7e145315460912b706e
SSDEEP 384:YnjTvCNwv57NWvDO226ETA2DeE09EGRvI1kSZE7tSsMhAHdptBKkKlvx1PG7oDbZ:YUaDrzkHGhisrZXNnSQn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.6/fr/System.Linq.xml

SHA256 6883712d7eccd3c2dd7619d16f8b9d6cc1e17b45bcb2f1bc93d60a0a4b8eadb8
MD5 665f88309b75cb834adfa42aaee2a237
SHA1 57f774990911584de3e51e6d0c77f96294f8640c
SHA512 8bc0e734fe0287a1b13556184ac74ebdc379769920d9e70def9bf603bfb280259accdd2a2d1cb9fd2df5d33b6d530ebf368eb19e163e3d535b330f459714ad71
SSDEEP 384:Y5mjFnuU+NIymuYCYxaNWyjVYCk6xfd+mflW+gTax+wUrAKFxSIW2hiEebCJ+kYQ:Y5Z1bjujAa+Z7LhHTi
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.6/it/System.Linq.xml

SHA256 f1059728fe52ceba93d137e6c646dab3a7510c50da31740eaf603b420ca7ccf1
MD5 cb2afc215a45e3ce3ffc34eac18928df
SHA1 68af2ab6e2e750720e89acebcbad3c5f01c636cd
SHA512 09f0a7d17a752e9eaa5a23c1802d46b96c96bf34fcd5f9bc9e700c9945e4c01a6bab8535f009679a8fac6ee403b0a0663966bc59cf53d1b83601abb561d94927
SSDEEP 1536:/6zKPRIY3oAvpskK0XvPBeFl7npeXV7cUt5Z:/6H0Xvd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.6/ja/System.Linq.xml

SHA256 ceb0eecbd8b95e170c3844b3c28fa51c5ef5e8c7af65f02b8305d448030b8c83
MD5 2076122b4fe29b64fb33527072e9dd36
SHA1 2a33d1c8065bcef1e65efdeb4ff326a656571f63
SHA512 b705d71cb7f6cff22868c807fac2a9be5f376e1ecc81131dcda847e8a8fe81bea435d1895af96e4f9b345d871e4c3accd42d676ea5c390b0b6275875fc8b7a61
SSDEEP 768:YLFZV0lKbmoy3SetXvRJYgjeobFN/wq54qvn:QV0lKbUyqvn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.6/ko/System.Linq.xml

SHA256 35eec1a0c302818ab124e9e0f6d7774aedeff0d3d05f20db4e24c4c309177f30
MD5 baee5969671c80966f067260c691c9d9
SHA1 87b0771061df1fe5faabdfc2698c01987ad97309
SHA512 8220f806406a17a46e047bbbdfead9b2c80bad2c8487ffa254e7d448904b1dcfbb510676df264c8ec4496cf8143788bfdcec07483713ddafb7a4e16fd1ec1509
SSDEEP 3072:ZIUrCWFXQgXRy7b8tgUIcoxtbChXTppPZxVGq+0N0CYBP710jiDy/OPSiw97Dl:9oxtbChXTpYy/OPSiw97Dl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.6/ru/System.Linq.xml

SHA256 2ca6a42a8efbf8148e6716eecd5573b7d3079b97d53cd99aeebdbed43291acfc
MD5 16bdce8d8f42a12340ace1590da598c8
SHA1 96977078138a64ed070722d8a3c3abe19eb13e68
SHA512 2c789b6205c3a10ef373674e26b0c12167f27e52e5ad3f6cc5a4305aaf77230e8476383a71970cb8260b33162130c83e7c1aa6f25e6e70c64bfc130919a41591
SSDEEP 6144:yXgGKL40g6lVYK9R71KPxE6b8zvQN6A8Y1J:yXgGKL40g6lVYK9R71KPxE6b8zvQN6AV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.6/zh-hans/System.Linq.xml

SHA256 e28e701915a565465734d4d9431367ff5ac3232d2fd418186caa2b3b9260a0d7
MD5 39f1d9c42a07511536d56a382de1a00b
SHA1 9bd8fc1f6d457e3b9663370f1cc20389698d37d0
SHA512 5d2467237a80f4ad3dc2893df4ecbaf15671383b819173f54cb126c1ea0f8cf07023b3f7c88da63ad01569739e5bc4f5f6238cd8bf10cc0574dd29b8fe73e86a
SSDEEP 1536:I7sv5VVj2KJkgmmThTkXTxTwbiGGmVzMtKQmly:Wsv5Te
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.4.3.0/ref/netstandard1.6/zh-hant/System.Linq.xml

SHA256 50cdd7cacd4cee3d89ed348715ee5a02b37af4b7babc99f448c985cb5451594a
MD5 779026fdf284024ab73532931c2c83f1
SHA1 3dd4ca4b580d11bf4f32058d401579b8f58f5a4f
SHA512 7d9975044de12208f7a31184fd1865913443207b955160dc9a9a895dd04a3a826cf8ed1694bf8249e4d702bde6eba9404411adb1217fe71cc8d9d29d947dfc6e
SSDEEP 1536:nQ4g5p7MpdVs6v5vAUMssbahLxWauS6dFQL3FQjNC523Y7GgN:nQ4g5p7MpdVsbQL3FQjN0aW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/.signature.p7s

SHA256 88c27302c18b64668356ed81a607b1d7fbaba93dfb1d75e1b2195ac066d63250
MD5 e81102bf6cefecb2e0596c097e4e8707
SHA1 8fe6c837189771447a72c6ab7c55bdf5e1d16537
SHA512 a2350f91cf0fa3b8360128807fae9c81820f44fe12ce8f7635e11e430d52c1b2cbde5c079a69be97e9b8c1d62d0303bee847ef3695e5ffd7a03adfa98d7417eb
SSDEEP 192:8dr7x0KDWpHhXZCVzV07xrwex2xt9DH0JOqNG8Fp28Wh8nKa:ERvDGGVptU2xt9oJNNzFwhhiKa
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/System.Linq.Expressions.4.3.0.nupkg

SHA256 fb7a6f85963bae2a7c1c26df7542f38e50bd14f645a58a10c6191cb859b6c24f
MD5 0937dd969de02edc143482567982d93b
SHA1 7c7b39f0355bf6e3aa108bd28df30e040f664e99
SHA512 61b90ef9ae6f779fbc8a7b6483ee8f5449cdd05c81b05235f70447e656a73b2aab7c341784b999f7532374744a72e2c3a5cd13800ea23417fac32ccfae5cde6d
SSDEEP 49152:EAzH2cnWiELAmRuzoq6mkc93Bvoq6pbvauoq6kUvz1oq67kddUhcD:EApHEdUUhARwDS/nrCjSD
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/lib/net463/System.Linq.Expressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8787bf413189639d069854f156ccc3208405312832d253b4ca856ac5c8ed99e1
MD5 87fa82c0764cad8bee370adcd0d8b518
SHA1 9c7453410f1085fb596d4fbecc2e7edd4e9bb563
SHA512 295543c761633a33b4b5427dfad772d0a839a578e9cbd7689615cf502dbfccad90ef607a4d51eedff5654db088d59c271a5af11e72307dfb7e08cdb1911bd56d
SSDEEP 384:rU9JyT8ULtT8WleWLYWAeWv3rq0GftpBjx/XoERHRN79KOlJrvcr:A9wgUZv+divYEB9Kabq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

06:63:e1:26:63:9a:40:d6:a8:ad:38:53:71:ef:b1:1a:29:0a:43:dc:4e:64:21:04:a8:d7:9f:f1:01:ee:96:9d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

70:9a:b7:61:8f:ab:cc:b1:6a:b5:eb:64:dc:25:e7:5d:76:2b:7c:d6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Linq.Expressions/net463\System.Linq.Expressions.pdb

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/lib/netcore50/System.Linq.Expressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 624081a07b7705c67cfb8ea967b92e55c9a9acd2a60f740d3529df98a94de161
MD5 220571045931eea23dcc78131839758a
SHA1 006ead2d5439f8920daac38338b208497f10f910
SHA512 68ca06f1a2e696a45ebeb5e0935e30227876c78e93415a9e5e13c6dcb9da3c2d467155e6797dab2c3aff2a0cc001d01fc53cd100f6358acffccaf562cacc7d9d
SSDEEP 6144:0sVFpuecpWvqaaRi2USFwZhRQvRxuoB6s:jNcNy+wDmZ3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

88:86:9f:58:84:c3:dc:a7:b8:b6:df:8b:91:fe:78:fd:3e:ff:7b:a1:37:15:57:92:3b:95:21:05:83:42:55:ca

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

c6:91:82:e2:e7:6e:d1:66:78:64:56:c0:fa:89:b6:25:ca:9a:60:5e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

371050

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\\FxCore\x86ret\System.Linq.Expressions.NetNativeCore\System.Linq.Expressions.pdb

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/lib/netstandard1.6/System.Linq.Expressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 adbc4a80e5ab49ed799a7f08ef8575649a038733d7df941d2a4873c7a0063ee9
MD5 56150ae40391c7b257fe84c5cd7b11e1
SHA1 da360225bfc5b432c89190987ee4fff09d458d01
SHA512 49f471b62cca9aee26cb16d25558777715037056a803120b42cff3816d1ee0e66943ac1548d1f35b8c867a7c9635f05fbd4bf1d6bafb3b41310a5c4ab9d3e97f
SSDEEP 6144:iVX+uCpX+alVoykvaTySseurO/WB9L+UIR/ybSbRBECIfEx34wuK:qX+uCpOal+yAoyf9+QYzt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a3:bf:aa:bc:ca:f1:59:92:aa:47:69:51:bc:01:10:18:b7:4a:83:11:6b:30:ec:87:dc:e1:9e:7d:a0:f0:ad:fd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

69:b0:53:6d:eb:6b:d9:cf:08:18:2c:7a:28:a4:74:a3:78:5a:34:a7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:7d:32:16:7c:7e:fd:05:03:00:00:00:00:00:ca

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

447434

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Linq.Expressions\System.Linq.Expressions.pdb

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/net463/System.Linq.Expressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8787bf413189639d069854f156ccc3208405312832d253b4ca856ac5c8ed99e1
MD5 87fa82c0764cad8bee370adcd0d8b518
SHA1 9c7453410f1085fb596d4fbecc2e7edd4e9bb563
SHA512 295543c761633a33b4b5427dfad772d0a839a578e9cbd7689615cf502dbfccad90ef607a4d51eedff5654db088d59c271a5af11e72307dfb7e08cdb1911bd56d
SSDEEP 384:rU9JyT8ULtT8WleWLYWAeWv3rq0GftpBjx/XoERHRN79KOlJrvcr:A9wgUZv+divYEB9Kabq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

06:63:e1:26:63:9a:40:d6:a8:ad:38:53:71:ef:b1:1a:29:0a:43:dc:4e:64:21:04:a8:d7:9f:f1:01:ee:96:9d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

70:9a:b7:61:8f:ab:cc:b1:6a:b5:eb:64:dc:25:e7:5d:76:2b:7c:d6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Linq.Expressions/net463\System.Linq.Expressions.pdb

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netcore50/System.Linq.Expressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7bb6524b7ff0be2d1897c573173b38cb00c26c77ab297a57864995738a3288c8
MD5 833fcc4d9e9e42082bf50a17fe6ec623
SHA1 3ecaa60dbc29fadcbd6618cb1a479a38e769ad7b
SHA512 f59e957b90ee08dbe92c2e087e9bab5e65abaa1dea0997c979487e6f5f7a81d97837cf06c615ded0590f2846922a9931368a267c05b39f15333b984ad33c8616
SSDEEP 768:E32JxdObWaZ83g+sALYKoTkdim+pNiACm2vUha+0V:E32jdHaZ41RoT0imCNkm5YV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

97:89:03:c2:e2:2b:86:c3:2b:57:0b:a1:cf:ac:50:0a:22:3b:4f:8f:a3:5f:5e:1f:a2:58:82:b6:e8:5c:51:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

48:86:16:d5:5c:92:90:6f:a1:1e:6b:3b:99:26:7e:7f:7e:c3:64:b8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

37906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Linq.Expressions\4.0.10.0\System.Linq.Expressions.pdb

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netcore50/System.Linq.Expressions.xml

SHA256 5f0b3894e3e84ad91fea1421fb6ec0edc7fdce380178d2d8c3d527bd84dc879f
MD5 0b619a7a343545028afca19625f6ac95
SHA1 3fc0c36710d2064164cca1b46e50d04cb2c91bf4
SHA512 7942e14317177e3ff6a133408b8e9f93b41a92bf87140b7190ecfb7f274f948793db72a976863f753e5acb2d5107545f4196187cd180d28e080cd9175282aa4e
SSDEEP 1536:k+4DxDT5QZLye3SLxALoLDtEkZKcrj1ls8A7JpY4c4CCRPMPmtNvLtub2CxiiWCl:py5QZLye32fFA7JpZlAL9UCKGwF7z7U1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netcore50/de/System.Linq.Expressions.xml

SHA256 ecfd0a3c5fd5008e00f33ee1e04f1bf71fb5a80909dd7bf18cc49af9af794d29
MD5 00569aa0b93ba951b5c2fa7ec412c48c
SHA1 274dea6163b87021361fef46de1ab0b61cc1ad86
SHA512 019422b985687bd64ea9faf678a696aad292c53b3b87310909a60d8204e451c967e8fb19cd36125869a315ec5e6b415272415984201cab0b1dcd60eb33660695
SSDEEP 12288:KWTFRRW2AaXhX/xMiMLhYQ3qCo7t7aiTDUr1V4jH14MdRnV:ZFRRW2AaXhX/xMiMLhYQ3qCo7t7aiTDZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netcore50/es/System.Linq.Expressions.xml

SHA256 0cb3bf168c9f8faa630072e53aa17c702d28566054e22def87f4c3e08d0670c3
MD5 eb62f097bb366bdf376a2c983d5bd57f
SHA1 0974a9f8ac1fe8bf7784e86ee3d7e72062259e03
SHA512 71bf7b453df6d0df250f8becad34dcf437b180bcd41579c02049aa5099cb7ffa13c247af3788d2d29d3f105628ae3f4b98a183b2718d91ad78af73dc2bb7e03a
SSDEEP 1536:W248048VWUYfUYVJUYVJ5UYYUYVCUYVJf48P48VQ487U8VA48/48V9UYdUYV3UYl:WgjsFvgl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netcore50/fr/System.Linq.Expressions.xml

SHA256 9a9b0c75cf6aaf4d5abcc15e50d097b1166aa0509378c5b5b147bb533382f5cb
MD5 872f05357187ffa5fdc2ea5e10624cef
SHA1 db3476b919146aa0c484a0502169ccb20acd7f92
SHA512 ece98615e838d7efab9b6914aaf313ae2919cb6dcb5b55b0c472ecd957b72b3e5ff1e6e6fb29d5463f99fdde6b5498673ed2a8fdfbaeb7f69eed18692129d795
SSDEEP 1536:iGqHM2qUuzF5zv9cKF+h8lYgwvTeEpXKN8+REIGhiDM5HC:hzF5zv9cKMvT3pXK+IGhiDM5HC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netcore50/it/System.Linq.Expressions.xml

SHA256 25c3ec7f123f3d6133a73e7ecc93fc2a97ccf8bc5a95a6e476316db9ded9e45e
MD5 c72854eaa020567fbe61ffad024fe2c0
SHA1 2ca424a4c152cc49ce4fc0c0468c9593091a92fd
SHA512 faedb0fd952ab6423e3900cc7727fd85fd403eb30073977718d554f8678feae2d3462f7763d7a443f59cea0e077ff0d963686b2ecbd357cb9137c370b75d287b
SSDEEP 6144:HEZ/IH+Z1jYVhKgyckiMtRtFnIoffgfd0ySHHZmio+LM2fM9qf20zqYKQKNK4V3v:7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netcore50/ja/System.Linq.Expressions.xml

SHA256 1994c660be94bc299a92f02cdc5ea7f8523058f6296563f91b8d21f1ea6bb96e
MD5 9d4e6dfb9f701c92135491ebfd666c7e
SHA1 d987e1471609694dd885e8e01b6ff45b149d90e1
SHA512 260af38d16d948423ca4d41d9b8d669a89f7be4e2f3eedb1bba6e6f0f4639c37d1a443bb9a17fa2dfc6885a79da0a64e7a2377316414253b21c7fec61fb0ba93
SSDEEP 768:YVCKw6e7yW2M+xZi41yoIJiy2C+sOBgnfClGc80X8yA2I+4IY2doYiV7cP+S:AwB4wKmS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netcore50/ko/System.Linq.Expressions.xml

SHA256 9fb2569ee10135791235b81725c0c5b31429645d40f83261f3c570ab485c1f47
MD5 5d2726eb570db738b2a776af7cad721d
SHA1 1b49d91a5a0fe4c44932977d409b5a091b3f478a
SHA512 70b9a5cbee3cf1e36810f4a61aba88c20413b0f554a923582e42755f3fd61da9beb0d65cac7fd96a918d0c0700d40e367f0c1fca2fe2294181213efaa9233546
SSDEEP 12288:HBBsBivyOFaSrZ6iHFZLz6T/UeMH/9IuTQpWBmiTsRDXuns3552M1zRGL9msO86e:H
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netcore50/ru/System.Linq.Expressions.xml

SHA256 e648c6111eb579e4ae24e5e0a7c665416f9fc6d8c49547d0e8f7420884f6a8a4
MD5 7f5642d85526037c57784626b797d23c
SHA1 556c3af241555c7640fda7208677b038341ea34d
SHA512 a4fe9da4323ba9de011060432dfc5db1d43b805dea572f66986ca49f2439b17065341f4e0115a80cc78560a90bd51ad7c0facfd2a95de976da56e63ba47037bc
SSDEEP 12288:lRETTTtatWtRtCWYffKEtYWQ6lnTVWiGAvgUdazPfnO6zsfYylAujBsse4UCKcRt:3t1x
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netcore50/zh-hans/System.Linq.Expressions.xml

SHA256 8d7e45e8236d685b8080243a3f6b90094a4ff15c5442b472049339fae71dbf4f
MD5 bf1c6046e8cbb030e1eef2a05e223d95
SHA1 a33346f70a5258ed877d5f1f509f26c52cdb14c3
SHA512 f2f88f94e2f6ebf1a51745c96edb097c2d159c6ded0edc5aac94c20c7f271a3f22fb21d55d95a0690006a0e43f16ebf8c7d9107d52a6bbfc3f5990b01b9c7bc1
SSDEEP 1536:pbilVFG0oL8xzKlqRFqPG53KWPnxuYuWIozPOjieavF3GBc33VdwPd9hTtQrXhgD:0zhxRWJaLqFqbrBNmY9A
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netcore50/zh-hant/System.Linq.Expressions.xml

SHA256 72baccdf68c686432c33a51004d36d3d912c725e8de5d124d1313b17923a9be7
MD5 0af048ac9a8aaecddc4b962c2874a348
SHA1 66cfafaa1c6557e744c12e3abdb81d1ab8d13669
SHA512 6eec78b17827dc7f64bea9b187d8f837de435707fb70b3b532267f66c479ef5bba31c17ed55cbb9aae0fceba35d74a7073e38e7a9ad954dd16429c614fcfa493
SSDEEP 1536:/AhPqPhhehdXWJgrqahX6dhUpWDlXAdGeMP+SWE+h7U2htEFV4:ePqPzsdX7X6HJeMPHWEM7UUtEs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.0/System.Linq.Expressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2722484e58f41e9e2c23671e7997480d136ac4ccf89b63b2b7f37d292d4a5a4f
MD5 227ee716a2037ef9c61707e7bfdc1188
SHA1 c36ad8bf1a05c535fdafff7a3c4ae4a357d7e811
SHA512 23985d460de7c4634abcc8218cd703ce23cb20920637edc05936fc166dbbbe752a733077fc1540afd9af6a9f8aa6ea9f9086ef308b8d23665737f58022d78b49
SSDEEP 768:JlwLFLNk1Tf7PrBhyrrJb4cTKguKsc6JrCeqK7fBHYJAuCWiCDQNX:i3OTZB46uZJDQF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

0e:cf:c8:79:52:1a:86:c3:ae:56:7f:40:67:25:b6:b4:e1:00:26:d3:46:1d:66:e2:e7:27:a3:9d:75:50:31:20

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a6:1a:b1:4a:ab:17:85:11:98:5c:dd:b1:ca:a7:d7:da:85:32:5b:85

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

38094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.0/System.Linq.Expressions.xml

SHA256 5f0b3894e3e84ad91fea1421fb6ec0edc7fdce380178d2d8c3d527bd84dc879f
MD5 0b619a7a343545028afca19625f6ac95
SHA1 3fc0c36710d2064164cca1b46e50d04cb2c91bf4
SHA512 7942e14317177e3ff6a133408b8e9f93b41a92bf87140b7190ecfb7f274f948793db72a976863f753e5acb2d5107545f4196187cd180d28e080cd9175282aa4e
SSDEEP 1536:k+4DxDT5QZLye3SLxALoLDtEkZKcrj1ls8A7JpY4c4CCRPMPmtNvLtub2CxiiWCl:py5QZLye32fFA7JpZlAL9UCKGwF7z7U1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.0/de/System.Linq.Expressions.xml

SHA256 ecfd0a3c5fd5008e00f33ee1e04f1bf71fb5a80909dd7bf18cc49af9af794d29
MD5 00569aa0b93ba951b5c2fa7ec412c48c
SHA1 274dea6163b87021361fef46de1ab0b61cc1ad86
SHA512 019422b985687bd64ea9faf678a696aad292c53b3b87310909a60d8204e451c967e8fb19cd36125869a315ec5e6b415272415984201cab0b1dcd60eb33660695
SSDEEP 12288:KWTFRRW2AaXhX/xMiMLhYQ3qCo7t7aiTDUr1V4jH14MdRnV:ZFRRW2AaXhX/xMiMLhYQ3qCo7t7aiTDZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.0/es/System.Linq.Expressions.xml

SHA256 0cb3bf168c9f8faa630072e53aa17c702d28566054e22def87f4c3e08d0670c3
MD5 eb62f097bb366bdf376a2c983d5bd57f
SHA1 0974a9f8ac1fe8bf7784e86ee3d7e72062259e03
SHA512 71bf7b453df6d0df250f8becad34dcf437b180bcd41579c02049aa5099cb7ffa13c247af3788d2d29d3f105628ae3f4b98a183b2718d91ad78af73dc2bb7e03a
SSDEEP 1536:W248048VWUYfUYVJUYVJ5UYYUYVCUYVJf48P48VQ487U8VA48/48V9UYdUYV3UYl:WgjsFvgl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.0/fr/System.Linq.Expressions.xml

SHA256 9a9b0c75cf6aaf4d5abcc15e50d097b1166aa0509378c5b5b147bb533382f5cb
MD5 872f05357187ffa5fdc2ea5e10624cef
SHA1 db3476b919146aa0c484a0502169ccb20acd7f92
SHA512 ece98615e838d7efab9b6914aaf313ae2919cb6dcb5b55b0c472ecd957b72b3e5ff1e6e6fb29d5463f99fdde6b5498673ed2a8fdfbaeb7f69eed18692129d795
SSDEEP 1536:iGqHM2qUuzF5zv9cKF+h8lYgwvTeEpXKN8+REIGhiDM5HC:hzF5zv9cKMvT3pXK+IGhiDM5HC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.0/it/System.Linq.Expressions.xml

SHA256 25c3ec7f123f3d6133a73e7ecc93fc2a97ccf8bc5a95a6e476316db9ded9e45e
MD5 c72854eaa020567fbe61ffad024fe2c0
SHA1 2ca424a4c152cc49ce4fc0c0468c9593091a92fd
SHA512 faedb0fd952ab6423e3900cc7727fd85fd403eb30073977718d554f8678feae2d3462f7763d7a443f59cea0e077ff0d963686b2ecbd357cb9137c370b75d287b
SSDEEP 6144:HEZ/IH+Z1jYVhKgyckiMtRtFnIoffgfd0ySHHZmio+LM2fM9qf20zqYKQKNK4V3v:7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.0/ja/System.Linq.Expressions.xml

SHA256 1994c660be94bc299a92f02cdc5ea7f8523058f6296563f91b8d21f1ea6bb96e
MD5 9d4e6dfb9f701c92135491ebfd666c7e
SHA1 d987e1471609694dd885e8e01b6ff45b149d90e1
SHA512 260af38d16d948423ca4d41d9b8d669a89f7be4e2f3eedb1bba6e6f0f4639c37d1a443bb9a17fa2dfc6885a79da0a64e7a2377316414253b21c7fec61fb0ba93
SSDEEP 768:YVCKw6e7yW2M+xZi41yoIJiy2C+sOBgnfClGc80X8yA2I+4IY2doYiV7cP+S:AwB4wKmS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.0/ko/System.Linq.Expressions.xml

SHA256 9fb2569ee10135791235b81725c0c5b31429645d40f83261f3c570ab485c1f47
MD5 5d2726eb570db738b2a776af7cad721d
SHA1 1b49d91a5a0fe4c44932977d409b5a091b3f478a
SHA512 70b9a5cbee3cf1e36810f4a61aba88c20413b0f554a923582e42755f3fd61da9beb0d65cac7fd96a918d0c0700d40e367f0c1fca2fe2294181213efaa9233546
SSDEEP 12288:HBBsBivyOFaSrZ6iHFZLz6T/UeMH/9IuTQpWBmiTsRDXuns3552M1zRGL9msO86e:H
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.0/ru/System.Linq.Expressions.xml

SHA256 e648c6111eb579e4ae24e5e0a7c665416f9fc6d8c49547d0e8f7420884f6a8a4
MD5 7f5642d85526037c57784626b797d23c
SHA1 556c3af241555c7640fda7208677b038341ea34d
SHA512 a4fe9da4323ba9de011060432dfc5db1d43b805dea572f66986ca49f2439b17065341f4e0115a80cc78560a90bd51ad7c0facfd2a95de976da56e63ba47037bc
SSDEEP 12288:lRETTTtatWtRtCWYffKEtYWQ6lnTVWiGAvgUdazPfnO6zsfYylAujBsse4UCKcRt:3t1x
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.0/zh-hans/System.Linq.Expressions.xml

SHA256 8d7e45e8236d685b8080243a3f6b90094a4ff15c5442b472049339fae71dbf4f
MD5 bf1c6046e8cbb030e1eef2a05e223d95
SHA1 a33346f70a5258ed877d5f1f509f26c52cdb14c3
SHA512 f2f88f94e2f6ebf1a51745c96edb097c2d159c6ded0edc5aac94c20c7f271a3f22fb21d55d95a0690006a0e43f16ebf8c7d9107d52a6bbfc3f5990b01b9c7bc1
SSDEEP 1536:pbilVFG0oL8xzKlqRFqPG53KWPnxuYuWIozPOjieavF3GBc33VdwPd9hTtQrXhgD:0zhxRWJaLqFqbrBNmY9A
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.0/zh-hant/System.Linq.Expressions.xml

SHA256 72baccdf68c686432c33a51004d36d3d912c725e8de5d124d1313b17923a9be7
MD5 0af048ac9a8aaecddc4b962c2874a348
SHA1 66cfafaa1c6557e744c12e3abdb81d1ab8d13669
SHA512 6eec78b17827dc7f64bea9b187d8f837de435707fb70b3b532267f66c479ef5bba31c17ed55cbb9aae0fceba35d74a7073e38e7a9ad954dd16429c614fcfa493
SSDEEP 1536:/AhPqPhhehdXWJgrqahX6dhUpWDlXAdGeMP+SWE+h7U2htEFV4:ePqPzsdX7X6HJeMPHWEM7UUtEs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.3/System.Linq.Expressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7bb6524b7ff0be2d1897c573173b38cb00c26c77ab297a57864995738a3288c8
MD5 833fcc4d9e9e42082bf50a17fe6ec623
SHA1 3ecaa60dbc29fadcbd6618cb1a479a38e769ad7b
SHA512 f59e957b90ee08dbe92c2e087e9bab5e65abaa1dea0997c979487e6f5f7a81d97837cf06c615ded0590f2846922a9931368a267c05b39f15333b984ad33c8616
SSDEEP 768:E32JxdObWaZ83g+sALYKoTkdim+pNiACm2vUha+0V:E32jdHaZ41RoT0imCNkm5YV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

97:89:03:c2:e2:2b:86:c3:2b:57:0b:a1:cf:ac:50:0a:22:3b:4f:8f:a3:5f:5e:1f:a2:58:82:b6:e8:5c:51:25

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

48:86:16:d5:5c:92:90:6f:a1:1e:6b:3b:99:26:7e:7f:7e:c3:64:b8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

37906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Linq.Expressions\4.0.10.0\System.Linq.Expressions.pdb

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.3/System.Linq.Expressions.xml

SHA256 5f0b3894e3e84ad91fea1421fb6ec0edc7fdce380178d2d8c3d527bd84dc879f
MD5 0b619a7a343545028afca19625f6ac95
SHA1 3fc0c36710d2064164cca1b46e50d04cb2c91bf4
SHA512 7942e14317177e3ff6a133408b8e9f93b41a92bf87140b7190ecfb7f274f948793db72a976863f753e5acb2d5107545f4196187cd180d28e080cd9175282aa4e
SSDEEP 1536:k+4DxDT5QZLye3SLxALoLDtEkZKcrj1ls8A7JpY4c4CCRPMPmtNvLtub2CxiiWCl:py5QZLye32fFA7JpZlAL9UCKGwF7z7U1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.3/de/System.Linq.Expressions.xml

SHA256 ecfd0a3c5fd5008e00f33ee1e04f1bf71fb5a80909dd7bf18cc49af9af794d29
MD5 00569aa0b93ba951b5c2fa7ec412c48c
SHA1 274dea6163b87021361fef46de1ab0b61cc1ad86
SHA512 019422b985687bd64ea9faf678a696aad292c53b3b87310909a60d8204e451c967e8fb19cd36125869a315ec5e6b415272415984201cab0b1dcd60eb33660695
SSDEEP 12288:KWTFRRW2AaXhX/xMiMLhYQ3qCo7t7aiTDUr1V4jH14MdRnV:ZFRRW2AaXhX/xMiMLhYQ3qCo7t7aiTDZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.3/es/System.Linq.Expressions.xml

SHA256 0cb3bf168c9f8faa630072e53aa17c702d28566054e22def87f4c3e08d0670c3
MD5 eb62f097bb366bdf376a2c983d5bd57f
SHA1 0974a9f8ac1fe8bf7784e86ee3d7e72062259e03
SHA512 71bf7b453df6d0df250f8becad34dcf437b180bcd41579c02049aa5099cb7ffa13c247af3788d2d29d3f105628ae3f4b98a183b2718d91ad78af73dc2bb7e03a
SSDEEP 1536:W248048VWUYfUYVJUYVJ5UYYUYVCUYVJf48P48VQ487U8VA48/48V9UYdUYV3UYl:WgjsFvgl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.3/fr/System.Linq.Expressions.xml

SHA256 9a9b0c75cf6aaf4d5abcc15e50d097b1166aa0509378c5b5b147bb533382f5cb
MD5 872f05357187ffa5fdc2ea5e10624cef
SHA1 db3476b919146aa0c484a0502169ccb20acd7f92
SHA512 ece98615e838d7efab9b6914aaf313ae2919cb6dcb5b55b0c472ecd957b72b3e5ff1e6e6fb29d5463f99fdde6b5498673ed2a8fdfbaeb7f69eed18692129d795
SSDEEP 1536:iGqHM2qUuzF5zv9cKF+h8lYgwvTeEpXKN8+REIGhiDM5HC:hzF5zv9cKMvT3pXK+IGhiDM5HC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.3/it/System.Linq.Expressions.xml

SHA256 25c3ec7f123f3d6133a73e7ecc93fc2a97ccf8bc5a95a6e476316db9ded9e45e
MD5 c72854eaa020567fbe61ffad024fe2c0
SHA1 2ca424a4c152cc49ce4fc0c0468c9593091a92fd
SHA512 faedb0fd952ab6423e3900cc7727fd85fd403eb30073977718d554f8678feae2d3462f7763d7a443f59cea0e077ff0d963686b2ecbd357cb9137c370b75d287b
SSDEEP 6144:HEZ/IH+Z1jYVhKgyckiMtRtFnIoffgfd0ySHHZmio+LM2fM9qf20zqYKQKNK4V3v:7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.3/ja/System.Linq.Expressions.xml

SHA256 1994c660be94bc299a92f02cdc5ea7f8523058f6296563f91b8d21f1ea6bb96e
MD5 9d4e6dfb9f701c92135491ebfd666c7e
SHA1 d987e1471609694dd885e8e01b6ff45b149d90e1
SHA512 260af38d16d948423ca4d41d9b8d669a89f7be4e2f3eedb1bba6e6f0f4639c37d1a443bb9a17fa2dfc6885a79da0a64e7a2377316414253b21c7fec61fb0ba93
SSDEEP 768:YVCKw6e7yW2M+xZi41yoIJiy2C+sOBgnfClGc80X8yA2I+4IY2doYiV7cP+S:AwB4wKmS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.3/ko/System.Linq.Expressions.xml

SHA256 9fb2569ee10135791235b81725c0c5b31429645d40f83261f3c570ab485c1f47
MD5 5d2726eb570db738b2a776af7cad721d
SHA1 1b49d91a5a0fe4c44932977d409b5a091b3f478a
SHA512 70b9a5cbee3cf1e36810f4a61aba88c20413b0f554a923582e42755f3fd61da9beb0d65cac7fd96a918d0c0700d40e367f0c1fca2fe2294181213efaa9233546
SSDEEP 12288:HBBsBivyOFaSrZ6iHFZLz6T/UeMH/9IuTQpWBmiTsRDXuns3552M1zRGL9msO86e:H
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.3/ru/System.Linq.Expressions.xml

SHA256 e648c6111eb579e4ae24e5e0a7c665416f9fc6d8c49547d0e8f7420884f6a8a4
MD5 7f5642d85526037c57784626b797d23c
SHA1 556c3af241555c7640fda7208677b038341ea34d
SHA512 a4fe9da4323ba9de011060432dfc5db1d43b805dea572f66986ca49f2439b17065341f4e0115a80cc78560a90bd51ad7c0facfd2a95de976da56e63ba47037bc
SSDEEP 12288:lRETTTtatWtRtCWYffKEtYWQ6lnTVWiGAvgUdazPfnO6zsfYylAujBsse4UCKcRt:3t1x
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.3/zh-hans/System.Linq.Expressions.xml

SHA256 8d7e45e8236d685b8080243a3f6b90094a4ff15c5442b472049339fae71dbf4f
MD5 bf1c6046e8cbb030e1eef2a05e223d95
SHA1 a33346f70a5258ed877d5f1f509f26c52cdb14c3
SHA512 f2f88f94e2f6ebf1a51745c96edb097c2d159c6ded0edc5aac94c20c7f271a3f22fb21d55d95a0690006a0e43f16ebf8c7d9107d52a6bbfc3f5990b01b9c7bc1
SSDEEP 1536:pbilVFG0oL8xzKlqRFqPG53KWPnxuYuWIozPOjieavF3GBc33VdwPd9hTtQrXhgD:0zhxRWJaLqFqbrBNmY9A
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.3/zh-hant/System.Linq.Expressions.xml

SHA256 72baccdf68c686432c33a51004d36d3d912c725e8de5d124d1313b17923a9be7
MD5 0af048ac9a8aaecddc4b962c2874a348
SHA1 66cfafaa1c6557e744c12e3abdb81d1ab8d13669
SHA512 6eec78b17827dc7f64bea9b187d8f837de435707fb70b3b532267f66c479ef5bba31c17ed55cbb9aae0fceba35d74a7073e38e7a9ad954dd16429c614fcfa493
SSDEEP 1536:/AhPqPhhehdXWJgrqahX6dhUpWDlXAdGeMP+SWE+h7U2htEFV4:ePqPzsdX7X6HJeMPHWEM7UUtEs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.6/System.Linq.Expressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 47e84a2911786863208f8604864d616dd593be17beb3ec041d64aaa5715d00a3
MD5 8eabf5c62f1cd38403db077713a9789d
SHA1 12afafa58934b473e7ea794e28b8b93fa3ea75d2
SHA512 ab3e4721bfe929070b4e8ccf1bc151fd69de43388314af178d46f97ff9be9115307647c8b78f83d7efaea406878e88cf8c14f46771bff2c52ac855d3ffa46756
SSDEEP 384:LuA4hPNHzfjTRybKUGd+4P2/Ggd5nuoKRCfTWZdimAV6WNeWCaCIcPA0GftpBjBx:aZQ4xNgKoK8TkdimADyi++EBA91Rs8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a8:e3:cd:14:95:7c:a4:39:75:6a:ed:1a:81:61:d8:34:7b:20:65:1c:21:f1:a6:98:02:92:f2:2f:9a:23:a0:94

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

0c:39:b2:7e:f4:ad:da:79:b1:88:20:3b:86:67:dc:16:cd:b9:e1:31

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

36346

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Linq.Expressions\4.1.0.0\System.Linq.Expressions.pdb

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.6/System.Linq.Expressions.xml

SHA256 5f0b3894e3e84ad91fea1421fb6ec0edc7fdce380178d2d8c3d527bd84dc879f
MD5 0b619a7a343545028afca19625f6ac95
SHA1 3fc0c36710d2064164cca1b46e50d04cb2c91bf4
SHA512 7942e14317177e3ff6a133408b8e9f93b41a92bf87140b7190ecfb7f274f948793db72a976863f753e5acb2d5107545f4196187cd180d28e080cd9175282aa4e
SSDEEP 1536:k+4DxDT5QZLye3SLxALoLDtEkZKcrj1ls8A7JpY4c4CCRPMPmtNvLtub2CxiiWCl:py5QZLye32fFA7JpZlAL9UCKGwF7z7U1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.6/de/System.Linq.Expressions.xml

SHA256 ecfd0a3c5fd5008e00f33ee1e04f1bf71fb5a80909dd7bf18cc49af9af794d29
MD5 00569aa0b93ba951b5c2fa7ec412c48c
SHA1 274dea6163b87021361fef46de1ab0b61cc1ad86
SHA512 019422b985687bd64ea9faf678a696aad292c53b3b87310909a60d8204e451c967e8fb19cd36125869a315ec5e6b415272415984201cab0b1dcd60eb33660695
SSDEEP 12288:KWTFRRW2AaXhX/xMiMLhYQ3qCo7t7aiTDUr1V4jH14MdRnV:ZFRRW2AaXhX/xMiMLhYQ3qCo7t7aiTDZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.6/es/System.Linq.Expressions.xml

SHA256 0cb3bf168c9f8faa630072e53aa17c702d28566054e22def87f4c3e08d0670c3
MD5 eb62f097bb366bdf376a2c983d5bd57f
SHA1 0974a9f8ac1fe8bf7784e86ee3d7e72062259e03
SHA512 71bf7b453df6d0df250f8becad34dcf437b180bcd41579c02049aa5099cb7ffa13c247af3788d2d29d3f105628ae3f4b98a183b2718d91ad78af73dc2bb7e03a
SSDEEP 1536:W248048VWUYfUYVJUYVJ5UYYUYVCUYVJf48P48VQ487U8VA48/48V9UYdUYV3UYl:WgjsFvgl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.6/fr/System.Linq.Expressions.xml

SHA256 9a9b0c75cf6aaf4d5abcc15e50d097b1166aa0509378c5b5b147bb533382f5cb
MD5 872f05357187ffa5fdc2ea5e10624cef
SHA1 db3476b919146aa0c484a0502169ccb20acd7f92
SHA512 ece98615e838d7efab9b6914aaf313ae2919cb6dcb5b55b0c472ecd957b72b3e5ff1e6e6fb29d5463f99fdde6b5498673ed2a8fdfbaeb7f69eed18692129d795
SSDEEP 1536:iGqHM2qUuzF5zv9cKF+h8lYgwvTeEpXKN8+REIGhiDM5HC:hzF5zv9cKMvT3pXK+IGhiDM5HC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.6/it/System.Linq.Expressions.xml

SHA256 25c3ec7f123f3d6133a73e7ecc93fc2a97ccf8bc5a95a6e476316db9ded9e45e
MD5 c72854eaa020567fbe61ffad024fe2c0
SHA1 2ca424a4c152cc49ce4fc0c0468c9593091a92fd
SHA512 faedb0fd952ab6423e3900cc7727fd85fd403eb30073977718d554f8678feae2d3462f7763d7a443f59cea0e077ff0d963686b2ecbd357cb9137c370b75d287b
SSDEEP 6144:HEZ/IH+Z1jYVhKgyckiMtRtFnIoffgfd0ySHHZmio+LM2fM9qf20zqYKQKNK4V3v:7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.6/ja/System.Linq.Expressions.xml

SHA256 1994c660be94bc299a92f02cdc5ea7f8523058f6296563f91b8d21f1ea6bb96e
MD5 9d4e6dfb9f701c92135491ebfd666c7e
SHA1 d987e1471609694dd885e8e01b6ff45b149d90e1
SHA512 260af38d16d948423ca4d41d9b8d669a89f7be4e2f3eedb1bba6e6f0f4639c37d1a443bb9a17fa2dfc6885a79da0a64e7a2377316414253b21c7fec61fb0ba93
SSDEEP 768:YVCKw6e7yW2M+xZi41yoIJiy2C+sOBgnfClGc80X8yA2I+4IY2doYiV7cP+S:AwB4wKmS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.6/ko/System.Linq.Expressions.xml

SHA256 9fb2569ee10135791235b81725c0c5b31429645d40f83261f3c570ab485c1f47
MD5 5d2726eb570db738b2a776af7cad721d
SHA1 1b49d91a5a0fe4c44932977d409b5a091b3f478a
SHA512 70b9a5cbee3cf1e36810f4a61aba88c20413b0f554a923582e42755f3fd61da9beb0d65cac7fd96a918d0c0700d40e367f0c1fca2fe2294181213efaa9233546
SSDEEP 12288:HBBsBivyOFaSrZ6iHFZLz6T/UeMH/9IuTQpWBmiTsRDXuns3552M1zRGL9msO86e:H
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.6/ru/System.Linq.Expressions.xml

SHA256 e648c6111eb579e4ae24e5e0a7c665416f9fc6d8c49547d0e8f7420884f6a8a4
MD5 7f5642d85526037c57784626b797d23c
SHA1 556c3af241555c7640fda7208677b038341ea34d
SHA512 a4fe9da4323ba9de011060432dfc5db1d43b805dea572f66986ca49f2439b17065341f4e0115a80cc78560a90bd51ad7c0facfd2a95de976da56e63ba47037bc
SSDEEP 12288:lRETTTtatWtRtCWYffKEtYWQ6lnTVWiGAvgUdazPfnO6zsfYylAujBsse4UCKcRt:3t1x
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.6/zh-hans/System.Linq.Expressions.xml

SHA256 8d7e45e8236d685b8080243a3f6b90094a4ff15c5442b472049339fae71dbf4f
MD5 bf1c6046e8cbb030e1eef2a05e223d95
SHA1 a33346f70a5258ed877d5f1f509f26c52cdb14c3
SHA512 f2f88f94e2f6ebf1a51745c96edb097c2d159c6ded0edc5aac94c20c7f271a3f22fb21d55d95a0690006a0e43f16ebf8c7d9107d52a6bbfc3f5990b01b9c7bc1
SSDEEP 1536:pbilVFG0oL8xzKlqRFqPG53KWPnxuYuWIozPOjieavF3GBc33VdwPd9hTtQrXhgD:0zhxRWJaLqFqbrBNmY9A
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/ref/netstandard1.6/zh-hant/System.Linq.Expressions.xml

SHA256 72baccdf68c686432c33a51004d36d3d912c725e8de5d124d1313b17923a9be7
MD5 0af048ac9a8aaecddc4b962c2874a348
SHA1 66cfafaa1c6557e744c12e3abdb81d1ab8d13669
SHA512 6eec78b17827dc7f64bea9b187d8f837de435707fb70b3b532267f66c479ef5bba31c17ed55cbb9aae0fceba35d74a7073e38e7a9ad954dd16429c614fcfa493
SSDEEP 1536:/AhPqPhhehdXWJgrqahX6dhUpWDlXAdGeMP+SWE+h7U2htEFV4:ePqPzsdX7X6HJeMPHWEM7UUtEs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Linq.Expressions.4.3.0/runtimes/aot/lib/netcore50/System.Linq.Expressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 38e62dd1a73d471d0db4a0db73a576bd26d26e3b9bab4b9492d7469ecc586183
MD5 fda2e2a078010fc655576501c222d847
SHA1 01d04b1d9dca0f90f248d004da5a40b95afea5c8
SHA512 e2f050437fa118cdeb136cd77d0834203c6a184b8b7a4f83c0a1e5bf72c4395657c845b2226441d4c696bf27b56f2d1f8d1a6cc1f68c1e987492500fcb12aa3e
SSDEEP 6144:jsNFtuecho5rc08XE/SL7Bq+LmuyuoicKqp:4RctL7Bq+EZia
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

59:ef:b3:43:9a:45:9b:ff:b8:03:95:50:c5:32:d2:f8:c0:4a:8b:fc:cf:81:30:2f:17:e4:a4:4d:6d:2b:4d:f8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

f7:55:65:3e:6b:f8:61:ce:23:12:84:68:03:88:87:32:0d:6a:09:7c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

378302

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\\FxCore\x86ret\System.Linq.Expressions.NetNative\System.Linq.Expressions.pdb

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/.signature.p7s

SHA256 e3bbf96a414c0159d33369ae7b97ce65b416a2ee7b1d08e79d8f7885f8825807
MD5 4d104392491f2bbcf1722ddbce22b4f6
SHA1 e432c7b7eac501452e469760803603defd73b4a1
SHA512 0b9332f72c1c452c4cfcb51ff5e18a3167787f34fa2fc9c06cb7c9c5090eca7169ad7135e9b7e230c9c832a6e85ec274939521d0e128111479c7df76ae5252ed
SSDEEP 192:Jd47x0KDWpHhXZCVzV07VrNsFGGX39DH0JOqNG8Fp28Wh8n/:bqvDGGVpWsFGGn9oJNNzFwhhi/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/System.Net.Http.4.3.0.nupkg

SHA256 528041ed63c3a760677bf7f0c4a1749c4f20ac9e85cd3317753fe37eca618fc4
MD5 152ffd3eec86e2b87d4392123abdad40
SHA1 eb5338f3af3c13ce7682de72c70395610aee3e29
SHA512 e8105ce8151aee95852fb29423f73cc1bd7c2286d36474ed7102a4b31248e45f434434a176d3af0442738398c96c5753965ee0444fb9c97525abbd9c88b13e41
SSDEEP 24576:feUkxcbKBcD2hdZMD2xqcbXNuD2TgcbCzcD2JNvjEUABUksXBhzv1g3r0:GebKBbhdZrx5bXNVTnbCzbJF1oYBpO4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/lib/net46/System.Net.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b741118740bad14229b30f27ce3883c2c8c0a720dee09a1c7e336fc0fc2073b1
MD5 0a57fb3524cbb09fff3f81068802d1af
SHA1 6d344a09471d8b4b849f16b0eebbaff8688a17ce
SHA512 c9c0f6de3f78a14d8f640dfef371c6c16073694555f9b8553c6212114c8ad43ce58b55f976279165ef0af813f1381efe3cb7ee44ef2ecfa8249701269a5417ea
SSDEEP 6144:JEYcGn/euhYp+YlHN7nD14NbaaQXSkNaahU89/IgBrpr8bMkapan4kgLMp3kVyf9:JEYcGn/e58bj74HjVA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

4c:d3:a1:8c:7e:3e:bd:22:64:47:93:94:5a:cb:5c:73:d3:d2:31:44:db:ea:b2:50:80:49:19:03:76:ff:bf:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

78:c6:9a:a6:a2:b5:73:34:08:7f:d1:b2:63:64:28:ba:7b:1b:53:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

254342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\net46\System.Net.Http.pdb

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/net46/System.Net.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 122ba6729df3fc3a7c1c8d9830e0976e671608adb142d12b2afe06d158d95ff6
MD5 b100790afe63a29e65d5cb6f6bf5ff6c
SHA1 e5372869461e3885c4a44878a41628c69397807c
SHA512 8a0130ea1ae2674d1484e897cfa419835eec3f2c841d734f9d2fadcb10a6b2d87fe0621bf51e5dfd498ee1cc1af705b869cdea84bf99036504e5097c1dea48dc
SSDEEP 768:kGN50bWBDBUFs4/uJUKxofwB7301vieNEB0jL:bNnoFs4/uJp7301vLEB0f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

2f:c4:8d:4f:c8:cd:26:e8:eb:3c:8d:b9:56:02:80:fe:2b:5d:62:0a:42:7a:a4:79:c6:38:45:17:f8:b6:a9:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

94:b4:7c:75:2f:b5:ae:90:e3:36:2e:df:4f:94:eb:d9:7c:41:9b:82

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

34258

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\ref\System.Net.Http\4.1.1.0\System.Net.Http.pdb

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/net46/System.Net.Http.xml

SHA256 dd18068cab95ac00ffe010775714455bd3b931aa7043172c9cd3edddc25a63f3
MD5 0bcbd80d8be28902d8fed22c1109c090
SHA1 66fa039b2d64c459a90f13748dc2bcd2a120b723
SHA512 1bcbb55c31c0daf39b972241cf38c5a05c684110cec9ca2fc3b4842c0684a1504297e095c434a6cfbae256a77f301a1a74c3d17cf6da6201898a3fde7a3ec46e
SSDEEP 1536:paH5LivK7kW8+swmH37pVTxogQ/nm5HwQdOUfhgc:paH9ivK7kW8+swmH37pVTxogQe5HFpgc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/net46/de/System.Net.Http.xml

SHA256 2dfeceff8943a5401273b2ee691e28757e58e94701e1977fc72037d4bdfdbdc5
MD5 ff8cac95fab402bc0659c3e8eab2f106
SHA1 bf5618311ba4964eb4b11817fafecb7c1fbb268c
SHA512 04214091c3781bcca92755087f1516ae6161cf1b7dd31955ff28d3585d41a1a4dd2e4651a5ee57a495e7fc5d400b245f1de65ffed835ac8da40b8598a8693858
SSDEEP 6144:I9BvusZ4WMQossm3/b5vpox1bqUb3UgW5EjV7mkuVqtfaokrRUFlFee:I9BvKb3UkjV7mBqx5kNUvFee
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/net46/es/System.Net.Http.xml

SHA256 4b14898c77c9bdd51f82685edd17ab809a90ceddac1b6f872cabb8f5abc23cf7
MD5 44c07e80686ebb2b861b3612d53193f1
SHA1 1738dcb73291bf860960503422fd4efca90574df
SHA512 821f8706398b7d1347909fc4a83f618cdf5ee7d455f0dce38535ae9bc1ca28ffa81948452882c608d72861c1832e5db1ffc122e7d8e7133a8f5d637773411dbf
SSDEEP 3072:Nusd8FIoEzGw2o535dDFEcx7JouqpCSYAF04V:YFIoEzGw2o535dDFEcx7JonCSYAF04V
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/net46/fr/System.Net.Http.xml

SHA256 34e5dbc7a5329f0ade1075a72ebb0b8caf13a04f4ea4fbc8b6263cd111871c21
MD5 39038ee4376f283f4402ee2138ccb417
SHA1 6f2eaf29b7c36bbd6fdb8b515367eba747f913d2
SHA512 c6f5a4019e03e32edfdf6822658abc5ba66951741ee722d9aa05559d9fa8ba5cc399139251d35de76d28109b6e5b8ef9081c20a56a105ac140cd97d2e841a55a
SSDEEP 6144:F6bN/TY+1UgCp9W84sxCev2ooD4zpNhXOgL:J
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/net46/it/System.Net.Http.xml

SHA256 f5ddab4b3ac2caf5d3ab4831cbaf972867d32892c31062c57e7dd4496b83ecdd
MD5 29b057ba18b5aebed8b51e62c60e6e9d
SHA1 e8a0c6b8bdc2c38f009b736cdc842ca447ffc088
SHA512 ca8f34fafbca00a5adaa02f7769dd50c2dba39cce080529d974002cedc8ca4463de131581bd2f07e8b7fcc1a11f6ad6d8a246efa8603654656aa1f8d4415c1f7
SSDEEP 6144:n4g/QFvVcNJGKHZ4gBQERTouHxjNs9kTqpQV1cGa8atX7a3wqA6HYMf6CYbGjSjf:E
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/net46/ja/System.Net.Http.xml

SHA256 4d157db9f237dbdd172accc37f9f5a81f699adaea23e71cbb3aa414521b0342f
MD5 37d0cb1204bba39d29e5f3bf21aec3d1
SHA1 5cdd4d509eb936d83cf76289c7318d41ecbe92f2
SHA512 d94010f0540ab61350cda00d786994f9a6169e1e12c559915ddec3bcfd6cbbc724a4df56f9daaa589a7b7163c6b180f0c000c0e38105944c8523f38b7564852c
SSDEEP 3072:6EnyoLJnvGrmNDtz7RFPjxcYC32aHUxWseJ:KoLJnvGrmNDtz7RFPjxcYCpUxWseJ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/net46/ko/System.Net.Http.xml

SHA256 ab485c1709e5cd4061f75bc867c5612587080274e18af9142d223d02a65105b1
MD5 8d4b473fa359d6db095dbd20ebe46487
SHA1 51ffe8bdddcb9d4aba51d6143f2322d19286805f
SHA512 f22391b416fd4017c7424a98e5721ee31135853ea8f9e6cfd4f1c5cc7493b9a3c825ca8b8618a8f2db55b243328ef8dfc69bcfd6fcebd46b24feb940be32a2f3
SSDEEP 6144:FvseQk5I/27pBXfR4D9R3GX5L4npGemoK3FSmePqxlHCEntutRLLslCXfv4QUihA:FvseQk5I/27pBXfR4D9R3G3ntutRLLs/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/net46/ru/System.Net.Http.xml

SHA256 182e7d267216eeb73458a6c8bbcdc65411318533a014c60307a7b8b404bba7ce
MD5 e41f28a02610fe14142acfea11c37e7c
SHA1 9d4c9bdf6285d2024c522a7a139f77a49dfa969c
SHA512 2bd40b68a84df1e85e244419bd1564a51d6b2a4b2190a6e875daa527994cca62689b058e31237b9bd5c24256354abd4dc275f904db29b92f0927028d532afbe5
SSDEEP 6144:RTQLWPBOYdmI2Y3JCrkrcwAXQLZ7yZWjRbytvaMxbeKrLBk41SoxGS:RTQLWPBOYdmI2Y3JCrkrcJLddb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/net46/zh-hans/System.Net.Http.xml

SHA256 da0172f8457625a4b75a5fdd4ad7abcd948a25a635d5d750841333e91bcb01d4
MD5 009b02434b849da433175f4f33475c01
SHA1 188e22dfd4092905119eaff3672aea62db367cac
SHA512 8ac274375aa5e91e558d70ad3258bf05b5d814d2ac46cb7d292cca1bd4bab34352d95447378d449860a16047eb6de9aafbc07de3784285563372142caa9e0162
SSDEEP 3072:pTlhTswYS0HFQDmAXJ39wfixicxcu3bvv+5KFBy4SPRXpLkAMRRgzILhyxxs8xcv:ZswYS0HFQDmAXJ39wfixicxcu3bvv+50
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/net46/zh-hant/System.Net.Http.xml

SHA256 f855ea33aa5b5d6111f22290b5d52f050446ff5238ddfcd101c670b37c377c5f
MD5 8adcbc2a69f14aa18e3fdb184af1aa00
SHA1 250b7dad20be28deb5bc5de914daededf92ee07a
SHA512 e75fb721bfcd7c5bf9433000a8d3f067cf1dd2cc471a5b470a92ef2a11d84efbf63aa8fde5d4b5cae980c0264c3c8fac54e355bedd2cb01835d59fefb4fca5af
SSDEEP 6144:BIY+0gHOAIh+Ovxw/AxCBWRCKfdb8rl5Rsk:0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netcore50/System.Net.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 122ba6729df3fc3a7c1c8d9830e0976e671608adb142d12b2afe06d158d95ff6
MD5 b100790afe63a29e65d5cb6f6bf5ff6c
SHA1 e5372869461e3885c4a44878a41628c69397807c
SHA512 8a0130ea1ae2674d1484e897cfa419835eec3f2c841d734f9d2fadcb10a6b2d87fe0621bf51e5dfd498ee1cc1af705b869cdea84bf99036504e5097c1dea48dc
SSDEEP 768:kGN50bWBDBUFs4/uJUKxofwB7301vieNEB0jL:bNnoFs4/uJp7301vLEB0f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

2f:c4:8d:4f:c8:cd:26:e8:eb:3c:8d:b9:56:02:80:fe:2b:5d:62:0a:42:7a:a4:79:c6:38:45:17:f8:b6:a9:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

94:b4:7c:75:2f:b5:ae:90:e3:36:2e:df:4f:94:eb:d9:7c:41:9b:82

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

34258

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\ref\System.Net.Http\4.1.1.0\System.Net.Http.pdb

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netcore50/System.Net.Http.xml

SHA256 dd18068cab95ac00ffe010775714455bd3b931aa7043172c9cd3edddc25a63f3
MD5 0bcbd80d8be28902d8fed22c1109c090
SHA1 66fa039b2d64c459a90f13748dc2bcd2a120b723
SHA512 1bcbb55c31c0daf39b972241cf38c5a05c684110cec9ca2fc3b4842c0684a1504297e095c434a6cfbae256a77f301a1a74c3d17cf6da6201898a3fde7a3ec46e
SSDEEP 1536:paH5LivK7kW8+swmH37pVTxogQ/nm5HwQdOUfhgc:paH9ivK7kW8+swmH37pVTxogQe5HFpgc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netcore50/de/System.Net.Http.xml

SHA256 2dfeceff8943a5401273b2ee691e28757e58e94701e1977fc72037d4bdfdbdc5
MD5 ff8cac95fab402bc0659c3e8eab2f106
SHA1 bf5618311ba4964eb4b11817fafecb7c1fbb268c
SHA512 04214091c3781bcca92755087f1516ae6161cf1b7dd31955ff28d3585d41a1a4dd2e4651a5ee57a495e7fc5d400b245f1de65ffed835ac8da40b8598a8693858
SSDEEP 6144:I9BvusZ4WMQossm3/b5vpox1bqUb3UgW5EjV7mkuVqtfaokrRUFlFee:I9BvKb3UkjV7mBqx5kNUvFee
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netcore50/es/System.Net.Http.xml

SHA256 4b14898c77c9bdd51f82685edd17ab809a90ceddac1b6f872cabb8f5abc23cf7
MD5 44c07e80686ebb2b861b3612d53193f1
SHA1 1738dcb73291bf860960503422fd4efca90574df
SHA512 821f8706398b7d1347909fc4a83f618cdf5ee7d455f0dce38535ae9bc1ca28ffa81948452882c608d72861c1832e5db1ffc122e7d8e7133a8f5d637773411dbf
SSDEEP 3072:Nusd8FIoEzGw2o535dDFEcx7JouqpCSYAF04V:YFIoEzGw2o535dDFEcx7JonCSYAF04V
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netcore50/fr/System.Net.Http.xml

SHA256 34e5dbc7a5329f0ade1075a72ebb0b8caf13a04f4ea4fbc8b6263cd111871c21
MD5 39038ee4376f283f4402ee2138ccb417
SHA1 6f2eaf29b7c36bbd6fdb8b515367eba747f913d2
SHA512 c6f5a4019e03e32edfdf6822658abc5ba66951741ee722d9aa05559d9fa8ba5cc399139251d35de76d28109b6e5b8ef9081c20a56a105ac140cd97d2e841a55a
SSDEEP 6144:F6bN/TY+1UgCp9W84sxCev2ooD4zpNhXOgL:J
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netcore50/it/System.Net.Http.xml

SHA256 f5ddab4b3ac2caf5d3ab4831cbaf972867d32892c31062c57e7dd4496b83ecdd
MD5 29b057ba18b5aebed8b51e62c60e6e9d
SHA1 e8a0c6b8bdc2c38f009b736cdc842ca447ffc088
SHA512 ca8f34fafbca00a5adaa02f7769dd50c2dba39cce080529d974002cedc8ca4463de131581bd2f07e8b7fcc1a11f6ad6d8a246efa8603654656aa1f8d4415c1f7
SSDEEP 6144:n4g/QFvVcNJGKHZ4gBQERTouHxjNs9kTqpQV1cGa8atX7a3wqA6HYMf6CYbGjSjf:E
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netcore50/ja/System.Net.Http.xml

SHA256 4d157db9f237dbdd172accc37f9f5a81f699adaea23e71cbb3aa414521b0342f
MD5 37d0cb1204bba39d29e5f3bf21aec3d1
SHA1 5cdd4d509eb936d83cf76289c7318d41ecbe92f2
SHA512 d94010f0540ab61350cda00d786994f9a6169e1e12c559915ddec3bcfd6cbbc724a4df56f9daaa589a7b7163c6b180f0c000c0e38105944c8523f38b7564852c
SSDEEP 3072:6EnyoLJnvGrmNDtz7RFPjxcYC32aHUxWseJ:KoLJnvGrmNDtz7RFPjxcYCpUxWseJ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netcore50/ko/System.Net.Http.xml

SHA256 ab485c1709e5cd4061f75bc867c5612587080274e18af9142d223d02a65105b1
MD5 8d4b473fa359d6db095dbd20ebe46487
SHA1 51ffe8bdddcb9d4aba51d6143f2322d19286805f
SHA512 f22391b416fd4017c7424a98e5721ee31135853ea8f9e6cfd4f1c5cc7493b9a3c825ca8b8618a8f2db55b243328ef8dfc69bcfd6fcebd46b24feb940be32a2f3
SSDEEP 6144:FvseQk5I/27pBXfR4D9R3GX5L4npGemoK3FSmePqxlHCEntutRLLslCXfv4QUihA:FvseQk5I/27pBXfR4D9R3G3ntutRLLs/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netcore50/ru/System.Net.Http.xml

SHA256 182e7d267216eeb73458a6c8bbcdc65411318533a014c60307a7b8b404bba7ce
MD5 e41f28a02610fe14142acfea11c37e7c
SHA1 9d4c9bdf6285d2024c522a7a139f77a49dfa969c
SHA512 2bd40b68a84df1e85e244419bd1564a51d6b2a4b2190a6e875daa527994cca62689b058e31237b9bd5c24256354abd4dc275f904db29b92f0927028d532afbe5
SSDEEP 6144:RTQLWPBOYdmI2Y3JCrkrcwAXQLZ7yZWjRbytvaMxbeKrLBk41SoxGS:RTQLWPBOYdmI2Y3JCrkrcJLddb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netcore50/zh-hans/System.Net.Http.xml

SHA256 da0172f8457625a4b75a5fdd4ad7abcd948a25a635d5d750841333e91bcb01d4
MD5 009b02434b849da433175f4f33475c01
SHA1 188e22dfd4092905119eaff3672aea62db367cac
SHA512 8ac274375aa5e91e558d70ad3258bf05b5d814d2ac46cb7d292cca1bd4bab34352d95447378d449860a16047eb6de9aafbc07de3784285563372142caa9e0162
SSDEEP 3072:pTlhTswYS0HFQDmAXJ39wfixicxcu3bvv+5KFBy4SPRXpLkAMRRgzILhyxxs8xcv:ZswYS0HFQDmAXJ39wfixicxcu3bvv+50
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netcore50/zh-hant/System.Net.Http.xml

SHA256 f855ea33aa5b5d6111f22290b5d52f050446ff5238ddfcd101c670b37c377c5f
MD5 8adcbc2a69f14aa18e3fdb184af1aa00
SHA1 250b7dad20be28deb5bc5de914daededf92ee07a
SHA512 e75fb721bfcd7c5bf9433000a8d3f067cf1dd2cc471a5b470a92ef2a11d84efbf63aa8fde5d4b5cae980c0264c3c8fac54e355bedd2cb01835d59fefb4fca5af
SSDEEP 6144:BIY+0gHOAIh+Ovxw/AxCBWRCKfdb8rl5Rsk:0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.1/System.Net.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bb39e3ec2a5c44c5d0e8e3d32592df7a2934f394702be91e81f1378c6c10146d
MD5 53e539a787433320ee4b24e06f3024a1
SHA1 5c03e03fc15c4a77f5cf861cb45b6758f8a0298c
SHA512 af9e6737939a7489930e572998eca79122753ccc43227df33f320f83fcf1e2738bcdf3e45423f9284763ffa32e723bc1310fa6cb87a7fd1d2d595a0ee446ce82
SSDEEP 768:bRBi0w3x1MdK5GSRrm2rN9+Ba58WiYDmNY:FBid7MURRrp6Ba5XLDQY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

88:1c:e5:de:3d:5c:f3:dc:20:4d:6b:cf:15:73:97:33:00:13:dd:9d:11:52:23:d9:a2:f3:d3:fa:fd:28:27:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

ef:0c:f7:5f:f6:1f:04:10:bc:6f:0b:2a:51:6c:b2:98:6e:6c:6b:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

36270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.1/System.Net.Http.xml

SHA256 dd18068cab95ac00ffe010775714455bd3b931aa7043172c9cd3edddc25a63f3
MD5 0bcbd80d8be28902d8fed22c1109c090
SHA1 66fa039b2d64c459a90f13748dc2bcd2a120b723
SHA512 1bcbb55c31c0daf39b972241cf38c5a05c684110cec9ca2fc3b4842c0684a1504297e095c434a6cfbae256a77f301a1a74c3d17cf6da6201898a3fde7a3ec46e
SSDEEP 1536:paH5LivK7kW8+swmH37pVTxogQ/nm5HwQdOUfhgc:paH9ivK7kW8+swmH37pVTxogQe5HFpgc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.1/de/System.Net.Http.xml

SHA256 2dfeceff8943a5401273b2ee691e28757e58e94701e1977fc72037d4bdfdbdc5
MD5 ff8cac95fab402bc0659c3e8eab2f106
SHA1 bf5618311ba4964eb4b11817fafecb7c1fbb268c
SHA512 04214091c3781bcca92755087f1516ae6161cf1b7dd31955ff28d3585d41a1a4dd2e4651a5ee57a495e7fc5d400b245f1de65ffed835ac8da40b8598a8693858
SSDEEP 6144:I9BvusZ4WMQossm3/b5vpox1bqUb3UgW5EjV7mkuVqtfaokrRUFlFee:I9BvKb3UkjV7mBqx5kNUvFee
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.1/es/System.Net.Http.xml

SHA256 4b14898c77c9bdd51f82685edd17ab809a90ceddac1b6f872cabb8f5abc23cf7
MD5 44c07e80686ebb2b861b3612d53193f1
SHA1 1738dcb73291bf860960503422fd4efca90574df
SHA512 821f8706398b7d1347909fc4a83f618cdf5ee7d455f0dce38535ae9bc1ca28ffa81948452882c608d72861c1832e5db1ffc122e7d8e7133a8f5d637773411dbf
SSDEEP 3072:Nusd8FIoEzGw2o535dDFEcx7JouqpCSYAF04V:YFIoEzGw2o535dDFEcx7JonCSYAF04V
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.1/fr/System.Net.Http.xml

SHA256 34e5dbc7a5329f0ade1075a72ebb0b8caf13a04f4ea4fbc8b6263cd111871c21
MD5 39038ee4376f283f4402ee2138ccb417
SHA1 6f2eaf29b7c36bbd6fdb8b515367eba747f913d2
SHA512 c6f5a4019e03e32edfdf6822658abc5ba66951741ee722d9aa05559d9fa8ba5cc399139251d35de76d28109b6e5b8ef9081c20a56a105ac140cd97d2e841a55a
SSDEEP 6144:F6bN/TY+1UgCp9W84sxCev2ooD4zpNhXOgL:J
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.1/it/System.Net.Http.xml

SHA256 f5ddab4b3ac2caf5d3ab4831cbaf972867d32892c31062c57e7dd4496b83ecdd
MD5 29b057ba18b5aebed8b51e62c60e6e9d
SHA1 e8a0c6b8bdc2c38f009b736cdc842ca447ffc088
SHA512 ca8f34fafbca00a5adaa02f7769dd50c2dba39cce080529d974002cedc8ca4463de131581bd2f07e8b7fcc1a11f6ad6d8a246efa8603654656aa1f8d4415c1f7
SSDEEP 6144:n4g/QFvVcNJGKHZ4gBQERTouHxjNs9kTqpQV1cGa8atX7a3wqA6HYMf6CYbGjSjf:E
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.1/ja/System.Net.Http.xml

SHA256 4d157db9f237dbdd172accc37f9f5a81f699adaea23e71cbb3aa414521b0342f
MD5 37d0cb1204bba39d29e5f3bf21aec3d1
SHA1 5cdd4d509eb936d83cf76289c7318d41ecbe92f2
SHA512 d94010f0540ab61350cda00d786994f9a6169e1e12c559915ddec3bcfd6cbbc724a4df56f9daaa589a7b7163c6b180f0c000c0e38105944c8523f38b7564852c
SSDEEP 3072:6EnyoLJnvGrmNDtz7RFPjxcYC32aHUxWseJ:KoLJnvGrmNDtz7RFPjxcYCpUxWseJ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.1/ko/System.Net.Http.xml

SHA256 ab485c1709e5cd4061f75bc867c5612587080274e18af9142d223d02a65105b1
MD5 8d4b473fa359d6db095dbd20ebe46487
SHA1 51ffe8bdddcb9d4aba51d6143f2322d19286805f
SHA512 f22391b416fd4017c7424a98e5721ee31135853ea8f9e6cfd4f1c5cc7493b9a3c825ca8b8618a8f2db55b243328ef8dfc69bcfd6fcebd46b24feb940be32a2f3
SSDEEP 6144:FvseQk5I/27pBXfR4D9R3GX5L4npGemoK3FSmePqxlHCEntutRLLslCXfv4QUihA:FvseQk5I/27pBXfR4D9R3G3ntutRLLs/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.1/ru/System.Net.Http.xml

SHA256 182e7d267216eeb73458a6c8bbcdc65411318533a014c60307a7b8b404bba7ce
MD5 e41f28a02610fe14142acfea11c37e7c
SHA1 9d4c9bdf6285d2024c522a7a139f77a49dfa969c
SHA512 2bd40b68a84df1e85e244419bd1564a51d6b2a4b2190a6e875daa527994cca62689b058e31237b9bd5c24256354abd4dc275f904db29b92f0927028d532afbe5
SSDEEP 6144:RTQLWPBOYdmI2Y3JCrkrcwAXQLZ7yZWjRbytvaMxbeKrLBk41SoxGS:RTQLWPBOYdmI2Y3JCrkrcJLddb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.1/zh-hans/System.Net.Http.xml

SHA256 da0172f8457625a4b75a5fdd4ad7abcd948a25a635d5d750841333e91bcb01d4
MD5 009b02434b849da433175f4f33475c01
SHA1 188e22dfd4092905119eaff3672aea62db367cac
SHA512 8ac274375aa5e91e558d70ad3258bf05b5d814d2ac46cb7d292cca1bd4bab34352d95447378d449860a16047eb6de9aafbc07de3784285563372142caa9e0162
SSDEEP 3072:pTlhTswYS0HFQDmAXJ39wfixicxcu3bvv+5KFBy4SPRXpLkAMRRgzILhyxxs8xcv:ZswYS0HFQDmAXJ39wfixicxcu3bvv+50
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.1/zh-hant/System.Net.Http.xml

SHA256 f855ea33aa5b5d6111f22290b5d52f050446ff5238ddfcd101c670b37c377c5f
MD5 8adcbc2a69f14aa18e3fdb184af1aa00
SHA1 250b7dad20be28deb5bc5de914daededf92ee07a
SHA512 e75fb721bfcd7c5bf9433000a8d3f067cf1dd2cc471a5b470a92ef2a11d84efbf63aa8fde5d4b5cae980c0264c3c8fac54e355bedd2cb01835d59fefb4fca5af
SSDEEP 6144:BIY+0gHOAIh+Ovxw/AxCBWRCKfdb8rl5Rsk:0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.3/System.Net.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 122ba6729df3fc3a7c1c8d9830e0976e671608adb142d12b2afe06d158d95ff6
MD5 b100790afe63a29e65d5cb6f6bf5ff6c
SHA1 e5372869461e3885c4a44878a41628c69397807c
SHA512 8a0130ea1ae2674d1484e897cfa419835eec3f2c841d734f9d2fadcb10a6b2d87fe0621bf51e5dfd498ee1cc1af705b869cdea84bf99036504e5097c1dea48dc
SSDEEP 768:kGN50bWBDBUFs4/uJUKxofwB7301vieNEB0jL:bNnoFs4/uJp7301vLEB0f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

2f:c4:8d:4f:c8:cd:26:e8:eb:3c:8d:b9:56:02:80:fe:2b:5d:62:0a:42:7a:a4:79:c6:38:45:17:f8:b6:a9:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

94:b4:7c:75:2f:b5:ae:90:e3:36:2e:df:4f:94:eb:d9:7c:41:9b:82

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

34258

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\ref\System.Net.Http\4.1.1.0\System.Net.Http.pdb

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.3/System.Net.Http.xml

SHA256 dd18068cab95ac00ffe010775714455bd3b931aa7043172c9cd3edddc25a63f3
MD5 0bcbd80d8be28902d8fed22c1109c090
SHA1 66fa039b2d64c459a90f13748dc2bcd2a120b723
SHA512 1bcbb55c31c0daf39b972241cf38c5a05c684110cec9ca2fc3b4842c0684a1504297e095c434a6cfbae256a77f301a1a74c3d17cf6da6201898a3fde7a3ec46e
SSDEEP 1536:paH5LivK7kW8+swmH37pVTxogQ/nm5HwQdOUfhgc:paH9ivK7kW8+swmH37pVTxogQe5HFpgc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.3/de/System.Net.Http.xml

SHA256 2dfeceff8943a5401273b2ee691e28757e58e94701e1977fc72037d4bdfdbdc5
MD5 ff8cac95fab402bc0659c3e8eab2f106
SHA1 bf5618311ba4964eb4b11817fafecb7c1fbb268c
SHA512 04214091c3781bcca92755087f1516ae6161cf1b7dd31955ff28d3585d41a1a4dd2e4651a5ee57a495e7fc5d400b245f1de65ffed835ac8da40b8598a8693858
SSDEEP 6144:I9BvusZ4WMQossm3/b5vpox1bqUb3UgW5EjV7mkuVqtfaokrRUFlFee:I9BvKb3UkjV7mBqx5kNUvFee
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.3/es/System.Net.Http.xml

SHA256 4b14898c77c9bdd51f82685edd17ab809a90ceddac1b6f872cabb8f5abc23cf7
MD5 44c07e80686ebb2b861b3612d53193f1
SHA1 1738dcb73291bf860960503422fd4efca90574df
SHA512 821f8706398b7d1347909fc4a83f618cdf5ee7d455f0dce38535ae9bc1ca28ffa81948452882c608d72861c1832e5db1ffc122e7d8e7133a8f5d637773411dbf
SSDEEP 3072:Nusd8FIoEzGw2o535dDFEcx7JouqpCSYAF04V:YFIoEzGw2o535dDFEcx7JonCSYAF04V
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.3/fr/System.Net.Http.xml

SHA256 34e5dbc7a5329f0ade1075a72ebb0b8caf13a04f4ea4fbc8b6263cd111871c21
MD5 39038ee4376f283f4402ee2138ccb417
SHA1 6f2eaf29b7c36bbd6fdb8b515367eba747f913d2
SHA512 c6f5a4019e03e32edfdf6822658abc5ba66951741ee722d9aa05559d9fa8ba5cc399139251d35de76d28109b6e5b8ef9081c20a56a105ac140cd97d2e841a55a
SSDEEP 6144:F6bN/TY+1UgCp9W84sxCev2ooD4zpNhXOgL:J
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.3/it/System.Net.Http.xml

SHA256 f5ddab4b3ac2caf5d3ab4831cbaf972867d32892c31062c57e7dd4496b83ecdd
MD5 29b057ba18b5aebed8b51e62c60e6e9d
SHA1 e8a0c6b8bdc2c38f009b736cdc842ca447ffc088
SHA512 ca8f34fafbca00a5adaa02f7769dd50c2dba39cce080529d974002cedc8ca4463de131581bd2f07e8b7fcc1a11f6ad6d8a246efa8603654656aa1f8d4415c1f7
SSDEEP 6144:n4g/QFvVcNJGKHZ4gBQERTouHxjNs9kTqpQV1cGa8atX7a3wqA6HYMf6CYbGjSjf:E
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.3/ja/System.Net.Http.xml

SHA256 4d157db9f237dbdd172accc37f9f5a81f699adaea23e71cbb3aa414521b0342f
MD5 37d0cb1204bba39d29e5f3bf21aec3d1
SHA1 5cdd4d509eb936d83cf76289c7318d41ecbe92f2
SHA512 d94010f0540ab61350cda00d786994f9a6169e1e12c559915ddec3bcfd6cbbc724a4df56f9daaa589a7b7163c6b180f0c000c0e38105944c8523f38b7564852c
SSDEEP 3072:6EnyoLJnvGrmNDtz7RFPjxcYC32aHUxWseJ:KoLJnvGrmNDtz7RFPjxcYCpUxWseJ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.3/ko/System.Net.Http.xml

SHA256 ab485c1709e5cd4061f75bc867c5612587080274e18af9142d223d02a65105b1
MD5 8d4b473fa359d6db095dbd20ebe46487
SHA1 51ffe8bdddcb9d4aba51d6143f2322d19286805f
SHA512 f22391b416fd4017c7424a98e5721ee31135853ea8f9e6cfd4f1c5cc7493b9a3c825ca8b8618a8f2db55b243328ef8dfc69bcfd6fcebd46b24feb940be32a2f3
SSDEEP 6144:FvseQk5I/27pBXfR4D9R3GX5L4npGemoK3FSmePqxlHCEntutRLLslCXfv4QUihA:FvseQk5I/27pBXfR4D9R3G3ntutRLLs/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.3/ru/System.Net.Http.xml

SHA256 182e7d267216eeb73458a6c8bbcdc65411318533a014c60307a7b8b404bba7ce
MD5 e41f28a02610fe14142acfea11c37e7c
SHA1 9d4c9bdf6285d2024c522a7a139f77a49dfa969c
SHA512 2bd40b68a84df1e85e244419bd1564a51d6b2a4b2190a6e875daa527994cca62689b058e31237b9bd5c24256354abd4dc275f904db29b92f0927028d532afbe5
SSDEEP 6144:RTQLWPBOYdmI2Y3JCrkrcwAXQLZ7yZWjRbytvaMxbeKrLBk41SoxGS:RTQLWPBOYdmI2Y3JCrkrcJLddb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.3/zh-hans/System.Net.Http.xml

SHA256 da0172f8457625a4b75a5fdd4ad7abcd948a25a635d5d750841333e91bcb01d4
MD5 009b02434b849da433175f4f33475c01
SHA1 188e22dfd4092905119eaff3672aea62db367cac
SHA512 8ac274375aa5e91e558d70ad3258bf05b5d814d2ac46cb7d292cca1bd4bab34352d95447378d449860a16047eb6de9aafbc07de3784285563372142caa9e0162
SSDEEP 3072:pTlhTswYS0HFQDmAXJ39wfixicxcu3bvv+5KFBy4SPRXpLkAMRRgzILhyxxs8xcv:ZswYS0HFQDmAXJ39wfixicxcu3bvv+50
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/ref/netstandard1.3/zh-hant/System.Net.Http.xml

SHA256 f855ea33aa5b5d6111f22290b5d52f050446ff5238ddfcd101c670b37c377c5f
MD5 8adcbc2a69f14aa18e3fdb184af1aa00
SHA1 250b7dad20be28deb5bc5de914daededf92ee07a
SHA512 e75fb721bfcd7c5bf9433000a8d3f067cf1dd2cc471a5b470a92ef2a11d84efbf63aa8fde5d4b5cae980c0264c3c8fac54e355bedd2cb01835d59fefb4fca5af
SSDEEP 6144:BIY+0gHOAIh+Ovxw/AxCBWRCKfdb8rl5Rsk:0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/runtimes/unix/lib/netstandard1.6/System.Net.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 931ca0a62444a7332fdf7796c2660acfc871a9555ba0ef6611c57f2073c0fa98
MD5 2a8a309ae5593f929faa76cd2fd6f168
SHA1 64332a4e444e566555dae6fabd8e38e9693ba89f
SHA512 763a60eb16503f0425514b7916daead02cd02c9de203b083f061000f0dd96ec0a7402ad12b75a0efc1b0d7379483832225c1ef54b8e5a4da4c007418bad96002
SSDEEP 3072:VhigI6nbcpU1XHJn8sdGZ2GZxk9H6O+j6C2MUWnTY9yI/IfDt1wIdiUtidz7fCl4:VzngkH1hGQGZx4azTYWIg8pp3wAuy/3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

2e:ca:8e:6e:37:ed:d3:30:8b:e4:ce:28:18:45:51:45:92:b9:c1:07:b9:74:bb:7d:04:85:11:e5:a8:bf:e0:ed

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

da:1d:2e:c4:6c:e6:6e:8a:0d:bb:d2:df:ae:46:ee:58:c4:46:46:8f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

276914

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Unix.AnyCPU.Release\System.Net.Http\System.Net.Http.pdb

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/runtimes/win/lib/net46/System.Net.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b741118740bad14229b30f27ce3883c2c8c0a720dee09a1c7e336fc0fc2073b1
MD5 0a57fb3524cbb09fff3f81068802d1af
SHA1 6d344a09471d8b4b849f16b0eebbaff8688a17ce
SHA512 c9c0f6de3f78a14d8f640dfef371c6c16073694555f9b8553c6212114c8ad43ce58b55f976279165ef0af813f1381efe3cb7ee44ef2ecfa8249701269a5417ea
SSDEEP 6144:JEYcGn/euhYp+YlHN7nD14NbaaQXSkNaahU89/IgBrpr8bMkapan4kgLMp3kVyf9:JEYcGn/e58bj74HjVA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

4c:d3:a1:8c:7e:3e:bd:22:64:47:93:94:5a:cb:5c:73:d3:d2:31:44:db:ea:b2:50:80:49:19:03:76:ff:bf:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

78:c6:9a:a6:a2:b5:73:34:08:7f:d1:b2:63:64:28:ba:7b:1b:53:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

254342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\net46\System.Net.Http.pdb

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/runtimes/win/lib/netcore50/System.Net.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 39f30dee0003102585fd57c848df06dc251ac83ef6f68db5ff8ef311b5cf7f79
MD5 4572b8637af2a7ebae95feae3e7129d1
SHA1 048b883853630d68df84e50177ee025cd42379b9
SHA512 a4bf319f01d162a79326c33b59f0e579cb3784228489f091ef7dbe727e62a636fe5535a9293b0d69b9e7999dfead49f107b187ad4f8aa6aa0944279409051d90
SSDEEP 3072:oqJAh0d9AgmEKMFVoagsDWYlw5/U2T+s871wqvpi64GPW/GmweRdxCaFPqUKrlQI:2h0ogmEKMFV9KYplpZGyvVX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

26:d8:f3:ba:fc:a6:9c:1d:75:b5:03:ed:d3:3e:fa:cb:80:1e:be:aa:3d:e3:c3:21:12:31:03:0b:89:60:6e:71

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8c:d7:42:52:91:03:5a:a7:06:e7:c7:ff:76:89:5b:41:fa:82:3d:67

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

214130

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\netcore50\System.Net.Http.pdb

LegionStealer V1 SRC/packages/System.Net.Http.4.3.0/runtimes/win/lib/netstandard1.3/System.Net.Http.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6fd63eeac19ee92e905cb71326956c6bbf31153152b53dd146f19d46ac064b8f
MD5 52849d2e8988f05b2de9188d4d9ec16b
SHA1 a1dfb71508e2eedf348e156c34df35501af9220f
SHA512 91405b9917175f488f51796ea313cc481cbb9d542473df99543f5e5e185e8c4c9c83f6e309982aa936f7dd704c27c6ffa3e86ceda77f686dd4dbf9f41a79ff1f
SSDEEP 6144:HbRPQCssX3TBQFu8n4eMKvvdOn4xFv/pXh4MTy23:HVAn4e5y4/xmGn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

22:89:55:c0:2c:92:98:a0:b1:41:38:66:13:ce:e3:ed:6e:cb:53:e2:1a:f1:2b:61:d6:c8:83:69:69:51:7b:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

68:e2:50:96:4d:1f:55:a0:de:31:86:fd:1f:b1:85:d3:74:8f:74:76

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

260806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Net.Http\System.Net.Http.pdb

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/.signature.p7s

SHA256 7fa2141d656c6ef5f4d2f3cec00052da13e7d7464e67da0122e6ae2e4d95c997
MD5 b2d880f36782263e24c0cf35e5699afe
SHA1 a0a349467fd4acaf06a8a3100546dbbebfd11a11
SHA512 1a7ee170d452927cc6e51b85207a453cafef8e458befbb44d1f9264c4bd94f761ebb23a6dbb8875ff600940363f5d1d79d90e85856fdceebec4c0418cdbc1741
SSDEEP 192:8dx7x0KDWpHhXZCVzV07xrPTGDH0JOqsmVgz28WhBq6/jiV:ErvDGGVpaGoJN77hhp+V
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/System.Net.Primitives.4.3.0.nupkg

SHA256 318ed9eaf3ad14c6c429a2d6f6739265e023716a700ad74eeff5b59a41990731
MD5 323b34f9ed78da3e01c7b020c9460f7c
SHA1 abb374372f9a8b1b7694d782d4fc76a459c7be5e
SHA512 9f7fdece330a81f3312ea7c804927852413bee2c929f3066b736993803df47cc0692fbca236c222bf19dc8f59b42f54f2a4c00da9a4d624e458da5874d127ce6
SSDEEP 12288:tvQPZVla9oPGqa+7qWDql6Wh2gQPZVgaroPRqnX7qWDqKERh2xPZVRaRoPsqeK7E:tviZVVGe7FD/WliZVIRi7FDiRWZV5soo
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netcore50/System.Net.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 40a440cc71450d39ae5079c9a733e17ca180c2485a537cecad6084a697a0f34f
MD5 ac495e21047ba0358c0dca9886c5285c
SHA1 9bbe338c76385a7dce8abdb91483007c318f5884
SHA512 2cf65c95c5068614437773e0524e7a0bc3564fd735a3ac5c7f8affba0cf114bd24a4b4069f6b285068b65fd71975617045c3b979c8b3f20d1c5036066f222ff9
SSDEEP 384:XIJgAjxDLGmXVQCWfyW/vdIQLyDMSVUXEHbDmFWHIWinyAA0GftpBjDkGNERHRN6:XUpHVQCUB6HbDAixkGNEBGI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

05:fa:30:df:06:a8:fc:c4:e0:48:53:5c:f0:7b:18:41:c6:19:a7:cd:ad:38:a6:01:2e:11:eb:50:46:be:e9:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

18:f0:0e:b4:7e:f2:30:98:ed:3b:d5:b6:04:8e:0b:84:1b:5d:f3:80

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

23238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Net.Primitives\4.0.10.0\System.Net.Primitives.pdb

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netcore50/System.Net.Primitives.xml

SHA256 a175fcadf6910909c610938e088813ef93179ee5e9717003d12498b53b715ce1
MD5 cb2d3cf31b9bc1a26f413b0af8b4c305
SHA1 bc6c187b3d933292171ef6c2a32101976e819bea
SHA512 694c2760842ada19c68ba85959ab6f6b1798e573dbee228ed4bcfdc68533f3c5d4a4d438fd87a43c10f94670f27e780f72d902367e0e377c476b7a1c764cf3e1
SSDEEP 3072:C2O2h/rEQaXgyDXtIc5QT3kHWWwXWodssnx/pIIa0Aj60uh:9aXHXtI9kHPwXnpIL0iuh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netcore50/de/System.Net.Primitives.xml

SHA256 2c9e3f158ea01c6a4a320d8e4f813bc85b0babd09224373b22a9ed2ec8cb0b15
MD5 557f67e5ddd86c8a651b0736421cb6b9
SHA1 2213a1ccc8417cc5b141d05290a09a8844839986
SHA512 46ed22924431016192c01ba2f00bd2310fc23eea2bcdc1699712b276ff509a5ef615e1d7bbc468a8330f462786f3d165492b57468df773c056de83c65faed34a
SSDEEP 1536:cIk8ckZkaIDxjoqppF+Gs3oanKHjvE7vXF5vkJ61:cI1cAFIDxjoqppF+Gs3oanKHjvWXF5p
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netcore50/es/System.Net.Primitives.xml

SHA256 0309ef90a26b8b6afae011443ab4478ac52c44ef52fdc86f04a7f2cac9e98d5a
MD5 fdc8c622cf4aee81c26f1f082baaf3b0
SHA1 266468a792438aee393f769087ae19435edb204b
SHA512 6c3ee3863e4225d681517241767a4c5dcd05f3e9b0ade42eff27fdd814d839926abe691ad65bb64e5f4650169349224183b6eec27db5cdc066fccc50fde6af41
SSDEEP 1536:+HAHaHOn81qqDnRUeKCl+CjqfnEYTOhT1dOGYvO6mRRYbXJW+9K+B4wRCSWbuq/7:7o1cWUXJW+9K+BBRCSAZOWO7zHZgp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netcore50/fr/System.Net.Primitives.xml

SHA256 ef0af0c17abbcedb80a691bf8d9e9f9379a9d0a28294f5093c57dc665d53c110
MD5 411d02a2c01c9556660940c6b6c7e73c
SHA1 fc34d7cd7c4200ba02acf8ad9e835651f4a34456
SHA512 7ec03b5371e9b546b1ccfa1348fd10d955d72708dd0e552006f68fea2b356326c6817be94cd64463b3bce7ce9d329009c8518a59196a72e8638abf7d0a583ac4
SSDEEP 3072:svjgjlX0cSOicPV1cG/FuMZMI0Dz8Q/GS/:svjgJX03McG9uMxU/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netcore50/it/System.Net.Primitives.xml

SHA256 739d071db299f49427e23a77f424766601c9e9a75b4e346c2598a64e71bfe605
MD5 35eacdcd165641a14bffe6310cbbc73e
SHA1 22831e4dbb1af1f2679b9a3af2eef224c52e9fbe
SHA512 9a5ade192bea7d7d0e0c348dde3aa435e2657e7fa4378ea3c48eae90861ef94d87b77a5cbb5bcf24958f05c6498d41c5f8ce36e99db6447e29b9332fbc846625
SSDEEP 3072:KqRBokvCDnIIGw4+fiKUv47bLMxriaGPEKxuu85L:K6BokvCDnIIGw4+ffU91Icx
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netcore50/ja/System.Net.Primitives.xml

SHA256 182ae2e7fcb2068a0b5954d2ea9f34047063e843b4fd8cc1615069bd3cc661f6
MD5 e402de6d662c9e0edfc75c47f4ba848c
SHA1 3249a5f6daea5402c00e2e27c29ff815f057469e
SHA512 54bc6974a0bb8f95cac34df34f4b88da44f3f18e9a5e7d2b94e7bad5957793529fe56ee68a3410e6b0f80e382b9bff8b4df23326da4441c5957f0b4b791d0b8e
SSDEEP 768:YWEeNwceNrTeNfU28gDr5llNFE4ky5oIxUNEn6F8LveHXqHAUicTnr:RrVb5oIxUN06F8LWHXqHTicTnr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netcore50/ko/System.Net.Primitives.xml

SHA256 984d107d5ece7bc877ddc424aa35c8f641db3633b83a5fdf1cd40d4d66e5848e
MD5 1df925f2a82585ea236f60720c9e3e9f
SHA1 3eb988477be536906c057caec79a9e7822da4974
SHA512 0b64e10abf6eb72fd12218d645007d858bc4e6822cca95f1f72de8bb4d58aed74ca6fc09ec438ff8f136428ee4ef4d9ce7fc543379c33c9753d0d3dd6f3aa9c9
SSDEEP 3072:DLnvVXoXIACQjUDKmr5+dCm21VfUYwxfR0N:DLn8mV+d921VfUYafR0N
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netcore50/ru/System.Net.Primitives.xml

SHA256 ebaf0b908839489da80c16659a239966a3d37f3f3bf6a1ccc86daee7683691e6
MD5 288b934b3e6352656ecb975b8c433bcf
SHA1 4ac052f4d443c4410e2a69102cb57c5eaea264cb
SHA512 b8c6031f72beee1c001fc2b59c4cca394729ffc92bb3ec68363dceec3613ab3c2bad455e235adc052b12e0af1f3438eab40bf20a4549892c2b79c68012c82e8e
SSDEEP 3072:UBBsuEoI2wBcO/gb1r1+INCwPq1z+PwwbwIldfT2ryzyqVgkb:UBBsuw2wBcO/gbJ1+INNwwwOQKVgkb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netcore50/zh-hans/System.Net.Primitives.xml

SHA256 f1438cf62a587d54125aacb375e41b0ec3010a4256a7c56927cca19f78d0e561
MD5 c060790119281f148e6f501617626b21
SHA1 96f8c04fb1e1b4d6fcee58ae8a171d6a1f654ee0
SHA512 418d7d09fb8fa72efcd14d173877ad9bf6e71ae4b67f0e7e5e4cd2ad21148d82cd9126e37b7dfea3d1b5841bdc4596971b86149d3368987782932aba31f02786
SSDEEP 1536:gnZB5YQR66O0v7C+7sR/dqCp4/XGtn1rOeLIgE8HQ:+OmV7sRYCp4/XGtpOeLdHQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netcore50/zh-hant/System.Net.Primitives.xml

SHA256 506f6f0116b4a2e52cf172985657e717896173ea80baec2fc97b39d182a7d4c6
MD5 c659623116831a56d0726b121174b15a
SHA1 1467d5beac7025f9f1886e49866b221f9b5cb3be
SHA512 13dd4c001003068168fdfb6e2d04c2f87eef6105d96a0ef851727c6bbc6970233bffca67fe0d9409c418a584f5d37b42d39398ea3183efb0790edb1cb9e10fa5
SSDEEP 3072:jK2v9ybiCyFe/SFla2T7pa07040gNU0ujnOs3cvv:jvCula2T7g07040rsvv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.0/System.Net.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a122b58f6dcbe0a49eab4aa439cc1b3dfc91a8c44db085cc3fb2c9ef4a051300
MD5 6a49c046f9f0035da4ea3cd39b3692a6
SHA1 888669180e1620a5ee6f5063dc04057b330f218d
SHA512 4b291915a3913b43423a137e4cc82f3b276557fe993803498ab4a1307e8ca339b19ca6bbf8530ea13cf454c6a2b6c56cb90c45282d9ba08626c2cda381311fb5
SSDEEP 384:LubTO5SDXuS5KWS05rWkIW5MnJ//0GftpBjQZT9DoFtAHRN7Zsltrgxx:Lu+yDk8i0fIrA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

de:24:1e:02:f7:43:2d:f3:cd:23:c2:32:c8:7e:43:76:af:b8:e5:d5:da:9a:8c:0f:a6:40:88:8a:82:17:d0:f4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

6d:b5:ad:16:c8:f2:fe:92:55:2d:75:94:cd:94:ea:f5:c5:46:e5:b5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 24, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:2b:39:32:48:c1:b2:c9:48:f3:00:00:00:00:00:2b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 4, 2012 - Dec 4, 2013

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 7, 2012 - Oct 7, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

15262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.0/System.Net.Primitives.xml

SHA256 a175fcadf6910909c610938e088813ef93179ee5e9717003d12498b53b715ce1
MD5 cb2d3cf31b9bc1a26f413b0af8b4c305
SHA1 bc6c187b3d933292171ef6c2a32101976e819bea
SHA512 694c2760842ada19c68ba85959ab6f6b1798e573dbee228ed4bcfdc68533f3c5d4a4d438fd87a43c10f94670f27e780f72d902367e0e377c476b7a1c764cf3e1
SSDEEP 3072:C2O2h/rEQaXgyDXtIc5QT3kHWWwXWodssnx/pIIa0Aj60uh:9aXHXtI9kHPwXnpIL0iuh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.0/de/System.Net.Primitives.xml

SHA256 2c9e3f158ea01c6a4a320d8e4f813bc85b0babd09224373b22a9ed2ec8cb0b15
MD5 557f67e5ddd86c8a651b0736421cb6b9
SHA1 2213a1ccc8417cc5b141d05290a09a8844839986
SHA512 46ed22924431016192c01ba2f00bd2310fc23eea2bcdc1699712b276ff509a5ef615e1d7bbc468a8330f462786f3d165492b57468df773c056de83c65faed34a
SSDEEP 1536:cIk8ckZkaIDxjoqppF+Gs3oanKHjvE7vXF5vkJ61:cI1cAFIDxjoqppF+Gs3oanKHjvWXF5p
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.0/es/System.Net.Primitives.xml

SHA256 0309ef90a26b8b6afae011443ab4478ac52c44ef52fdc86f04a7f2cac9e98d5a
MD5 fdc8c622cf4aee81c26f1f082baaf3b0
SHA1 266468a792438aee393f769087ae19435edb204b
SHA512 6c3ee3863e4225d681517241767a4c5dcd05f3e9b0ade42eff27fdd814d839926abe691ad65bb64e5f4650169349224183b6eec27db5cdc066fccc50fde6af41
SSDEEP 1536:+HAHaHOn81qqDnRUeKCl+CjqfnEYTOhT1dOGYvO6mRRYbXJW+9K+B4wRCSWbuq/7:7o1cWUXJW+9K+BBRCSAZOWO7zHZgp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.0/fr/System.Net.Primitives.xml

SHA256 ef0af0c17abbcedb80a691bf8d9e9f9379a9d0a28294f5093c57dc665d53c110
MD5 411d02a2c01c9556660940c6b6c7e73c
SHA1 fc34d7cd7c4200ba02acf8ad9e835651f4a34456
SHA512 7ec03b5371e9b546b1ccfa1348fd10d955d72708dd0e552006f68fea2b356326c6817be94cd64463b3bce7ce9d329009c8518a59196a72e8638abf7d0a583ac4
SSDEEP 3072:svjgjlX0cSOicPV1cG/FuMZMI0Dz8Q/GS/:svjgJX03McG9uMxU/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.0/it/System.Net.Primitives.xml

SHA256 739d071db299f49427e23a77f424766601c9e9a75b4e346c2598a64e71bfe605
MD5 35eacdcd165641a14bffe6310cbbc73e
SHA1 22831e4dbb1af1f2679b9a3af2eef224c52e9fbe
SHA512 9a5ade192bea7d7d0e0c348dde3aa435e2657e7fa4378ea3c48eae90861ef94d87b77a5cbb5bcf24958f05c6498d41c5f8ce36e99db6447e29b9332fbc846625
SSDEEP 3072:KqRBokvCDnIIGw4+fiKUv47bLMxriaGPEKxuu85L:K6BokvCDnIIGw4+ffU91Icx
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.0/ja/System.Net.Primitives.xml

SHA256 182ae2e7fcb2068a0b5954d2ea9f34047063e843b4fd8cc1615069bd3cc661f6
MD5 e402de6d662c9e0edfc75c47f4ba848c
SHA1 3249a5f6daea5402c00e2e27c29ff815f057469e
SHA512 54bc6974a0bb8f95cac34df34f4b88da44f3f18e9a5e7d2b94e7bad5957793529fe56ee68a3410e6b0f80e382b9bff8b4df23326da4441c5957f0b4b791d0b8e
SSDEEP 768:YWEeNwceNrTeNfU28gDr5llNFE4ky5oIxUNEn6F8LveHXqHAUicTnr:RrVb5oIxUN06F8LWHXqHTicTnr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.0/ko/System.Net.Primitives.xml

SHA256 984d107d5ece7bc877ddc424aa35c8f641db3633b83a5fdf1cd40d4d66e5848e
MD5 1df925f2a82585ea236f60720c9e3e9f
SHA1 3eb988477be536906c057caec79a9e7822da4974
SHA512 0b64e10abf6eb72fd12218d645007d858bc4e6822cca95f1f72de8bb4d58aed74ca6fc09ec438ff8f136428ee4ef4d9ce7fc543379c33c9753d0d3dd6f3aa9c9
SSDEEP 3072:DLnvVXoXIACQjUDKmr5+dCm21VfUYwxfR0N:DLn8mV+d921VfUYafR0N
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.0/ru/System.Net.Primitives.xml

SHA256 ebaf0b908839489da80c16659a239966a3d37f3f3bf6a1ccc86daee7683691e6
MD5 288b934b3e6352656ecb975b8c433bcf
SHA1 4ac052f4d443c4410e2a69102cb57c5eaea264cb
SHA512 b8c6031f72beee1c001fc2b59c4cca394729ffc92bb3ec68363dceec3613ab3c2bad455e235adc052b12e0af1f3438eab40bf20a4549892c2b79c68012c82e8e
SSDEEP 3072:UBBsuEoI2wBcO/gb1r1+INCwPq1z+PwwbwIldfT2ryzyqVgkb:UBBsuw2wBcO/gbJ1+INNwwwOQKVgkb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.0/zh-hans/System.Net.Primitives.xml

SHA256 f1438cf62a587d54125aacb375e41b0ec3010a4256a7c56927cca19f78d0e561
MD5 c060790119281f148e6f501617626b21
SHA1 96f8c04fb1e1b4d6fcee58ae8a171d6a1f654ee0
SHA512 418d7d09fb8fa72efcd14d173877ad9bf6e71ae4b67f0e7e5e4cd2ad21148d82cd9126e37b7dfea3d1b5841bdc4596971b86149d3368987782932aba31f02786
SSDEEP 1536:gnZB5YQR66O0v7C+7sR/dqCp4/XGtn1rOeLIgE8HQ:+OmV7sRYCp4/XGtpOeLdHQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.0/zh-hant/System.Net.Primitives.xml

SHA256 506f6f0116b4a2e52cf172985657e717896173ea80baec2fc97b39d182a7d4c6
MD5 c659623116831a56d0726b121174b15a
SHA1 1467d5beac7025f9f1886e49866b221f9b5cb3be
SHA512 13dd4c001003068168fdfb6e2d04c2f87eef6105d96a0ef851727c6bbc6970233bffca67fe0d9409c418a584f5d37b42d39398ea3183efb0790edb1cb9e10fa5
SSDEEP 3072:jK2v9ybiCyFe/SFla2T7pa07040gNU0ujnOs3cvv:jvCula2T7g07040rsvv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.1/System.Net.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b56129c6323e327c29212a2f71dd1162200c5e2cf077bc2e48f2b06ab60ec98a
MD5 7be1ad76c92ba780c7f03ee26997d9f1
SHA1 c2490af41ee2b3704620e627cab0b9b20c1b8951
SHA512 9441947135bb1076eaf4536556df821d755f706a78963d6fc73c4219f24c65d288023b2af98b97e6fd4edf00edf1776adab9ad451df20a0f948334ec1379f449
SSDEEP 384:GVjVjVR/3XYF7Ej5/HuS5KWp333WfIWt1LHB0GftpBjhBDHRN78lGBPjc:GhVjVR/3XdbMBWiFDZBw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

72:d1:c3:cc:08:fe:7d:d0:33:49:c4:19:af:f4:59:7c:a1:d8:5f:69:28:a3:ed:56:79:30:98:2b:1f:eb:70:d8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

db:f2:6c:b8:c9:ee:fe:c0:0b:87:d5:35:14:d4:d0:58:1a:14:57:01

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

16798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.1/System.Net.Primitives.xml

SHA256 a175fcadf6910909c610938e088813ef93179ee5e9717003d12498b53b715ce1
MD5 cb2d3cf31b9bc1a26f413b0af8b4c305
SHA1 bc6c187b3d933292171ef6c2a32101976e819bea
SHA512 694c2760842ada19c68ba85959ab6f6b1798e573dbee228ed4bcfdc68533f3c5d4a4d438fd87a43c10f94670f27e780f72d902367e0e377c476b7a1c764cf3e1
SSDEEP 3072:C2O2h/rEQaXgyDXtIc5QT3kHWWwXWodssnx/pIIa0Aj60uh:9aXHXtI9kHPwXnpIL0iuh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.1/de/System.Net.Primitives.xml

SHA256 2c9e3f158ea01c6a4a320d8e4f813bc85b0babd09224373b22a9ed2ec8cb0b15
MD5 557f67e5ddd86c8a651b0736421cb6b9
SHA1 2213a1ccc8417cc5b141d05290a09a8844839986
SHA512 46ed22924431016192c01ba2f00bd2310fc23eea2bcdc1699712b276ff509a5ef615e1d7bbc468a8330f462786f3d165492b57468df773c056de83c65faed34a
SSDEEP 1536:cIk8ckZkaIDxjoqppF+Gs3oanKHjvE7vXF5vkJ61:cI1cAFIDxjoqppF+Gs3oanKHjvWXF5p
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.1/es/System.Net.Primitives.xml

SHA256 0309ef90a26b8b6afae011443ab4478ac52c44ef52fdc86f04a7f2cac9e98d5a
MD5 fdc8c622cf4aee81c26f1f082baaf3b0
SHA1 266468a792438aee393f769087ae19435edb204b
SHA512 6c3ee3863e4225d681517241767a4c5dcd05f3e9b0ade42eff27fdd814d839926abe691ad65bb64e5f4650169349224183b6eec27db5cdc066fccc50fde6af41
SSDEEP 1536:+HAHaHOn81qqDnRUeKCl+CjqfnEYTOhT1dOGYvO6mRRYbXJW+9K+B4wRCSWbuq/7:7o1cWUXJW+9K+BBRCSAZOWO7zHZgp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.1/fr/System.Net.Primitives.xml

SHA256 ef0af0c17abbcedb80a691bf8d9e9f9379a9d0a28294f5093c57dc665d53c110
MD5 411d02a2c01c9556660940c6b6c7e73c
SHA1 fc34d7cd7c4200ba02acf8ad9e835651f4a34456
SHA512 7ec03b5371e9b546b1ccfa1348fd10d955d72708dd0e552006f68fea2b356326c6817be94cd64463b3bce7ce9d329009c8518a59196a72e8638abf7d0a583ac4
SSDEEP 3072:svjgjlX0cSOicPV1cG/FuMZMI0Dz8Q/GS/:svjgJX03McG9uMxU/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.1/it/System.Net.Primitives.xml

SHA256 739d071db299f49427e23a77f424766601c9e9a75b4e346c2598a64e71bfe605
MD5 35eacdcd165641a14bffe6310cbbc73e
SHA1 22831e4dbb1af1f2679b9a3af2eef224c52e9fbe
SHA512 9a5ade192bea7d7d0e0c348dde3aa435e2657e7fa4378ea3c48eae90861ef94d87b77a5cbb5bcf24958f05c6498d41c5f8ce36e99db6447e29b9332fbc846625
SSDEEP 3072:KqRBokvCDnIIGw4+fiKUv47bLMxriaGPEKxuu85L:K6BokvCDnIIGw4+ffU91Icx
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.1/ja/System.Net.Primitives.xml

SHA256 182ae2e7fcb2068a0b5954d2ea9f34047063e843b4fd8cc1615069bd3cc661f6
MD5 e402de6d662c9e0edfc75c47f4ba848c
SHA1 3249a5f6daea5402c00e2e27c29ff815f057469e
SHA512 54bc6974a0bb8f95cac34df34f4b88da44f3f18e9a5e7d2b94e7bad5957793529fe56ee68a3410e6b0f80e382b9bff8b4df23326da4441c5957f0b4b791d0b8e
SSDEEP 768:YWEeNwceNrTeNfU28gDr5llNFE4ky5oIxUNEn6F8LveHXqHAUicTnr:RrVb5oIxUN06F8LWHXqHTicTnr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.1/ko/System.Net.Primitives.xml

SHA256 984d107d5ece7bc877ddc424aa35c8f641db3633b83a5fdf1cd40d4d66e5848e
MD5 1df925f2a82585ea236f60720c9e3e9f
SHA1 3eb988477be536906c057caec79a9e7822da4974
SHA512 0b64e10abf6eb72fd12218d645007d858bc4e6822cca95f1f72de8bb4d58aed74ca6fc09ec438ff8f136428ee4ef4d9ce7fc543379c33c9753d0d3dd6f3aa9c9
SSDEEP 3072:DLnvVXoXIACQjUDKmr5+dCm21VfUYwxfR0N:DLn8mV+d921VfUYafR0N
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.1/ru/System.Net.Primitives.xml

SHA256 ebaf0b908839489da80c16659a239966a3d37f3f3bf6a1ccc86daee7683691e6
MD5 288b934b3e6352656ecb975b8c433bcf
SHA1 4ac052f4d443c4410e2a69102cb57c5eaea264cb
SHA512 b8c6031f72beee1c001fc2b59c4cca394729ffc92bb3ec68363dceec3613ab3c2bad455e235adc052b12e0af1f3438eab40bf20a4549892c2b79c68012c82e8e
SSDEEP 3072:UBBsuEoI2wBcO/gb1r1+INCwPq1z+PwwbwIldfT2ryzyqVgkb:UBBsuw2wBcO/gbJ1+INNwwwOQKVgkb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.1/zh-hans/System.Net.Primitives.xml

SHA256 f1438cf62a587d54125aacb375e41b0ec3010a4256a7c56927cca19f78d0e561
MD5 c060790119281f148e6f501617626b21
SHA1 96f8c04fb1e1b4d6fcee58ae8a171d6a1f654ee0
SHA512 418d7d09fb8fa72efcd14d173877ad9bf6e71ae4b67f0e7e5e4cd2ad21148d82cd9126e37b7dfea3d1b5841bdc4596971b86149d3368987782932aba31f02786
SSDEEP 1536:gnZB5YQR66O0v7C+7sR/dqCp4/XGtn1rOeLIgE8HQ:+OmV7sRYCp4/XGtpOeLdHQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.1/zh-hant/System.Net.Primitives.xml

SHA256 506f6f0116b4a2e52cf172985657e717896173ea80baec2fc97b39d182a7d4c6
MD5 c659623116831a56d0726b121174b15a
SHA1 1467d5beac7025f9f1886e49866b221f9b5cb3be
SHA512 13dd4c001003068168fdfb6e2d04c2f87eef6105d96a0ef851727c6bbc6970233bffca67fe0d9409c418a584f5d37b42d39398ea3183efb0790edb1cb9e10fa5
SSDEEP 3072:jK2v9ybiCyFe/SFla2T7pa07040gNU0ujnOs3cvv:jvCula2T7g07040rsvv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.3/System.Net.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 40a440cc71450d39ae5079c9a733e17ca180c2485a537cecad6084a697a0f34f
MD5 ac495e21047ba0358c0dca9886c5285c
SHA1 9bbe338c76385a7dce8abdb91483007c318f5884
SHA512 2cf65c95c5068614437773e0524e7a0bc3564fd735a3ac5c7f8affba0cf114bd24a4b4069f6b285068b65fd71975617045c3b979c8b3f20d1c5036066f222ff9
SSDEEP 384:XIJgAjxDLGmXVQCWfyW/vdIQLyDMSVUXEHbDmFWHIWinyAA0GftpBjDkGNERHRN6:XUpHVQCUB6HbDAixkGNEBGI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

05:fa:30:df:06:a8:fc:c4:e0:48:53:5c:f0:7b:18:41:c6:19:a7:cd:ad:38:a6:01:2e:11:eb:50:46:be:e9:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

18:f0:0e:b4:7e:f2:30:98:ed:3b:d5:b6:04:8e:0b:84:1b:5d:f3:80

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

23238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Net.Primitives\4.0.10.0\System.Net.Primitives.pdb

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.3/System.Net.Primitives.xml

SHA256 a175fcadf6910909c610938e088813ef93179ee5e9717003d12498b53b715ce1
MD5 cb2d3cf31b9bc1a26f413b0af8b4c305
SHA1 bc6c187b3d933292171ef6c2a32101976e819bea
SHA512 694c2760842ada19c68ba85959ab6f6b1798e573dbee228ed4bcfdc68533f3c5d4a4d438fd87a43c10f94670f27e780f72d902367e0e377c476b7a1c764cf3e1
SSDEEP 3072:C2O2h/rEQaXgyDXtIc5QT3kHWWwXWodssnx/pIIa0Aj60uh:9aXHXtI9kHPwXnpIL0iuh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.3/de/System.Net.Primitives.xml

SHA256 2c9e3f158ea01c6a4a320d8e4f813bc85b0babd09224373b22a9ed2ec8cb0b15
MD5 557f67e5ddd86c8a651b0736421cb6b9
SHA1 2213a1ccc8417cc5b141d05290a09a8844839986
SHA512 46ed22924431016192c01ba2f00bd2310fc23eea2bcdc1699712b276ff509a5ef615e1d7bbc468a8330f462786f3d165492b57468df773c056de83c65faed34a
SSDEEP 1536:cIk8ckZkaIDxjoqppF+Gs3oanKHjvE7vXF5vkJ61:cI1cAFIDxjoqppF+Gs3oanKHjvWXF5p
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.3/es/System.Net.Primitives.xml

SHA256 0309ef90a26b8b6afae011443ab4478ac52c44ef52fdc86f04a7f2cac9e98d5a
MD5 fdc8c622cf4aee81c26f1f082baaf3b0
SHA1 266468a792438aee393f769087ae19435edb204b
SHA512 6c3ee3863e4225d681517241767a4c5dcd05f3e9b0ade42eff27fdd814d839926abe691ad65bb64e5f4650169349224183b6eec27db5cdc066fccc50fde6af41
SSDEEP 1536:+HAHaHOn81qqDnRUeKCl+CjqfnEYTOhT1dOGYvO6mRRYbXJW+9K+B4wRCSWbuq/7:7o1cWUXJW+9K+BBRCSAZOWO7zHZgp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.3/fr/System.Net.Primitives.xml

SHA256 ef0af0c17abbcedb80a691bf8d9e9f9379a9d0a28294f5093c57dc665d53c110
MD5 411d02a2c01c9556660940c6b6c7e73c
SHA1 fc34d7cd7c4200ba02acf8ad9e835651f4a34456
SHA512 7ec03b5371e9b546b1ccfa1348fd10d955d72708dd0e552006f68fea2b356326c6817be94cd64463b3bce7ce9d329009c8518a59196a72e8638abf7d0a583ac4
SSDEEP 3072:svjgjlX0cSOicPV1cG/FuMZMI0Dz8Q/GS/:svjgJX03McG9uMxU/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.3/it/System.Net.Primitives.xml

SHA256 739d071db299f49427e23a77f424766601c9e9a75b4e346c2598a64e71bfe605
MD5 35eacdcd165641a14bffe6310cbbc73e
SHA1 22831e4dbb1af1f2679b9a3af2eef224c52e9fbe
SHA512 9a5ade192bea7d7d0e0c348dde3aa435e2657e7fa4378ea3c48eae90861ef94d87b77a5cbb5bcf24958f05c6498d41c5f8ce36e99db6447e29b9332fbc846625
SSDEEP 3072:KqRBokvCDnIIGw4+fiKUv47bLMxriaGPEKxuu85L:K6BokvCDnIIGw4+ffU91Icx
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.3/ja/System.Net.Primitives.xml

SHA256 182ae2e7fcb2068a0b5954d2ea9f34047063e843b4fd8cc1615069bd3cc661f6
MD5 e402de6d662c9e0edfc75c47f4ba848c
SHA1 3249a5f6daea5402c00e2e27c29ff815f057469e
SHA512 54bc6974a0bb8f95cac34df34f4b88da44f3f18e9a5e7d2b94e7bad5957793529fe56ee68a3410e6b0f80e382b9bff8b4df23326da4441c5957f0b4b791d0b8e
SSDEEP 768:YWEeNwceNrTeNfU28gDr5llNFE4ky5oIxUNEn6F8LveHXqHAUicTnr:RrVb5oIxUN06F8LWHXqHTicTnr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.3/ko/System.Net.Primitives.xml

SHA256 984d107d5ece7bc877ddc424aa35c8f641db3633b83a5fdf1cd40d4d66e5848e
MD5 1df925f2a82585ea236f60720c9e3e9f
SHA1 3eb988477be536906c057caec79a9e7822da4974
SHA512 0b64e10abf6eb72fd12218d645007d858bc4e6822cca95f1f72de8bb4d58aed74ca6fc09ec438ff8f136428ee4ef4d9ce7fc543379c33c9753d0d3dd6f3aa9c9
SSDEEP 3072:DLnvVXoXIACQjUDKmr5+dCm21VfUYwxfR0N:DLn8mV+d921VfUYafR0N
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.3/ru/System.Net.Primitives.xml

SHA256 ebaf0b908839489da80c16659a239966a3d37f3f3bf6a1ccc86daee7683691e6
MD5 288b934b3e6352656ecb975b8c433bcf
SHA1 4ac052f4d443c4410e2a69102cb57c5eaea264cb
SHA512 b8c6031f72beee1c001fc2b59c4cca394729ffc92bb3ec68363dceec3613ab3c2bad455e235adc052b12e0af1f3438eab40bf20a4549892c2b79c68012c82e8e
SSDEEP 3072:UBBsuEoI2wBcO/gb1r1+INCwPq1z+PwwbwIldfT2ryzyqVgkb:UBBsuw2wBcO/gbJ1+INNwwwOQKVgkb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.3/zh-hans/System.Net.Primitives.xml

SHA256 f1438cf62a587d54125aacb375e41b0ec3010a4256a7c56927cca19f78d0e561
MD5 c060790119281f148e6f501617626b21
SHA1 96f8c04fb1e1b4d6fcee58ae8a171d6a1f654ee0
SHA512 418d7d09fb8fa72efcd14d173877ad9bf6e71ae4b67f0e7e5e4cd2ad21148d82cd9126e37b7dfea3d1b5841bdc4596971b86149d3368987782932aba31f02786
SSDEEP 1536:gnZB5YQR66O0v7C+7sR/dqCp4/XGtn1rOeLIgE8HQ:+OmV7sRYCp4/XGtpOeLdHQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Primitives.4.3.0/ref/netstandard1.3/zh-hant/System.Net.Primitives.xml

SHA256 506f6f0116b4a2e52cf172985657e717896173ea80baec2fc97b39d182a7d4c6
MD5 c659623116831a56d0726b121174b15a
SHA1 1467d5beac7025f9f1886e49866b221f9b5cb3be
SHA512 13dd4c001003068168fdfb6e2d04c2f87eef6105d96a0ef851727c6bbc6970233bffca67fe0d9409c418a584f5d37b42d39398ea3183efb0790edb1cb9e10fa5
SSDEEP 3072:jK2v9ybiCyFe/SFla2T7pa07040gNU0ujnOs3cvv:jvCula2T7g07040rsvv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/.signature.p7s

SHA256 7c20617e71f602beb4707cf56766afd36ea94e370b54087b264f0313ea7e18af
MD5 38ea59c588e8109bc41096e5f4f24529
SHA1 3a64d12c4ff4d0cd869bb5caeef89e2853d347ad
SHA512 1721fbed5b28944f3af34bc2275b66227332726955270f07f08aba4f981d0ec24b003e5d37c61230f09f78b3daeecb04d1ed6ab1002f332abb0a2bc2b71efae5
SSDEEP 192:8d47x0KDWpHhXZCVzV07xrJ9DH0JOqNG8Fp28Wh8nbV:EqvDGGVps9oJNNzFwhhiR
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/System.Net.Sockets.4.3.0.nupkg

SHA256 8a5eddaf9553fd058383fd1cba1fb812cdaef0b63fffeaaa898f416666314aeb
MD5 1eae1d571f8b18f2e0346925cabfc248
SHA1 31fe408e7a8c0dd6b489541f69bc74f63ff117c0
SHA512 e32ed9518e9630e99edcf1963c3d0e7047ea8252853c9260eb5403a4206170ae28fd27eb239f39da4d2db766f830b3ebdc9e4da2e697be20241d928082200955
SSDEEP 3072:bx6AqTDKU+uTDKU++ExXCBYLlHUjpUNNYcNJ9uu4mot:bUPTuUPTuU2tlLl0mN3J9uhh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/lib/net46/System.Net.Sockets.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 eefa668da7a0d5880f794ad9a9205637997e88ea1fc084e402702eb62d1da120
MD5 dc223bcdc08c6628f6fbb4339770f112
SHA1 00278d53e59026cd8c22889773466fef27d52bbf
SHA512 8510a2c45ccfb97abd7c98a8ae152b3e17c2a0430328aa71f16eaaafdea5f69b67598855d0cda1f1ccf0fc1ab585322f00b369e9704a10c177764dbe7f2974c2
SSDEEP 768:Tt7G7wMzUmd1Dtc0ZoSikFw5GBpBEiKEBS6If:TVG5Imd1Jc0ZoSikFL3BEBEB3If
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

fb:64:e2:7d:ba:7e:ce:68:8f:d9:23:3c:7c:47:35:f5:8c:3f:17:a1:64:41:ab:4e:17:0a:0f:32:8c:f4:2e:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

59:b9:9d:aa:98:3f:9d:54:5f:4b:ed:03:4e:03:12:a6:67:3f:ef:70

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

34454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Net.Sockets/net46\System.Net.Sockets.pdb

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/net46/System.Net.Sockets.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 eefa668da7a0d5880f794ad9a9205637997e88ea1fc084e402702eb62d1da120
MD5 dc223bcdc08c6628f6fbb4339770f112
SHA1 00278d53e59026cd8c22889773466fef27d52bbf
SHA512 8510a2c45ccfb97abd7c98a8ae152b3e17c2a0430328aa71f16eaaafdea5f69b67598855d0cda1f1ccf0fc1ab585322f00b369e9704a10c177764dbe7f2974c2
SSDEEP 768:Tt7G7wMzUmd1Dtc0ZoSikFw5GBpBEiKEBS6If:TVG5Imd1Jc0ZoSikFL3BEBEB3If
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

fb:64:e2:7d:ba:7e:ce:68:8f:d9:23:3c:7c:47:35:f5:8c:3f:17:a1:64:41:ab:4e:17:0a:0f:32:8c:f4:2e:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

59:b9:9d:aa:98:3f:9d:54:5f:4b:ed:03:4e:03:12:a6:67:3f:ef:70

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

34454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Net.Sockets/net46\System.Net.Sockets.pdb

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/netstandard1.3/System.Net.Sockets.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ae4df534fe7ba4b8a7bbd33771a4368a0bad54284ab13a2463ef6c3eca8f30b1
MD5 235d49b51d12ecfb1a9d63811008a0fb
SHA1 d1f97e89c9b386437fd34c077437b9f0116cd220
SHA512 1413b3e8eb69f256285fdf5db2d03bedb2c5dc5ea1d38f71e74ac9acb3bb87f569de4af3e1ad9e638cc237628f99de67cac9e8bd6a4a3fbd03fb5d34355474a4
SSDEEP 768:aAu4IY7F4sCaQAUWjMiuN9F6L9iZEBKADHs6:c4ICF4s3zfMPN9cJ+EBDzs6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

01:78:70:e4:4e:9d:eb:95:3c:1b:8e:e2:82:eb:cf:16:5d:ea:d5:41:bb:33:b4:9e:6a:5c:99:07:d3:74:25:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

64:96:0d:d3:15:f1:2a:f8:9f:e3:a9:f0:7b:b9:af:45:6b:a7:f4:26

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:ec:3f:ad:b6:8b:b9:2d:d2:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2016 - Aug 3, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

27226

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Net.Sockets\4.1.0.0\System.Net.Sockets.pdb

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/netstandard1.3/System.Net.Sockets.xml

SHA256 3c5374f1ceed8b6b27fcd5b059695a77a5bafa920f8bb5acc5e7aa47811ed517
MD5 960f777a6ae7227fd278012985642c61
SHA1 ffc2e4b05639c8c877a3ebc2b4b66ad864ecf101
SHA512 842daf9b9d622d04fcad3ca2550c969cdd75304e94c2e5b88d2ba02564055614b878175cb0a21839cbaa5c129dee437453269767f8e1b99e71ff79bc56f55751
SSDEEP 768:YivSM6LUBgSYSoS4SWbuG3OwHwMKTc4O1FcKJJ6:7P6C
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/netstandard1.3/de/System.Net.Sockets.xml

SHA256 4807ecfafe772818a4b84c712d8c52aa11f13dbab66f3efd284db65de1a92efa
MD5 8c53243b2b81da5fb8e061d948413c68
SHA1 3257698b394f3336dfe00fa903766c21b3a0f1aa
SHA512 4a6f9d30fe6ab74222c0da4c98ae18696668829e099e2b8a24e3bd07b480c83beef125c5d4e0f6c73d847fd3a42416c0fccb6786e6acc1b9191fd7a65c141b9d
SSDEEP 384:YEoMSEHQHREmb0UjV/6nHV81juJmde3C8y8fY/SIk:YvMSEwymbfjV/6nHVcjLgSq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/netstandard1.3/es/System.Net.Sockets.xml

SHA256 2d143cd21ecbfec876136ee6f2d0fb533a80fb85844e34aa7f8806bb123eb0c9
MD5 aae4d684325260fb1957cb38b8bf3b10
SHA1 3468cd5a99c842fb5cea8cf972f6dcb27a5614ee
SHA512 a17c15ee242d568577b924e5f735f8cec7a9a41269a29e9f1c032f19c166794fde6522864fe265ef82965b7cb8983bcd59c203f7fdf0554ca3caca46a5571344
SSDEEP 768:YwB4o06iSohmVOjzmOSPlzS2Sa/+DNJDKjTTYn:ZQhmo3EPZ3SawNJDKjTTYn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/netstandard1.3/fr/System.Net.Sockets.xml

SHA256 5f458e17d6cf7d71c5b7ad6d801ca15f68fd9e7117714b7c5d541b20a306223d
MD5 baa38cd41cb4066c6db839f690e8df96
SHA1 e197436f3484035cddb451d590611ecfa941bfb8
SHA512 093af0fbcd88a7dff7410bc9c01bab409f02c27f2dda8d77509b5770da65c63633af435c43b222cf723a1c54b41250933fd2a924a0a2248b6a68291a03a03d01
SSDEEP 384:YEf2uOcs5ErbJDEQ/uObSEH/uOVSEIexXKVQ/uOqtdz/uO0nq/uO7t/uOwo9hqJA:YRy5lRo/Vpfq2yLCW4+Y7No6NIBU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/netstandard1.3/it/System.Net.Sockets.xml

SHA256 04a0408a262aaef8a048415ae0ab5a4448468131447e6d07d7be2a067245f028
MD5 1fc66fd10b62d986d75cb329faf52a54
SHA1 a6ba74c29aeb18b2d6d9a37232be13e16be0b2a4
SHA512 00df791ac9c56c5bb22ce3a3ad0a542d31a3d8a488b511cccb07b5156129e482db0a2a10b7fd7bd779c56430ace13910a1e83e1cea0d313321865bd24b06f000
SSDEEP 768:YQ+QtiwEqEAqL0hoGb0nirGqPaH5pRlnbt:R+QsX1AqL8o+0W1aH5fln5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/netstandard1.3/ja/System.Net.Sockets.xml

SHA256 ea78258a62d7c9acfaf922fdafe8f5231ed8c7d15e6f1a42c7d2ecb28c8092c3
MD5 6937b727c08fe168a9892c544d02566a
SHA1 15fe0b5666d58f6bc947edd0cf5cf8349f2999bc
SHA512 8fdb6fb6ba6c6cd0bc6b2943ab920c172250788b92297c2cae603162020c17ffec3640ab406dab1c73897e9100f2ce6a0167bad98fafa91967143ca4d09af973
SSDEEP 192:YE/LiqtdWiqt6c3GqnJg373Giqtt00Wl1W3o3pbo3MU3SSs39yVTjzTQmPtIGnAQ:YEjPOPNlPXc6t/zHIGnBDxT
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/netstandard1.3/ko/System.Net.Sockets.xml

SHA256 777eb76b4afd2f7310cc7be051c4b2df19489f4e6df51ea52e70756b022fa5ac
MD5 4f18c5642814ad6d9456fd4ec59b24dd
SHA1 13500939e18ad487b0d92e19dbdabcc0e55970a6
SHA512 de4ca7ef36babc92ef19961ff5da8f19583ca031d7df42360c07b7b86bc2a999bb328871357ba2c8791e89f0d693b4ad0eb4ec1d472d6b6bd6dd6199a82714e2
SSDEEP 768:Y22mQRImAimc3bOJ9mA1m63miXm6Ei/Rv:RF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/netstandard1.3/ru/System.Net.Sockets.xml

SHA256 e74725c075d0a33a71461fa5118692d08e6211d55a1f6cddc7f926dbd9e68067
MD5 053068d917f27a01b561dbb475933e47
SHA1 277b85154a6aebde677343038262e0bb0eb132cc
SHA512 a63327becf0c5d2a032d2c62e0d951470a8684312794b6872daecca4414503a8a165b49e38be9f657e2adc0aed34e7b3c814a1ae3e6e4baee078bcae753ebf91
SSDEEP 384:YE2hvONqhIM8whNbhNbKtfqRl7LixZEnSZ5FlXq5FlmUAOudDh:YqqhIWhdhgfil7CNZ5Fla5FlmUA5d1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/netstandard1.3/zh-hans/System.Net.Sockets.xml

SHA256 0ba23e6b2917894cb05268b4efa9f75ea4599a82171f41b77ccff945f2bf07eb
MD5 db5a61953ff9b55c282641fe42433eff
SHA1 0bba8d90c1a33a7ad74ecaa73a7e567f3dd4591e
SHA512 1fee269cdc5316293b33458dbb2b6bc12df04ceabca085e8b72f6ede4bc585a58dbde8e726abb5d6658ef6920c2abd98f92b6e548f3d5513ba87b563d6d5f927
SSDEEP 384:YEy+A+RT8jMb+b660ank6xtE+Pi3MxMf+:YmT8jMNuk60OiR+
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Net.Sockets.4.3.0/ref/netstandard1.3/zh-hant/System.Net.Sockets.xml

SHA256 49517fcf44957f1f4cb53c1861982a3419419640c062cc8976cb4bc3bc1fe2a2
MD5 be5415d469657da34afd280c68d99480
SHA1 c624024bd4eee33aa951894b01e80083434c3da0
SHA512 b48c9d195e26c3c2c2b7752523a7f7fce662ce497b0fbcb03481b4cad2666528e8e38540fc61c1502a7ba2774a77179ee4216c38d70d5a7dbae0c6799f66afd3
SSDEEP 768:YoqRTd+dILrSLWS/FUSKFldKSXJFdj9AtapWigc5n:JqRTd+dILrCWYFUdFldK6Fdj9AEpWigy
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/.signature.p7s

SHA256 778991bfbfded93d0f262f12b70c7029e92718698453d2a20aa983ed458e98ad
MD5 5872db42abbcacd8f072a61c0a8c0504
SHA1 a2e844e8901da45438b2726bd75f69d7523aef00
SHA512 99627b4b2f246a0dc31bd95bdc4d28406e17353237e8c1874481de16b486b3e961e225bcab2d37ff83d4e33d5fabe73c4a7b4c5d679f72fc41bf95e340ef5946
SSDEEP 192:xd/7x0KDWpHhXZCVzV07Vryup79DH0JOqNG8Fp28Wh8nRp:jdvDGGVpBul9oJNNzFwhhin
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/System.ObjectModel.4.3.0.nupkg

SHA256 82d9919163f62b0af79c7b43874c98b5c7b7f33d70ac6cdbe9f8e6e2ff3037a4
MD5 bb8fe41531b16a3e87fed9e445a6f806
SHA1 a1fb2ebe9ef95a53ef50b5a1f31352f5169d50d5
SHA512 409bca3d2139bd1d003c711400ba2db5e576bb54d593aa541ec3576e7b2029b60159ab1c5b2c4e7389267b1b95ebcd8c2f064dc6e1f53e693aacb1737f066123
SSDEEP 6144:gUhqPHQlbIcc6KUtZbvKAg6yAecxg/Cm9kx06DUYZbvK9gnyfdSecxg96QU/Zbv9:P4HkjtZbg6yAbxNSkuYZbhnylSbxF/ZZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/lib/netcore50/System.ObjectModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5afdebf74c2ba945e8308b698f51de0f20cdd8e95b5aeabc7b9e57e1af24dfc3
MD5 f134e482cd350dc14fa88f2d1dc1a0d9
SHA1 9fe19fca1e704b8106053904305cd23ec3e7ce3a
SHA512 29329cca62c812173b5cd61f0f8c512e7bd360ea0447b33622ddea03557fe28bce3c80ebb80c40c33d0b737ab798cd47fa346520ad09ff1ace473a05d6fe6833
SSDEEP 768:T2T242oAVKgoMEjF+sxUABP3C7/hh62r8iUsmozX:TqH2YM0RTuj62QDsmor
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

0c:6a:78:18:69:84:1a:6b:be:30:27:f1:6a:d3:8f:9d:86:67:9c:28:ce:2c:10:35:7a:04:48:b3:07:7e:cf:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

bf:46:71:d4:59:76:69:32:55:30:ae:63:7d:33:b0:f4:c3:21:a5:fe

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

39166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\\FxCore\x86ret\System.ObjectModel\System.ObjectModel.pdb

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/lib/netstandard1.3/System.ObjectModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 44793ee824928f252284723efd769e292dbb5bdc1f7de8d58f372b8b2f3cfa30
MD5 108a3cc22494ec15cbfa6c582d214790
SHA1 10cd21d42b2bcb10aff918fffad00662b547ff97
SHA512 38801128514ee2f60b3bf9179213d17218be200dc861b6d28679cfe895cfb13f6f4dbe1ba09186c584350e41d55324917fec628c92792d7f7a63ba7d26dbc699
SSDEEP 768:g//W6aPQPk0XJy/HTbihUAZ+z6NGghbi3EEBml0:g3W6zDJy/HvkWShboEEBml0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

3f:4f:f0:ec:28:85:5f:04:32:35:6f:44:1e:93:b2:16:78:5b:1a:66:49:db:0f:ea:58:91:6f:53:aa:10:0d:6a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

b0:1b:12:ff:21:22:5a:9c:f6:b3:d5:3f:97:23:e6:c0:e4:d5:39:47

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

38666

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.ObjectModel\System.ObjectModel.pdb

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netcore50/System.ObjectModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b57ab26ef596dd785d0140d6b3033fdc08fb9b06fc72d1d7c7f590b0c91a5cf7
MD5 d29be7b3e0c505eb60938dd94e8dc61f
SHA1 a5f3cf4879aa544f192a430fb527ba7ae78ac1e0
SHA512 f6784cdeb57ac12eee6708031882f50c6a5ad9ef4c70ea80bc89703f355e3e6ee6656676d210e6e423b6bba91dd1497905b8e90b5a3bc2d304f34c3027d18941
SSDEEP 384:3Dg6isKQGWWbVGfRQ1oZbARXsapa9ac8k6aBWTZQRG8U3stD2cHq7KYZU4Ztbpze:3DgvUA0tUuezfKli72EBTf+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

20:23:5b:2b:9b:a0:41:32:f2:93:d7:1e:96:a1:ca:8b:83:ce:76:af:b8:8c:b7:6f:a9:40:8d:1e:36:ba:60:ee

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

3c:4d:4a:ec:56:7c:bf:6a:b7:81:61:29:6c:52:d3:01:dc:3f:53:ae

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9d:42:68:ee:31:1c:d7:56:bd:00:00:00:00:00:9d

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

22082

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.ObjectModel\4.0.10.0\System.ObjectModel.pdb

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netcore50/System.ObjectModel.xml

SHA256 0ec61333a70a589cdc400cd496a6b5390f1dbaf125360da2e3e8dd49ea2c2e7a
MD5 fa81c26ea5d95f678247879e4939786f
SHA1 7d9e1c21322d721caba738c25fd0b0e3262051c7
SHA512 1b9bc344d0e8e303377a1e4b44667eec04e2e70ba1b44be8436af192e3ec44d103d3f48b09cf0d4c9e2873bb846aa484c45566d8b7598d81818a5399defbadf0
SSDEEP 1536:f9v5G57fXPLIrTzdTugI1Y2eOfbj2iAcyAi+OFmOfbF2Gt2yV8dOFfX:mfXPKzdYlAc5iZft2U88
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netcore50/de/System.ObjectModel.xml

SHA256 540f76285912420f9ff3c10c877eac05d72d646331cf6a6801c0b1b84cdc812c
MD5 f52afb36de3194ab4b16a51b3420a338
SHA1 32355d1139c0c19c4ef3b083cb626afd85c4a98a
SHA512 2848eab59f116f29da0d91c5c00530b3c861905580c7891fc2e71502279f23dbeb922ffb0a1d924811ec526107cfa196f34d7d1bd6cd2372ef4b430d0b3ab255
SSDEEP 1536:WjsEkN7vrOr6ind2DVmCDgQ/y07ngyR6UicyykkpZKpKBwKQARjRD7sDk22W:rw2DVmCRngk6UicyZkpZKpKjR1DoDJ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netcore50/es/System.ObjectModel.xml

SHA256 20f1d07fcbd6a1e7fbf61aa5eda1a6308baf61fbfcebede42a301828767f59ae
MD5 3328d1f7c98992ad1d190f10a259b8e4
SHA1 e2987d6cf20e63eb5dc27cee5747582f47517be3
SHA512 3e8e62f23679a54a2c0615ef99cdc16979e4447078723e67a1f2ec713db996a6d530b363db1d3de344d94cf708c5e8f0fa2a900a3a79d1a454eca220469cf23b
SSDEEP 1536:WwbAt1Dv+tV0kbKBQ5KvmWf/XOLgysSUYgAyyJMfhY0XTvszmVkXGJrf:q1Dv+VjLgZS6AykMN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netcore50/fr/System.ObjectModel.xml

SHA256 5d907b73a338b48b921e99279130a256cd0977420433cde513feff5ae498dbfe
MD5 c70e307f6ddc0606f3c8d1b7844a1d33
SHA1 e694d1f27ce159f34c3134508746ffd9b29015d1
SHA512 200c8b1d755f0ba07962dbfe7f9a9c5b30b6e4dca6519f9f3c057eda30b5d61d84a891d544aa2d69c171b7ee78fa56a9d268aeaeeb6efc71b6c1d491a4ede549
SSDEEP 768:Y0DfZGXLhjprdIH9qyiIFe0yfKTFPJHtp26C1D2CbssWhbhXXTjbeslxb7slwbW2:fDM7hNrdo9qyiIFe0yfKx//
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netcore50/it/System.ObjectModel.xml

SHA256 def9638e7625e37f7602c483ce227e930c158950b9fbc1d9ba483354d0364fa6
MD5 860d75b7f4f0bcac189dee2fc4693604
SHA1 563096d6f61ddc410b932e68fa5bc9bd6746b6c9
SHA512 a6b4648d781901690ab4a096caa38f6efd4bd58d8ed07ecc2bf79ac558a9d66c77fcebec4712054e7e8beaa646732dc1e7d0a4d95c719e45877fd78234b2139e
SSDEEP 1536:xksdA2TciMr89VAM7t+HwybM1roMiyyGCTGrp9VzXU2uHP+A1P:I2TciMq+HwCM1roMi7GCTGrhxAd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netcore50/ja/System.ObjectModel.xml

SHA256 bf7fd5b0486cf70e853a7c42c80e9aa2fcb26b12d5942f566cda8747b01b4303
MD5 022f94f5ca0d220d7fcff5f3061eb0c6
SHA1 fa4c2697741ae60ea66074ebcd7e648ce692d97e
SHA512 25e508a4201457be0f3d18bf32663b74c67fa140d58c63d399d33ebe8e51bf4b7103a782766aa5a310b952566fbc52a9e5acd01ec1e8cb28db4d1dee8c82b37d
SSDEEP 768:YcHC1X3NjZzkIMZyyuyif3t6BwyNVAtfX+bqAtCRJdh9byEfIb2sFdabYosCbBoe:psHNNzkSyuyifYBwyNVE
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netcore50/ko/System.ObjectModel.xml

SHA256 7ae34d63fd9168d3912a75e1ad59fb9a19dbc5ff5b067ca3161ad3e65f9e51f5
MD5 dbd88a0fb7a877805b036c52299f3b3c
SHA1 8e4cd9def6e194a051b90377464d4722587c869e
SHA512 12e156c260876327273017436af1082704f4525d31bd8416a2feaf9a2137b82bf6c6467ab25c88231cd01d299f8e4527bc166ef46ba098f8d40bf200c14e21d0
SSDEEP 1536:QUFMJCLe4SSrP7zrSlzZN6hjWnC+U6OkBPUjRCeaAWkyyvuMj8ymdTA4DsyWwGEr:QPCLe4SSrPHrSlzZN6hjWnC+U6OkBPUE
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netcore50/ru/System.ObjectModel.xml

SHA256 62985dfd44924935bc1add001a1c872609d444e3a03600398383e0a736021bbf
MD5 1f235fab2270534b8eb2d259ee84fa41
SHA1 a3619993f6481193365c0c797aa3848f213d7fc9
SHA512 117df5fd36dbf001b6ed42201c136ad6b3e63d8919ca6467a0ad408e20d7ae33484e44733b80e914fa93a8e3f99166cd7ee20186720bf4c47f07dd2c8a1266e9
SSDEEP 1536:sLBNMcF2i9WUHxdi0LbJy0CEGQI6vyHcNwQx1:sLBycV9WUHxdi0LbJzCEGQI6vYcNwQx1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netcore50/zh-hans/System.ObjectModel.xml

SHA256 b13c19eb8f7b889c9eecb38a14451739bca6d7db37f8ed03077cff8b8684b24a
MD5 d17ed656733cc87c3f81fbba50be8235
SHA1 c3c88d1d1c0530354507dcae2135e295877dee2d
SHA512 07ef355392d25d7a38aac2e305c863b0a27e0f74b22b80c2e58331f6a9b89ca510828e7d8b002fc5c817a146dda2cfc630a4fcf0639c4edcc9cd6d992fdff0d7
SSDEEP 1536:tLF5dIDxRM0bx/T69lm8bhDMeM8b+pbX1OwyjiPvoYTFiyU8y9Pf:xF5d2RM0bx/T69lm8bSeM8b+51OwoiHq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netcore50/zh-hant/System.ObjectModel.xml

SHA256 2908fea913bcb74f5df3e08bc0fcb9d08188ee86f5bee6e9630f09dd2de4fbb5
MD5 22feafb475a379b95b934d36d24bed31
SHA1 80d08d628bdb41f923275c32840adfecf9c97d13
SHA512 475e6a2150e1a323e49191ea6e400abca94388e1a70066d2c7e60787e42edcbc36cb2b24dbe0b2a594adf082a8c8accc066db0430a1c96e8e8e565aa65dc5d33
SSDEEP 1536:38udM4XSuOl0C/USx+SfnDWy92z+oysIKWE:MudM4XSuOl0C/USx+SfnDWY2z+oBIK/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.0/System.ObjectModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 abd05486b939b5df73f64a0d60340956cb4334b4a4cba49cd948e409d0956b28
MD5 76cc7f14bf6823c670a17c99dd60c22c
SHA1 90c79d39d0b351a6f412e186b477b5a26bbb9170
SHA512 0ddb959d8cd6d771f435657c91ea12fc91cb54a0ed833ab081b73cf63f0dd6188f9a2bbc1ee0b8994310e83e89c948262b347ba607317439d9a8c75294e0cfba
SSDEEP 384:DARBRebgJV8wK9aeMGVik/lZKHTEVakSM8rqGxbZ4ZQZZZYZQA4o/ho+5lZa2djD:sBRio7bGFoAvkQbded7pRwWiHsDgBN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

f9:2d:e9:67:5a:1a:f3:27:bb:c8:98:43:32:c2:8c:6c:96:39:81:f3:7c:3e:92:94:61:9d:b3:36:01:86:81:d4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

0e:4e:a7:aa:65:70:31:65:24:b5:74:63:6c:31:1b:29:2e:63:e1:81

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

22158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.0/System.ObjectModel.xml

SHA256 0ec61333a70a589cdc400cd496a6b5390f1dbaf125360da2e3e8dd49ea2c2e7a
MD5 fa81c26ea5d95f678247879e4939786f
SHA1 7d9e1c21322d721caba738c25fd0b0e3262051c7
SHA512 1b9bc344d0e8e303377a1e4b44667eec04e2e70ba1b44be8436af192e3ec44d103d3f48b09cf0d4c9e2873bb846aa484c45566d8b7598d81818a5399defbadf0
SSDEEP 1536:f9v5G57fXPLIrTzdTugI1Y2eOfbj2iAcyAi+OFmOfbF2Gt2yV8dOFfX:mfXPKzdYlAc5iZft2U88
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.0/de/System.ObjectModel.xml

SHA256 540f76285912420f9ff3c10c877eac05d72d646331cf6a6801c0b1b84cdc812c
MD5 f52afb36de3194ab4b16a51b3420a338
SHA1 32355d1139c0c19c4ef3b083cb626afd85c4a98a
SHA512 2848eab59f116f29da0d91c5c00530b3c861905580c7891fc2e71502279f23dbeb922ffb0a1d924811ec526107cfa196f34d7d1bd6cd2372ef4b430d0b3ab255
SSDEEP 1536:WjsEkN7vrOr6ind2DVmCDgQ/y07ngyR6UicyykkpZKpKBwKQARjRD7sDk22W:rw2DVmCRngk6UicyZkpZKpKjR1DoDJ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.0/es/System.ObjectModel.xml

SHA256 20f1d07fcbd6a1e7fbf61aa5eda1a6308baf61fbfcebede42a301828767f59ae
MD5 3328d1f7c98992ad1d190f10a259b8e4
SHA1 e2987d6cf20e63eb5dc27cee5747582f47517be3
SHA512 3e8e62f23679a54a2c0615ef99cdc16979e4447078723e67a1f2ec713db996a6d530b363db1d3de344d94cf708c5e8f0fa2a900a3a79d1a454eca220469cf23b
SSDEEP 1536:WwbAt1Dv+tV0kbKBQ5KvmWf/XOLgysSUYgAyyJMfhY0XTvszmVkXGJrf:q1Dv+VjLgZS6AykMN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.0/fr/System.ObjectModel.xml

SHA256 5d907b73a338b48b921e99279130a256cd0977420433cde513feff5ae498dbfe
MD5 c70e307f6ddc0606f3c8d1b7844a1d33
SHA1 e694d1f27ce159f34c3134508746ffd9b29015d1
SHA512 200c8b1d755f0ba07962dbfe7f9a9c5b30b6e4dca6519f9f3c057eda30b5d61d84a891d544aa2d69c171b7ee78fa56a9d268aeaeeb6efc71b6c1d491a4ede549
SSDEEP 768:Y0DfZGXLhjprdIH9qyiIFe0yfKTFPJHtp26C1D2CbssWhbhXXTjbeslxb7slwbW2:fDM7hNrdo9qyiIFe0yfKx//
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.0/it/System.ObjectModel.xml

SHA256 def9638e7625e37f7602c483ce227e930c158950b9fbc1d9ba483354d0364fa6
MD5 860d75b7f4f0bcac189dee2fc4693604
SHA1 563096d6f61ddc410b932e68fa5bc9bd6746b6c9
SHA512 a6b4648d781901690ab4a096caa38f6efd4bd58d8ed07ecc2bf79ac558a9d66c77fcebec4712054e7e8beaa646732dc1e7d0a4d95c719e45877fd78234b2139e
SSDEEP 1536:xksdA2TciMr89VAM7t+HwybM1roMiyyGCTGrp9VzXU2uHP+A1P:I2TciMq+HwCM1roMi7GCTGrhxAd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.0/ja/System.ObjectModel.xml

SHA256 bf7fd5b0486cf70e853a7c42c80e9aa2fcb26b12d5942f566cda8747b01b4303
MD5 022f94f5ca0d220d7fcff5f3061eb0c6
SHA1 fa4c2697741ae60ea66074ebcd7e648ce692d97e
SHA512 25e508a4201457be0f3d18bf32663b74c67fa140d58c63d399d33ebe8e51bf4b7103a782766aa5a310b952566fbc52a9e5acd01ec1e8cb28db4d1dee8c82b37d
SSDEEP 768:YcHC1X3NjZzkIMZyyuyif3t6BwyNVAtfX+bqAtCRJdh9byEfIb2sFdabYosCbBoe:psHNNzkSyuyifYBwyNVE
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.0/ko/System.ObjectModel.xml

SHA256 7ae34d63fd9168d3912a75e1ad59fb9a19dbc5ff5b067ca3161ad3e65f9e51f5
MD5 dbd88a0fb7a877805b036c52299f3b3c
SHA1 8e4cd9def6e194a051b90377464d4722587c869e
SHA512 12e156c260876327273017436af1082704f4525d31bd8416a2feaf9a2137b82bf6c6467ab25c88231cd01d299f8e4527bc166ef46ba098f8d40bf200c14e21d0
SSDEEP 1536:QUFMJCLe4SSrP7zrSlzZN6hjWnC+U6OkBPUjRCeaAWkyyvuMj8ymdTA4DsyWwGEr:QPCLe4SSrPHrSlzZN6hjWnC+U6OkBPUE
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.0/ru/System.ObjectModel.xml

SHA256 62985dfd44924935bc1add001a1c872609d444e3a03600398383e0a736021bbf
MD5 1f235fab2270534b8eb2d259ee84fa41
SHA1 a3619993f6481193365c0c797aa3848f213d7fc9
SHA512 117df5fd36dbf001b6ed42201c136ad6b3e63d8919ca6467a0ad408e20d7ae33484e44733b80e914fa93a8e3f99166cd7ee20186720bf4c47f07dd2c8a1266e9
SSDEEP 1536:sLBNMcF2i9WUHxdi0LbJy0CEGQI6vyHcNwQx1:sLBycV9WUHxdi0LbJzCEGQI6vYcNwQx1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.0/zh-hans/System.ObjectModel.xml

SHA256 b13c19eb8f7b889c9eecb38a14451739bca6d7db37f8ed03077cff8b8684b24a
MD5 d17ed656733cc87c3f81fbba50be8235
SHA1 c3c88d1d1c0530354507dcae2135e295877dee2d
SHA512 07ef355392d25d7a38aac2e305c863b0a27e0f74b22b80c2e58331f6a9b89ca510828e7d8b002fc5c817a146dda2cfc630a4fcf0639c4edcc9cd6d992fdff0d7
SSDEEP 1536:tLF5dIDxRM0bx/T69lm8bhDMeM8b+pbX1OwyjiPvoYTFiyU8y9Pf:xF5d2RM0bx/T69lm8bSeM8b+51OwoiHq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.0/zh-hant/System.ObjectModel.xml

SHA256 2908fea913bcb74f5df3e08bc0fcb9d08188ee86f5bee6e9630f09dd2de4fbb5
MD5 22feafb475a379b95b934d36d24bed31
SHA1 80d08d628bdb41f923275c32840adfecf9c97d13
SHA512 475e6a2150e1a323e49191ea6e400abca94388e1a70066d2c7e60787e42edcbc36cb2b24dbe0b2a594adf082a8c8accc066db0430a1c96e8e8e565aa65dc5d33
SSDEEP 1536:38udM4XSuOl0C/USx+SfnDWy92z+oysIKWE:MudM4XSuOl0C/USx+SfnDWY2z+oBIK/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.3/System.ObjectModel.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b57ab26ef596dd785d0140d6b3033fdc08fb9b06fc72d1d7c7f590b0c91a5cf7
MD5 d29be7b3e0c505eb60938dd94e8dc61f
SHA1 a5f3cf4879aa544f192a430fb527ba7ae78ac1e0
SHA512 f6784cdeb57ac12eee6708031882f50c6a5ad9ef4c70ea80bc89703f355e3e6ee6656676d210e6e423b6bba91dd1497905b8e90b5a3bc2d304f34c3027d18941
SSDEEP 384:3Dg6isKQGWWbVGfRQ1oZbARXsapa9ac8k6aBWTZQRG8U3stD2cHq7KYZU4Ztbpze:3DgvUA0tUuezfKli72EBTf+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

20:23:5b:2b:9b:a0:41:32:f2:93:d7:1e:96:a1:ca:8b:83:ce:76:af:b8:8c:b7:6f:a9:40:8d:1e:36:ba:60:ee

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

3c:4d:4a:ec:56:7c:bf:6a:b7:81:61:29:6c:52:d3:01:dc:3f:53:ae

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9d:42:68:ee:31:1c:d7:56:bd:00:00:00:00:00:9d

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

22082

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.ObjectModel\4.0.10.0\System.ObjectModel.pdb

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.3/System.ObjectModel.xml

SHA256 0ec61333a70a589cdc400cd496a6b5390f1dbaf125360da2e3e8dd49ea2c2e7a
MD5 fa81c26ea5d95f678247879e4939786f
SHA1 7d9e1c21322d721caba738c25fd0b0e3262051c7
SHA512 1b9bc344d0e8e303377a1e4b44667eec04e2e70ba1b44be8436af192e3ec44d103d3f48b09cf0d4c9e2873bb846aa484c45566d8b7598d81818a5399defbadf0
SSDEEP 1536:f9v5G57fXPLIrTzdTugI1Y2eOfbj2iAcyAi+OFmOfbF2Gt2yV8dOFfX:mfXPKzdYlAc5iZft2U88
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.3/de/System.ObjectModel.xml

SHA256 540f76285912420f9ff3c10c877eac05d72d646331cf6a6801c0b1b84cdc812c
MD5 f52afb36de3194ab4b16a51b3420a338
SHA1 32355d1139c0c19c4ef3b083cb626afd85c4a98a
SHA512 2848eab59f116f29da0d91c5c00530b3c861905580c7891fc2e71502279f23dbeb922ffb0a1d924811ec526107cfa196f34d7d1bd6cd2372ef4b430d0b3ab255
SSDEEP 1536:WjsEkN7vrOr6ind2DVmCDgQ/y07ngyR6UicyykkpZKpKBwKQARjRD7sDk22W:rw2DVmCRngk6UicyZkpZKpKjR1DoDJ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.3/es/System.ObjectModel.xml

SHA256 20f1d07fcbd6a1e7fbf61aa5eda1a6308baf61fbfcebede42a301828767f59ae
MD5 3328d1f7c98992ad1d190f10a259b8e4
SHA1 e2987d6cf20e63eb5dc27cee5747582f47517be3
SHA512 3e8e62f23679a54a2c0615ef99cdc16979e4447078723e67a1f2ec713db996a6d530b363db1d3de344d94cf708c5e8f0fa2a900a3a79d1a454eca220469cf23b
SSDEEP 1536:WwbAt1Dv+tV0kbKBQ5KvmWf/XOLgysSUYgAyyJMfhY0XTvszmVkXGJrf:q1Dv+VjLgZS6AykMN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.3/fr/System.ObjectModel.xml

SHA256 5d907b73a338b48b921e99279130a256cd0977420433cde513feff5ae498dbfe
MD5 c70e307f6ddc0606f3c8d1b7844a1d33
SHA1 e694d1f27ce159f34c3134508746ffd9b29015d1
SHA512 200c8b1d755f0ba07962dbfe7f9a9c5b30b6e4dca6519f9f3c057eda30b5d61d84a891d544aa2d69c171b7ee78fa56a9d268aeaeeb6efc71b6c1d491a4ede549
SSDEEP 768:Y0DfZGXLhjprdIH9qyiIFe0yfKTFPJHtp26C1D2CbssWhbhXXTjbeslxb7slwbW2:fDM7hNrdo9qyiIFe0yfKx//
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.3/it/System.ObjectModel.xml

SHA256 def9638e7625e37f7602c483ce227e930c158950b9fbc1d9ba483354d0364fa6
MD5 860d75b7f4f0bcac189dee2fc4693604
SHA1 563096d6f61ddc410b932e68fa5bc9bd6746b6c9
SHA512 a6b4648d781901690ab4a096caa38f6efd4bd58d8ed07ecc2bf79ac558a9d66c77fcebec4712054e7e8beaa646732dc1e7d0a4d95c719e45877fd78234b2139e
SSDEEP 1536:xksdA2TciMr89VAM7t+HwybM1roMiyyGCTGrp9VzXU2uHP+A1P:I2TciMq+HwCM1roMi7GCTGrhxAd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.3/ja/System.ObjectModel.xml

SHA256 bf7fd5b0486cf70e853a7c42c80e9aa2fcb26b12d5942f566cda8747b01b4303
MD5 022f94f5ca0d220d7fcff5f3061eb0c6
SHA1 fa4c2697741ae60ea66074ebcd7e648ce692d97e
SHA512 25e508a4201457be0f3d18bf32663b74c67fa140d58c63d399d33ebe8e51bf4b7103a782766aa5a310b952566fbc52a9e5acd01ec1e8cb28db4d1dee8c82b37d
SSDEEP 768:YcHC1X3NjZzkIMZyyuyif3t6BwyNVAtfX+bqAtCRJdh9byEfIb2sFdabYosCbBoe:psHNNzkSyuyifYBwyNVE
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.3/ko/System.ObjectModel.xml

SHA256 7ae34d63fd9168d3912a75e1ad59fb9a19dbc5ff5b067ca3161ad3e65f9e51f5
MD5 dbd88a0fb7a877805b036c52299f3b3c
SHA1 8e4cd9def6e194a051b90377464d4722587c869e
SHA512 12e156c260876327273017436af1082704f4525d31bd8416a2feaf9a2137b82bf6c6467ab25c88231cd01d299f8e4527bc166ef46ba098f8d40bf200c14e21d0
SSDEEP 1536:QUFMJCLe4SSrP7zrSlzZN6hjWnC+U6OkBPUjRCeaAWkyyvuMj8ymdTA4DsyWwGEr:QPCLe4SSrPHrSlzZN6hjWnC+U6OkBPUE
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.3/ru/System.ObjectModel.xml

SHA256 62985dfd44924935bc1add001a1c872609d444e3a03600398383e0a736021bbf
MD5 1f235fab2270534b8eb2d259ee84fa41
SHA1 a3619993f6481193365c0c797aa3848f213d7fc9
SHA512 117df5fd36dbf001b6ed42201c136ad6b3e63d8919ca6467a0ad408e20d7ae33484e44733b80e914fa93a8e3f99166cd7ee20186720bf4c47f07dd2c8a1266e9
SSDEEP 1536:sLBNMcF2i9WUHxdi0LbJy0CEGQI6vyHcNwQx1:sLBycV9WUHxdi0LbJzCEGQI6vYcNwQx1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.3/zh-hans/System.ObjectModel.xml

SHA256 b13c19eb8f7b889c9eecb38a14451739bca6d7db37f8ed03077cff8b8684b24a
MD5 d17ed656733cc87c3f81fbba50be8235
SHA1 c3c88d1d1c0530354507dcae2135e295877dee2d
SHA512 07ef355392d25d7a38aac2e305c863b0a27e0f74b22b80c2e58331f6a9b89ca510828e7d8b002fc5c817a146dda2cfc630a4fcf0639c4edcc9cd6d992fdff0d7
SSDEEP 1536:tLF5dIDxRM0bx/T69lm8bhDMeM8b+pbX1OwyjiPvoYTFiyU8y9Pf:xF5d2RM0bx/T69lm8bSeM8b+51OwoiHq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.ObjectModel.4.3.0/ref/netstandard1.3/zh-hant/System.ObjectModel.xml

SHA256 2908fea913bcb74f5df3e08bc0fcb9d08188ee86f5bee6e9630f09dd2de4fbb5
MD5 22feafb475a379b95b934d36d24bed31
SHA1 80d08d628bdb41f923275c32840adfecf9c97d13
SHA512 475e6a2150e1a323e49191ea6e400abca94388e1a70066d2c7e60787e42edcbc36cb2b24dbe0b2a594adf082a8c8accc066db0430a1c96e8e8e565aa65dc5d33
SSDEEP 1536:38udM4XSuOl0C/USx+SfnDWy92z+oysIKWE:MudM4XSuOl0C/USx+SfnDWY2z+oBIK/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/.signature.p7s

SHA256 c6f75ecc7b5e86404c8fba384080c9e0bf67d07b3e3230a0fb47f8ea56c192b6
MD5 0c3c74a4269733b02387dde618f3bc04
SHA1 5f1a2b71b5814b3e70c51c7b25ed0c2b07d3c988
SHA512 c7bac7d885173b234fdcd9d4dec13ea2c8d7d769340d8c7f0a0520c0d713ad361ca727d8d8db80394a98585ef3b424ac51d7d1023ae938162f9edcde6ee71022
SSDEEP 192:8dq7x0KDWpHhXZCVzV07xr499DH0JOqNG8Fp28Wh8n8:EwvDGGVpt99oJNNzFwhhi8
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/System.Reflection.4.3.0.nupkg

SHA256 35049946964bbed3d60e5be6308746c5c56ec949f0f76654468d215ec12c8576
MD5 26eccdc747cb4433c8b02296dc5c825e
SHA1 f1ab982a551e40ccf43b60c81655f7cd8db84d78
SHA512 2325b67ed60dce0302807064f25422cbe1b7fb275b539b44fba3c4a8ce4926f21d78529a5c34b31c03d80d110f7bace9af9589d457266beac014220057af8333
SSDEEP 12288:BflMm3/Dq152UCCJhRWMmU+nq1OHUCnJWXMmvB/q1RkUC/hfWiFMmpnLq1jOUC2W:B1bY2UjhTOlHU6wRikUUh7L4OUVW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/lib/net462/System.Reflection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f6dee242301db210f911807e6725c3fd4b2a71a981c1d6bd4a420e9740ecdbea
MD5 ed5e47014bb1b6cfb6ede8e77d5e7865
SHA1 b830e365efc12167714e591dc7c1dd0a623fca48
SHA512 997c9180a831bfadf3c285796778c19ed8e6c3a7d550934717a0d0bcdfe1b99c9d011de54bda9429d87e12711073efe8b6e8ac1f14ebe8f5265ddb062887f95e
SSDEEP 384:rkJmpCWrMWZWqMWQ3rq0GftpBjoShERHRN7plXhWm:rk8tBwiFEBT/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

46:6b:3e:a2:5d:68:b0:12:78:0b:bd:16:8a:75:6e:68:07:f6:6c:2e:a6:08:37:7e:a6:77:ee:74:a5:42:52:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

64:f1:ef:d9:a2:15:af:53:f2:b6:43:51:86:5b:7c:14:2d:52:c9:a0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Reflection/net462\System.Reflection.pdb

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/net462/System.Reflection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f6dee242301db210f911807e6725c3fd4b2a71a981c1d6bd4a420e9740ecdbea
MD5 ed5e47014bb1b6cfb6ede8e77d5e7865
SHA1 b830e365efc12167714e591dc7c1dd0a623fca48
SHA512 997c9180a831bfadf3c285796778c19ed8e6c3a7d550934717a0d0bcdfe1b99c9d011de54bda9429d87e12711073efe8b6e8ac1f14ebe8f5265ddb062887f95e
SSDEEP 384:rkJmpCWrMWZWqMWQ3rq0GftpBjoShERHRN7plXhWm:rk8tBwiFEBT/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

46:6b:3e:a2:5d:68:b0:12:78:0b:bd:16:8a:75:6e:68:07:f6:6c:2e:a6:08:37:7e:a6:77:ee:74:a5:42:52:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

64:f1:ef:d9:a2:15:af:53:f2:b6:43:51:86:5b:7c:14:2d:52:c9:a0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Reflection/net462\System.Reflection.pdb

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netcore50/System.Reflection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 05cde8d18ea9d10148c83fce991793b22c171ab1fc342155034a9884a2ba68b0
MD5 4cb5b99e778da74edfdb8daf7973fdcc
SHA1 a451b4ec3bd31ad591993152fcc6eb01d6aa37a3
SHA512 dd47aaea6c24f58ca85874864c67c8d53c6e31b49165b5162d9009552e6416a63edb3d22a03f6b4d6ad293bca6a745cb9a869b5aa60ad20ef6d6ffc25549d0d0
SSDEEP 384:yDO1zktddz6s1Pm7fCU5QHrpYV2ZesWN2We7QA0GftpBjC+ILKHRN7GlI66ntc:ybRFPmeJLpYIZC4yismH66W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

9f:3a:da:01:83:61:44:16:80:04:00:45:9d:5b:79:8c:71:33:5e:da:9d:50:7e:3e:fe:dd:31:22:b7:ad:6a:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

23:d6:79:28:35:85:d7:71:02:4d:b8:70:39:7c:5a:dc:1c:cd:b3:59

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

24686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Reflection\4.0.10.0\System.Reflection.pdb

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netcore50/System.Reflection.xml

SHA256 910dcac9da51fe26677c62d4a3f2baa2c67e42b0b5a14c718eb5eae39c39fb86
MD5 d73d9d51eaefca78e079d3908c37327e
SHA1 918e9ea01d8c204570aea6d76acdf7848d576b43
SHA512 725c8b79524774a6b6200c344eff0137801bc81a0a23dca3200912001f2e3a7c74555503a6495fb0f3dac7b99837095d8bd19ab5a279c1d68016a3920ba3372a
SSDEEP 768:YSd0nCUFQqwrlsHbVqdIfPnfFqdIRpR/Nf0sbb2EFpPwYcnzpm7vDEqvkE5rz5y8:E9DR/N1Fp2l+6UxypoSVPOPywr/z
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netcore50/de/System.Reflection.xml

SHA256 2c8729ffec6a753cc08e285a819360879cdc16c4432aa0068b8c40d42c358e81
MD5 1917b66e3fd948f1050110d8d3838f15
SHA1 ebbe11d1837db153edfdaeb32468293ec6101b7c
SHA512 a51ad848f1d5ab83d1ed04a24da390291017505b3d61905102c47870c743d8eb66c5e2e033fe497ac7b01e8f57e1b1cb4477eaf7582ed7b0eadfe6f0977bb121
SSDEEP 768:Y/GzFNbhaUGxbhlrI16RVplrIqoZXq+Twr9W1nXdlq9VshARpLnpK6WoLffafRWb:pLKYdqLr9i1IARg44pQfqH70Ci4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netcore50/es/System.Reflection.xml

SHA256 95cc963af8c1f5d1cabffa8eb694b00ba52c0ca1a9f3650371fd6b9e89230d1e
MD5 5d895165b993049944eb7da0192f8869
SHA1 b22611a4a5b85c9671eb141e7190e45572bdcc2e
SHA512 f6a1aeeed6c77fcd47c32269dbf6496c24b53b657b7fbe4ac228c6c8b84e13515a18434b897ffb967ddc1de5bfdb0128b4ac434702e293e4fe5392c5cfa74cfe
SSDEEP 1536:xh74hSVzkiQ6nZEEqDtK6XI5w3t6yRT8mu:jb8t6D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netcore50/fr/System.Reflection.xml

SHA256 d121eba84ed6f01fedaf9c96ddb480528c6d99fbc633d37bf83d4b6663fd9abe
MD5 9a5c688fb25c2f30c740a18b24d65e40
SHA1 37dba1a66cc18d10e9db9122944b5ce1ecfb20d5
SHA512 a1e01fa2556923b571757cc15c8ea8cfa34d4c619e4a7351420efa3662255ae87405dc57cdcc898f34dc752d6a93bcebd9484b5ed5ed432e5831bc7aa83416c5
SSDEEP 768:YFEndzlgansqA8TWyRgXA8Tr+LvxDgLRRfbQr5xJa0HRDgmR0XMrNO7KpPMjfj9V:8+LvxDcRRtUNO56UXfjg4N
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netcore50/it/System.Reflection.xml

SHA256 e18d256f93c610cc82f472c395228e80d87e95385d84fe8523a5d27c8707adff
MD5 c5ec8b432d47f13f9331040a421ee42b
SHA1 91bb9f9dca66d56ca78c843834d6f42226bde280
SHA512 cf3e51663c71dddf95d26b2fae9a4be837aba61d1746eecd43a035ca55e2edfee9f5ad72ffad5b45d07b9e11ce1b17d3c336ddf4b445807144792df3454f93fd
SSDEEP 3072:AfApIHv9Ef67dWr5BwyJSpfaSLvmiZmEK6LGD59JLT4p60ooYAQID:AfApIHv9Ef67dWr5BwyJSpfaSLvmiZm8
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netcore50/ja/System.Reflection.xml

SHA256 e816484b5454ddd20fe523209d79076aeb9f9c1ce18c464822a17fdfe4d69efc
MD5 e43137959e0f25e55065f53061d80922
SHA1 179885330b659bd3f29168473ddcaa22baf4774b
SHA512 f4342dd3ed7785704e775baf84f37b9848d006728a1ee5ff300b4d3ca4be914089c6fca5b5b8ea41a77223d3ce4fbcb31c0f9e6476884255de4ef1aea6e6c099
SSDEEP 768:YAmnipQCH5yMGSIA1tyMGGQbDV/rLFOJGo9F2h/CU5biuOX8ZaS5aSdm/K9H0ldE:LjWmCh/9OXR/Kj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netcore50/ko/System.Reflection.xml

SHA256 678a634d8f5dc55bc6b77b0a8e3241d08fce01ad22ea175105453df84e99a2a8
MD5 6ce2edad1202c37f2bd25235d055ee8f
SHA1 aa4a8cf8bbe86769711ce069230fbfe8be58475b
SHA512 a3bb90145cb8e447a382c62abd9f1c2571beb667663d2d4a8a03d196614d668a50ee8bb696522b2c084340e638d4706ee4bfbfb9b45bec32329518f33d645e66
SSDEEP 3072:XU1f/L2S+pp9sI0tpCux7Sm2PRnh6V7aY3iEaKHmYFcVvK:k1f/L2S+pp9J0tpCux7Sm+h6V7aY3iEp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netcore50/ru/System.Reflection.xml

SHA256 3e2d2463f926309ebcaa2c4757b88ff894c59fed296bffc7ccca89761edc9644
MD5 abb39ee680885f4c6c42693de4813103
SHA1 b17f2fa84ee851d2d1d013549e384dd0c58d1b86
SHA512 dd653941464502d9865f723efa230698d0c5a80916b54713998bbad0816c5182e5bca592bda1866344b035be598c0d4468842c99c92fb14125ff089781513cda
SSDEEP 1536:iJEGnr8ds7B3DxRFwVBYuds57vEPLScAlssQ:ZGnr8dsVD9wVBYudsZvoL8lssQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netcore50/zh-hans/System.Reflection.xml

SHA256 1ec2bf45228b8def1d9c956bd204564640df8a923b86b5bb0c432ae39705742a
MD5 130149bf761ff1299836dd96e201c8fa
SHA1 b699ce856eca0e16f8b35ba16367e126f4716398
SHA512 16596e602e4485a810e8938d23e7eec3845d932faacc6b5e9f7db382fe4e1e8d3b20e667cb0a4b582eeef9d4c0660903e8087d010365305f47ef17655ccd67ba
SSDEEP 1536:lB/dev/7krTSXsb5EXsramP7VLtFypO86ixpbQ:lBi/Zzb6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netcore50/zh-hant/System.Reflection.xml

SHA256 8c02c4c3596f7121f21a5ab1330c228a57d20837b7bd189e0b1d8b1ede5cf59f
MD5 55e71cddd89bcc2c5dc54a7ce83315ae
SHA1 c5b477e76665ed7562520669f8add4b18c6e7d6a
SHA512 b132b6afe2e0240b4cd0572eecb87ee96cc49216692763c43b1a7d0b46884edd905f05ea364a51b167536c44df1b9ebeb3fc0b0f4ba7954dc5a9042c5c0c8d15
SSDEEP 768:YWZJx3NbCgO+uhJtm9gO+uUPsJj0TgSGOrSdHPUuO5EdDKv1h9pHBls5w:QCwCA5rSdHG5GDKv1hr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.0/System.Reflection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b9409b269a0352eb80a2b25bf8f768ab1e0055c55ab822d56f500d1ce6412806
MD5 296ae4021742100eccbe5a8456d0df73
SHA1 1e84ecbb5288b6d78003a2947933e05ad4bbf7ea
SHA512 f64600244cae2b15730c0b1476b5bf3c672d0fb0fa3810df2a2699e55c177133702a892ef0b0ce34d36402d57eeb4d6695e35791ddc1e81d37e70d56bb7c7975
SSDEEP 384:I/65Fu0j9XlOmPGNqLVmeKlR4WzMW41LHB0GftpBjSDHRN7ZOlXxHG:I/+PpVSrP1CWiwDZom
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

17:2f:1b:9e:d8:85:08:bd:a2:87:a2:45:1e:4a:92:af:99:b7:1e:d4:a4:34:ef:c7:ab:10:c6:09:8a:db:c4:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

18:5a:12:95:42:a3:0c:da:13:26:cb:01:96:e5:00:5e:19:25:15:cb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

25630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.0/System.Reflection.xml

SHA256 910dcac9da51fe26677c62d4a3f2baa2c67e42b0b5a14c718eb5eae39c39fb86
MD5 d73d9d51eaefca78e079d3908c37327e
SHA1 918e9ea01d8c204570aea6d76acdf7848d576b43
SHA512 725c8b79524774a6b6200c344eff0137801bc81a0a23dca3200912001f2e3a7c74555503a6495fb0f3dac7b99837095d8bd19ab5a279c1d68016a3920ba3372a
SSDEEP 768:YSd0nCUFQqwrlsHbVqdIfPnfFqdIRpR/Nf0sbb2EFpPwYcnzpm7vDEqvkE5rz5y8:E9DR/N1Fp2l+6UxypoSVPOPywr/z
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.0/de/System.Reflection.xml

SHA256 2c8729ffec6a753cc08e285a819360879cdc16c4432aa0068b8c40d42c358e81
MD5 1917b66e3fd948f1050110d8d3838f15
SHA1 ebbe11d1837db153edfdaeb32468293ec6101b7c
SHA512 a51ad848f1d5ab83d1ed04a24da390291017505b3d61905102c47870c743d8eb66c5e2e033fe497ac7b01e8f57e1b1cb4477eaf7582ed7b0eadfe6f0977bb121
SSDEEP 768:Y/GzFNbhaUGxbhlrI16RVplrIqoZXq+Twr9W1nXdlq9VshARpLnpK6WoLffafRWb:pLKYdqLr9i1IARg44pQfqH70Ci4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.0/es/System.Reflection.xml

SHA256 95cc963af8c1f5d1cabffa8eb694b00ba52c0ca1a9f3650371fd6b9e89230d1e
MD5 5d895165b993049944eb7da0192f8869
SHA1 b22611a4a5b85c9671eb141e7190e45572bdcc2e
SHA512 f6a1aeeed6c77fcd47c32269dbf6496c24b53b657b7fbe4ac228c6c8b84e13515a18434b897ffb967ddc1de5bfdb0128b4ac434702e293e4fe5392c5cfa74cfe
SSDEEP 1536:xh74hSVzkiQ6nZEEqDtK6XI5w3t6yRT8mu:jb8t6D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.0/fr/System.Reflection.xml

SHA256 d121eba84ed6f01fedaf9c96ddb480528c6d99fbc633d37bf83d4b6663fd9abe
MD5 9a5c688fb25c2f30c740a18b24d65e40
SHA1 37dba1a66cc18d10e9db9122944b5ce1ecfb20d5
SHA512 a1e01fa2556923b571757cc15c8ea8cfa34d4c619e4a7351420efa3662255ae87405dc57cdcc898f34dc752d6a93bcebd9484b5ed5ed432e5831bc7aa83416c5
SSDEEP 768:YFEndzlgansqA8TWyRgXA8Tr+LvxDgLRRfbQr5xJa0HRDgmR0XMrNO7KpPMjfj9V:8+LvxDcRRtUNO56UXfjg4N
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.0/it/System.Reflection.xml

SHA256 e18d256f93c610cc82f472c395228e80d87e95385d84fe8523a5d27c8707adff
MD5 c5ec8b432d47f13f9331040a421ee42b
SHA1 91bb9f9dca66d56ca78c843834d6f42226bde280
SHA512 cf3e51663c71dddf95d26b2fae9a4be837aba61d1746eecd43a035ca55e2edfee9f5ad72ffad5b45d07b9e11ce1b17d3c336ddf4b445807144792df3454f93fd
SSDEEP 3072:AfApIHv9Ef67dWr5BwyJSpfaSLvmiZmEK6LGD59JLT4p60ooYAQID:AfApIHv9Ef67dWr5BwyJSpfaSLvmiZm8
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.0/ja/System.Reflection.xml

SHA256 e816484b5454ddd20fe523209d79076aeb9f9c1ce18c464822a17fdfe4d69efc
MD5 e43137959e0f25e55065f53061d80922
SHA1 179885330b659bd3f29168473ddcaa22baf4774b
SHA512 f4342dd3ed7785704e775baf84f37b9848d006728a1ee5ff300b4d3ca4be914089c6fca5b5b8ea41a77223d3ce4fbcb31c0f9e6476884255de4ef1aea6e6c099
SSDEEP 768:YAmnipQCH5yMGSIA1tyMGGQbDV/rLFOJGo9F2h/CU5biuOX8ZaS5aSdm/K9H0ldE:LjWmCh/9OXR/Kj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.0/ko/System.Reflection.xml

SHA256 678a634d8f5dc55bc6b77b0a8e3241d08fce01ad22ea175105453df84e99a2a8
MD5 6ce2edad1202c37f2bd25235d055ee8f
SHA1 aa4a8cf8bbe86769711ce069230fbfe8be58475b
SHA512 a3bb90145cb8e447a382c62abd9f1c2571beb667663d2d4a8a03d196614d668a50ee8bb696522b2c084340e638d4706ee4bfbfb9b45bec32329518f33d645e66
SSDEEP 3072:XU1f/L2S+pp9sI0tpCux7Sm2PRnh6V7aY3iEaKHmYFcVvK:k1f/L2S+pp9J0tpCux7Sm+h6V7aY3iEp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.0/ru/System.Reflection.xml

SHA256 3e2d2463f926309ebcaa2c4757b88ff894c59fed296bffc7ccca89761edc9644
MD5 abb39ee680885f4c6c42693de4813103
SHA1 b17f2fa84ee851d2d1d013549e384dd0c58d1b86
SHA512 dd653941464502d9865f723efa230698d0c5a80916b54713998bbad0816c5182e5bca592bda1866344b035be598c0d4468842c99c92fb14125ff089781513cda
SSDEEP 1536:iJEGnr8ds7B3DxRFwVBYuds57vEPLScAlssQ:ZGnr8dsVD9wVBYudsZvoL8lssQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.0/zh-hans/System.Reflection.xml

SHA256 1ec2bf45228b8def1d9c956bd204564640df8a923b86b5bb0c432ae39705742a
MD5 130149bf761ff1299836dd96e201c8fa
SHA1 b699ce856eca0e16f8b35ba16367e126f4716398
SHA512 16596e602e4485a810e8938d23e7eec3845d932faacc6b5e9f7db382fe4e1e8d3b20e667cb0a4b582eeef9d4c0660903e8087d010365305f47ef17655ccd67ba
SSDEEP 1536:lB/dev/7krTSXsb5EXsramP7VLtFypO86ixpbQ:lBi/Zzb6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.0/zh-hant/System.Reflection.xml

SHA256 8c02c4c3596f7121f21a5ab1330c228a57d20837b7bd189e0b1d8b1ede5cf59f
MD5 55e71cddd89bcc2c5dc54a7ce83315ae
SHA1 c5b477e76665ed7562520669f8add4b18c6e7d6a
SHA512 b132b6afe2e0240b4cd0572eecb87ee96cc49216692763c43b1a7d0b46884edd905f05ea364a51b167536c44df1b9ebeb3fc0b0f4ba7954dc5a9042c5c0c8d15
SSDEEP 768:YWZJx3NbCgO+uhJtm9gO+uUPsJj0TgSGOrSdHPUuO5EdDKv1h9pHBls5w:QCwCA5rSdHG5GDKv1hr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.3/System.Reflection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 05cde8d18ea9d10148c83fce991793b22c171ab1fc342155034a9884a2ba68b0
MD5 4cb5b99e778da74edfdb8daf7973fdcc
SHA1 a451b4ec3bd31ad591993152fcc6eb01d6aa37a3
SHA512 dd47aaea6c24f58ca85874864c67c8d53c6e31b49165b5162d9009552e6416a63edb3d22a03f6b4d6ad293bca6a745cb9a869b5aa60ad20ef6d6ffc25549d0d0
SSDEEP 384:yDO1zktddz6s1Pm7fCU5QHrpYV2ZesWN2We7QA0GftpBjC+ILKHRN7GlI66ntc:ybRFPmeJLpYIZC4yismH66W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

9f:3a:da:01:83:61:44:16:80:04:00:45:9d:5b:79:8c:71:33:5e:da:9d:50:7e:3e:fe:dd:31:22:b7:ad:6a:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

23:d6:79:28:35:85:d7:71:02:4d:b8:70:39:7c:5a:dc:1c:cd:b3:59

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

24686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Reflection\4.0.10.0\System.Reflection.pdb

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.3/System.Reflection.xml

SHA256 910dcac9da51fe26677c62d4a3f2baa2c67e42b0b5a14c718eb5eae39c39fb86
MD5 d73d9d51eaefca78e079d3908c37327e
SHA1 918e9ea01d8c204570aea6d76acdf7848d576b43
SHA512 725c8b79524774a6b6200c344eff0137801bc81a0a23dca3200912001f2e3a7c74555503a6495fb0f3dac7b99837095d8bd19ab5a279c1d68016a3920ba3372a
SSDEEP 768:YSd0nCUFQqwrlsHbVqdIfPnfFqdIRpR/Nf0sbb2EFpPwYcnzpm7vDEqvkE5rz5y8:E9DR/N1Fp2l+6UxypoSVPOPywr/z
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.3/de/System.Reflection.xml

SHA256 2c8729ffec6a753cc08e285a819360879cdc16c4432aa0068b8c40d42c358e81
MD5 1917b66e3fd948f1050110d8d3838f15
SHA1 ebbe11d1837db153edfdaeb32468293ec6101b7c
SHA512 a51ad848f1d5ab83d1ed04a24da390291017505b3d61905102c47870c743d8eb66c5e2e033fe497ac7b01e8f57e1b1cb4477eaf7582ed7b0eadfe6f0977bb121
SSDEEP 768:Y/GzFNbhaUGxbhlrI16RVplrIqoZXq+Twr9W1nXdlq9VshARpLnpK6WoLffafRWb:pLKYdqLr9i1IARg44pQfqH70Ci4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.3/es/System.Reflection.xml

SHA256 95cc963af8c1f5d1cabffa8eb694b00ba52c0ca1a9f3650371fd6b9e89230d1e
MD5 5d895165b993049944eb7da0192f8869
SHA1 b22611a4a5b85c9671eb141e7190e45572bdcc2e
SHA512 f6a1aeeed6c77fcd47c32269dbf6496c24b53b657b7fbe4ac228c6c8b84e13515a18434b897ffb967ddc1de5bfdb0128b4ac434702e293e4fe5392c5cfa74cfe
SSDEEP 1536:xh74hSVzkiQ6nZEEqDtK6XI5w3t6yRT8mu:jb8t6D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.3/fr/System.Reflection.xml

SHA256 d121eba84ed6f01fedaf9c96ddb480528c6d99fbc633d37bf83d4b6663fd9abe
MD5 9a5c688fb25c2f30c740a18b24d65e40
SHA1 37dba1a66cc18d10e9db9122944b5ce1ecfb20d5
SHA512 a1e01fa2556923b571757cc15c8ea8cfa34d4c619e4a7351420efa3662255ae87405dc57cdcc898f34dc752d6a93bcebd9484b5ed5ed432e5831bc7aa83416c5
SSDEEP 768:YFEndzlgansqA8TWyRgXA8Tr+LvxDgLRRfbQr5xJa0HRDgmR0XMrNO7KpPMjfj9V:8+LvxDcRRtUNO56UXfjg4N
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.3/it/System.Reflection.xml

SHA256 e18d256f93c610cc82f472c395228e80d87e95385d84fe8523a5d27c8707adff
MD5 c5ec8b432d47f13f9331040a421ee42b
SHA1 91bb9f9dca66d56ca78c843834d6f42226bde280
SHA512 cf3e51663c71dddf95d26b2fae9a4be837aba61d1746eecd43a035ca55e2edfee9f5ad72ffad5b45d07b9e11ce1b17d3c336ddf4b445807144792df3454f93fd
SSDEEP 3072:AfApIHv9Ef67dWr5BwyJSpfaSLvmiZmEK6LGD59JLT4p60ooYAQID:AfApIHv9Ef67dWr5BwyJSpfaSLvmiZm8
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.3/ja/System.Reflection.xml

SHA256 e816484b5454ddd20fe523209d79076aeb9f9c1ce18c464822a17fdfe4d69efc
MD5 e43137959e0f25e55065f53061d80922
SHA1 179885330b659bd3f29168473ddcaa22baf4774b
SHA512 f4342dd3ed7785704e775baf84f37b9848d006728a1ee5ff300b4d3ca4be914089c6fca5b5b8ea41a77223d3ce4fbcb31c0f9e6476884255de4ef1aea6e6c099
SSDEEP 768:YAmnipQCH5yMGSIA1tyMGGQbDV/rLFOJGo9F2h/CU5biuOX8ZaS5aSdm/K9H0ldE:LjWmCh/9OXR/Kj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.3/ko/System.Reflection.xml

SHA256 678a634d8f5dc55bc6b77b0a8e3241d08fce01ad22ea175105453df84e99a2a8
MD5 6ce2edad1202c37f2bd25235d055ee8f
SHA1 aa4a8cf8bbe86769711ce069230fbfe8be58475b
SHA512 a3bb90145cb8e447a382c62abd9f1c2571beb667663d2d4a8a03d196614d668a50ee8bb696522b2c084340e638d4706ee4bfbfb9b45bec32329518f33d645e66
SSDEEP 3072:XU1f/L2S+pp9sI0tpCux7Sm2PRnh6V7aY3iEaKHmYFcVvK:k1f/L2S+pp9J0tpCux7Sm+h6V7aY3iEp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.3/ru/System.Reflection.xml

SHA256 3e2d2463f926309ebcaa2c4757b88ff894c59fed296bffc7ccca89761edc9644
MD5 abb39ee680885f4c6c42693de4813103
SHA1 b17f2fa84ee851d2d1d013549e384dd0c58d1b86
SHA512 dd653941464502d9865f723efa230698d0c5a80916b54713998bbad0816c5182e5bca592bda1866344b035be598c0d4468842c99c92fb14125ff089781513cda
SSDEEP 1536:iJEGnr8ds7B3DxRFwVBYuds57vEPLScAlssQ:ZGnr8dsVD9wVBYudsZvoL8lssQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.3/zh-hans/System.Reflection.xml

SHA256 1ec2bf45228b8def1d9c956bd204564640df8a923b86b5bb0c432ae39705742a
MD5 130149bf761ff1299836dd96e201c8fa
SHA1 b699ce856eca0e16f8b35ba16367e126f4716398
SHA512 16596e602e4485a810e8938d23e7eec3845d932faacc6b5e9f7db382fe4e1e8d3b20e667cb0a4b582eeef9d4c0660903e8087d010365305f47ef17655ccd67ba
SSDEEP 1536:lB/dev/7krTSXsb5EXsramP7VLtFypO86ixpbQ:lBi/Zzb6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.3/zh-hant/System.Reflection.xml

SHA256 8c02c4c3596f7121f21a5ab1330c228a57d20837b7bd189e0b1d8b1ede5cf59f
MD5 55e71cddd89bcc2c5dc54a7ce83315ae
SHA1 c5b477e76665ed7562520669f8add4b18c6e7d6a
SHA512 b132b6afe2e0240b4cd0572eecb87ee96cc49216692763c43b1a7d0b46884edd905f05ea364a51b167536c44df1b9ebeb3fc0b0f4ba7954dc5a9042c5c0c8d15
SSDEEP 768:YWZJx3NbCgO+uhJtm9gO+uUPsJj0TgSGOrSdHPUuO5EdDKv1h9pHBls5w:QCwCA5rSdHG5GDKv1hr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.5/System.Reflection.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ba6f2bf90b1a3a4784adfbd6fef2736ec0d08d6b1fe8bf84aeb7028e0dc46a64
MD5 edd0e952eb54c46127d72713a374ca3e
SHA1 408ca8651bf17385868d89065ed593ade2ac31fb
SHA512 ba1c7973e782430b9cd7f3da703a84c9dfe26248667504637c7d6a5630507e79a7f9acbd9258604b9a7551eafa81e21a4793af6d5ead0753c43a654ba7080da3
SSDEEP 384:NsPjYtTxs7qDfnuCdrCGUzCXe4pKq1bShjrtjKeWTMWAaCIcPA0GftpBjsBZDERI:NsPjyxsWrUiw4StrtuTii6PDEBpkK2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d3:08:55:ec:57:7c:e9:20:1f:3b:d3:4f:c2:29:85:61:16:82:47:68:68:48:d8:93:8e:07:07:5e:8b:1a:b2:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8a:16:01:37:fc:de:43:1d:2f:9d:29:e2:13:ec:a6:72:a2:d2:38:7e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

30466

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Reflection\4.1.0.0\System.Reflection.pdb

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.5/System.Reflection.xml

SHA256 910dcac9da51fe26677c62d4a3f2baa2c67e42b0b5a14c718eb5eae39c39fb86
MD5 d73d9d51eaefca78e079d3908c37327e
SHA1 918e9ea01d8c204570aea6d76acdf7848d576b43
SHA512 725c8b79524774a6b6200c344eff0137801bc81a0a23dca3200912001f2e3a7c74555503a6495fb0f3dac7b99837095d8bd19ab5a279c1d68016a3920ba3372a
SSDEEP 768:YSd0nCUFQqwrlsHbVqdIfPnfFqdIRpR/Nf0sbb2EFpPwYcnzpm7vDEqvkE5rz5y8:E9DR/N1Fp2l+6UxypoSVPOPywr/z
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.5/de/System.Reflection.xml

SHA256 2c8729ffec6a753cc08e285a819360879cdc16c4432aa0068b8c40d42c358e81
MD5 1917b66e3fd948f1050110d8d3838f15
SHA1 ebbe11d1837db153edfdaeb32468293ec6101b7c
SHA512 a51ad848f1d5ab83d1ed04a24da390291017505b3d61905102c47870c743d8eb66c5e2e033fe497ac7b01e8f57e1b1cb4477eaf7582ed7b0eadfe6f0977bb121
SSDEEP 768:Y/GzFNbhaUGxbhlrI16RVplrIqoZXq+Twr9W1nXdlq9VshARpLnpK6WoLffafRWb:pLKYdqLr9i1IARg44pQfqH70Ci4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.5/es/System.Reflection.xml

SHA256 95cc963af8c1f5d1cabffa8eb694b00ba52c0ca1a9f3650371fd6b9e89230d1e
MD5 5d895165b993049944eb7da0192f8869
SHA1 b22611a4a5b85c9671eb141e7190e45572bdcc2e
SHA512 f6a1aeeed6c77fcd47c32269dbf6496c24b53b657b7fbe4ac228c6c8b84e13515a18434b897ffb967ddc1de5bfdb0128b4ac434702e293e4fe5392c5cfa74cfe
SSDEEP 1536:xh74hSVzkiQ6nZEEqDtK6XI5w3t6yRT8mu:jb8t6D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.5/fr/System.Reflection.xml

SHA256 d121eba84ed6f01fedaf9c96ddb480528c6d99fbc633d37bf83d4b6663fd9abe
MD5 9a5c688fb25c2f30c740a18b24d65e40
SHA1 37dba1a66cc18d10e9db9122944b5ce1ecfb20d5
SHA512 a1e01fa2556923b571757cc15c8ea8cfa34d4c619e4a7351420efa3662255ae87405dc57cdcc898f34dc752d6a93bcebd9484b5ed5ed432e5831bc7aa83416c5
SSDEEP 768:YFEndzlgansqA8TWyRgXA8Tr+LvxDgLRRfbQr5xJa0HRDgmR0XMrNO7KpPMjfj9V:8+LvxDcRRtUNO56UXfjg4N
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.5/it/System.Reflection.xml

SHA256 e18d256f93c610cc82f472c395228e80d87e95385d84fe8523a5d27c8707adff
MD5 c5ec8b432d47f13f9331040a421ee42b
SHA1 91bb9f9dca66d56ca78c843834d6f42226bde280
SHA512 cf3e51663c71dddf95d26b2fae9a4be837aba61d1746eecd43a035ca55e2edfee9f5ad72ffad5b45d07b9e11ce1b17d3c336ddf4b445807144792df3454f93fd
SSDEEP 3072:AfApIHv9Ef67dWr5BwyJSpfaSLvmiZmEK6LGD59JLT4p60ooYAQID:AfApIHv9Ef67dWr5BwyJSpfaSLvmiZm8
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.5/ja/System.Reflection.xml

SHA256 e816484b5454ddd20fe523209d79076aeb9f9c1ce18c464822a17fdfe4d69efc
MD5 e43137959e0f25e55065f53061d80922
SHA1 179885330b659bd3f29168473ddcaa22baf4774b
SHA512 f4342dd3ed7785704e775baf84f37b9848d006728a1ee5ff300b4d3ca4be914089c6fca5b5b8ea41a77223d3ce4fbcb31c0f9e6476884255de4ef1aea6e6c099
SSDEEP 768:YAmnipQCH5yMGSIA1tyMGGQbDV/rLFOJGo9F2h/CU5biuOX8ZaS5aSdm/K9H0ldE:LjWmCh/9OXR/Kj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.5/ko/System.Reflection.xml

SHA256 678a634d8f5dc55bc6b77b0a8e3241d08fce01ad22ea175105453df84e99a2a8
MD5 6ce2edad1202c37f2bd25235d055ee8f
SHA1 aa4a8cf8bbe86769711ce069230fbfe8be58475b
SHA512 a3bb90145cb8e447a382c62abd9f1c2571beb667663d2d4a8a03d196614d668a50ee8bb696522b2c084340e638d4706ee4bfbfb9b45bec32329518f33d645e66
SSDEEP 3072:XU1f/L2S+pp9sI0tpCux7Sm2PRnh6V7aY3iEaKHmYFcVvK:k1f/L2S+pp9J0tpCux7Sm+h6V7aY3iEp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.5/ru/System.Reflection.xml

SHA256 3e2d2463f926309ebcaa2c4757b88ff894c59fed296bffc7ccca89761edc9644
MD5 abb39ee680885f4c6c42693de4813103
SHA1 b17f2fa84ee851d2d1d013549e384dd0c58d1b86
SHA512 dd653941464502d9865f723efa230698d0c5a80916b54713998bbad0816c5182e5bca592bda1866344b035be598c0d4468842c99c92fb14125ff089781513cda
SSDEEP 1536:iJEGnr8ds7B3DxRFwVBYuds57vEPLScAlssQ:ZGnr8dsVD9wVBYudsZvoL8lssQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.5/zh-hans/System.Reflection.xml

SHA256 1ec2bf45228b8def1d9c956bd204564640df8a923b86b5bb0c432ae39705742a
MD5 130149bf761ff1299836dd96e201c8fa
SHA1 b699ce856eca0e16f8b35ba16367e126f4716398
SHA512 16596e602e4485a810e8938d23e7eec3845d932faacc6b5e9f7db382fe4e1e8d3b20e667cb0a4b582eeef9d4c0660903e8087d010365305f47ef17655ccd67ba
SSDEEP 1536:lB/dev/7krTSXsb5EXsramP7VLtFypO86ixpbQ:lBi/Zzb6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.4.3.0/ref/netstandard1.5/zh-hant/System.Reflection.xml

SHA256 8c02c4c3596f7121f21a5ab1330c228a57d20837b7bd189e0b1d8b1ede5cf59f
MD5 55e71cddd89bcc2c5dc54a7ce83315ae
SHA1 c5b477e76665ed7562520669f8add4b18c6e7d6a
SHA512 b132b6afe2e0240b4cd0572eecb87ee96cc49216692763c43b1a7d0b46884edd905f05ea364a51b167536c44df1b9ebeb3fc0b0f4ba7954dc5a9042c5c0c8d15
SSDEEP 768:YWZJx3NbCgO+uhJtm9gO+uUPsJj0TgSGOrSdHPUuO5EdDKv1h9pHBls5w:QCwCA5rSdHG5GDKv1hr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/.signature.p7s

SHA256 3c6a858362e77027eff312a537dcb932d2f371b28167f9a137207b40f10ea743
MD5 afc15f5db602603a483ac985d09e1b15
SHA1 14f1313cbdf63b70d039cf10007b69115cf2a97e
SHA512 896e8aff13647a0ff866bc4a6454edb72857e2e8988cb971879cf90b9c67c7d2f689a20c01d7f75c16fe565b6244bd8dbdd65dff15b461dc4fc74b0c2af70110
SSDEEP 192:8dZ7x0KDWpHhXZCVzV07xra9DH0JOqNG8Fp28Wh8nGq:EzvDGGVpf9oJNNzFwhhil
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/System.Reflection.Extensions.4.3.0.nupkg

SHA256 98c38263351e9e3778ad621fabbcc85fd3c5624fdd694c85d00f25d616f27409
MD5 73e9428ac6c1604ef6b36b943fae0394
SHA1 94cee365a2c06aa9491ba0a98c827610e76a0269
SHA512 06cfd992c8d7fd9ab6432ab02be981a01b6558285a6e26a7825a064d4efcce08d9e7344f03fa19b033a2459d42b0b80e8c1400ce39b47a1752869ab8825b0475
SSDEEP 1536:lwbex6voUvaz8Buyh4v1O/icWwTofhb7KW5lTofhb7KELUZyIzv1OYicZww8l9W6:lwCx6AKk0fvWNb2W5Eb2OurAaZ/8vt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netcore50/System.Reflection.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 70651db06fc364e7aaa0e073d36f7342628a407f34e278ba724e147a15c0216e
MD5 8ce883df97ca30881b40cbaf47d2796d
SHA1 102c97a8a61e4806f43df7d8a7b82552f9eb0879
SHA512 6c574c3937b4d304550d4608b5c4d1f47431fa60fdcc1cb100a21525256b673145e9a29595433ef2d00789ca2c2f39b2142fe8967252b5e4d10db98afab61373
SSDEEP 384:Nxi4lVR9Ww4WWJA0GftpBjA4RERHRN7l9HIlraGp:rdZMipEBbSJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

74:f3:cc:57:08:88:32:a7:f6:47:94:7b:ab:7f:26:6b:b6:d6:fa:50:c8:12:49:13:71:17:c9:06:8b:d8:26:03

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

99:68:04:34:8d:c2:c7:d6:f4:c8:55:ad:e4:c8:c3:68:63:32:8d:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9d:42:68:ee:31:1c:d7:56:bd:00:00:00:00:00:9d

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Reflection.Extensions\4.0.0.0\System.Reflection.Extensions.pdb

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netcore50/System.Reflection.Extensions.xml

SHA256 b8da2da122ffba0d7529d04dd51462e16b1d62b56e9fdc444945f504ca0f78f2
MD5 e2b6e01ca251a25bdcd0cc5794d1acaf
SHA1 08a463ec99198555f32e53c92a9868c9b4e998e5
SHA512 c3035323cabb587604e48c521b9507c2b3a53bff8278b893540e1be71fcb52bf73fa76ccddff93c514b346302a79a775e7c4f57b750ea77e6a08bfb5a63822a8
SSDEEP 192:Yo0zhzY0zv0zKzvzI0zRzD0zr0zfz5zd0zczk0ze0z4zmzB0zyzA0zb0zwz6zBMp:YNndZpqs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netcore50/de/System.Reflection.Extensions.xml

SHA256 393e459a56de64e811f9569ae274a6efdcdad76d031ecb00fa5765b51b333a3f
MD5 a5779d203d4a56407c60c1ac46e1732b
SHA1 77552b1f0fab334c0ffeff4f461785d99d8f45bb
SHA512 898eebf3a16a2b374568eb61c700b5aa57233c9094823e76681b05607536d415cb8a465d7390517b00df9cd0443e295a63d8ca4fbfbb89d2c08eaa80b034c3f1
SSDEEP 192:Y4tMgSY7RakWSoHMRSoHIzGHgzjH/zSYfiaUNSoHDWSoHaIaH1IDHAuAgSONAssP:Y48fd5KBMv6ikj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netcore50/es/System.Reflection.Extensions.xml

SHA256 ab7685e280bd0dedf98425dd881eea1fe496323500796aa60dc7a0ea96cc268c
MD5 3b812562f0f9b9e1688a912f0c9675a7
SHA1 30022cfeed7af17f77114c93ac3e0670ceb8f62b
SHA512 b7e40125d07b12ac43ad5d0d0fd0d2e313484c0d76f75ab20e9afc60ad3281fab027f0de4dc023630acb0486768910b23a7d60de1d50f4f76f523121d4a46ba9
SSDEEP 384:Ya2Z2V2G2I2Z2+292q2g2C2s2r6zC9jQ8TO4REKmXXJ5V:YFsIhvsZQ1ntDr6zC9jQ8TO4REXLV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netcore50/fr/System.Reflection.Extensions.xml

SHA256 6c3dd7770981da8fcdcde40bc836397bb0c4f9fdbb39f5b9dca97e63ebcff1dd
MD5 7f4638f33e5ec29db1c9fd0a6fc3bcd2
SHA1 d8297512461ab6ce7527e470706c8713c48b6035
SHA512 9ef7674ef76e595e609c09faa92aefd94573866d31617eec7bce429517356557c8f84107d171b5cd9d47f240a4c417019de0085b1b8a25325e32bed6fc5c6dbd
SSDEEP 384:YEzSSqk5Da5DXFctryGgu5NfSsw/IzbSsIjM4:Yx
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netcore50/it/System.Reflection.Extensions.xml

SHA256 0154a83665044ff4dd635c69d2adbdc11b5f0635f5698adb376c1f3da33e7c22
MD5 63e41f4cdf79ede29f0633818b5f44ba
SHA1 b9f7adc34694eeec5bbfd45ac1a5fec87bb31061
SHA512 37ea63e321b974f6ac40da2084be8e7bb7483a785685bfd7f1dfa553247301221d344b510584fb25cf0dcffa40ee9b0e7ceac05bda29a876896652a0afdd7152
SSDEEP 384:Y/qzF6uSAYN176V7NIkOHuTWJ5QNJr7KY1:YP1+hNIkguTWJ5QNJr7KY1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netcore50/ja/System.Reflection.Extensions.xml

SHA256 a1cf892970f80c859903353859c9bc31fd7220063742a8c6a9427d4aec48eac8
MD5 075d0f1b65401587ac526312e39d0a77
SHA1 3646819da79cb68f0aa5b7ac359d29bf57f55ea6
SHA512 2a10a2e23d2e33c15f5370d5b20f917682b3f71b491ae6e5e2b2fdace59c125a8fa90ba6edee9e11aa78a8330ae845b25fcc456cf55907397865c1000a13b983
SSDEEP 192:Ye+B7+ZeZSODOP+57lZwZZ777JAcmqUWHWJI2BmbinWpNTjYdm5LJfM:Y5eynYvCcUGN2geWrXcALK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netcore50/ko/System.Reflection.Extensions.xml

SHA256 d13379d8d0e467798a1c336d9e87975fa66b7de70976645082bf47962deb898f
MD5 25ddcfa12b0190d260996fd11523583e
SHA1 c3ca1515a0e569b2643260ad51ae3e1fa520fc1a
SHA512 b690e5b0ccc832da1eadece775babd582247626cead045d1920413a839127060c6706d33387d5eb4d9f4eb95765dbd85c5d60316285ae083d2abcb67cc704147
SSDEEP 768:YlXm3VtbP6u2L/bXXAy7AijAka7AkHAiyA+0Z6+FjA/tGADbt7A1HACjAhm7ATHe:YXUVFP6nLTXXAy7AijAka7AkHAiyANZj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netcore50/ru/System.Reflection.Extensions.xml

SHA256 b5534782c4043bf687b71a5ef17fd1c5b88b07d604473269421a775e6e9bde06
MD5 f980a7dbb3d161648e9558282d47e49b
SHA1 6096a82940d9753c128ab0ac496d07ea4f1bcda2
SHA512 c3e00e5acb12c768d362ec1a6d9b9335a51a078c5a97f2b1edbac8f5657d07fb1b0b235cb65efe0731657abde4e37852f86377a5bd83dba6bbc970a2565da028
SSDEEP 768:YAdwVF8ObN1ATeEpXdDddRlnadXidMoHvq+7:jdwVF8ObN1ATeEptDbRln+X2MoHvn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netcore50/zh-hans/System.Reflection.Extensions.xml

SHA256 4a094eee78097fa99cc05d64bb5efcca9db149d9a73e3b6d944932e7a03458e2
MD5 0cdeb652e2866a3284704f57c236c0a4
SHA1 28e557fb329918145e0f82d0ce8e94db5af3b7ba
SHA512 7397ffe562a2bfe3c082d2e2372ae643908beefad30fc3a85c5f424b8c80a1df23b2d80df3cbc1bbf8251f37ef6fefbe43fce4681323b60329bc67afb6515524
SSDEEP 192:YasKBQp2oa4rsgkFzO7oCpsD3A5pwxogZYajVdj+5d8oZUB7rQk+dyz9zESrTxIr:YabBSE4wrFi3pcztxIrX
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netcore50/zh-hant/System.Reflection.Extensions.xml

SHA256 770fc0b189a44075b64c57ed3e8ce4de60cc1ad8cd3d3bd95510ced5bd48dba0
MD5 328df14a31213d7b792cb0c5330d99e7
SHA1 5ea67c633fc6ddabde64f3b8fb0e28342b5b8e7b
SHA512 f02cca5ace438402eed489f471e40790d420adde2a729ab59f14e18e9450891d48a26cd9eed91908a66d06daf87870128e6c33d614767472f2ccf0e22f028d0a
SSDEEP 96:YVF5XNH4Gqdl1Nz31H8GmH2FGkr3TPHmGHkeCazi0HlGv4TFGFLME5deDLMd04G2:Yh+HH5X4IeVKoAmA/UjIt3DRYWo05L6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netstandard1.0/System.Reflection.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 70651db06fc364e7aaa0e073d36f7342628a407f34e278ba724e147a15c0216e
MD5 8ce883df97ca30881b40cbaf47d2796d
SHA1 102c97a8a61e4806f43df7d8a7b82552f9eb0879
SHA512 6c574c3937b4d304550d4608b5c4d1f47431fa60fdcc1cb100a21525256b673145e9a29595433ef2d00789ca2c2f39b2142fe8967252b5e4d10db98afab61373
SSDEEP 384:Nxi4lVR9Ww4WWJA0GftpBjA4RERHRN7l9HIlraGp:rdZMipEBbSJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

74:f3:cc:57:08:88:32:a7:f6:47:94:7b:ab:7f:26:6b:b6:d6:fa:50:c8:12:49:13:71:17:c9:06:8b:d8:26:03

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

99:68:04:34:8d:c2:c7:d6:f4:c8:55:ad:e4:c8:c3:68:63:32:8d:2e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9d:42:68:ee:31:1c:d7:56:bd:00:00:00:00:00:9d

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Reflection.Extensions\4.0.0.0\System.Reflection.Extensions.pdb

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netstandard1.0/System.Reflection.Extensions.xml

SHA256 b8da2da122ffba0d7529d04dd51462e16b1d62b56e9fdc444945f504ca0f78f2
MD5 e2b6e01ca251a25bdcd0cc5794d1acaf
SHA1 08a463ec99198555f32e53c92a9868c9b4e998e5
SHA512 c3035323cabb587604e48c521b9507c2b3a53bff8278b893540e1be71fcb52bf73fa76ccddff93c514b346302a79a775e7c4f57b750ea77e6a08bfb5a63822a8
SSDEEP 192:Yo0zhzY0zv0zKzvzI0zRzD0zr0zfz5zd0zczk0ze0z4zmzB0zyzA0zb0zwz6zBMp:YNndZpqs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netstandard1.0/de/System.Reflection.Extensions.xml

SHA256 393e459a56de64e811f9569ae274a6efdcdad76d031ecb00fa5765b51b333a3f
MD5 a5779d203d4a56407c60c1ac46e1732b
SHA1 77552b1f0fab334c0ffeff4f461785d99d8f45bb
SHA512 898eebf3a16a2b374568eb61c700b5aa57233c9094823e76681b05607536d415cb8a465d7390517b00df9cd0443e295a63d8ca4fbfbb89d2c08eaa80b034c3f1
SSDEEP 192:Y4tMgSY7RakWSoHMRSoHIzGHgzjH/zSYfiaUNSoHDWSoHaIaH1IDHAuAgSONAssP:Y48fd5KBMv6ikj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netstandard1.0/es/System.Reflection.Extensions.xml

SHA256 ab7685e280bd0dedf98425dd881eea1fe496323500796aa60dc7a0ea96cc268c
MD5 3b812562f0f9b9e1688a912f0c9675a7
SHA1 30022cfeed7af17f77114c93ac3e0670ceb8f62b
SHA512 b7e40125d07b12ac43ad5d0d0fd0d2e313484c0d76f75ab20e9afc60ad3281fab027f0de4dc023630acb0486768910b23a7d60de1d50f4f76f523121d4a46ba9
SSDEEP 384:Ya2Z2V2G2I2Z2+292q2g2C2s2r6zC9jQ8TO4REKmXXJ5V:YFsIhvsZQ1ntDr6zC9jQ8TO4REXLV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netstandard1.0/fr/System.Reflection.Extensions.xml

SHA256 6c3dd7770981da8fcdcde40bc836397bb0c4f9fdbb39f5b9dca97e63ebcff1dd
MD5 7f4638f33e5ec29db1c9fd0a6fc3bcd2
SHA1 d8297512461ab6ce7527e470706c8713c48b6035
SHA512 9ef7674ef76e595e609c09faa92aefd94573866d31617eec7bce429517356557c8f84107d171b5cd9d47f240a4c417019de0085b1b8a25325e32bed6fc5c6dbd
SSDEEP 384:YEzSSqk5Da5DXFctryGgu5NfSsw/IzbSsIjM4:Yx
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netstandard1.0/it/System.Reflection.Extensions.xml

SHA256 0154a83665044ff4dd635c69d2adbdc11b5f0635f5698adb376c1f3da33e7c22
MD5 63e41f4cdf79ede29f0633818b5f44ba
SHA1 b9f7adc34694eeec5bbfd45ac1a5fec87bb31061
SHA512 37ea63e321b974f6ac40da2084be8e7bb7483a785685bfd7f1dfa553247301221d344b510584fb25cf0dcffa40ee9b0e7ceac05bda29a876896652a0afdd7152
SSDEEP 384:Y/qzF6uSAYN176V7NIkOHuTWJ5QNJr7KY1:YP1+hNIkguTWJ5QNJr7KY1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netstandard1.0/ja/System.Reflection.Extensions.xml

SHA256 a1cf892970f80c859903353859c9bc31fd7220063742a8c6a9427d4aec48eac8
MD5 075d0f1b65401587ac526312e39d0a77
SHA1 3646819da79cb68f0aa5b7ac359d29bf57f55ea6
SHA512 2a10a2e23d2e33c15f5370d5b20f917682b3f71b491ae6e5e2b2fdace59c125a8fa90ba6edee9e11aa78a8330ae845b25fcc456cf55907397865c1000a13b983
SSDEEP 192:Ye+B7+ZeZSODOP+57lZwZZ777JAcmqUWHWJI2BmbinWpNTjYdm5LJfM:Y5eynYvCcUGN2geWrXcALK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netstandard1.0/ko/System.Reflection.Extensions.xml

SHA256 d13379d8d0e467798a1c336d9e87975fa66b7de70976645082bf47962deb898f
MD5 25ddcfa12b0190d260996fd11523583e
SHA1 c3ca1515a0e569b2643260ad51ae3e1fa520fc1a
SHA512 b690e5b0ccc832da1eadece775babd582247626cead045d1920413a839127060c6706d33387d5eb4d9f4eb95765dbd85c5d60316285ae083d2abcb67cc704147
SSDEEP 768:YlXm3VtbP6u2L/bXXAy7AijAka7AkHAiyA+0Z6+FjA/tGADbt7A1HACjAhm7ATHe:YXUVFP6nLTXXAy7AijAka7AkHAiyANZj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netstandard1.0/ru/System.Reflection.Extensions.xml

SHA256 b5534782c4043bf687b71a5ef17fd1c5b88b07d604473269421a775e6e9bde06
MD5 f980a7dbb3d161648e9558282d47e49b
SHA1 6096a82940d9753c128ab0ac496d07ea4f1bcda2
SHA512 c3e00e5acb12c768d362ec1a6d9b9335a51a078c5a97f2b1edbac8f5657d07fb1b0b235cb65efe0731657abde4e37852f86377a5bd83dba6bbc970a2565da028
SSDEEP 768:YAdwVF8ObN1ATeEpXdDddRlnadXidMoHvq+7:jdwVF8ObN1ATeEptDbRln+X2MoHvn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netstandard1.0/zh-hans/System.Reflection.Extensions.xml

SHA256 4a094eee78097fa99cc05d64bb5efcca9db149d9a73e3b6d944932e7a03458e2
MD5 0cdeb652e2866a3284704f57c236c0a4
SHA1 28e557fb329918145e0f82d0ce8e94db5af3b7ba
SHA512 7397ffe562a2bfe3c082d2e2372ae643908beefad30fc3a85c5f424b8c80a1df23b2d80df3cbc1bbf8251f37ef6fefbe43fce4681323b60329bc67afb6515524
SSDEEP 192:YasKBQp2oa4rsgkFzO7oCpsD3A5pwxogZYajVdj+5d8oZUB7rQk+dyz9zESrTxIr:YabBSE4wrFi3pcztxIrX
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Extensions.4.3.0/ref/netstandard1.0/zh-hant/System.Reflection.Extensions.xml

SHA256 770fc0b189a44075b64c57ed3e8ce4de60cc1ad8cd3d3bd95510ced5bd48dba0
MD5 328df14a31213d7b792cb0c5330d99e7
SHA1 5ea67c633fc6ddabde64f3b8fb0e28342b5b8e7b
SHA512 f02cca5ace438402eed489f471e40790d420adde2a729ab59f14e18e9450891d48a26cd9eed91908a66d06daf87870128e6c33d614767472f2ccf0e22f028d0a
SSDEEP 96:YVF5XNH4Gqdl1Nz31H8GmH2FGkr3TPHmGHkeCazi0HlGv4TFGFLME5deDLMd04G2:Yh+HH5X4IeVKoAmA/UjIt3DRYWo05L6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/.signature.p7s

SHA256 ef7aa68ff75d8d91fc58392682b73395c87b7566b8f27177ce18915791a0421a
MD5 34dcdbe8695adf46f28cf01d2da9bd21
SHA1 38d1e59ab3d1416878d34c97cc6ae98b9fe01542
SHA512 fe5dcc350b288f0c79e47edc2c807d1723850122abd14032d04cace63608c7db5ef73140b366ae4b053dfa5f1c7c6b1be4016888f82c0cb5c087adabd1c9db79
SSDEEP 192:8d7K7x0KDWpHhXZCVzV07xrcZZY9DH0JOqNG8Fp28Wh8naX:E7QvDGGVpZZm9oJNNzFwhhiaX
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/System.Reflection.Primitives.4.3.0.nupkg

SHA256 e68830581e2f9504e5de38e4d718e7886da8cdb1488d94cbf6e834bac650b813
MD5 030911e33ca5280ba7cd5ebe22c10b15
SHA1 cf336fe4479c5f58bb5a65eb74f151d6fd8f4722
SHA512 d4b9cc905f5a5cab900206338e889068bf66c18ee863a29d68eff3cde2ccca734112a2a851f2e2e5388a21ec28005fa19317c64d9b23923b05d6344be2e49eaa
SSDEEP 6144:s1USRMmaYLyb6rxPA0ODOGZmRYLPb6rYAfON:TyMmrWbK5MZm6jbLU8
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netcore50/System.Reflection.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4fdc3d955b9a257b595ea132186e987d3bb4adccd3e387eb09de594652bd7b7c
MD5 509ac1b5d59a0c4d1cf46d265d639cd3
SHA1 8d9e2c82a3d1798644385846fb56f168e28002de
SHA512 67779e11490d41f0c927a933607f91db776f1cdf9c37b553aed1d8b64b5e371889e0d8d0e931329e51079cb6b52f40d2ea553afbe045349de0cea80de371bfd8
SSDEEP 384:+5nbejGyEJHyWdsJ5cgOalpPLdIbCI7vDiYBciM9aWAQWoMIA0GftpBj5EgERHR9:ynoGsWyDccjDW1fiqjVqibEBsoFRN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

ab:1a:0f:1e:ee:e2:af:e6:e1:39:80:00:86:1f:8c:2a:d2:c8:11:66:a9:87:31:80:8c:09:94:38:a5:9b:c8:e7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

2e:3b:83:dd:5d:ef:ac:86:3e:83:fd:39:08:a8:c7:82:d8:39:c2:6a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

19082

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Reflection.Primitives\4.0.0.0\System.Reflection.Primitives.pdb

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netcore50/System.Reflection.Primitives.xml

SHA256 2464b27022cb602cf359390a2463877fd65dc20f7c14a3b4406045259213e15d
MD5 6e4c6ee096f997fb18639c2836baf926
SHA1 526aa6b4de054ddf6a1de448dbcf143e5cfd84de
SHA512 c5d567ec72bacf473afc1990647c2498ee8673b15eefc60ef741128f945c7eed272fb52071eeb6d97ac7a29ce910218bb36e557356e00a716c648df301c9947f
SSDEEP 768:YJd5rdltujaahPbt/F2e+e9t0j931XQzQ7XrBf/ISDSzKXpIVtv8eCqACH3PmMbk:xNF7z6fxUKXSb1yv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netcore50/de/System.Reflection.Primitives.xml

SHA256 c4245c3a66bc0f84575dbea664079756350b0b7573327c0c3c0504d99315f82d
MD5 2414fd7a06d74760da8df536bc0cfe59
SHA1 5961de389c644978bc61eedfc52f6910ac3e0c51
SHA512 dd3b39842248bdca3b4a4c34a417084f00999fc9626816dadc7b0e0d35fdd7a85bfbd77a555bbd00d3735d6fde58d6500c2a815d0a6b738ba214fa14993fd1fa
SSDEEP 1536:rAVc0XZp9kSKXgXpLWTmyCi/0UypXNx1jRuKXjzZFBHNMw1645fBPWaum4To:rAVc8ZpKSKXgXATmyCi/0UypXNx1jRuQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netcore50/es/System.Reflection.Primitives.xml

SHA256 8186ea5d9dab755deeaf59268896cfccc0c94c05feb78706340eae86d15e4e08
MD5 ff3b426f39d7091fcc45e429a8e47d5d
SHA1 d8464732ec8cc6dbd43e277880f5af383dd15f8d
SHA512 227194ec0222cdfebb2b24d10585a23776fb046094efd78a478ddf722b39c0c094e9b5f4940fee0f64a9d4b99f31413c351d25f1fbdd480d942a563ca8ba547a
SSDEEP 768:YPd5skNBDmpwOSRSRByZYh0N4Uy4iuKadKDcGcKbDGDjn0/18adZi/i3dX1ACxt8:8d7mpwzOgyfPfUW8yjgVDT
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netcore50/fr/System.Reflection.Primitives.xml

SHA256 784795c313ad322aa1acb7e84523dfafe7025ca3499148584dff33a7cfbca949
MD5 550dc687ce6d99886903f129e825a78e
SHA1 d4e0fad05c59447653dfea56adba6687e643138d
SHA512 19685f154606f060cbdfc16268321772a158424500432c50e0d2af7d1047cfd32e37f66a1722b9e0e3e631b1a22fedc40b37d9e3d6049791a12b2ddedaa0bf50
SSDEEP 768:YPzbP8W7697jWeAskWavk5i53btzPX3SDdAXadjqxMNuM0wlbTuFKQhp2u7OQ1v0:CzbiWmk4dAFMs0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netcore50/it/System.Reflection.Primitives.xml

SHA256 4a34379e888a17aaaa37e54f76b19aee798c207fe8778d7babbe37ba187fe697
MD5 2ae10ac593da1ab3dfc44522bbacd1d6
SHA1 2fd95e718621cfec6603967dff37d2201499ef12
SHA512 4c35e44ce93841a2d171eeb4927730716db6ff5ecac2919a2301134206051f933746f221d9a08bfa723ee6e07f0bc843c25cc3c00cbeb4fc85d666589b1a9360
SSDEEP 768:YFu5gcOEqq7G9H5PD8O/NLBWMPqSxBlesKygZxVhP3JPMYbi96ObL:zrqZPIseP3JzObL
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netcore50/ja/System.Reflection.Primitives.xml

SHA256 7bc47cf34bcbb6c279cbca6e683797bbd9dccbb86563476f4f579372cb89e528
MD5 a7ec7598eaacbf2c058ed2a9e3204133
SHA1 9ff8bf49cae46665feeb665bc7f94dd697adb6c3
SHA512 8ed5ecd3cd51faf6f0fb2c47eb4f88deb7e2d544ee2935d8826774fafb189b8a3391207a04f0bbec787fd6735e92a7261daeaeff9fd7c0c72c0235f04d9830b2
SSDEEP 768:Y9c3BNqz0L213quXIdNOdoy6QMxXCLMbqrdfYIpU3a+c5XF1CzFQ:vj3ylqBbxEp+a+DQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netcore50/ko/System.Reflection.Primitives.xml

SHA256 044291e88a75f6b14e0f4d086eb74b53e01136abc82d049b3de60be0276eb4db
MD5 64010f243fb3c9444b0bfcd618d66ba9
SHA1 6798e5db80ab0422d54e663993dfa49ff4546a00
SHA512 039d506bc24f5fe285a66d9f5ecf532a00f73f4a811e449b3821774dd319510726bd6781a7a7e5147a880e15e6ac3bbfb2d9afff3d6485732edf0a6346bf04c4
SSDEEP 1536:8OZMqXOTDcHpcAKOOLtgZR7oA2YC34dtbw+l:8R3cHpcAKRLtKtjl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netcore50/ru/System.Reflection.Primitives.xml

SHA256 9289179b1907138dd7e036d072f108f61ec791aaeb12ddc5af1f5c8124d59eb1
MD5 8c1cb9a964ee3c01fcf1f68292c3ac39
SHA1 917ab5b6a760f2e33d389fa3cb0d2e3ddf07e5fb
SHA512 aabc7f84b32c91ec863d04ede67ee5be53fcd21c2c43b24daea969613d1cae1ab7f107b9f1e75c384788296efcbd294f752f4de804cadbf69e856e0cd596ae40
SSDEEP 3072:b4l0wXaqCX1k80EHUEfGVfdaMWZREDE3s:bKEHUEfGVfda4A3s
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netcore50/zh-hans/System.Reflection.Primitives.xml

SHA256 af53ed4ea91e915e628157581a950c582652b7615ffce5374abc2b668fba8d4a
MD5 bac8d94f080da5461cc147e164dd8fbf
SHA1 525237bb995fcb95370bc838b1e60007e6f65abb
SHA512 8c088937b11a47b1fd6d8d1b69c16f368dc37810e4e337749d4cebcb060c490a6a0c04200d45f18fa0012c0e5c1fb139fd4f3d702baa168be0f1a257c5bf6d64
SSDEEP 1536:tjZ9B9cGF1QK0sfvDKw3yTWjlhpQB1265pyUyYFhjFF7v/8e5gPNmCzW:BYFh0YCzW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netcore50/zh-hant/System.Reflection.Primitives.xml

SHA256 e4e42fa76359266f2052f564a43082572215b6e9ee6bfc76f1bfd88e69dfc693
MD5 e145465b2b0a86bde9175da34eb6d79f
SHA1 74abe7bb53a35c8a9c182e8c4122bf1ffd784eb2
SHA512 7567002c2c82f9faa9dc6aab4e4c5cb9212c9d2915904d6b0ca0993dac6e13153cdeb6836a94219fe49f70f5df923f76ad2df4f8b7675f779ea6f09341073a12
SSDEEP 768:Yf9Y8kwHPSqGUMjdhMn9FLJf4zHISYAA3zHPdTcEd3Pi4u9j4:waC6RQf/ndi4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netstandard1.0/System.Reflection.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4fdc3d955b9a257b595ea132186e987d3bb4adccd3e387eb09de594652bd7b7c
MD5 509ac1b5d59a0c4d1cf46d265d639cd3
SHA1 8d9e2c82a3d1798644385846fb56f168e28002de
SHA512 67779e11490d41f0c927a933607f91db776f1cdf9c37b553aed1d8b64b5e371889e0d8d0e931329e51079cb6b52f40d2ea553afbe045349de0cea80de371bfd8
SSDEEP 384:+5nbejGyEJHyWdsJ5cgOalpPLdIbCI7vDiYBciM9aWAQWoMIA0GftpBj5EgERHR9:ynoGsWyDccjDW1fiqjVqibEBsoFRN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

ab:1a:0f:1e:ee:e2:af:e6:e1:39:80:00:86:1f:8c:2a:d2:c8:11:66:a9:87:31:80:8c:09:94:38:a5:9b:c8:e7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

2e:3b:83:dd:5d:ef:ac:86:3e:83:fd:39:08:a8:c7:82:d8:39:c2:6a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

19082

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Reflection.Primitives\4.0.0.0\System.Reflection.Primitives.pdb

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netstandard1.0/System.Reflection.Primitives.xml

SHA256 2464b27022cb602cf359390a2463877fd65dc20f7c14a3b4406045259213e15d
MD5 6e4c6ee096f997fb18639c2836baf926
SHA1 526aa6b4de054ddf6a1de448dbcf143e5cfd84de
SHA512 c5d567ec72bacf473afc1990647c2498ee8673b15eefc60ef741128f945c7eed272fb52071eeb6d97ac7a29ce910218bb36e557356e00a716c648df301c9947f
SSDEEP 768:YJd5rdltujaahPbt/F2e+e9t0j931XQzQ7XrBf/ISDSzKXpIVtv8eCqACH3PmMbk:xNF7z6fxUKXSb1yv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netstandard1.0/de/System.Reflection.Primitives.xml

SHA256 c4245c3a66bc0f84575dbea664079756350b0b7573327c0c3c0504d99315f82d
MD5 2414fd7a06d74760da8df536bc0cfe59
SHA1 5961de389c644978bc61eedfc52f6910ac3e0c51
SHA512 dd3b39842248bdca3b4a4c34a417084f00999fc9626816dadc7b0e0d35fdd7a85bfbd77a555bbd00d3735d6fde58d6500c2a815d0a6b738ba214fa14993fd1fa
SSDEEP 1536:rAVc0XZp9kSKXgXpLWTmyCi/0UypXNx1jRuKXjzZFBHNMw1645fBPWaum4To:rAVc8ZpKSKXgXATmyCi/0UypXNx1jRuQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netstandard1.0/es/System.Reflection.Primitives.xml

SHA256 8186ea5d9dab755deeaf59268896cfccc0c94c05feb78706340eae86d15e4e08
MD5 ff3b426f39d7091fcc45e429a8e47d5d
SHA1 d8464732ec8cc6dbd43e277880f5af383dd15f8d
SHA512 227194ec0222cdfebb2b24d10585a23776fb046094efd78a478ddf722b39c0c094e9b5f4940fee0f64a9d4b99f31413c351d25f1fbdd480d942a563ca8ba547a
SSDEEP 768:YPd5skNBDmpwOSRSRByZYh0N4Uy4iuKadKDcGcKbDGDjn0/18adZi/i3dX1ACxt8:8d7mpwzOgyfPfUW8yjgVDT
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netstandard1.0/fr/System.Reflection.Primitives.xml

SHA256 784795c313ad322aa1acb7e84523dfafe7025ca3499148584dff33a7cfbca949
MD5 550dc687ce6d99886903f129e825a78e
SHA1 d4e0fad05c59447653dfea56adba6687e643138d
SHA512 19685f154606f060cbdfc16268321772a158424500432c50e0d2af7d1047cfd32e37f66a1722b9e0e3e631b1a22fedc40b37d9e3d6049791a12b2ddedaa0bf50
SSDEEP 768:YPzbP8W7697jWeAskWavk5i53btzPX3SDdAXadjqxMNuM0wlbTuFKQhp2u7OQ1v0:CzbiWmk4dAFMs0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netstandard1.0/it/System.Reflection.Primitives.xml

SHA256 4a34379e888a17aaaa37e54f76b19aee798c207fe8778d7babbe37ba187fe697
MD5 2ae10ac593da1ab3dfc44522bbacd1d6
SHA1 2fd95e718621cfec6603967dff37d2201499ef12
SHA512 4c35e44ce93841a2d171eeb4927730716db6ff5ecac2919a2301134206051f933746f221d9a08bfa723ee6e07f0bc843c25cc3c00cbeb4fc85d666589b1a9360
SSDEEP 768:YFu5gcOEqq7G9H5PD8O/NLBWMPqSxBlesKygZxVhP3JPMYbi96ObL:zrqZPIseP3JzObL
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netstandard1.0/ja/System.Reflection.Primitives.xml

SHA256 7bc47cf34bcbb6c279cbca6e683797bbd9dccbb86563476f4f579372cb89e528
MD5 a7ec7598eaacbf2c058ed2a9e3204133
SHA1 9ff8bf49cae46665feeb665bc7f94dd697adb6c3
SHA512 8ed5ecd3cd51faf6f0fb2c47eb4f88deb7e2d544ee2935d8826774fafb189b8a3391207a04f0bbec787fd6735e92a7261daeaeff9fd7c0c72c0235f04d9830b2
SSDEEP 768:Y9c3BNqz0L213quXIdNOdoy6QMxXCLMbqrdfYIpU3a+c5XF1CzFQ:vj3ylqBbxEp+a+DQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netstandard1.0/ko/System.Reflection.Primitives.xml

SHA256 044291e88a75f6b14e0f4d086eb74b53e01136abc82d049b3de60be0276eb4db
MD5 64010f243fb3c9444b0bfcd618d66ba9
SHA1 6798e5db80ab0422d54e663993dfa49ff4546a00
SHA512 039d506bc24f5fe285a66d9f5ecf532a00f73f4a811e449b3821774dd319510726bd6781a7a7e5147a880e15e6ac3bbfb2d9afff3d6485732edf0a6346bf04c4
SSDEEP 1536:8OZMqXOTDcHpcAKOOLtgZR7oA2YC34dtbw+l:8R3cHpcAKRLtKtjl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netstandard1.0/ru/System.Reflection.Primitives.xml

SHA256 9289179b1907138dd7e036d072f108f61ec791aaeb12ddc5af1f5c8124d59eb1
MD5 8c1cb9a964ee3c01fcf1f68292c3ac39
SHA1 917ab5b6a760f2e33d389fa3cb0d2e3ddf07e5fb
SHA512 aabc7f84b32c91ec863d04ede67ee5be53fcd21c2c43b24daea969613d1cae1ab7f107b9f1e75c384788296efcbd294f752f4de804cadbf69e856e0cd596ae40
SSDEEP 3072:b4l0wXaqCX1k80EHUEfGVfdaMWZREDE3s:bKEHUEfGVfda4A3s
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netstandard1.0/zh-hans/System.Reflection.Primitives.xml

SHA256 af53ed4ea91e915e628157581a950c582652b7615ffce5374abc2b668fba8d4a
MD5 bac8d94f080da5461cc147e164dd8fbf
SHA1 525237bb995fcb95370bc838b1e60007e6f65abb
SHA512 8c088937b11a47b1fd6d8d1b69c16f368dc37810e4e337749d4cebcb060c490a6a0c04200d45f18fa0012c0e5c1fb139fd4f3d702baa168be0f1a257c5bf6d64
SSDEEP 1536:tjZ9B9cGF1QK0sfvDKw3yTWjlhpQB1265pyUyYFhjFF7v/8e5gPNmCzW:BYFh0YCzW
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Reflection.Primitives.4.3.0/ref/netstandard1.0/zh-hant/System.Reflection.Primitives.xml

SHA256 e4e42fa76359266f2052f564a43082572215b6e9ee6bfc76f1bfd88e69dfc693
MD5 e145465b2b0a86bde9175da34eb6d79f
SHA1 74abe7bb53a35c8a9c182e8c4122bf1ffd784eb2
SHA512 7567002c2c82f9faa9dc6aab4e4c5cb9212c9d2915904d6b0ca0993dac6e13153cdeb6836a94219fe49f70f5df923f76ad2df4f8b7675f779ea6f09341073a12
SSDEEP 768:Yf9Y8kwHPSqGUMjdhMn9FLJf4zHISYAA3zHPdTcEd3Pi4u9j4:waC6RQf/ndi4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/.signature.p7s

SHA256 3dd0b72140ec8cf3efd65d2869097d0933e54adc4c700a9921ea616a3b1a53c3
MD5 d0acc8e2f0f69a7ce66d18962a44df38
SHA1 6e11d162a1838077b7a9bffc02cf024eccd6a103
SHA512 786fa498acd45a92e8996c47a7d56ad0799c35db31ee237e2319c123c3e4161d5839d41b4710e5c1514d68cf11447b9af1c0bb38293cc27ccc3957a15d9af119
SSDEEP 192:xdL7x0KDWpHhXZCVzV07Vro3Du9DH0JOqNG8Fp28Wh8niD:jxvDGGVpX3a9oJNNzFwhhiiD
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/System.Resources.ResourceManager.4.3.0.nupkg

SHA256 89d88e0fddf16dbadbc304a70f898e440f51622fc3fd4e3c79152c9ff5a7586a
MD5 76c34e21ab907c1931dbb9108514112f
SHA1 117f15b13fe85a25af2d8cdf854bd249b138b166
SHA512 9067db28f1c48d08fc52ad40a608f88c14ad9112646741ddaf426fdfe68bed61ab01954b179461e61d187371600c1e6e5c36c788993f5a105a64f5702a6b81d4
SSDEEP 1536:O7Px6voUvmXyi6rpp48hGsXVmJNdsXVmNXiZRW48hpNwbghQF7:O7Px6AIh7PhGuVmLduVm94WPhrwfx
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netcore50/System.Resources.ResourceManager.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cf4fb2e7e9e52bc46f40c3fa19ea18d976124afb543262e57ce8404e4b79de83
MD5 95d727cae951d29f648aeae5c3ec60dd
SHA1 1a6098cd616649b1528427ddfc17d64b3e5595e5
SHA512 7b4aad0caa91a78b1a4369d11ddaa40e6b05253b68cd11470b9ed048ebfc36d116cdf1ae8087e2c7295a6d66e438574496980fb59f36d03cf48358e2488bd016
SSDEEP 384:N28sDPiWctWR2MIA0GftpBj+UERHRN7/4lkoUEOh6:N28GA0dqiUUEBboFOM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

dd:8a:ea:dc:4c:c7:ea:f1:b7:51:bd:4f:fa:a8:99:38:0c:8a:a0:a5:cf:02:a5:53:a7:87:ca:2a:1f:61:d0:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

08:30:66:6c:5b:56:b7:2c:97:b3:1e:3f:dc:08:1f:ab:5f:6d:cc:8e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Resources.ResourceManager\4.0.0.0\System.Resources.ResourceManager.pdb

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netcore50/System.Resources.ResourceManager.xml

SHA256 04d421584fed77ae382058fbdbb20e6720e25b201f4b6f05426c8d8200e0e3f2
MD5 22778a49137c3a04483e6165afca3e51
SHA1 99f96fa6efac59fb409dc03342f7b4031531de80
SHA512 57f05393efae9b2d756e8e43e68c9052d47ca5a11cc9a053f797df63cbfc9a33a2ecb6189166fcad7ee6c92536c4bce1a2124018fe664ca0863ba5ea802ef7fc
SSDEEP 192:YaVJMaZzuSsENSMY13V6VMpQEVqVMuMjMqMmMe:YcJMjTMY13QVMpQEwVMuMjMqMmMe
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netcore50/de/System.Resources.ResourceManager.xml

SHA256 3fc6ffda3779b439c01734fd0f52477c65a8f61e447c20f79eb1f341ab3b5a15
MD5 ed3c9b91671574cf2e2064d6268bdf0b
SHA1 404211cb0dad3a77a2cf38c092a57d2b1fedf521
SHA512 95f941cb2180480c3d3d0030c91551c86642bf40592761a3803c0b89d676c374bb16d1f36f2e56d83eee8be2a9e0ee1762860eb5d043d9bbe5a4b66a58e4d767
SSDEEP 96:Y2yw/K1Xo0KOEoXooiAyS0w94tg6hA4LAYYBoafKKQgKfBy7s8ujNkLNpKQC7qUg:Y58DS0w2YJBoYRK5m2Wq81DL
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netcore50/es/System.Resources.ResourceManager.xml

SHA256 646ff358c065284a1d57b9007949b37ab36ada4ebd5420daa492312a22e80eb7
MD5 bf7fe9e4bd5b0eb5c5072e433694e416
SHA1 d33d23c839b16c1e97d317a615a07c8916c63038
SHA512 d7212680c27b9a838c5cfcce54c17434184e95d0188aac6a78e4d50fe5caebbd7d450d8f8cab29af7c16ca8c5d8c96a5d4f5e8049f74f4c7a50edc097f636343
SSDEEP 96:YnnKvh9RjAhRhitdB+98tv8KbpgQKbQKWME6QKdXCKbpgZgKoTQKWME6QKEwJG7r:YnCYR98tjcbQwQYXJeuQwQIG7r
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netcore50/fr/System.Resources.ResourceManager.xml

SHA256 7ed07a179fbe8af54b54b90c9fa71173d97863f40b89a00598eed368d055c50b
MD5 c2f62ffe3c48cc473ddd19b0f1ef6bcd
SHA1 86a5fc561462483f6b6734c947e9cc790e98e1af
SHA512 01dea46c06cf344567294b6fbd09c6694501925d49c8a237a926a8c2e611246d88cdeec07c84cc91ba289bf59e7666c73109721b1018b46b7b6fd6a426f77843
SSDEEP 192:Y3lfMhfzbIMoDeUA5G94VMde4bA7PMGy4VMd5ZMvMsM6Mp:Y39MhfzbIMMhA5oQMde6AYNQMd5ZMvMP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netcore50/it/System.Resources.ResourceManager.xml

SHA256 37229aaa06b7d2bfbafcd98d1793571eb89fe4b1142ba8aed3a25e02ee27a3a1
MD5 be598676ad2451ae86053967ca717575
SHA1 564eaa39dccd2a1f08ed97e5f5e553fa168256ab
SHA512 30ef2a0313f79dca632c14db7cafeaf79da3fc998554df8e849072c364fa5496cfc3d4f52a84902be065ec1469f5b144481f0c967f0f8361c433807931568682
SSDEEP 192:Y1XMVSe/vvLBZbZqdFMJVGM3TPMuSTE8TPMuSMjMJWMuMP:Y1XMoe/LHbZqdFMJVGM3TPMuSTE8TPMj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netcore50/ja/System.Resources.ResourceManager.xml

SHA256 003d47fcff6b70e1620ed9d6de7c23d68b898e429bf635311f90c45ee3d80a70
MD5 be2c9b8da3c911a4c06a0b85936a31c3
SHA1 f09839ec989c3530925a1b3d67cb79bc088da758
SHA512 7a6be21f3338aedd4ed70bb5f8296d46725ef2e8a73f0442ee41d6d5bc0b61c5ee2373f5cb77ab7fc12528912087dd0b26c417c78982999eaec3345c8d932e55
SSDEEP 96:Y8ziuxzTrK7IBPP1GB/1LbKkGBKDBEcKkG+KDBw:Y8zSIBP9GB/xuwi7pG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netcore50/ko/System.Resources.ResourceManager.xml

SHA256 73e3506c18f4f622a9ccd3ce55c0a098b90095f8b7bb42e6577ca084054c25da
MD5 7dad66bd332232f2ce93448e70e01e15
SHA1 2985bf685a4fb9609805b6e9fbad51c3eaf0f5a1
SHA512 40a07626947389ceb719d728bf20148d586c8d3b60646e76d2332fd8159f9a516c474e05cd3c8fd2ad399ac082f38b7ae814a67b3f7be34156fbad2408fb9812
SSDEEP 96:YXGvHI/XnpEnIw3bO4Cs2M6AKIKKEKNKf5hNuFJKIKKVnKNKf5hNZe7:YXGQ+bO4VGtofFYYKce7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netcore50/ru/System.Resources.ResourceManager.xml

SHA256 ada1b5b0afc78eb9e72d2d42306f4dc4f147567ffc680ec88bf51609f7d16317
MD5 252577753eb6c14caa78e1a224765f0b
SHA1 42751d20abb67d1d80b353013f4976a4fb40e038
SHA512 624959e596c47949164e4e1db1ffcdbcfa7d236bcef8109c2f0a9086ab2a3d9332fa3cc87051ea786cefed9efba91c1047addb4a130906e0506b851c1dcc8d32
SSDEEP 96:YX6T8E8/1qAZX1rLn/9/ma1mqMENvVtVK0zKsjCA2C9ZB/FdK0843KsjCA2C9ZBb:YXH9qAZX1l/maFvcVKCyOq6KC8gM1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netcore50/zh-hans/System.Resources.ResourceManager.xml

SHA256 7db99428c912b38dbf2df5513b1b657f1bee2227a4222f641f6b24ff4b701a19
MD5 33ea0c4608a202464e27b8c79e487083
SHA1 49ac1acd2b6b00145778c4345b513f69e541e413
SHA512 67551aaacb82b801230b9b8329a623a18ec1d1c857f4747e6ea93b9c948f50809cb370f93e688a6f381ee106c52505305865b9b125217ba42e5e3a987b7a360e
SSDEEP 96:YZ5EU69z5HTMwlFAHHI0FHKrHKcemhvfemh2WKrLKcemhvfemh4sFRbb:YZk5zwnZqrqIt7wNr+It7usFRbb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netcore50/zh-hant/System.Resources.ResourceManager.xml

SHA256 cedf0e4ff61f6f5948c1a0efbfeae526a49abd75ec73cb8ef58e6ecbf97cc7d5
MD5 4b86b679edd19bd222fb6a6554ab5e53
SHA1 fb4183c3d392affda7a3850daec2f96c1bb4b299
SHA512 7c7624bc7f934ff4d04ed6e39ca7d700f0680cb492d7344cd99541f8cbe971c42b2a6e966f28916a498cee94b56cf0083951ec2520c794233f7fee2038f4d745
SSDEEP 192:YQg1sMJ/P3swHrY0UNfUN5mySUNfUNDX0Rb:YIM1swHriCTmybC0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netstandard1.0/System.Resources.ResourceManager.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cf4fb2e7e9e52bc46f40c3fa19ea18d976124afb543262e57ce8404e4b79de83
MD5 95d727cae951d29f648aeae5c3ec60dd
SHA1 1a6098cd616649b1528427ddfc17d64b3e5595e5
SHA512 7b4aad0caa91a78b1a4369d11ddaa40e6b05253b68cd11470b9ed048ebfc36d116cdf1ae8087e2c7295a6d66e438574496980fb59f36d03cf48358e2488bd016
SSDEEP 384:N28sDPiWctWR2MIA0GftpBj+UERHRN7/4lkoUEOh6:N28GA0dqiUUEBboFOM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

dd:8a:ea:dc:4c:c7:ea:f1:b7:51:bd:4f:fa:a8:99:38:0c:8a:a0:a5:cf:02:a5:53:a7:87:ca:2a:1f:61:d0:70

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

08:30:66:6c:5b:56:b7:2c:97:b3:1e:3f:dc:08:1f:ab:5f:6d:cc:8e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Resources.ResourceManager\4.0.0.0\System.Resources.ResourceManager.pdb

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netstandard1.0/System.Resources.ResourceManager.xml

SHA256 04d421584fed77ae382058fbdbb20e6720e25b201f4b6f05426c8d8200e0e3f2
MD5 22778a49137c3a04483e6165afca3e51
SHA1 99f96fa6efac59fb409dc03342f7b4031531de80
SHA512 57f05393efae9b2d756e8e43e68c9052d47ca5a11cc9a053f797df63cbfc9a33a2ecb6189166fcad7ee6c92536c4bce1a2124018fe664ca0863ba5ea802ef7fc
SSDEEP 192:YaVJMaZzuSsENSMY13V6VMpQEVqVMuMjMqMmMe:YcJMjTMY13QVMpQEwVMuMjMqMmMe
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netstandard1.0/de/System.Resources.ResourceManager.xml

SHA256 3fc6ffda3779b439c01734fd0f52477c65a8f61e447c20f79eb1f341ab3b5a15
MD5 ed3c9b91671574cf2e2064d6268bdf0b
SHA1 404211cb0dad3a77a2cf38c092a57d2b1fedf521
SHA512 95f941cb2180480c3d3d0030c91551c86642bf40592761a3803c0b89d676c374bb16d1f36f2e56d83eee8be2a9e0ee1762860eb5d043d9bbe5a4b66a58e4d767
SSDEEP 96:Y2yw/K1Xo0KOEoXooiAyS0w94tg6hA4LAYYBoafKKQgKfBy7s8ujNkLNpKQC7qUg:Y58DS0w2YJBoYRK5m2Wq81DL
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netstandard1.0/es/System.Resources.ResourceManager.xml

SHA256 646ff358c065284a1d57b9007949b37ab36ada4ebd5420daa492312a22e80eb7
MD5 bf7fe9e4bd5b0eb5c5072e433694e416
SHA1 d33d23c839b16c1e97d317a615a07c8916c63038
SHA512 d7212680c27b9a838c5cfcce54c17434184e95d0188aac6a78e4d50fe5caebbd7d450d8f8cab29af7c16ca8c5d8c96a5d4f5e8049f74f4c7a50edc097f636343
SSDEEP 96:YnnKvh9RjAhRhitdB+98tv8KbpgQKbQKWME6QKdXCKbpgZgKoTQKWME6QKEwJG7r:YnCYR98tjcbQwQYXJeuQwQIG7r
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netstandard1.0/fr/System.Resources.ResourceManager.xml

SHA256 7ed07a179fbe8af54b54b90c9fa71173d97863f40b89a00598eed368d055c50b
MD5 c2f62ffe3c48cc473ddd19b0f1ef6bcd
SHA1 86a5fc561462483f6b6734c947e9cc790e98e1af
SHA512 01dea46c06cf344567294b6fbd09c6694501925d49c8a237a926a8c2e611246d88cdeec07c84cc91ba289bf59e7666c73109721b1018b46b7b6fd6a426f77843
SSDEEP 192:Y3lfMhfzbIMoDeUA5G94VMde4bA7PMGy4VMd5ZMvMsM6Mp:Y39MhfzbIMMhA5oQMde6AYNQMd5ZMvMP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netstandard1.0/it/System.Resources.ResourceManager.xml

SHA256 37229aaa06b7d2bfbafcd98d1793571eb89fe4b1142ba8aed3a25e02ee27a3a1
MD5 be598676ad2451ae86053967ca717575
SHA1 564eaa39dccd2a1f08ed97e5f5e553fa168256ab
SHA512 30ef2a0313f79dca632c14db7cafeaf79da3fc998554df8e849072c364fa5496cfc3d4f52a84902be065ec1469f5b144481f0c967f0f8361c433807931568682
SSDEEP 192:Y1XMVSe/vvLBZbZqdFMJVGM3TPMuSTE8TPMuSMjMJWMuMP:Y1XMoe/LHbZqdFMJVGM3TPMuSTE8TPMj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netstandard1.0/ja/System.Resources.ResourceManager.xml

SHA256 003d47fcff6b70e1620ed9d6de7c23d68b898e429bf635311f90c45ee3d80a70
MD5 be2c9b8da3c911a4c06a0b85936a31c3
SHA1 f09839ec989c3530925a1b3d67cb79bc088da758
SHA512 7a6be21f3338aedd4ed70bb5f8296d46725ef2e8a73f0442ee41d6d5bc0b61c5ee2373f5cb77ab7fc12528912087dd0b26c417c78982999eaec3345c8d932e55
SSDEEP 96:Y8ziuxzTrK7IBPP1GB/1LbKkGBKDBEcKkG+KDBw:Y8zSIBP9GB/xuwi7pG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netstandard1.0/ko/System.Resources.ResourceManager.xml

SHA256 73e3506c18f4f622a9ccd3ce55c0a098b90095f8b7bb42e6577ca084054c25da
MD5 7dad66bd332232f2ce93448e70e01e15
SHA1 2985bf685a4fb9609805b6e9fbad51c3eaf0f5a1
SHA512 40a07626947389ceb719d728bf20148d586c8d3b60646e76d2332fd8159f9a516c474e05cd3c8fd2ad399ac082f38b7ae814a67b3f7be34156fbad2408fb9812
SSDEEP 96:YXGvHI/XnpEnIw3bO4Cs2M6AKIKKEKNKf5hNuFJKIKKVnKNKf5hNZe7:YXGQ+bO4VGtofFYYKce7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netstandard1.0/ru/System.Resources.ResourceManager.xml

SHA256 ada1b5b0afc78eb9e72d2d42306f4dc4f147567ffc680ec88bf51609f7d16317
MD5 252577753eb6c14caa78e1a224765f0b
SHA1 42751d20abb67d1d80b353013f4976a4fb40e038
SHA512 624959e596c47949164e4e1db1ffcdbcfa7d236bcef8109c2f0a9086ab2a3d9332fa3cc87051ea786cefed9efba91c1047addb4a130906e0506b851c1dcc8d32
SSDEEP 96:YX6T8E8/1qAZX1rLn/9/ma1mqMENvVtVK0zKsjCA2C9ZB/FdK0843KsjCA2C9ZBb:YXH9qAZX1l/maFvcVKCyOq6KC8gM1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netstandard1.0/zh-hans/System.Resources.ResourceManager.xml

SHA256 7db99428c912b38dbf2df5513b1b657f1bee2227a4222f641f6b24ff4b701a19
MD5 33ea0c4608a202464e27b8c79e487083
SHA1 49ac1acd2b6b00145778c4345b513f69e541e413
SHA512 67551aaacb82b801230b9b8329a623a18ec1d1c857f4747e6ea93b9c948f50809cb370f93e688a6f381ee106c52505305865b9b125217ba42e5e3a987b7a360e
SSDEEP 96:YZ5EU69z5HTMwlFAHHI0FHKrHKcemhvfemh2WKrLKcemhvfemh4sFRbb:YZk5zwnZqrqIt7wNr+It7usFRbb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Resources.ResourceManager.4.3.0/ref/netstandard1.0/zh-hant/System.Resources.ResourceManager.xml

SHA256 cedf0e4ff61f6f5948c1a0efbfeae526a49abd75ec73cb8ef58e6ecbf97cc7d5
MD5 4b86b679edd19bd222fb6a6554ab5e53
SHA1 fb4183c3d392affda7a3850daec2f96c1bb4b299
SHA512 7c7624bc7f934ff4d04ed6e39ca7d700f0680cb492d7344cd99541f8cbe971c42b2a6e966f28916a498cee94b56cf0083951ec2520c794233f7fee2038f4d745
SSDEEP 192:YQg1sMJ/P3swHrY0UNfUN5mySUNfUNDX0Rb:YIM1swHriCTmybC0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/.signature.p7s

SHA256 caf942e86e73ad718cf85e46afa13204fb8e612a6e2fcd589ce23a51c8483618
MD5 95ed01bc1c23d865b23b5aa1bd3291cb
SHA1 ed795e852d8e63b613cb6427bee52c87e1e19bef
SHA512 3fab6fef74bccd799438516f8269626d8143ca9cd4a71107ce4a7251cb8ebf74c64598890347bb3388f2d941c967182dd559ec5686e56673edff7b26b113778c
SSDEEP 192:xd/7x0KDWpHhXZCVzV07Vr/j9DH0JOqNG8Fp28Wh8nXw:jdvDGGVpcj9oJNNzFwhhiA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/System.Runtime.4.3.0.nupkg

SHA256 e75f35dd65e9048b2e03a7d4b44e57691423716750dbf966128909b7deeed118
MD5 2937ce8ee54b2ad07634a226c815a067
SHA1 8e048aa5ce6894434f7399e3aabe966a633cd605
SHA512 92ab2249f08073cfafdc4cfbd7db36d651ad871b8d8ba961006982187de374bf4a30af93f15f73b05af343f7a70cbd484b04d646570587636ae72171eb0714fb
SSDEEP 98304:B+fX//fFFI+Om/w8joA+Hd/t3JaA+II/2mD1l+Gm/w396x:IfXLOz3HviIfNGTs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/lib/net462/System.Runtime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c2a12ce9d69e99bf227ac7c5e14fd5176a5be9131c68f684fd74d11759458ccc
MD5 1d1c54a689038757714be74074c7e12d
SHA1 7e549944512de844b49aad4b9d4a9547c06ede37
SHA512 b5cf0945de1abbeb343b6fe3bb66a6b6c1ccd8fa54dce5b494ecd92ee4778b9236581948ac89b338d5a625380e44bb0e015190bccd0f075c904a8da9d3ec130f
SSDEEP 384:mYKcexuZtMWC6g/e4PW6XWzWVXWJ80aq0GftpBjs2TERHRN7clO6arh9:nKTcIFJixTEBpX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

37:61:86:21:b5:eb:3f:26:6a:88:50:19:23:32:74:d9:49:5e:26:b6:98:01:00:d0:87:20:7b:d8:95:aa:80:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

81:86:28:ad:a8:9f:3f:a9:51:8d:82:af:dd:e6:53:a9:b5:8e:78:9d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

18362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Runtime/net462\System.Runtime.pdb

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/net462/System.Runtime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c2a12ce9d69e99bf227ac7c5e14fd5176a5be9131c68f684fd74d11759458ccc
MD5 1d1c54a689038757714be74074c7e12d
SHA1 7e549944512de844b49aad4b9d4a9547c06ede37
SHA512 b5cf0945de1abbeb343b6fe3bb66a6b6c1ccd8fa54dce5b494ecd92ee4778b9236581948ac89b338d5a625380e44bb0e015190bccd0f075c904a8da9d3ec130f
SSDEEP 384:mYKcexuZtMWC6g/e4PW6XWzWVXWJ80aq0GftpBjs2TERHRN7clO6arh9:nKTcIFJixTEBpX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

37:61:86:21:b5:eb:3f:26:6a:88:50:19:23:32:74:d9:49:5e:26:b6:98:01:00:d0:87:20:7b:d8:95:aa:80:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

81:86:28:ad:a8:9f:3f:a9:51:8d:82:af:dd:e6:53:a9:b5:8e:78:9d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

18362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Runtime/net462\System.Runtime.pdb

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netcore50/System.Runtime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bc848e3bf9523240c1053a35939ea203f356593ea063f01d5f7b4dfe71b8f011
MD5 dffdb4981584dbb79574c3856bd2ca47
SHA1 618e5a1bb17eca003bbedf6895bebe825112b0ec
SHA512 14bdc531c6553eb684aab71c23755dc81a243325e5a04f11547c03f9e5f81188abc06a1e632121e21b0d332261ee45bea2ccca49d5e783fa3a0582c62cd05a7e
SSDEEP 1536:nHKXL6Gskm7omyxVvVbA9gCgSRnZJBivbvDw0Dyi3pB25bzmhYqG:nHK76GskDA9gCgwZJBeXy8pB25bzkYq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

bf:03:a0:ff:bc:cd:c0:7c:a9:d4:3b:44:02:07:b8:4d:e0:e4:ed:66:a6:9d:92:0c:4e:04:39:58:b7:93:0f:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a5:f6:92:e6:27:ac:38:c6:f1:bd:44:01:37:fc:c2:e2:13:96:44:a1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

116474

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Runtime\4.0.20.0\System.Runtime.pdb

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netcore50/System.Runtime.xml

SHA256 3ec029ac16594883af331eded34eb8621a36a58e419deb08f9311353356f009b
MD5 851e272b3e64dc1d2a7e7752761a340f
SHA1 c3324dde6345c0f43394d5bc54495d76746ed1f3
SHA512 fe59d260ee696a191821b66d1dec9a7e5061180eb3e76f8bea21e29b2ef2408889472cf819f94f26865d63ab46f21ec591a7b416f324ea21b380a574f8129c1e
SSDEEP 6144:7ENVLjFHaKe4RdYtB5GJvLZp5FVkTVZpS9CgK8ikE4RhwAeJ:D4Rd8BykTVZM9CgKcRhq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netcore50/de/System.Runtime.xml

SHA256 0c89ecd20d32f44b3fe5004248138d8405a9d6a732aed95d132e039a25fb90e7
MD5 4f3010ed096981fb0742767567eb9ff0
SHA1 efbaa214e71514f6cac6bd4c74c8ab90f2f07641
SHA512 7f55032a46c4fd8f85db2ba6bc034c73aeac5b2ab6e12abda5dbe4e64e2dc3933da486347e7e9b59ab0a11461f73f9d2c14a11ea4fc9bdf7b021ffdc8933917f
SSDEEP 24576:26wvksjmvGPsyBKq2sE5jeFf8dWtcKFxLzeGiEV0TdZnePiWyk4ufCL6SAGJc+Tq:AtcKvj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netcore50/es/System.Runtime.xml

SHA256 27e644696b0824912daf4d0a7c4a922813081b19749277cfd3a1ae9044458c28
MD5 f063f74ca6d4bc6a0fb2fa1e6e106b9e
SHA1 ee7db0b401c742be5480deafba5c089204979924
SHA512 25cb775d383c9548785bc7f6224eb617199678b2c48ada25e1d2a14020a551b8575880f94f567d9cf0a02095a517f8b9d77b7662b44516e05aa08b06aeecadaa
SSDEEP 6144:u6c8At5vbReofGV/hWPIwTMc1Wc1aiVQmiVQDTyfTk+x6k4a0NJX+IMWupNF2HNV:7WPIwT7+IMWupNF2e0Bw1e
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netcore50/fr/System.Runtime.xml

SHA256 3224e0a2a1251f8a09ac9eaf3754d9b8570af569c2e47d9fc119104b534dd81a
MD5 d069eda8bc4373dc8ee548668057a3a0
SHA1 d8e80672f23387276d19773f55ff342dc49c2b67
SHA512 56b0a3f3d790318d59d40221b365fb3f73b8a5bce6a74091fff2225c14e77487c815eede31843543e9dfee5cdf6524ed919b1fdc564ffad419859b59119db5c6
SSDEEP 6144:ea1UaFIw7k4ZJEJSiuOnEo1mhY8DrKXCtxNr4S5ElTWuZoDYoDWMLiaM+XPs/9GX:rk4ZJEJSr7lPElTWuZ6YoKRobRT
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netcore50/it/System.Runtime.xml

SHA256 225ca47c2669570b56f08b5088921467717e3911b5cfb1ed82acd8ef685d425b
MD5 3dd536d84d206a0fde929652869b0579
SHA1 b65fbdba0a0ca19e8c99c894b59f35b935a48bfc
SHA512 26f8b39da3b5e3ce38c7efa79c0937a50e33d5fc75064efedf6182ea46283fa262b47b35b8d326f8f97b30d925da9287b0d1ae69a8e9397a887a45cd1d628920
SSDEEP 6144:uo04TylCPqmwqTFfqrMqGnq7yq7Rtq77q71mUeomUcIifajuQsQfDMlChGINUss3:mjUUYjuvQjxSTVh/+G4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netcore50/ja/System.Runtime.xml

SHA256 5744024221fba38e841e3e96b6d4931d42856ce7b3cd6373628546f96d3653d8
MD5 f1eed567bfaf6f135ed3a495cf946fc4
SHA1 8c064d8cd337db2fefc58d592209ce2f9850ca59
SHA512 8bd1917fdb4a4c939ea657e9a45e84bc67d1fd1294c03014dfc8a1b834be60b5f70662e44b663b3a239dd9584ce612ac32a1678d8ceca389bc8ba30c11366756
SSDEEP 24576:CAR7yzBuKRBNaN7JY3x4vAix6M0wBH3RM9u6jFw:qw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netcore50/ko/System.Runtime.xml

SHA256 06ec22dbafcb5935eda03702ab1b14b71333afabca662326c6dcf7a2dd244b67
MD5 4b26cd1a4c1ed5d778bd518bc2a267aa
SHA1 e7d2f8585a138bd6d6bbc3f804f84343900ade1f
SHA512 27df1cf0d155ede758a86ac202cb2969cfa5ed8064beab577ba3ef90d5580d20a6649d8081963d195208c3338cab038d22168e2341425214b3c0674200560fb4
SSDEEP 12288:egCFitdg7Ml6sAOj1ypG3cJVsB7JyD9JFfniWpotwMdOeMPiUGOSh5/X88BIBHb0:D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netcore50/ru/System.Runtime.xml

SHA256 d7fa06ca7f0fe1d8292e53f1b4dbab8f693490da6305e1327357a16939d2b004
MD5 1cd27629364842292d9a69cf3810807d
SHA1 3591aa6e64f45098bed83e871e7fd162301eb76f
SHA512 7e420f31b61ee73a6615a365f7f0133a5530e4fdefed251694cf5a6589f5ba391df63249be82aaab32599f4958ef56cdd2c83de83bbeb0bf38d0ae30dd55bf95
SSDEEP 12288:4Pw9V3tT2GlVpDTQgOQsDCpk3nMUqiCRH3zwslpOytLIiV0IioIoTkGCWPUvWwBx:o
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netcore50/zh-hans/System.Runtime.xml

SHA256 bb3f5b6f7d9c4dc389c4d7e1171779b8ce554b09001fd2f0e21af7a56e122a4f
MD5 c52c9ed367bbfa02a5699b7f5458e2e8
SHA1 c103f94125140990bae19bc285b183bc39bc3851
SHA512 18e18f1ca8c2e29b18a539ccfb340c356a9d1fa8ef18daa83c77ee36ef21cdea9f0e382b26db0a4aefeb00bbc2f141c9d9daee8eab470b376745bd0b76780e64
SSDEEP 12288:Smj2HoRBKo6AEbQF5pHKOmz9RkB2dFOyqH2X+29uSAytbfYBhYl6WeZ5NCLwT:pRBKIm627ZATCLg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netcore50/zh-hant/System.Runtime.xml

SHA256 14f420f536a5b0b592bedae238e50abbcc655bee549e034ed47b6106a86c0a80
MD5 a7eb78c9523b31d21f44fe116b62f41a
SHA1 4ee3473b56137b3a528c96e2b765b579d5e1bf3d
SHA512 526aa200d22729c714e3463de256c841bdec9a6bb26c7105473652565fb9ce02453eb9075e6dff60e3ff0e0e89488799eaafc04cf1146e50566ed4ee60d50788
SSDEEP 12288:H+djUdB4mVqanPN3QwwyR0a15Y1RNHd+CMBSMLl0AR2Alb:h3QvNHg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.0/System.Runtime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4cdc297f2bdc20a76e7c97b302fbabcce3b348ba01eb098ffdb0268c4e330024
MD5 fc701d7f8e0c81ab5737ff529f39470f
SHA1 797433e20b7fce47a82bff82d55c9625634e8de9
SHA512 bf22dc737404ffec9723593acceb514a3462970877f5d3fe6797583a09dc8d0c58fb4e66f967425a09fad40c96822d29a83ce02e1ac2fee478618b60e803919a
SSDEEP 1536:22GEil92AgWTGTbSQ7d/H+EnHInhN/VDp9nKgoQqsPDlBA:22T+CTbSQ7d/H+EnSN/VDpNo7sRBA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

cf:59:91:01:f0:26:61:f1:9e:83:a6:c7:82:56:65:4b:2f:11:18:7d:be:ff:fe:5d:44:ca:95:be:e1:0a:3b:c3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

c1:06:5f:1f:e2:fc:7c:1f:86:d4:7e:52:99:7e:1f:82:9e:cb:68:74

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

105534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.0/System.Runtime.xml

SHA256 3ec029ac16594883af331eded34eb8621a36a58e419deb08f9311353356f009b
MD5 851e272b3e64dc1d2a7e7752761a340f
SHA1 c3324dde6345c0f43394d5bc54495d76746ed1f3
SHA512 fe59d260ee696a191821b66d1dec9a7e5061180eb3e76f8bea21e29b2ef2408889472cf819f94f26865d63ab46f21ec591a7b416f324ea21b380a574f8129c1e
SSDEEP 6144:7ENVLjFHaKe4RdYtB5GJvLZp5FVkTVZpS9CgK8ikE4RhwAeJ:D4Rd8BykTVZM9CgKcRhq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.0/de/System.Runtime.xml

SHA256 0c89ecd20d32f44b3fe5004248138d8405a9d6a732aed95d132e039a25fb90e7
MD5 4f3010ed096981fb0742767567eb9ff0
SHA1 efbaa214e71514f6cac6bd4c74c8ab90f2f07641
SHA512 7f55032a46c4fd8f85db2ba6bc034c73aeac5b2ab6e12abda5dbe4e64e2dc3933da486347e7e9b59ab0a11461f73f9d2c14a11ea4fc9bdf7b021ffdc8933917f
SSDEEP 24576:26wvksjmvGPsyBKq2sE5jeFf8dWtcKFxLzeGiEV0TdZnePiWyk4ufCL6SAGJc+Tq:AtcKvj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.0/es/System.Runtime.xml

SHA256 27e644696b0824912daf4d0a7c4a922813081b19749277cfd3a1ae9044458c28
MD5 f063f74ca6d4bc6a0fb2fa1e6e106b9e
SHA1 ee7db0b401c742be5480deafba5c089204979924
SHA512 25cb775d383c9548785bc7f6224eb617199678b2c48ada25e1d2a14020a551b8575880f94f567d9cf0a02095a517f8b9d77b7662b44516e05aa08b06aeecadaa
SSDEEP 6144:u6c8At5vbReofGV/hWPIwTMc1Wc1aiVQmiVQDTyfTk+x6k4a0NJX+IMWupNF2HNV:7WPIwT7+IMWupNF2e0Bw1e
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.0/fr/System.Runtime.xml

SHA256 3224e0a2a1251f8a09ac9eaf3754d9b8570af569c2e47d9fc119104b534dd81a
MD5 d069eda8bc4373dc8ee548668057a3a0
SHA1 d8e80672f23387276d19773f55ff342dc49c2b67
SHA512 56b0a3f3d790318d59d40221b365fb3f73b8a5bce6a74091fff2225c14e77487c815eede31843543e9dfee5cdf6524ed919b1fdc564ffad419859b59119db5c6
SSDEEP 6144:ea1UaFIw7k4ZJEJSiuOnEo1mhY8DrKXCtxNr4S5ElTWuZoDYoDWMLiaM+XPs/9GX:rk4ZJEJSr7lPElTWuZ6YoKRobRT
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.0/it/System.Runtime.xml

SHA256 225ca47c2669570b56f08b5088921467717e3911b5cfb1ed82acd8ef685d425b
MD5 3dd536d84d206a0fde929652869b0579
SHA1 b65fbdba0a0ca19e8c99c894b59f35b935a48bfc
SHA512 26f8b39da3b5e3ce38c7efa79c0937a50e33d5fc75064efedf6182ea46283fa262b47b35b8d326f8f97b30d925da9287b0d1ae69a8e9397a887a45cd1d628920
SSDEEP 6144:uo04TylCPqmwqTFfqrMqGnq7yq7Rtq77q71mUeomUcIifajuQsQfDMlChGINUss3:mjUUYjuvQjxSTVh/+G4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.0/ja/System.Runtime.xml

SHA256 5744024221fba38e841e3e96b6d4931d42856ce7b3cd6373628546f96d3653d8
MD5 f1eed567bfaf6f135ed3a495cf946fc4
SHA1 8c064d8cd337db2fefc58d592209ce2f9850ca59
SHA512 8bd1917fdb4a4c939ea657e9a45e84bc67d1fd1294c03014dfc8a1b834be60b5f70662e44b663b3a239dd9584ce612ac32a1678d8ceca389bc8ba30c11366756
SSDEEP 24576:CAR7yzBuKRBNaN7JY3x4vAix6M0wBH3RM9u6jFw:qw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.0/ko/System.Runtime.xml

SHA256 06ec22dbafcb5935eda03702ab1b14b71333afabca662326c6dcf7a2dd244b67
MD5 4b26cd1a4c1ed5d778bd518bc2a267aa
SHA1 e7d2f8585a138bd6d6bbc3f804f84343900ade1f
SHA512 27df1cf0d155ede758a86ac202cb2969cfa5ed8064beab577ba3ef90d5580d20a6649d8081963d195208c3338cab038d22168e2341425214b3c0674200560fb4
SSDEEP 12288:egCFitdg7Ml6sAOj1ypG3cJVsB7JyD9JFfniWpotwMdOeMPiUGOSh5/X88BIBHb0:D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.0/ru/System.Runtime.xml

SHA256 d7fa06ca7f0fe1d8292e53f1b4dbab8f693490da6305e1327357a16939d2b004
MD5 1cd27629364842292d9a69cf3810807d
SHA1 3591aa6e64f45098bed83e871e7fd162301eb76f
SHA512 7e420f31b61ee73a6615a365f7f0133a5530e4fdefed251694cf5a6589f5ba391df63249be82aaab32599f4958ef56cdd2c83de83bbeb0bf38d0ae30dd55bf95
SSDEEP 12288:4Pw9V3tT2GlVpDTQgOQsDCpk3nMUqiCRH3zwslpOytLIiV0IioIoTkGCWPUvWwBx:o
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.0/zh-hans/System.Runtime.xml

SHA256 bb3f5b6f7d9c4dc389c4d7e1171779b8ce554b09001fd2f0e21af7a56e122a4f
MD5 c52c9ed367bbfa02a5699b7f5458e2e8
SHA1 c103f94125140990bae19bc285b183bc39bc3851
SHA512 18e18f1ca8c2e29b18a539ccfb340c356a9d1fa8ef18daa83c77ee36ef21cdea9f0e382b26db0a4aefeb00bbc2f141c9d9daee8eab470b376745bd0b76780e64
SSDEEP 12288:Smj2HoRBKo6AEbQF5pHKOmz9RkB2dFOyqH2X+29uSAytbfYBhYl6WeZ5NCLwT:pRBKIm627ZATCLg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.0/zh-hant/System.Runtime.xml

SHA256 14f420f536a5b0b592bedae238e50abbcc655bee549e034ed47b6106a86c0a80
MD5 a7eb78c9523b31d21f44fe116b62f41a
SHA1 4ee3473b56137b3a528c96e2b765b579d5e1bf3d
SHA512 526aa200d22729c714e3463de256c841bdec9a6bb26c7105473652565fb9ce02453eb9075e6dff60e3ff0e0e89488799eaafc04cf1146e50566ed4ee60d50788
SSDEEP 12288:H+djUdB4mVqanPN3QwwyR0a15Y1RNHd+CMBSMLl0AR2Alb:h3QvNHg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.2/System.Runtime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 10df127b62335573275ae240a159e14f67b148d597e4b7ee99ead35c2bf51ec5
MD5 88bd731d55f075e3eb89d72b75f8b66a
SHA1 b97e9e63aeccef1caf9ce11b96a87a2a01739fbb
SHA512 976da31258a925115a766bccd21a38b9135dba057d101ec6ea52a4cccc590f6c55e8df88c21a50bc571e91e39b7eac4c0dccbebcc4f40b3e9dbd2c007d45d2b3
SSDEEP 1536:Wffken1Be6/kf7vjBWiVfCvrx2Yv6Z4nueBHtATDp9nKt48b+8VcxS:Wh/qtqF0ENATDpN38b+8mxS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

df:cf:db:00:f9:2e:d0:98:fe:7c:df:92:b5:1a:06:2e:29:f0:e1:94:ac:1f:85:62:df:e1:41:85:95:b9:74:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8f:a8:71:55:7f:a5:da:b4:9b:aa:e4:f1:3c:2f:18:5d:2a:4e:59:94

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 3, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 7, 2012 - Oct 7, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

125550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.2/System.Runtime.xml

SHA256 3ec029ac16594883af331eded34eb8621a36a58e419deb08f9311353356f009b
MD5 851e272b3e64dc1d2a7e7752761a340f
SHA1 c3324dde6345c0f43394d5bc54495d76746ed1f3
SHA512 fe59d260ee696a191821b66d1dec9a7e5061180eb3e76f8bea21e29b2ef2408889472cf819f94f26865d63ab46f21ec591a7b416f324ea21b380a574f8129c1e
SSDEEP 6144:7ENVLjFHaKe4RdYtB5GJvLZp5FVkTVZpS9CgK8ikE4RhwAeJ:D4Rd8BykTVZM9CgKcRhq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.2/de/System.Runtime.xml

SHA256 0c89ecd20d32f44b3fe5004248138d8405a9d6a732aed95d132e039a25fb90e7
MD5 4f3010ed096981fb0742767567eb9ff0
SHA1 efbaa214e71514f6cac6bd4c74c8ab90f2f07641
SHA512 7f55032a46c4fd8f85db2ba6bc034c73aeac5b2ab6e12abda5dbe4e64e2dc3933da486347e7e9b59ab0a11461f73f9d2c14a11ea4fc9bdf7b021ffdc8933917f
SSDEEP 24576:26wvksjmvGPsyBKq2sE5jeFf8dWtcKFxLzeGiEV0TdZnePiWyk4ufCL6SAGJc+Tq:AtcKvj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.2/es/System.Runtime.xml

SHA256 27e644696b0824912daf4d0a7c4a922813081b19749277cfd3a1ae9044458c28
MD5 f063f74ca6d4bc6a0fb2fa1e6e106b9e
SHA1 ee7db0b401c742be5480deafba5c089204979924
SHA512 25cb775d383c9548785bc7f6224eb617199678b2c48ada25e1d2a14020a551b8575880f94f567d9cf0a02095a517f8b9d77b7662b44516e05aa08b06aeecadaa
SSDEEP 6144:u6c8At5vbReofGV/hWPIwTMc1Wc1aiVQmiVQDTyfTk+x6k4a0NJX+IMWupNF2HNV:7WPIwT7+IMWupNF2e0Bw1e
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.2/fr/System.Runtime.xml

SHA256 3224e0a2a1251f8a09ac9eaf3754d9b8570af569c2e47d9fc119104b534dd81a
MD5 d069eda8bc4373dc8ee548668057a3a0
SHA1 d8e80672f23387276d19773f55ff342dc49c2b67
SHA512 56b0a3f3d790318d59d40221b365fb3f73b8a5bce6a74091fff2225c14e77487c815eede31843543e9dfee5cdf6524ed919b1fdc564ffad419859b59119db5c6
SSDEEP 6144:ea1UaFIw7k4ZJEJSiuOnEo1mhY8DrKXCtxNr4S5ElTWuZoDYoDWMLiaM+XPs/9GX:rk4ZJEJSr7lPElTWuZ6YoKRobRT
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.2/it/System.Runtime.xml

SHA256 225ca47c2669570b56f08b5088921467717e3911b5cfb1ed82acd8ef685d425b
MD5 3dd536d84d206a0fde929652869b0579
SHA1 b65fbdba0a0ca19e8c99c894b59f35b935a48bfc
SHA512 26f8b39da3b5e3ce38c7efa79c0937a50e33d5fc75064efedf6182ea46283fa262b47b35b8d326f8f97b30d925da9287b0d1ae69a8e9397a887a45cd1d628920
SSDEEP 6144:uo04TylCPqmwqTFfqrMqGnq7yq7Rtq77q71mUeomUcIifajuQsQfDMlChGINUss3:mjUUYjuvQjxSTVh/+G4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.2/ja/System.Runtime.xml

SHA256 5744024221fba38e841e3e96b6d4931d42856ce7b3cd6373628546f96d3653d8
MD5 f1eed567bfaf6f135ed3a495cf946fc4
SHA1 8c064d8cd337db2fefc58d592209ce2f9850ca59
SHA512 8bd1917fdb4a4c939ea657e9a45e84bc67d1fd1294c03014dfc8a1b834be60b5f70662e44b663b3a239dd9584ce612ac32a1678d8ceca389bc8ba30c11366756
SSDEEP 24576:CAR7yzBuKRBNaN7JY3x4vAix6M0wBH3RM9u6jFw:qw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.2/ko/System.Runtime.xml

SHA256 06ec22dbafcb5935eda03702ab1b14b71333afabca662326c6dcf7a2dd244b67
MD5 4b26cd1a4c1ed5d778bd518bc2a267aa
SHA1 e7d2f8585a138bd6d6bbc3f804f84343900ade1f
SHA512 27df1cf0d155ede758a86ac202cb2969cfa5ed8064beab577ba3ef90d5580d20a6649d8081963d195208c3338cab038d22168e2341425214b3c0674200560fb4
SSDEEP 12288:egCFitdg7Ml6sAOj1ypG3cJVsB7JyD9JFfniWpotwMdOeMPiUGOSh5/X88BIBHb0:D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.2/ru/System.Runtime.xml

SHA256 d7fa06ca7f0fe1d8292e53f1b4dbab8f693490da6305e1327357a16939d2b004
MD5 1cd27629364842292d9a69cf3810807d
SHA1 3591aa6e64f45098bed83e871e7fd162301eb76f
SHA512 7e420f31b61ee73a6615a365f7f0133a5530e4fdefed251694cf5a6589f5ba391df63249be82aaab32599f4958ef56cdd2c83de83bbeb0bf38d0ae30dd55bf95
SSDEEP 12288:4Pw9V3tT2GlVpDTQgOQsDCpk3nMUqiCRH3zwslpOytLIiV0IioIoTkGCWPUvWwBx:o
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.2/zh-hans/System.Runtime.xml

SHA256 bb3f5b6f7d9c4dc389c4d7e1171779b8ce554b09001fd2f0e21af7a56e122a4f
MD5 c52c9ed367bbfa02a5699b7f5458e2e8
SHA1 c103f94125140990bae19bc285b183bc39bc3851
SHA512 18e18f1ca8c2e29b18a539ccfb340c356a9d1fa8ef18daa83c77ee36ef21cdea9f0e382b26db0a4aefeb00bbc2f141c9d9daee8eab470b376745bd0b76780e64
SSDEEP 12288:Smj2HoRBKo6AEbQF5pHKOmz9RkB2dFOyqH2X+29uSAytbfYBhYl6WeZ5NCLwT:pRBKIm627ZATCLg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.2/zh-hant/System.Runtime.xml

SHA256 14f420f536a5b0b592bedae238e50abbcc655bee549e034ed47b6106a86c0a80
MD5 a7eb78c9523b31d21f44fe116b62f41a
SHA1 4ee3473b56137b3a528c96e2b765b579d5e1bf3d
SHA512 526aa200d22729c714e3463de256c841bdec9a6bb26c7105473652565fb9ce02453eb9075e6dff60e3ff0e0e89488799eaafc04cf1146e50566ed4ee60d50788
SSDEEP 12288:H+djUdB4mVqanPN3QwwyR0a15Y1RNHd+CMBSMLl0AR2Alb:h3QvNHg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.3/System.Runtime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bc848e3bf9523240c1053a35939ea203f356593ea063f01d5f7b4dfe71b8f011
MD5 dffdb4981584dbb79574c3856bd2ca47
SHA1 618e5a1bb17eca003bbedf6895bebe825112b0ec
SHA512 14bdc531c6553eb684aab71c23755dc81a243325e5a04f11547c03f9e5f81188abc06a1e632121e21b0d332261ee45bea2ccca49d5e783fa3a0582c62cd05a7e
SSDEEP 1536:nHKXL6Gskm7omyxVvVbA9gCgSRnZJBivbvDw0Dyi3pB25bzmhYqG:nHK76GskDA9gCgwZJBeXy8pB25bzkYq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

bf:03:a0:ff:bc:cd:c0:7c:a9:d4:3b:44:02:07:b8:4d:e0:e4:ed:66:a6:9d:92:0c:4e:04:39:58:b7:93:0f:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a5:f6:92:e6:27:ac:38:c6:f1:bd:44:01:37:fc:c2:e2:13:96:44:a1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

116474

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Runtime\4.0.20.0\System.Runtime.pdb

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.3/System.Runtime.xml

SHA256 3ec029ac16594883af331eded34eb8621a36a58e419deb08f9311353356f009b
MD5 851e272b3e64dc1d2a7e7752761a340f
SHA1 c3324dde6345c0f43394d5bc54495d76746ed1f3
SHA512 fe59d260ee696a191821b66d1dec9a7e5061180eb3e76f8bea21e29b2ef2408889472cf819f94f26865d63ab46f21ec591a7b416f324ea21b380a574f8129c1e
SSDEEP 6144:7ENVLjFHaKe4RdYtB5GJvLZp5FVkTVZpS9CgK8ikE4RhwAeJ:D4Rd8BykTVZM9CgKcRhq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.3/de/System.Runtime.xml

SHA256 0c89ecd20d32f44b3fe5004248138d8405a9d6a732aed95d132e039a25fb90e7
MD5 4f3010ed096981fb0742767567eb9ff0
SHA1 efbaa214e71514f6cac6bd4c74c8ab90f2f07641
SHA512 7f55032a46c4fd8f85db2ba6bc034c73aeac5b2ab6e12abda5dbe4e64e2dc3933da486347e7e9b59ab0a11461f73f9d2c14a11ea4fc9bdf7b021ffdc8933917f
SSDEEP 24576:26wvksjmvGPsyBKq2sE5jeFf8dWtcKFxLzeGiEV0TdZnePiWyk4ufCL6SAGJc+Tq:AtcKvj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.3/es/System.Runtime.xml

SHA256 27e644696b0824912daf4d0a7c4a922813081b19749277cfd3a1ae9044458c28
MD5 f063f74ca6d4bc6a0fb2fa1e6e106b9e
SHA1 ee7db0b401c742be5480deafba5c089204979924
SHA512 25cb775d383c9548785bc7f6224eb617199678b2c48ada25e1d2a14020a551b8575880f94f567d9cf0a02095a517f8b9d77b7662b44516e05aa08b06aeecadaa
SSDEEP 6144:u6c8At5vbReofGV/hWPIwTMc1Wc1aiVQmiVQDTyfTk+x6k4a0NJX+IMWupNF2HNV:7WPIwT7+IMWupNF2e0Bw1e
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.3/fr/System.Runtime.xml

SHA256 3224e0a2a1251f8a09ac9eaf3754d9b8570af569c2e47d9fc119104b534dd81a
MD5 d069eda8bc4373dc8ee548668057a3a0
SHA1 d8e80672f23387276d19773f55ff342dc49c2b67
SHA512 56b0a3f3d790318d59d40221b365fb3f73b8a5bce6a74091fff2225c14e77487c815eede31843543e9dfee5cdf6524ed919b1fdc564ffad419859b59119db5c6
SSDEEP 6144:ea1UaFIw7k4ZJEJSiuOnEo1mhY8DrKXCtxNr4S5ElTWuZoDYoDWMLiaM+XPs/9GX:rk4ZJEJSr7lPElTWuZ6YoKRobRT
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.3/it/System.Runtime.xml

SHA256 225ca47c2669570b56f08b5088921467717e3911b5cfb1ed82acd8ef685d425b
MD5 3dd536d84d206a0fde929652869b0579
SHA1 b65fbdba0a0ca19e8c99c894b59f35b935a48bfc
SHA512 26f8b39da3b5e3ce38c7efa79c0937a50e33d5fc75064efedf6182ea46283fa262b47b35b8d326f8f97b30d925da9287b0d1ae69a8e9397a887a45cd1d628920
SSDEEP 6144:uo04TylCPqmwqTFfqrMqGnq7yq7Rtq77q71mUeomUcIifajuQsQfDMlChGINUss3:mjUUYjuvQjxSTVh/+G4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.3/ja/System.Runtime.xml

SHA256 5744024221fba38e841e3e96b6d4931d42856ce7b3cd6373628546f96d3653d8
MD5 f1eed567bfaf6f135ed3a495cf946fc4
SHA1 8c064d8cd337db2fefc58d592209ce2f9850ca59
SHA512 8bd1917fdb4a4c939ea657e9a45e84bc67d1fd1294c03014dfc8a1b834be60b5f70662e44b663b3a239dd9584ce612ac32a1678d8ceca389bc8ba30c11366756
SSDEEP 24576:CAR7yzBuKRBNaN7JY3x4vAix6M0wBH3RM9u6jFw:qw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.3/ko/System.Runtime.xml

SHA256 06ec22dbafcb5935eda03702ab1b14b71333afabca662326c6dcf7a2dd244b67
MD5 4b26cd1a4c1ed5d778bd518bc2a267aa
SHA1 e7d2f8585a138bd6d6bbc3f804f84343900ade1f
SHA512 27df1cf0d155ede758a86ac202cb2969cfa5ed8064beab577ba3ef90d5580d20a6649d8081963d195208c3338cab038d22168e2341425214b3c0674200560fb4
SSDEEP 12288:egCFitdg7Ml6sAOj1ypG3cJVsB7JyD9JFfniWpotwMdOeMPiUGOSh5/X88BIBHb0:D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.3/ru/System.Runtime.xml

SHA256 d7fa06ca7f0fe1d8292e53f1b4dbab8f693490da6305e1327357a16939d2b004
MD5 1cd27629364842292d9a69cf3810807d
SHA1 3591aa6e64f45098bed83e871e7fd162301eb76f
SHA512 7e420f31b61ee73a6615a365f7f0133a5530e4fdefed251694cf5a6589f5ba391df63249be82aaab32599f4958ef56cdd2c83de83bbeb0bf38d0ae30dd55bf95
SSDEEP 12288:4Pw9V3tT2GlVpDTQgOQsDCpk3nMUqiCRH3zwslpOytLIiV0IioIoTkGCWPUvWwBx:o
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.3/zh-hans/System.Runtime.xml

SHA256 bb3f5b6f7d9c4dc389c4d7e1171779b8ce554b09001fd2f0e21af7a56e122a4f
MD5 c52c9ed367bbfa02a5699b7f5458e2e8
SHA1 c103f94125140990bae19bc285b183bc39bc3851
SHA512 18e18f1ca8c2e29b18a539ccfb340c356a9d1fa8ef18daa83c77ee36ef21cdea9f0e382b26db0a4aefeb00bbc2f141c9d9daee8eab470b376745bd0b76780e64
SSDEEP 12288:Smj2HoRBKo6AEbQF5pHKOmz9RkB2dFOyqH2X+29uSAytbfYBhYl6WeZ5NCLwT:pRBKIm627ZATCLg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.3/zh-hant/System.Runtime.xml

SHA256 14f420f536a5b0b592bedae238e50abbcc655bee549e034ed47b6106a86c0a80
MD5 a7eb78c9523b31d21f44fe116b62f41a
SHA1 4ee3473b56137b3a528c96e2b765b579d5e1bf3d
SHA512 526aa200d22729c714e3463de256c841bdec9a6bb26c7105473652565fb9ce02453eb9075e6dff60e3ff0e0e89488799eaafc04cf1146e50566ed4ee60d50788
SSDEEP 12288:H+djUdB4mVqanPN3QwwyR0a15Y1RNHd+CMBSMLl0AR2Alb:h3QvNHg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.5/System.Runtime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 79fdc7276d7cc830fdfeccbbdb447bc3c5a522b314e575c9baa09acd09ff037b
MD5 53856ab3d490a22dd2c472823a3d463e
SHA1 6b0341409cf628d74eaf5ee4024a00fdba21d252
SHA512 1c46b999601518ccd6f885f15b9253a3134cdb68a36599fb55d3ce7e0fc437f40dc20d8fb271f72cdae8b4b830dbd4669189120949da9594a7660cf89a07dc09
SSDEEP 3072:ru/uS1qMvOF3hPpyMFZ2liyty8pfnt7qiEVR:DSxOFRP3F8wyQ8pfkR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

5e:b3:4b:66:25:9b:2e:c6:7d:4e:9e:50:ad:f6:1a:82:20:77:69:4c:79:9c:cc:e8:f7:fc:9f:95:f8:fc:9c:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

9a:ae:08:7d:84:25:37:2e:55:47:3f:b3:e5:9a:ab:4c:99:d8:14:15

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

109770

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Runtime\4.1.0.0\System.Runtime.pdb

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.5/System.Runtime.xml

SHA256 3ec029ac16594883af331eded34eb8621a36a58e419deb08f9311353356f009b
MD5 851e272b3e64dc1d2a7e7752761a340f
SHA1 c3324dde6345c0f43394d5bc54495d76746ed1f3
SHA512 fe59d260ee696a191821b66d1dec9a7e5061180eb3e76f8bea21e29b2ef2408889472cf819f94f26865d63ab46f21ec591a7b416f324ea21b380a574f8129c1e
SSDEEP 6144:7ENVLjFHaKe4RdYtB5GJvLZp5FVkTVZpS9CgK8ikE4RhwAeJ:D4Rd8BykTVZM9CgKcRhq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.5/de/System.Runtime.xml

SHA256 0c89ecd20d32f44b3fe5004248138d8405a9d6a732aed95d132e039a25fb90e7
MD5 4f3010ed096981fb0742767567eb9ff0
SHA1 efbaa214e71514f6cac6bd4c74c8ab90f2f07641
SHA512 7f55032a46c4fd8f85db2ba6bc034c73aeac5b2ab6e12abda5dbe4e64e2dc3933da486347e7e9b59ab0a11461f73f9d2c14a11ea4fc9bdf7b021ffdc8933917f
SSDEEP 24576:26wvksjmvGPsyBKq2sE5jeFf8dWtcKFxLzeGiEV0TdZnePiWyk4ufCL6SAGJc+Tq:AtcKvj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.5/es/System.Runtime.xml

SHA256 27e644696b0824912daf4d0a7c4a922813081b19749277cfd3a1ae9044458c28
MD5 f063f74ca6d4bc6a0fb2fa1e6e106b9e
SHA1 ee7db0b401c742be5480deafba5c089204979924
SHA512 25cb775d383c9548785bc7f6224eb617199678b2c48ada25e1d2a14020a551b8575880f94f567d9cf0a02095a517f8b9d77b7662b44516e05aa08b06aeecadaa
SSDEEP 6144:u6c8At5vbReofGV/hWPIwTMc1Wc1aiVQmiVQDTyfTk+x6k4a0NJX+IMWupNF2HNV:7WPIwT7+IMWupNF2e0Bw1e
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.5/fr/System.Runtime.xml

SHA256 3224e0a2a1251f8a09ac9eaf3754d9b8570af569c2e47d9fc119104b534dd81a
MD5 d069eda8bc4373dc8ee548668057a3a0
SHA1 d8e80672f23387276d19773f55ff342dc49c2b67
SHA512 56b0a3f3d790318d59d40221b365fb3f73b8a5bce6a74091fff2225c14e77487c815eede31843543e9dfee5cdf6524ed919b1fdc564ffad419859b59119db5c6
SSDEEP 6144:ea1UaFIw7k4ZJEJSiuOnEo1mhY8DrKXCtxNr4S5ElTWuZoDYoDWMLiaM+XPs/9GX:rk4ZJEJSr7lPElTWuZ6YoKRobRT
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.5/it/System.Runtime.xml

SHA256 225ca47c2669570b56f08b5088921467717e3911b5cfb1ed82acd8ef685d425b
MD5 3dd536d84d206a0fde929652869b0579
SHA1 b65fbdba0a0ca19e8c99c894b59f35b935a48bfc
SHA512 26f8b39da3b5e3ce38c7efa79c0937a50e33d5fc75064efedf6182ea46283fa262b47b35b8d326f8f97b30d925da9287b0d1ae69a8e9397a887a45cd1d628920
SSDEEP 6144:uo04TylCPqmwqTFfqrMqGnq7yq7Rtq77q71mUeomUcIifajuQsQfDMlChGINUss3:mjUUYjuvQjxSTVh/+G4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.5/ja/System.Runtime.xml

SHA256 5744024221fba38e841e3e96b6d4931d42856ce7b3cd6373628546f96d3653d8
MD5 f1eed567bfaf6f135ed3a495cf946fc4
SHA1 8c064d8cd337db2fefc58d592209ce2f9850ca59
SHA512 8bd1917fdb4a4c939ea657e9a45e84bc67d1fd1294c03014dfc8a1b834be60b5f70662e44b663b3a239dd9584ce612ac32a1678d8ceca389bc8ba30c11366756
SSDEEP 24576:CAR7yzBuKRBNaN7JY3x4vAix6M0wBH3RM9u6jFw:qw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.5/ko/System.Runtime.xml

SHA256 06ec22dbafcb5935eda03702ab1b14b71333afabca662326c6dcf7a2dd244b67
MD5 4b26cd1a4c1ed5d778bd518bc2a267aa
SHA1 e7d2f8585a138bd6d6bbc3f804f84343900ade1f
SHA512 27df1cf0d155ede758a86ac202cb2969cfa5ed8064beab577ba3ef90d5580d20a6649d8081963d195208c3338cab038d22168e2341425214b3c0674200560fb4
SSDEEP 12288:egCFitdg7Ml6sAOj1ypG3cJVsB7JyD9JFfniWpotwMdOeMPiUGOSh5/X88BIBHb0:D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.5/ru/System.Runtime.xml

SHA256 d7fa06ca7f0fe1d8292e53f1b4dbab8f693490da6305e1327357a16939d2b004
MD5 1cd27629364842292d9a69cf3810807d
SHA1 3591aa6e64f45098bed83e871e7fd162301eb76f
SHA512 7e420f31b61ee73a6615a365f7f0133a5530e4fdefed251694cf5a6589f5ba391df63249be82aaab32599f4958ef56cdd2c83de83bbeb0bf38d0ae30dd55bf95
SSDEEP 12288:4Pw9V3tT2GlVpDTQgOQsDCpk3nMUqiCRH3zwslpOytLIiV0IioIoTkGCWPUvWwBx:o
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.5/zh-hans/System.Runtime.xml

SHA256 bb3f5b6f7d9c4dc389c4d7e1171779b8ce554b09001fd2f0e21af7a56e122a4f
MD5 c52c9ed367bbfa02a5699b7f5458e2e8
SHA1 c103f94125140990bae19bc285b183bc39bc3851
SHA512 18e18f1ca8c2e29b18a539ccfb340c356a9d1fa8ef18daa83c77ee36ef21cdea9f0e382b26db0a4aefeb00bbc2f141c9d9daee8eab470b376745bd0b76780e64
SSDEEP 12288:Smj2HoRBKo6AEbQF5pHKOmz9RkB2dFOyqH2X+29uSAytbfYBhYl6WeZ5NCLwT:pRBKIm627ZATCLg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.4.3.0/ref/netstandard1.5/zh-hant/System.Runtime.xml

SHA256 14f420f536a5b0b592bedae238e50abbcc655bee549e034ed47b6106a86c0a80
MD5 a7eb78c9523b31d21f44fe116b62f41a
SHA1 4ee3473b56137b3a528c96e2b765b579d5e1bf3d
SHA512 526aa200d22729c714e3463de256c841bdec9a6bb26c7105473652565fb9ce02453eb9075e6dff60e3ff0e0e89488799eaafc04cf1146e50566ed4ee60d50788
SSDEEP 12288:H+djUdB4mVqanPN3QwwyR0a15Y1RNHd+CMBSMLl0AR2Alb:h3QvNHg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/.signature.p7s

SHA256 c1e9de6fe0e34e71244e886dd6fc8d2039f00eca9d017ea4aec473dc3f9065ed
MD5 dd01fd0afa21300e24c509bb361df906
SHA1 e7473f15c65972604b0c9b892358e500b7ea3dad
SHA512 7758842c985fdf99b0ab72ba1d72759baa9e786994bac34366576e2f721fbefc6d88ffd12e6bf82d0752cccb6b791d3c67b701bf001b36d795e88de6452b3ecb
SSDEEP 192:8dU7x0KDWpHhXZCVzV07xr9Y7w9DH0JOqNG8Fp28Wh8n2O:EevDGGVpeYs9oJNNzFwhhiP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/System.Runtime.Extensions.4.3.0.nupkg

SHA256 c0b0c79a8cebf38bf55b6cd8096631c63d0547424360749545a46e0e6d1b77fa
MD5 8f703fb4850b35810b746990683a4198
SHA1 f0d8ed1bde12e1d6a01e301ebfe4b72e55f7ba64
SHA512 680a32b19c2bd5026f8687aa5382aea4f432b4f032f8bde299facb618c56d57369adef7f7cc8e60ad82ae3c12e5dd50772491363bf8044c778778628a6605bbc
SSDEEP 24576:sPcYala1tQnPHpqQWNa9i1jQnD5QWOpDaci1OQnM2QWVaqG14Qn2UQWO:f8Qn/xW2gQnaWOr5QnaWJHQnSWO
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/lib/net462/System.Runtime.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 db7508019e0b46adee37afc10e992a15a32e7a7d7a86f84f49e3ab1a02af154c
MD5 a4af8cd9aa31fc83d2e434a748dd6676
SHA1 9c6772a60e6464208a491a2cb55d62c8f3c67d00
SHA512 468d008e91791160236c1c5ea62d139ccb93878de166d6768602ac9ab6c6fde36fe77be3a495fd04e4b84a31a90a9a71d06bbf1808f3fafbab95e0111f2c22a1
SSDEEP 384:LzDClj4k5raxf7eSDJgDBtqcoHSljd5z7NuhBWzTW/WyTWO3rq0GftpBjhHERHRV:L/CyIIuqcoHifYhSS7i3HEB9N
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

06:bb:17:cc:2a:97:31:fe:4a:d5:8b:78:55:bb:7b:6d:bc:a6:92:ba:a9:14:d3:0d:77:6e:a2:ef:d0:7a:76:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

1d:a4:26:3f:61:1d:02:55:d8:2d:5d:cf:a7:49:b2:bb:a0:e5:78:b0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

21486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Runtime.Extensions/net462\System.Runtime.Extensions.pdb

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/net462/System.Runtime.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 db7508019e0b46adee37afc10e992a15a32e7a7d7a86f84f49e3ab1a02af154c
MD5 a4af8cd9aa31fc83d2e434a748dd6676
SHA1 9c6772a60e6464208a491a2cb55d62c8f3c67d00
SHA512 468d008e91791160236c1c5ea62d139ccb93878de166d6768602ac9ab6c6fde36fe77be3a495fd04e4b84a31a90a9a71d06bbf1808f3fafbab95e0111f2c22a1
SSDEEP 384:LzDClj4k5raxf7eSDJgDBtqcoHSljd5z7NuhBWzTW/WyTWO3rq0GftpBjhHERHRV:L/CyIIuqcoHifYhSS7i3HEB9N
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

06:bb:17:cc:2a:97:31:fe:4a:d5:8b:78:55:bb:7b:6d:bc:a6:92:ba:a9:14:d3:0d:77:6e:a2:ef:d0:7a:76:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

1d:a4:26:3f:61:1d:02:55:d8:2d:5d:cf:a7:49:b2:bb:a0:e5:78:b0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

21486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Runtime.Extensions/net462\System.Runtime.Extensions.pdb

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netcore50/System.Runtime.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf22395b545a59a95a658505d596ef53d2a3a2b6e0a80941561b30977714106a
MD5 837bc546511a15185f15ba8d18ad2fd8
SHA1 fbaf610c0e6e7a03183bc49449b6ca981d9abaeb
SHA512 ac61a6902494df205dd6fa3504d21473d0eb723a474befbbe43150f4a9e064d22108e13ad472b5fe1d58064e9f0792c84f191331e3842b24b390a86dd84344c3
SSDEEP 384:PP66qYDjk4xwf40vU/lkB//h2Yc/Qw0miWFJW5vSUA0GftpBjadI+ILKHRN76Vbw:H66qeky8Uw0h4nmRYicdIm6Vb/66i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

3b:a1:4d:73:85:b2:45:36:f3:aa:fa:b3:7d:7b:04:e8:c4:ec:03:d9:e8:92:7d:02:76:b4:94:bd:60:a6:c4:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

45:35:ba:b7:3a:a3:88:60:2f:4c:ae:22:1f:21:b3:9e:22:d7:77:b5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

28978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Runtime.Extensions\4.0.10.0\System.Runtime.Extensions.pdb

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netcore50/System.Runtime.Extensions.xml

SHA256 24f0392c97a08d3b178b6511b180ef10e3df77be935d2f224b7192f49e0239c2
MD5 134503de0fa1216c93a78af3b2ed7e14
SHA1 183b01e0b3e8fe3451a56912e2bbb1e1ec66f655
SHA512 07a0ec3556e8a0aaa7a54c6be411a1e0b32ed620c2ca67a52fef8ada1297b8d7524b77e0ce85031944f9b68d42907b8d3fff389b5e811f132366b9736b824802
SSDEEP 1536:xZey/YeXc13CVrhJdi0CO3/yZF+8WsB4Khh1NjZuIN1PktXjAcyWFICPEZFXZwYa:3QbtnRqx3ICeZwY6L
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netcore50/de/System.Runtime.Extensions.xml

SHA256 ea84f637b557512129207f7f816aa3c62b0296c6917cbff34cdb928969196b3a
MD5 a9ab333f2ebbe9c94086a2e9c044e07b
SHA1 7a2697cae797fef36fa7fb713b436dacdce123f5
SHA512 976d90b99552f5ba4971b87f1beceabf98723d6ae8465f7617f66a3abce1eec02859ad0702d43c95b843be99e92e313856c2e79ba84a41515a7c70ebb9f62d59
SSDEEP 3072:Osxv9y8go4PYao48m9VbSyn1NoN97dh0PI:6PHo48m9VbSyn1NoN9Jh0PI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netcore50/es/System.Runtime.Extensions.xml

SHA256 4ccb883b823eab712662dbd27446bbba26633f30c6f3dc48035fc984f2f175dc
MD5 cab318118ddd9443ed459aaf077e057c
SHA1 dbdafc04d4c044a9f457f4d74205608dec69dc0e
SHA512 c207f85942795d304780b0b7b6e47c0e1f2c23e715b4e7898be74840490428842ce8314e81a73432975c26dfb314818ae5001e0a219c9829ab17763b08d8b0b7
SSDEEP 1536:aqh6BHcB21qHDvcsJhc9o+cmmcMtA6IcdoqcGNjcdvH3EQDer42aMukXKZcVykD/:aqUVvH3EQDsaMDyZM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netcore50/fr/System.Runtime.Extensions.xml

SHA256 326c8c1206e7331bfc80ba9948a0638a8882bb83939e7920be6d192cb81ef3db
MD5 d442a591bc50e4f0073047734f7f127d
SHA1 adb2d0c88a626c4f30c699f0c48ed04c666134de
SHA512 619193460eef3fa612381ac80fb6910ff285d2cd28c56f74bdbe7d820e6c16ebe870cd0d7a30a397c009b6379e7ff94ba197dfcec3ca89db01b352df1b460bc5
SSDEEP 3072:I/hr2QagJXGieh4+lTcyfL6DW0LZikuL+bxbblOb0vN9P9tjn7nRnFnZnhnqgzKE:hWEduC36d
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netcore50/it/System.Runtime.Extensions.xml

SHA256 fbc7abcb604f7519a57dcec5310e02238d98475ec9cca3c944b905b0ea24e6a2
MD5 a8c8dfde42f643d7168659f1b2da4ecf
SHA1 3b7f6efbc623c07565bcf6ba330e6af54aec5729
SHA512 c0548e12634c46f9ab691bcec4ad2418ba823e826fb7c3c4f223c4de3e5eaf34a6be2c69b847f3c4e33563af7772a44631c047b7999dd58631b36e0af5ad14a4
SSDEEP 6144:lT78b8V838lTDToTEm9rpi7m1bAGhTLXGubS:gjo
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netcore50/ja/System.Runtime.Extensions.xml

SHA256 f89c29b39c7bab72ff59a3b9b00478a1a84db0736ae70da9142817ef24882eb2
MD5 3ec00219ed8d2ca104af3130dcb1917f
SHA1 867b84d2df6033adde5e3ccfca19c849b901a6ba
SHA512 bdb86e274ee7b096ab4e949b142998f816c39334acc870e4662bbefc51f6275ccd11df2a041b6b3fd7f98f4d66d7c651330eae6413f4237a2ecd9a954c2b3613
SSDEEP 768:Yr8cLt9rs/fJy7UbUuWS1LVVyVd95V/VfVcVvVbTV5QF9FAV0VQVFJ8ypEWTm6YO:L+YlkHer1ocQ8qp2Cspwezius3BU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netcore50/ko/System.Runtime.Extensions.xml

SHA256 6545ed04ad31e0695f4077be9f1677fc7bbea19bb130a64997facfd52101074a
MD5 3d7ccc379f429124215cd6e2ef0954c7
SHA1 982dd7d846ae2621b1783ba27da7fcf64cd060dc
SHA512 fa59987a36c81cfde8f1cb94fa49110cbbe1639a0bc19731e4963b3c3fd722fdf83d14e97d1fd539a9981275d4112d0a4a17dbc4e36fe354d66d5bcf271c004c
SSDEEP 1536:noICwFgxjAOTae+nN+w/DiePNmaaRt0OFOK:jF1nBiePN0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netcore50/ru/System.Runtime.Extensions.xml

SHA256 95195486886010253c43771007c40efcc3d935047d7dc552789492f58f35f4bf
MD5 a614d6e5bf22a087b923c5792a08184d
SHA1 a06b86e8bb6ccdd80b3a5409cc30543c6304e98b
SHA512 edea0b3b944fe3d80ee38145f2b4edc7b8e08e05e738c68f89fc2b12ea42a3f69db323fffcf1ddf29400e419e6abad419b1cdfb7ea35b39084152f1ed0aa56ec
SSDEEP 12288:70OSf1m6SXmS1R4TmoSUjGPti98TjJrctH9XSTXPd6+Y8BKaQmmZKdO5/jb2y7Gt:IA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netcore50/zh-hans/System.Runtime.Extensions.xml

SHA256 ba8b4096516b2a148cea07f3f0be9957defb3729465290d09eb54750ade6f854
MD5 5f4aba4d4e68a8700b1dfc7557799757
SHA1 03f5033070042211ec2013aa25d10424a89d3753
SHA512 ef6d20468ffd946e6e7d798644ac4626d14a05328e6b7fa9bd6b968398c4ae5aaf5d75aa12a9831ff4925f0a1756622f67377fd71acc7fab231671fac828236d
SSDEEP 1536:yYFpTgLNXDoDvCUThjOcVfhRRR2W6haH82m7d6C0Fr2iaqitL/pcOODlRuk7UPmB:J9itQloc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netcore50/zh-hant/System.Runtime.Extensions.xml

SHA256 c3bf90cd37b3a20d435ced0b3f8efc7d85ad616c7e729edda731bb2570875c86
MD5 54f1c631570808595c1819df0d7d9b8f
SHA1 1b1e213b3afde5d84b90051dc2bf969cdad692ba
SHA512 ece2d3ed94bf7f23981442bf9a048c2ec51e7276c486d2190f1364c17ed55999e1b8769c15cf2865d71931a3e3b2e3a51ace7fa9b66257e6233b973f6014bc22
SSDEEP 768:YdfACcctU+y8DeJlSxUSEDnaYGYgMLBKzC3rGlC9KB8ow8LaWn/n4l+J0AjCFM1R:QlMLd3ClV6ow8LaWn/n4l+LjT63NfaX
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.0/System.Runtime.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1fde07d19c925f17ad23d802f5583fc5ba0e3196c82431faa952e72621f216e9
MD5 56ceacbd124b3a2a77a03fc70280dd9b
SHA1 42ff4d8994cb2cb2e7cfe0718c4d964639843949
SHA512 cc8164a9f9787d196b2bdc71ffccb81bf70730d572c4d78147c73001b3a4f95b8a6b4da8e21eb1cda5f6032b53121e5ebe51b29d3780994cae7d4cd6437dc409
SSDEEP 384:zVrcY1ol1ts1gBmO5ZX/Q2520kNkcdTJ4eNewnwLWLTWEa1ae00GftpBjxwDHRNF:zpml1tQgBmOT7GTkHcsasinwDr7yW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

9d:37:3f:18:95:28:8d:0d:05:cb:12:72:02:22:69:be:ad:4f:05:c3:ba:29:e7:04:23:6f:7d:2f:55:1b:22:51

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

4d:33:c9:ac:67:74:55:75:69:f9:6d:1f:cc:a6:aa:64:5d:2a:c0:72

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:13:36:00:00:00:00:00:1a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

28286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.0/System.Runtime.Extensions.xml

SHA256 24f0392c97a08d3b178b6511b180ef10e3df77be935d2f224b7192f49e0239c2
MD5 134503de0fa1216c93a78af3b2ed7e14
SHA1 183b01e0b3e8fe3451a56912e2bbb1e1ec66f655
SHA512 07a0ec3556e8a0aaa7a54c6be411a1e0b32ed620c2ca67a52fef8ada1297b8d7524b77e0ce85031944f9b68d42907b8d3fff389b5e811f132366b9736b824802
SSDEEP 1536:xZey/YeXc13CVrhJdi0CO3/yZF+8WsB4Khh1NjZuIN1PktXjAcyWFICPEZFXZwYa:3QbtnRqx3ICeZwY6L
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.0/de/System.Runtime.Extensions.xml

SHA256 ea84f637b557512129207f7f816aa3c62b0296c6917cbff34cdb928969196b3a
MD5 a9ab333f2ebbe9c94086a2e9c044e07b
SHA1 7a2697cae797fef36fa7fb713b436dacdce123f5
SHA512 976d90b99552f5ba4971b87f1beceabf98723d6ae8465f7617f66a3abce1eec02859ad0702d43c95b843be99e92e313856c2e79ba84a41515a7c70ebb9f62d59
SSDEEP 3072:Osxv9y8go4PYao48m9VbSyn1NoN97dh0PI:6PHo48m9VbSyn1NoN9Jh0PI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.0/es/System.Runtime.Extensions.xml

SHA256 4ccb883b823eab712662dbd27446bbba26633f30c6f3dc48035fc984f2f175dc
MD5 cab318118ddd9443ed459aaf077e057c
SHA1 dbdafc04d4c044a9f457f4d74205608dec69dc0e
SHA512 c207f85942795d304780b0b7b6e47c0e1f2c23e715b4e7898be74840490428842ce8314e81a73432975c26dfb314818ae5001e0a219c9829ab17763b08d8b0b7
SSDEEP 1536:aqh6BHcB21qHDvcsJhc9o+cmmcMtA6IcdoqcGNjcdvH3EQDer42aMukXKZcVykD/:aqUVvH3EQDsaMDyZM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.0/fr/System.Runtime.Extensions.xml

SHA256 326c8c1206e7331bfc80ba9948a0638a8882bb83939e7920be6d192cb81ef3db
MD5 d442a591bc50e4f0073047734f7f127d
SHA1 adb2d0c88a626c4f30c699f0c48ed04c666134de
SHA512 619193460eef3fa612381ac80fb6910ff285d2cd28c56f74bdbe7d820e6c16ebe870cd0d7a30a397c009b6379e7ff94ba197dfcec3ca89db01b352df1b460bc5
SSDEEP 3072:I/hr2QagJXGieh4+lTcyfL6DW0LZikuL+bxbblOb0vN9P9tjn7nRnFnZnhnqgzKE:hWEduC36d
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.0/it/System.Runtime.Extensions.xml

SHA256 fbc7abcb604f7519a57dcec5310e02238d98475ec9cca3c944b905b0ea24e6a2
MD5 a8c8dfde42f643d7168659f1b2da4ecf
SHA1 3b7f6efbc623c07565bcf6ba330e6af54aec5729
SHA512 c0548e12634c46f9ab691bcec4ad2418ba823e826fb7c3c4f223c4de3e5eaf34a6be2c69b847f3c4e33563af7772a44631c047b7999dd58631b36e0af5ad14a4
SSDEEP 6144:lT78b8V838lTDToTEm9rpi7m1bAGhTLXGubS:gjo
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.0/ja/System.Runtime.Extensions.xml

SHA256 f89c29b39c7bab72ff59a3b9b00478a1a84db0736ae70da9142817ef24882eb2
MD5 3ec00219ed8d2ca104af3130dcb1917f
SHA1 867b84d2df6033adde5e3ccfca19c849b901a6ba
SHA512 bdb86e274ee7b096ab4e949b142998f816c39334acc870e4662bbefc51f6275ccd11df2a041b6b3fd7f98f4d66d7c651330eae6413f4237a2ecd9a954c2b3613
SSDEEP 768:Yr8cLt9rs/fJy7UbUuWS1LVVyVd95V/VfVcVvVbTV5QF9FAV0VQVFJ8ypEWTm6YO:L+YlkHer1ocQ8qp2Cspwezius3BU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.0/ko/System.Runtime.Extensions.xml

SHA256 6545ed04ad31e0695f4077be9f1677fc7bbea19bb130a64997facfd52101074a
MD5 3d7ccc379f429124215cd6e2ef0954c7
SHA1 982dd7d846ae2621b1783ba27da7fcf64cd060dc
SHA512 fa59987a36c81cfde8f1cb94fa49110cbbe1639a0bc19731e4963b3c3fd722fdf83d14e97d1fd539a9981275d4112d0a4a17dbc4e36fe354d66d5bcf271c004c
SSDEEP 1536:noICwFgxjAOTae+nN+w/DiePNmaaRt0OFOK:jF1nBiePN0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.0/ru/System.Runtime.Extensions.xml

SHA256 95195486886010253c43771007c40efcc3d935047d7dc552789492f58f35f4bf
MD5 a614d6e5bf22a087b923c5792a08184d
SHA1 a06b86e8bb6ccdd80b3a5409cc30543c6304e98b
SHA512 edea0b3b944fe3d80ee38145f2b4edc7b8e08e05e738c68f89fc2b12ea42a3f69db323fffcf1ddf29400e419e6abad419b1cdfb7ea35b39084152f1ed0aa56ec
SSDEEP 12288:70OSf1m6SXmS1R4TmoSUjGPti98TjJrctH9XSTXPd6+Y8BKaQmmZKdO5/jb2y7Gt:IA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.0/zh-hans/System.Runtime.Extensions.xml

SHA256 ba8b4096516b2a148cea07f3f0be9957defb3729465290d09eb54750ade6f854
MD5 5f4aba4d4e68a8700b1dfc7557799757
SHA1 03f5033070042211ec2013aa25d10424a89d3753
SHA512 ef6d20468ffd946e6e7d798644ac4626d14a05328e6b7fa9bd6b968398c4ae5aaf5d75aa12a9831ff4925f0a1756622f67377fd71acc7fab231671fac828236d
SSDEEP 1536:yYFpTgLNXDoDvCUThjOcVfhRRR2W6haH82m7d6C0Fr2iaqitL/pcOODlRuk7UPmB:J9itQloc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.0/zh-hant/System.Runtime.Extensions.xml

SHA256 c3bf90cd37b3a20d435ced0b3f8efc7d85ad616c7e729edda731bb2570875c86
MD5 54f1c631570808595c1819df0d7d9b8f
SHA1 1b1e213b3afde5d84b90051dc2bf969cdad692ba
SHA512 ece2d3ed94bf7f23981442bf9a048c2ec51e7276c486d2190f1364c17ed55999e1b8769c15cf2865d71931a3e3b2e3a51ace7fa9b66257e6233b973f6014bc22
SSDEEP 768:YdfACcctU+y8DeJlSxUSEDnaYGYgMLBKzC3rGlC9KB8ow8LaWn/n4l+J0AjCFM1R:QlMLd3ClV6ow8LaWn/n4l+LjT63NfaX
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.3/System.Runtime.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf22395b545a59a95a658505d596ef53d2a3a2b6e0a80941561b30977714106a
MD5 837bc546511a15185f15ba8d18ad2fd8
SHA1 fbaf610c0e6e7a03183bc49449b6ca981d9abaeb
SHA512 ac61a6902494df205dd6fa3504d21473d0eb723a474befbbe43150f4a9e064d22108e13ad472b5fe1d58064e9f0792c84f191331e3842b24b390a86dd84344c3
SSDEEP 384:PP66qYDjk4xwf40vU/lkB//h2Yc/Qw0miWFJW5vSUA0GftpBjadI+ILKHRN76Vbw:H66qeky8Uw0h4nmRYicdIm6Vb/66i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

3b:a1:4d:73:85:b2:45:36:f3:aa:fa:b3:7d:7b:04:e8:c4:ec:03:d9:e8:92:7d:02:76:b4:94:bd:60:a6:c4:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

45:35:ba:b7:3a:a3:88:60:2f:4c:ae:22:1f:21:b3:9e:22:d7:77:b5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

28978

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Runtime.Extensions\4.0.10.0\System.Runtime.Extensions.pdb

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.3/System.Runtime.Extensions.xml

SHA256 24f0392c97a08d3b178b6511b180ef10e3df77be935d2f224b7192f49e0239c2
MD5 134503de0fa1216c93a78af3b2ed7e14
SHA1 183b01e0b3e8fe3451a56912e2bbb1e1ec66f655
SHA512 07a0ec3556e8a0aaa7a54c6be411a1e0b32ed620c2ca67a52fef8ada1297b8d7524b77e0ce85031944f9b68d42907b8d3fff389b5e811f132366b9736b824802
SSDEEP 1536:xZey/YeXc13CVrhJdi0CO3/yZF+8WsB4Khh1NjZuIN1PktXjAcyWFICPEZFXZwYa:3QbtnRqx3ICeZwY6L
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.3/de/System.Runtime.Extensions.xml

SHA256 ea84f637b557512129207f7f816aa3c62b0296c6917cbff34cdb928969196b3a
MD5 a9ab333f2ebbe9c94086a2e9c044e07b
SHA1 7a2697cae797fef36fa7fb713b436dacdce123f5
SHA512 976d90b99552f5ba4971b87f1beceabf98723d6ae8465f7617f66a3abce1eec02859ad0702d43c95b843be99e92e313856c2e79ba84a41515a7c70ebb9f62d59
SSDEEP 3072:Osxv9y8go4PYao48m9VbSyn1NoN97dh0PI:6PHo48m9VbSyn1NoN9Jh0PI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.3/es/System.Runtime.Extensions.xml

SHA256 4ccb883b823eab712662dbd27446bbba26633f30c6f3dc48035fc984f2f175dc
MD5 cab318118ddd9443ed459aaf077e057c
SHA1 dbdafc04d4c044a9f457f4d74205608dec69dc0e
SHA512 c207f85942795d304780b0b7b6e47c0e1f2c23e715b4e7898be74840490428842ce8314e81a73432975c26dfb314818ae5001e0a219c9829ab17763b08d8b0b7
SSDEEP 1536:aqh6BHcB21qHDvcsJhc9o+cmmcMtA6IcdoqcGNjcdvH3EQDer42aMukXKZcVykD/:aqUVvH3EQDsaMDyZM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.3/fr/System.Runtime.Extensions.xml

SHA256 326c8c1206e7331bfc80ba9948a0638a8882bb83939e7920be6d192cb81ef3db
MD5 d442a591bc50e4f0073047734f7f127d
SHA1 adb2d0c88a626c4f30c699f0c48ed04c666134de
SHA512 619193460eef3fa612381ac80fb6910ff285d2cd28c56f74bdbe7d820e6c16ebe870cd0d7a30a397c009b6379e7ff94ba197dfcec3ca89db01b352df1b460bc5
SSDEEP 3072:I/hr2QagJXGieh4+lTcyfL6DW0LZikuL+bxbblOb0vN9P9tjn7nRnFnZnhnqgzKE:hWEduC36d
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.3/it/System.Runtime.Extensions.xml

SHA256 fbc7abcb604f7519a57dcec5310e02238d98475ec9cca3c944b905b0ea24e6a2
MD5 a8c8dfde42f643d7168659f1b2da4ecf
SHA1 3b7f6efbc623c07565bcf6ba330e6af54aec5729
SHA512 c0548e12634c46f9ab691bcec4ad2418ba823e826fb7c3c4f223c4de3e5eaf34a6be2c69b847f3c4e33563af7772a44631c047b7999dd58631b36e0af5ad14a4
SSDEEP 6144:lT78b8V838lTDToTEm9rpi7m1bAGhTLXGubS:gjo
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.3/ja/System.Runtime.Extensions.xml

SHA256 f89c29b39c7bab72ff59a3b9b00478a1a84db0736ae70da9142817ef24882eb2
MD5 3ec00219ed8d2ca104af3130dcb1917f
SHA1 867b84d2df6033adde5e3ccfca19c849b901a6ba
SHA512 bdb86e274ee7b096ab4e949b142998f816c39334acc870e4662bbefc51f6275ccd11df2a041b6b3fd7f98f4d66d7c651330eae6413f4237a2ecd9a954c2b3613
SSDEEP 768:Yr8cLt9rs/fJy7UbUuWS1LVVyVd95V/VfVcVvVbTV5QF9FAV0VQVFJ8ypEWTm6YO:L+YlkHer1ocQ8qp2Cspwezius3BU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.3/ko/System.Runtime.Extensions.xml

SHA256 6545ed04ad31e0695f4077be9f1677fc7bbea19bb130a64997facfd52101074a
MD5 3d7ccc379f429124215cd6e2ef0954c7
SHA1 982dd7d846ae2621b1783ba27da7fcf64cd060dc
SHA512 fa59987a36c81cfde8f1cb94fa49110cbbe1639a0bc19731e4963b3c3fd722fdf83d14e97d1fd539a9981275d4112d0a4a17dbc4e36fe354d66d5bcf271c004c
SSDEEP 1536:noICwFgxjAOTae+nN+w/DiePNmaaRt0OFOK:jF1nBiePN0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.3/ru/System.Runtime.Extensions.xml

SHA256 95195486886010253c43771007c40efcc3d935047d7dc552789492f58f35f4bf
MD5 a614d6e5bf22a087b923c5792a08184d
SHA1 a06b86e8bb6ccdd80b3a5409cc30543c6304e98b
SHA512 edea0b3b944fe3d80ee38145f2b4edc7b8e08e05e738c68f89fc2b12ea42a3f69db323fffcf1ddf29400e419e6abad419b1cdfb7ea35b39084152f1ed0aa56ec
SSDEEP 12288:70OSf1m6SXmS1R4TmoSUjGPti98TjJrctH9XSTXPd6+Y8BKaQmmZKdO5/jb2y7Gt:IA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.3/zh-hans/System.Runtime.Extensions.xml

SHA256 ba8b4096516b2a148cea07f3f0be9957defb3729465290d09eb54750ade6f854
MD5 5f4aba4d4e68a8700b1dfc7557799757
SHA1 03f5033070042211ec2013aa25d10424a89d3753
SHA512 ef6d20468ffd946e6e7d798644ac4626d14a05328e6b7fa9bd6b968398c4ae5aaf5d75aa12a9831ff4925f0a1756622f67377fd71acc7fab231671fac828236d
SSDEEP 1536:yYFpTgLNXDoDvCUThjOcVfhRRR2W6haH82m7d6C0Fr2iaqitL/pcOODlRuk7UPmB:J9itQloc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.3/zh-hant/System.Runtime.Extensions.xml

SHA256 c3bf90cd37b3a20d435ced0b3f8efc7d85ad616c7e729edda731bb2570875c86
MD5 54f1c631570808595c1819df0d7d9b8f
SHA1 1b1e213b3afde5d84b90051dc2bf969cdad692ba
SHA512 ece2d3ed94bf7f23981442bf9a048c2ec51e7276c486d2190f1364c17ed55999e1b8769c15cf2865d71931a3e3b2e3a51ace7fa9b66257e6233b973f6014bc22
SSDEEP 768:YdfACcctU+y8DeJlSxUSEDnaYGYgMLBKzC3rGlC9KB8ow8LaWn/n4l+J0AjCFM1R:QlMLd3ClV6ow8LaWn/n4l+LjT63NfaX
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.5/System.Runtime.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 31863dd11c45b7b609af14fc057c806a8fb2af6d9cb0fef06624312563b2454e
MD5 7cd6a55cee4610da3bf51e06c5b7cc6a
SHA1 08b280926703530499bdfc9add4b15b12df797b6
SHA512 36f8cc63aeb963818762ba179eb1198348c6e7ec88f8de1fc9cca98ed24ea8f257004851a8034d99c66eb8233a9b0116887adbb12b0b880bc74b0a5e5dd9c36c
SSDEEP 384:yXmyBeVJyeOcDmfMU/lIB/dh2s+/Qw33mI9dmWbTWhaCIcPA0GftpBjTolERHRN0:oBeVPOgmkU8ah4MmqAi2lEBJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

97:e4:22:e6:5b:8f:f7:8e:ba:83:2f:00:6d:0a:fc:17:de:1f:20:ee:96:82:2a:13:4c:0f:d0:23:de:0e:41:8a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

45:36:d2:ff:8d:7e:60:7b:11:3d:98:e2:30:04:38:7e:b3:ea:53:b3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

27318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Runtime.Extensions\4.1.0.0\System.Runtime.Extensions.pdb

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.5/System.Runtime.Extensions.xml

SHA256 24f0392c97a08d3b178b6511b180ef10e3df77be935d2f224b7192f49e0239c2
MD5 134503de0fa1216c93a78af3b2ed7e14
SHA1 183b01e0b3e8fe3451a56912e2bbb1e1ec66f655
SHA512 07a0ec3556e8a0aaa7a54c6be411a1e0b32ed620c2ca67a52fef8ada1297b8d7524b77e0ce85031944f9b68d42907b8d3fff389b5e811f132366b9736b824802
SSDEEP 1536:xZey/YeXc13CVrhJdi0CO3/yZF+8WsB4Khh1NjZuIN1PktXjAcyWFICPEZFXZwYa:3QbtnRqx3ICeZwY6L
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.5/de/System.Runtime.Extensions.xml

SHA256 ea84f637b557512129207f7f816aa3c62b0296c6917cbff34cdb928969196b3a
MD5 a9ab333f2ebbe9c94086a2e9c044e07b
SHA1 7a2697cae797fef36fa7fb713b436dacdce123f5
SHA512 976d90b99552f5ba4971b87f1beceabf98723d6ae8465f7617f66a3abce1eec02859ad0702d43c95b843be99e92e313856c2e79ba84a41515a7c70ebb9f62d59
SSDEEP 3072:Osxv9y8go4PYao48m9VbSyn1NoN97dh0PI:6PHo48m9VbSyn1NoN9Jh0PI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.5/es/System.Runtime.Extensions.xml

SHA256 4ccb883b823eab712662dbd27446bbba26633f30c6f3dc48035fc984f2f175dc
MD5 cab318118ddd9443ed459aaf077e057c
SHA1 dbdafc04d4c044a9f457f4d74205608dec69dc0e
SHA512 c207f85942795d304780b0b7b6e47c0e1f2c23e715b4e7898be74840490428842ce8314e81a73432975c26dfb314818ae5001e0a219c9829ab17763b08d8b0b7
SSDEEP 1536:aqh6BHcB21qHDvcsJhc9o+cmmcMtA6IcdoqcGNjcdvH3EQDer42aMukXKZcVykD/:aqUVvH3EQDsaMDyZM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.5/fr/System.Runtime.Extensions.xml

SHA256 326c8c1206e7331bfc80ba9948a0638a8882bb83939e7920be6d192cb81ef3db
MD5 d442a591bc50e4f0073047734f7f127d
SHA1 adb2d0c88a626c4f30c699f0c48ed04c666134de
SHA512 619193460eef3fa612381ac80fb6910ff285d2cd28c56f74bdbe7d820e6c16ebe870cd0d7a30a397c009b6379e7ff94ba197dfcec3ca89db01b352df1b460bc5
SSDEEP 3072:I/hr2QagJXGieh4+lTcyfL6DW0LZikuL+bxbblOb0vN9P9tjn7nRnFnZnhnqgzKE:hWEduC36d
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.5/it/System.Runtime.Extensions.xml

SHA256 fbc7abcb604f7519a57dcec5310e02238d98475ec9cca3c944b905b0ea24e6a2
MD5 a8c8dfde42f643d7168659f1b2da4ecf
SHA1 3b7f6efbc623c07565bcf6ba330e6af54aec5729
SHA512 c0548e12634c46f9ab691bcec4ad2418ba823e826fb7c3c4f223c4de3e5eaf34a6be2c69b847f3c4e33563af7772a44631c047b7999dd58631b36e0af5ad14a4
SSDEEP 6144:lT78b8V838lTDToTEm9rpi7m1bAGhTLXGubS:gjo
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.5/ja/System.Runtime.Extensions.xml

SHA256 f89c29b39c7bab72ff59a3b9b00478a1a84db0736ae70da9142817ef24882eb2
MD5 3ec00219ed8d2ca104af3130dcb1917f
SHA1 867b84d2df6033adde5e3ccfca19c849b901a6ba
SHA512 bdb86e274ee7b096ab4e949b142998f816c39334acc870e4662bbefc51f6275ccd11df2a041b6b3fd7f98f4d66d7c651330eae6413f4237a2ecd9a954c2b3613
SSDEEP 768:Yr8cLt9rs/fJy7UbUuWS1LVVyVd95V/VfVcVvVbTV5QF9FAV0VQVFJ8ypEWTm6YO:L+YlkHer1ocQ8qp2Cspwezius3BU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.5/ko/System.Runtime.Extensions.xml

SHA256 6545ed04ad31e0695f4077be9f1677fc7bbea19bb130a64997facfd52101074a
MD5 3d7ccc379f429124215cd6e2ef0954c7
SHA1 982dd7d846ae2621b1783ba27da7fcf64cd060dc
SHA512 fa59987a36c81cfde8f1cb94fa49110cbbe1639a0bc19731e4963b3c3fd722fdf83d14e97d1fd539a9981275d4112d0a4a17dbc4e36fe354d66d5bcf271c004c
SSDEEP 1536:noICwFgxjAOTae+nN+w/DiePNmaaRt0OFOK:jF1nBiePN0
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.5/ru/System.Runtime.Extensions.xml

SHA256 95195486886010253c43771007c40efcc3d935047d7dc552789492f58f35f4bf
MD5 a614d6e5bf22a087b923c5792a08184d
SHA1 a06b86e8bb6ccdd80b3a5409cc30543c6304e98b
SHA512 edea0b3b944fe3d80ee38145f2b4edc7b8e08e05e738c68f89fc2b12ea42a3f69db323fffcf1ddf29400e419e6abad419b1cdfb7ea35b39084152f1ed0aa56ec
SSDEEP 12288:70OSf1m6SXmS1R4TmoSUjGPti98TjJrctH9XSTXPd6+Y8BKaQmmZKdO5/jb2y7Gt:IA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.5/zh-hans/System.Runtime.Extensions.xml

SHA256 ba8b4096516b2a148cea07f3f0be9957defb3729465290d09eb54750ade6f854
MD5 5f4aba4d4e68a8700b1dfc7557799757
SHA1 03f5033070042211ec2013aa25d10424a89d3753
SHA512 ef6d20468ffd946e6e7d798644ac4626d14a05328e6b7fa9bd6b968398c4ae5aaf5d75aa12a9831ff4925f0a1756622f67377fd71acc7fab231671fac828236d
SSDEEP 1536:yYFpTgLNXDoDvCUThjOcVfhRRR2W6haH82m7d6C0Fr2iaqitL/pcOODlRuk7UPmB:J9itQloc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Extensions.4.3.0/ref/netstandard1.5/zh-hant/System.Runtime.Extensions.xml

SHA256 c3bf90cd37b3a20d435ced0b3f8efc7d85ad616c7e729edda731bb2570875c86
MD5 54f1c631570808595c1819df0d7d9b8f
SHA1 1b1e213b3afde5d84b90051dc2bf969cdad692ba
SHA512 ece2d3ed94bf7f23981442bf9a048c2ec51e7276c486d2190f1364c17ed55999e1b8769c15cf2865d71931a3e3b2e3a51ace7fa9b66257e6233b973f6014bc22
SSDEEP 768:YdfACcctU+y8DeJlSxUSEDnaYGYgMLBKzC3rGlC9KB8ow8LaWn/n4l+J0AjCFM1R:QlMLd3ClV6ow8LaWn/n4l+LjT63NfaX
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/.signature.p7s

SHA256 83bac121dde429d7a43e52161bd7cef44f5c47ff5a5f3ea8ea8fcc934e8b7482
MD5 98e72f624e189c0d3ce40694081bc664
SHA1 a1395bd7c25a76428f51c3a47741c79b496420cc
SHA512 1c2520b6c649f04f439edec3cca14d569fbf7c7a273e94e62fabd8a87543b5f0ef76482facfbf1b2f04f50ed0c9679a25118db187a15c0652a9305acdd7075b5
SSDEEP 192:xdx7x0KDWpHhXZCVzV07Vrjj2GDH0JOqsmVgz28WhBqVaOjZ:jrvDGGVpMj2GoJN77hhpwZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/System.Runtime.Handles.4.3.0.nupkg

SHA256 289e5a5e81a9079e98ebe89ea4191da71fc07da243022b71e2fae42ea47b826b
MD5 a637d7ae77e8415db609c0eb3f8f04d3
SHA1 54790934374f952f5b39239146a3df0bc6d50180
SHA512 0a5baf1dd554bf9e01bcb4ce082cb26ee82b783364feb47cba730faeecd70edc528efad0394dcce11f37d7f9507f8608f15629ebaf051906bfd3513e46af0f11
SSDEEP 1536:ex6voUvgNvc8KB2GaM2TJ55pUIb/4j8rKI8Yy3hnw3y7:ex6Adch21M2TT3zm8CYa57
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ref/netstandard1.3/System.Runtime.Handles.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aa84213661c74f458164a4e835b5b687940789d6da83787e8b25cadb38fd5b4f
MD5 70148aeb5f8332bbe4cfdeb5b3b54587
SHA1 49c45edb8e4c5507bbc9482971a403fbc320cfb3
SHA512 4e586f3967b897d0c3d760bfd90e90aee30d368fa17d9d16ad59ce4093f09f9f5495dc50f0f43a1c2153ce1e32b611dbfc7eb6afab1a072cf5ca926cc7948397
SSDEEP 384:kKOX7lYQWa4BIW6oWFyAA0GftpBjcERHRN7Ll2IwnR6M:ISa3hieEBkIXM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

7b:ae:24:ad:b0:3e:f7:51:57:13:f4:c1:08:6f:99:4b:a7:fb:c6:b5:21:1f:a9:57:bd:3a:ed:08:e5:d1:3d:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a4:38:a6:88:0e:a8:2b:f7:73:22:b4:0f:01:91:da:d8:ff:ef:05:6a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

12054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Runtime.Handles\4.0.0.0\System.Runtime.Handles.pdb

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ref/netstandard1.3/System.Runtime.Handles.xml

SHA256 0226270b92c3b00de9d9a737b7b30893f65b79ab0fe9ef0d79351ea3c7d838cf
MD5 83c3747d91af4f9ad272881d128ebf50
SHA1 aaa88445dab80f6b3333f37f4db7639b866e4cb7
SHA512 52b36bcb5c75ea423961164603d28c44dfcad8e6b499b7fcb65cf26f19ec1ad99fcf7945fb00100ec8f20c78a7c1eba413ef1d6865675ca07114446b093d78a9
SSDEEP 192:YXxln+OjxOygpG6z38B5HyOJlOCKZ24cBZQHIN5ejG52:YhXEyUAdyCweBHN5g
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ref/netstandard1.3/de/System.Runtime.Handles.xml

SHA256 89aaaed08e5f478d2fc5fb047e3ae3b5f2eb64fef9c2b1c1b26f3244d9c5aa5e
MD5 d74232b5f5ceac5c13a56ff4cfdef41a
SHA1 07b36f22e167f18fe3a7b40e4f67ce5723c89b10
SHA512 4074f5e17c7eb8b5a6e169a3df04aeecdda0ec608494c8a234a5738470de75846922e7b4cec04b009126a27a0507971edda271b85fb9a27e605767eec04b8944
SSDEEP 192:Yehy7ogWXOsg8hm5oOge3H6OXim0wAZuB/N5tVaj:Yehy7o9+8g5obCLUwOuB/N5tVM
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ref/netstandard1.3/es/System.Runtime.Handles.xml

SHA256 4aa457b203e71d0eec83e4ff6c3d195c97496391d521f2ab84a994a7a7665cbc
MD5 998f2b0d66cdd909bcb4a101b9681ce7
SHA1 e37255a8d0600173dd86da6671bb85493d364408
SHA512 7dbb9759c1994f6b158ffb1de8b2f336492f436e3873684e65bafde37c4e0102bb470eeb5406aed12de61d160630a21df1f69e53e1f34ff6a762f6d8055954f7
SSDEEP 192:YeXpVZhw0G7DYNq4+b4r9ZkBVuSa/SXbS5N54uSVSEn:YwpGGRHkBaN5a
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ref/netstandard1.3/fr/System.Runtime.Handles.xml

SHA256 78f2283219e050082b4fba983ece534111cc3aced98a39e34c1f2341e793758a
MD5 33337c3af795bada9adb97e7534d7460
SHA1 be9eb9f09f22bebc0230adafb38a97180dd6abce
SHA512 522d906249a7924e34c12543483a546e36437c0b73c6a42eacf7574e505b8f0dfdc3c3f978d7b8e30b0a7ad54f4114d116038fd919b8e5fb67e03af07a7f5540
SSDEEP 192:YP4cX8i+YIiJFKBVhr8kmExH3HQqdZc6i0iqYt5VFGxtZYBDrYxQZN5W+N:YT0YC//3YBpN5z
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ref/netstandard1.3/it/System.Runtime.Handles.xml

SHA256 41e4b0f8df7297a145152ecca5137e9c7da4520280ef6738164f32a47cf8d247
MD5 11a3cd83c4246c3b147b528f881aef67
SHA1 8df361b3cead14b6b0629be004a87bbe7bac820f
SHA512 67e7ac8234e4b6de7933bbbad9d79ace6bae95e59f9391b6bfe62985e05351b902d6081c2dc14cd11aec1553ea8e4e866ca17f57a1e0fee941818c53210181f6
SSDEEP 192:YX2wTLjD64H46kIbAxD4ZW7eEm3pRp4H4OZ6PAxDv/ZwRBtWZ92N5dW9rM2w:YGwLju4H4GS8fN4H4XSFmBLN5Ei
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ref/netstandard1.3/ja/System.Runtime.Handles.xml

SHA256 5fac7385a48174604702d75332c4a1e82cbbe76b4763ff74ff12b0bba10d3a8a
MD5 2ab2366531827d32ccc44a15b1460bf6
SHA1 7d10e32559a47540fe0fec11947649008760f511
SHA512 31cf86bad6faed2f12287750691ffc05a0e0ea991d0a4b4219013ae48f1ebf47e30e8bd3866a7d9beae0ab99d2cdc6e65b25d1d90c5420dd57c8c85dbd4a097f
SSDEEP 96:Y1vTlc1efbm6E5YYN1ragwi6Igw4SI+hAo/1cMm9g2sAKM913agwOAIgwcSI+9Av:YMQYLiiF8SX9msAKMniO34iXZhBiN5p
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ref/netstandard1.3/ko/System.Runtime.Handles.xml

SHA256 5c6beea80c2a0e30ecc57a7838317b7e746994e1b91a43449978d0fb5540529e
MD5 ed0d57fab905e10dba03f963af4a135b
SHA1 ebe65ec082f7b778c95a1c15a99a75c50c5d175e
SHA512 a80793c3a61aa6a22823e687b7885d3e871afab98bba85e1100928f5769f3e94be088a32d0a1d42ee0ec7dcfeb682b2f04fd6674ef1b163efe3288be81feee9f
SSDEEP 192:YWZAwtEUxtmtNCqVFLCRJwkf2ZsA4htytZCq9FxZfEB5N57y:YWZlBxMDRfuR6kdhUzR3r8B5N57y
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ref/netstandard1.3/ru/System.Runtime.Handles.xml

SHA256 c5fe0643f0d22ff9e3e96a692b7049847dff7e7912b1f288c533ba5d90add1bc
MD5 1aae0db81d67246b7997c42acdb76651
SHA1 e57d4292242996885233af24b53c01f4008df0ba
SHA512 c2961376a04d9ab4f27c3710335946d5139203ed0fdf5d0464bba801d7a36fe054d16ebe0137ccbfeeae919248eb0e9c0e24e018963d13d859688c33353bcadb
SSDEEP 192:Ykc5k8R8BjqLOcmHoc5FXfg8Doz0JjQDebGiREYpfOcydoR9dZXK3sqSgZQBuzNs:YkndnffDoz0JkqbGR2K3PSuQBuzN50Z
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ref/netstandard1.3/zh-hans/System.Runtime.Handles.xml

SHA256 58205f84c99cbbabecd418c395ccc24e17648f75a417f87ec4c06765a44491dc
MD5 a08bf97d1efe5fda91512482d9f353af
SHA1 1bc97b2aaa433b875200eba047f778e3e41a3e37
SHA512 0139b4302912e40cafaf620e03d2df68fd3396b0859fff3cce307dd7c9bf443ff52ebc142ac2cfe909711795613a9afee16f591d5aee02dc5bd293a1c01a6780
SSDEEP 192:Yz+V7NOBykYZWL3fc7mD/+VhS0GnHoEYfV3fcGmBZy4FB5N5G:YyVtnmD+V9xm7y4FB5N5G
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Handles.4.3.0/ref/netstandard1.3/zh-hant/System.Runtime.Handles.xml

SHA256 78bb1b6f302b80e942bb7ffd48539bf36cefc61b8b020deee3870a43544cf077
MD5 9f3fe688cfb50d6f48beb2eed0f6d6a5
SHA1 94fe985b08967819a9327c0b64ce49522f5f1750
SHA512 53ce2a2b519ced3e304f5e57a1c8d2463c9118ea498f282df4397c7f2a9f254b7ed6be47d8b8f9ae039f8e219a4e40b631958064404ce62a800abfbf5dc817a2
SSDEEP 192:YJkIQCZMoC9LeHUemvjpI/tTVFUXoCBLecowmTKZbBGN55M:YpTmve8mTwbBGN55M
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/.signature.p7s

SHA256 c12d76f2facda05102d4c224b708946c61d285c6fbc0628a3791fbb2b731eba3
MD5 6ee9f354cc35af872a60e1f9f5952619
SHA1 6fabab20885a9c5df3fade0d6ab7a42ab294e327
SHA512 bc1e8922db8b2397e7f18f37f65ff7bda92d89b78126ee6231e5ac55db5c187ce1e6a25af501e5af2f5981de376f75a9f88481f28ee25cdac7eb5bf08e83a4c5
SSDEEP 192:8dt7x0KDWpHhXZCVzV07xriIGDH0JOqsmVgz28WhBq5FR:EvvDGGVpNIGoJN77hh0b
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/System.Runtime.InteropServices.4.3.0.nupkg

SHA256 f2c0c7f965097c247eedee277e97ed8fffa5b2d122662c56501b9e476ce61e02
MD5 cb7529145f71e4a694c0853f0996448d
SHA1 20521141d9c8a1ea086821c3c846f92a4074c8fd
SHA512 650799c3e654efbb9ad67157c9c60ce46f288a81597be37ce2a0bf5d4835044065ef3f65b997328cbbbbfb81f4c89b8d7e7d61380880019deee6eb3f963f70d9
SSDEEP 49152:5uree5oT8K9Y+RgbHShT+K9YAjPRjG8ChlTIK9YTctVNIdTuK9YahgvzeJTWK9YF:YeqMY+RgbrMYAjPw8jMYTctVzMYahgv9
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/lib/net462/System.Runtime.InteropServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 53e97936af2e5fb19e4d9159c13b83b49cf76bcf7d251930e0e11a66332bbb5a
MD5 826cdf5c864dba3fac283e694b5d300e
SHA1 452039516e53e284d9db5112cd1d5d50a954c1e2
SHA512 31dca2d1957a8404414fcb8d4a63820c8b2ca1a556c4db3d6644eb71d917b0278c2753b2b0a6e51b496a722fa8047f783a7ab88371e34cec97f4fc08f5462079
SSDEEP 768:2HlUQy7QV5+nuEWS7YLxE2AWMuzMtENmvsOqqnk7bd/EAqT44k9i7EBToFN:HfT446QEBToz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

df:72:db:64:f8:2a:16:7c:b7:d1:a7:39:92:8e:1a:a3:2a:1f:61:6e:d4:82:69:0a:13:bb:7c:a7:28:b2:7d:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a3:56:eb:e6:83:ed:f6:e1:c1:43:ff:62:f4:83:8a:78:e6:fe:8f:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:ec:3f:ad:b6:8b:b9:2d:d2:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2016 - Aug 3, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin/obj/AnyOS.AnyCPU.Release/System.Runtime.InteropServices/net462\System.Runtime.InteropServices.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/lib/net463/System.Runtime.InteropServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bad0d5b969a91a17bdd0ac3005a8f547e317673b9ffdf664525baddd6d7e4430
MD5 0c39c4e24bcaaefba2bd9082839aba63
SHA1 2dad0a731fbdf5dba19b46906e2c6aeb5a500b78
SHA512 63d1c301129f3855505dc5d79f8eea71e9e107abe4583aea18ed524693c2da16e173413236c99756461f7345f478ee71b211f102b8e73e730a7a7c79c9c70b39
SSDEEP 768:HHlUQy7QV5+nuEWS7YLxE2AWMuzMtENmvsOqqnk7bd/EAg1Q8iylEBQe3:E51Q8nEBQe3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

75:cf:17:02:ca:8c:29:f2:6e:18:8d:2a:88:46:fa:58:a8:60:3b:12:e0:d0:9c:ac:b5:2e:68:ae:95:fe:de:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

6f:de:8d:cb:ac:a9:c2:c3:8a:b9:62:c4:4d:1c:91:9d:f4:c7:53:d0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Runtime.InteropServices/net463\System.Runtime.InteropServices.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/net462/System.Runtime.InteropServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 53e97936af2e5fb19e4d9159c13b83b49cf76bcf7d251930e0e11a66332bbb5a
MD5 826cdf5c864dba3fac283e694b5d300e
SHA1 452039516e53e284d9db5112cd1d5d50a954c1e2
SHA512 31dca2d1957a8404414fcb8d4a63820c8b2ca1a556c4db3d6644eb71d917b0278c2753b2b0a6e51b496a722fa8047f783a7ab88371e34cec97f4fc08f5462079
SSDEEP 768:2HlUQy7QV5+nuEWS7YLxE2AWMuzMtENmvsOqqnk7bd/EAqT44k9i7EBToFN:HfT446QEBToz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

df:72:db:64:f8:2a:16:7c:b7:d1:a7:39:92:8e:1a:a3:2a:1f:61:6e:d4:82:69:0a:13:bb:7c:a7:28:b2:7d:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a3:56:eb:e6:83:ed:f6:e1:c1:43:ff:62:f4:83:8a:78:e6:fe:8f:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ae:ec:3f:ad:b6:8b:b9:2d:d2:00:00:00:00:00:ae

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2016 - Aug 3, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin/obj/AnyOS.AnyCPU.Release/System.Runtime.InteropServices/net462\System.Runtime.InteropServices.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/net463/System.Runtime.InteropServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bad0d5b969a91a17bdd0ac3005a8f547e317673b9ffdf664525baddd6d7e4430
MD5 0c39c4e24bcaaefba2bd9082839aba63
SHA1 2dad0a731fbdf5dba19b46906e2c6aeb5a500b78
SHA512 63d1c301129f3855505dc5d79f8eea71e9e107abe4583aea18ed524693c2da16e173413236c99756461f7345f478ee71b211f102b8e73e730a7a7c79c9c70b39
SSDEEP 768:HHlUQy7QV5+nuEWS7YLxE2AWMuzMtENmvsOqqnk7bd/EAg1Q8iylEBQe3:E51Q8nEBQe3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

75:cf:17:02:ca:8c:29:f2:6e:18:8d:2a:88:46:fa:58:a8:60:3b:12:e0:d0:9c:ac:b5:2e:68:ae:95:fe:de:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

6f:de:8d:cb:ac:a9:c2:c3:8a:b9:62:c4:4d:1c:91:9d:f4:c7:53:d0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Runtime.InteropServices/net463\System.Runtime.InteropServices.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcore50/System.Runtime.InteropServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bd7caf50d13804d58118e84070f8100836caf824e1b57010f65af69c7558cc42
MD5 98942c0e79e0565f490bf70bd87dd65c
SHA1 56eae70e3d7fec90002c9a8557c27692620ef522
SHA512 f75997a41dfe3f4a6abe7c2b8a1bf983d951fd4e12e563b2012271ec7795acd5e47db43871c8a1262eb4a949154efab965d8ed640d2d7dfef7fccbc9a0dd9ffd
SSDEEP 768:8Z6wLEdlleEjeO0Nkrj4fSLdFF9as7jBo3Yy8irZmG66:v2Edlot+AW9m3YBmZmp6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

bc:6c:7f:6e:90:fc:07:47:e6:5f:e3:89:d2:1f:f4:f3:ed:03:5c:68:3b:8e:cd:5c:b9:1f:49:3f:34:de:65:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d8:e0:a2:2c:6d:16:bd:fa:93:f1:26:27:33:38:91:e7:f6:e9:49:92

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

50702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Runtime.InteropServices\4.0.20.0\System.Runtime.InteropServices.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcore50/System.Runtime.InteropServices.xml

SHA256 61e34e67b8b618fba5e516f1eeab40e37087132516986844a898ab8c211e1cd1
MD5 f107c34c81428ecb4b119e4a25743ef2
SHA1 cf1a1ac8b8381565550c50d0dc8e732bf2b2d211
SHA512 3f29476bf2f57c9f5ffa00faa420f9fbb90279c2183d4414a0d621705f178e857ab9cf24eaf2ff1398ff21254738eacb4ac915b7b060784167332480d561193f
SSDEEP 1536:3U7n78wao+efXUoeeqB1KEWhsLfXUz/rLtSZOsHN3ZuC39Z+ZPU8IcVo3VD4LlYh:3IhsDUz/rLtSZORAJ4HYcVu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcore50/de/System.Runtime.InteropServices.xml

SHA256 7b9f8d777ac21103aac8b664bc58b3839d4867e365135bbe83e63b6fd6afd48e
MD5 7ec8d47be7eec8647e1448f500608060
SHA1 b005c7a7b1bc41ed82a788b99a17e53c8d9514b2
SHA512 2501bf25a1687d982d290e017c61256013349db156f255bc7c09b082ad93a7ddaa6c2757029ef2127bd243ab1b874c1ce4216c213a67ad26c2c1d6167de46888
SSDEEP 12288:7T0c8c1CpHW2PT6CcCNeyV7N1/eQXMdMYl:7T0c8c1CpHW276CcCN7r/eQcMYl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcore50/es/System.Runtime.InteropServices.xml

SHA256 d0c00892fbbd320086732d49c8be17d2651f86acc9f96849e9f0f7c729c44c14
MD5 a15f5225b1a54b3c91425264dfc218d5
SHA1 154ddd26f0c41d69cfecc3aafeec837c5f22ba71
SHA512 7b522d6182aa11d374370b9e17eb308265d469b6989c020b2c0cc18f06aa7730c9bb8d1abf5ca1ac3f8819546a3c8569dd85785e6212f12a2f0288d7939d2e8e
SSDEEP 1536:JQ95yJTCJOCUNpvWn58izT585s2Be2Wy6FFbTeKMK3Xg1YFMWy7yryxy4yMyAt4S:ASne2WZ3VfA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcore50/fr/System.Runtime.InteropServices.xml

SHA256 c29ddc3902c368de31e340e6c0be998f56e16c0bcf892cad59db7b46a002326e
MD5 6668962bfb6c3010c5cfe386c921fd47
SHA1 211b5c7be67514215fe7b7d4db2d3e8d476beb9e
SHA512 8fbd5483c4671cc2babe549217a569c2e06401b5ea01056a990e125281113e522fdebb3f6efe7fee6799545a93a42d469612781363bcb5194ef527ef5fa8009e
SSDEEP 3072:u+4sqEIBo7SYEFI5VSrzFwmvWkclOIeOwgHSnve1YdnH:u+47F3vWkclOIeOwMSn21YdnH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcore50/it/System.Runtime.InteropServices.xml

SHA256 c087e9275c5ae5e9e312fbf2ba1af216aa128564c2866bc77fad614e95727abc
MD5 be38702027bb915dd5557f4c1c6a11ad
SHA1 61a99229ead626ae4103221f59193141ccf736e1
SHA512 cba49b0db0712549e5a1c3095431dfd7b23d1c283119282c1ca048a2b2e45aee97712dc2e85f4306bda42f95e173b1db665483af3419c668bd8eaef715761b0a
SSDEEP 6144:CEWje8mHFTwC97Mo2q2amJ4VYPxm8jUaHDKkj/3ezvy:+f
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcore50/ja/System.Runtime.InteropServices.xml

SHA256 ead41445048ce43cd488aa3a06411afcd55d1ddb0632fc03c9f4f920496f7b08
MD5 b66d5385b53ef118cc0e6d08e6e29ba3
SHA1 59b37e8bac03e9919fb4132c822834048a3e75e7
SHA512 359f8faed4aebee86e21c8036ad1d943adf58a9850ff867b7ce52f472caf0b32858534d655dc107562530e189ec9152a471013954ec36bd29b5f85e6a6c6bbcc
SSDEEP 1536:0++pUEO1c7wURPowKjepGa55exqe/ab9zhtmGHi809TL9eO9e:He8Ja55eQe/abNHi809TL9eOs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcore50/ko/System.Runtime.InteropServices.xml

SHA256 a3d59d40239a8417c7ebfc28099eb83654429256cae12907283f8f195940525b
MD5 583ef11535d7ba81ef46b7bcd8f7a5db
SHA1 0fede3e0abfb4faa434d52e02562e033fb99a3da
SHA512 f8d92bd2a86f51559d8de99e37a5f944e79a7b8b60049293c706f0d0d56d94d1c746b5d699e640acdffd22c06d348f94b737f4d4c239176ebf50c9efa40ad3e1
SSDEEP 3072:w2ylgzdunxHxK3bGIPE/bV4ysq9bKyQiUC76A+7pdpQTmxhbPC:Z9zdgHN6CiemxhbPC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcore50/ru/System.Runtime.InteropServices.xml

SHA256 376ee1a05f16cb9042659d917e59ab68a29c73e1c2a602270421df4494e5ec66
MD5 e1c2455ba3887332cb6684d570c6d4d4
SHA1 a6fa9644303aea3ac11ceef23d8bead9777f5486
SHA512 1ad12eb0324be0ec75cad0dc4dcaf7f41f0f42ab055b69a02bcfc8d917d9b8a73c6427ef0769d0fe01194e6d2b62a151b55a88da59dc7096537de9806ad66dc6
SSDEEP 12288:3clHKor0xftdSopoKz+1+x7rPrgNv7q6eGCEHY1AldOTPCMbZXr3agJsOfMm5j9K:yeAfOTPCaw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcore50/zh-hans/System.Runtime.InteropServices.xml

SHA256 1041595ee24dea387f1d1f82c773e747c0827ac9b0168464fba47d39ba274095
MD5 ce890052c1e911a07abd74f887b483b9
SHA1 84395f14df779a81987e5e12ebdd263779b8482d
SHA512 3c6bdfea4b8a3660d27a98f8335649ba7a51e427174159fe9652738832908f23157a0e5d25881b0a0df8ebf2a050395c57aaacd39e81c6166a07a6bc6a8de139
SSDEEP 1536:nedw5CNQljWHO17rIgkhmS9HfmmvRdPOSWElzscHYCVeOqQ5VvYch/hO9QtH2lob:rGHYCzKQW5j3RGe0UMh2BwUhLVk
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcore50/zh-hant/System.Runtime.InteropServices.xml

SHA256 443c4b51cc071068c4d270057e785a245f61b08a36b1628a7ce275ea23619c79
MD5 96114d837f9c3da19702f9db29c88238
SHA1 7a5a9de7a22679f10d1ae12c613b0d79c2f04bf4
SHA512 70338223679b581637cb110ee229536b6d964e7e476c82994a0933f93d104247ed2339f94fb5c420a6d2005b38576a5818d9903cb1a5ea65597c2be81c353303
SSDEEP 1536:48ORMOP39TYgydTxfBzL2+XIVEOd5uZkzI/+a/bH0l/ak+9439hI3GEFdMeJ+70k:+ixZOd82I3Ho5IZ+r
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netcoreapp1.1/System.Runtime.InteropServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0905c74e020c46aa686df0bf2079fef8535f30954521817aabbd71ef8264d23a
MD5 232f9d8f634e5875cc9b467a88a3fce7
SHA1 c2671960ee0bfd948102f600c91509e9f21c214d
SHA512 1982389e863ebbca5501743f65cd9e27ae147852c634be9974ac170a30428bc08dddd79fea9cae16950b4032d0ce8ba0008915c48158aa8843daf54e3f90f498
SSDEEP 768:DSjTPOFelwwoK4zEoftdFF9aNtjBoRDJid1WJEB8R0oO:MTWF2wwoK4z37MGRDJS+EB6O
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

38:4b:d8:84:64:4c:8b:8e:1c:4d:60:8e:5f:a3:7e:ac:ee:1f:81:d0:bf:e8:59:d1:23:d3:11:86:e3:42:ab:c1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

47:0a:94:20:17:74:45:27:dc:60:ec:ba:19:19:e1:48:87:0f:cf:3b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

47394

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\ref\System.Runtime.InteropServices\4.1.1.0\System.Runtime.InteropServices.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.1/System.Runtime.InteropServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bed4a63613a88a2cc6f99955145ac3cc3ede23cf8cd09baf12df033c0fc93ad3
MD5 fab8d4ea74c03409ea76cfd29bd35376
SHA1 1e45c99cef7dd0cd84223fdf5a82b8864b45c450
SHA512 c0a15fa0f3833d9004f6b2c80778c497e3886b66e9c2b1078a390fa94a1da4fccf0e20275c10daabce7e55c64f79528c2ca0b760f091e7acd89817bab2d15023
SSDEEP 768:pzcpMaF9FcEJIa3fWqvYnNd5TLQSlX13Qb/zTTkkp3G9WinD4Bp:uzFQ6Ia3+g2XQS3O3T9GA8D4Bp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

7d:24:b2:67:f9:67:2c:22:fb:dd:ab:ab:8c:6e:b4:76:e1:0b:9d:b4:a9:87:4d:e3:72:fd:1f:7b:56:df:9c:3d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

4d:54:19:50:f6:0b:5e:02:1f:2e:ea:db:0a:06:3a:93:56:6b:bf:f5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

44670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.1/System.Runtime.InteropServices.xml

SHA256 61e34e67b8b618fba5e516f1eeab40e37087132516986844a898ab8c211e1cd1
MD5 f107c34c81428ecb4b119e4a25743ef2
SHA1 cf1a1ac8b8381565550c50d0dc8e732bf2b2d211
SHA512 3f29476bf2f57c9f5ffa00faa420f9fbb90279c2183d4414a0d621705f178e857ab9cf24eaf2ff1398ff21254738eacb4ac915b7b060784167332480d561193f
SSDEEP 1536:3U7n78wao+efXUoeeqB1KEWhsLfXUz/rLtSZOsHN3ZuC39Z+ZPU8IcVo3VD4LlYh:3IhsDUz/rLtSZORAJ4HYcVu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.1/de/System.Runtime.InteropServices.xml

SHA256 7b9f8d777ac21103aac8b664bc58b3839d4867e365135bbe83e63b6fd6afd48e
MD5 7ec8d47be7eec8647e1448f500608060
SHA1 b005c7a7b1bc41ed82a788b99a17e53c8d9514b2
SHA512 2501bf25a1687d982d290e017c61256013349db156f255bc7c09b082ad93a7ddaa6c2757029ef2127bd243ab1b874c1ce4216c213a67ad26c2c1d6167de46888
SSDEEP 12288:7T0c8c1CpHW2PT6CcCNeyV7N1/eQXMdMYl:7T0c8c1CpHW276CcCN7r/eQcMYl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.1/es/System.Runtime.InteropServices.xml

SHA256 d0c00892fbbd320086732d49c8be17d2651f86acc9f96849e9f0f7c729c44c14
MD5 a15f5225b1a54b3c91425264dfc218d5
SHA1 154ddd26f0c41d69cfecc3aafeec837c5f22ba71
SHA512 7b522d6182aa11d374370b9e17eb308265d469b6989c020b2c0cc18f06aa7730c9bb8d1abf5ca1ac3f8819546a3c8569dd85785e6212f12a2f0288d7939d2e8e
SSDEEP 1536:JQ95yJTCJOCUNpvWn58izT585s2Be2Wy6FFbTeKMK3Xg1YFMWy7yryxy4yMyAt4S:ASne2WZ3VfA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.1/fr/System.Runtime.InteropServices.xml

SHA256 c29ddc3902c368de31e340e6c0be998f56e16c0bcf892cad59db7b46a002326e
MD5 6668962bfb6c3010c5cfe386c921fd47
SHA1 211b5c7be67514215fe7b7d4db2d3e8d476beb9e
SHA512 8fbd5483c4671cc2babe549217a569c2e06401b5ea01056a990e125281113e522fdebb3f6efe7fee6799545a93a42d469612781363bcb5194ef527ef5fa8009e
SSDEEP 3072:u+4sqEIBo7SYEFI5VSrzFwmvWkclOIeOwgHSnve1YdnH:u+47F3vWkclOIeOwMSn21YdnH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.1/it/System.Runtime.InteropServices.xml

SHA256 c087e9275c5ae5e9e312fbf2ba1af216aa128564c2866bc77fad614e95727abc
MD5 be38702027bb915dd5557f4c1c6a11ad
SHA1 61a99229ead626ae4103221f59193141ccf736e1
SHA512 cba49b0db0712549e5a1c3095431dfd7b23d1c283119282c1ca048a2b2e45aee97712dc2e85f4306bda42f95e173b1db665483af3419c668bd8eaef715761b0a
SSDEEP 6144:CEWje8mHFTwC97Mo2q2amJ4VYPxm8jUaHDKkj/3ezvy:+f
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.1/ja/System.Runtime.InteropServices.xml

SHA256 ead41445048ce43cd488aa3a06411afcd55d1ddb0632fc03c9f4f920496f7b08
MD5 b66d5385b53ef118cc0e6d08e6e29ba3
SHA1 59b37e8bac03e9919fb4132c822834048a3e75e7
SHA512 359f8faed4aebee86e21c8036ad1d943adf58a9850ff867b7ce52f472caf0b32858534d655dc107562530e189ec9152a471013954ec36bd29b5f85e6a6c6bbcc
SSDEEP 1536:0++pUEO1c7wURPowKjepGa55exqe/ab9zhtmGHi809TL9eO9e:He8Ja55eQe/abNHi809TL9eOs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.1/ko/System.Runtime.InteropServices.xml

SHA256 a3d59d40239a8417c7ebfc28099eb83654429256cae12907283f8f195940525b
MD5 583ef11535d7ba81ef46b7bcd8f7a5db
SHA1 0fede3e0abfb4faa434d52e02562e033fb99a3da
SHA512 f8d92bd2a86f51559d8de99e37a5f944e79a7b8b60049293c706f0d0d56d94d1c746b5d699e640acdffd22c06d348f94b737f4d4c239176ebf50c9efa40ad3e1
SSDEEP 3072:w2ylgzdunxHxK3bGIPE/bV4ysq9bKyQiUC76A+7pdpQTmxhbPC:Z9zdgHN6CiemxhbPC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.1/ru/System.Runtime.InteropServices.xml

SHA256 376ee1a05f16cb9042659d917e59ab68a29c73e1c2a602270421df4494e5ec66
MD5 e1c2455ba3887332cb6684d570c6d4d4
SHA1 a6fa9644303aea3ac11ceef23d8bead9777f5486
SHA512 1ad12eb0324be0ec75cad0dc4dcaf7f41f0f42ab055b69a02bcfc8d917d9b8a73c6427ef0769d0fe01194e6d2b62a151b55a88da59dc7096537de9806ad66dc6
SSDEEP 12288:3clHKor0xftdSopoKz+1+x7rPrgNv7q6eGCEHY1AldOTPCMbZXr3agJsOfMm5j9K:yeAfOTPCaw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.1/zh-hans/System.Runtime.InteropServices.xml

SHA256 1041595ee24dea387f1d1f82c773e747c0827ac9b0168464fba47d39ba274095
MD5 ce890052c1e911a07abd74f887b483b9
SHA1 84395f14df779a81987e5e12ebdd263779b8482d
SHA512 3c6bdfea4b8a3660d27a98f8335649ba7a51e427174159fe9652738832908f23157a0e5d25881b0a0df8ebf2a050395c57aaacd39e81c6166a07a6bc6a8de139
SSDEEP 1536:nedw5CNQljWHO17rIgkhmS9HfmmvRdPOSWElzscHYCVeOqQ5VvYch/hO9QtH2lob:rGHYCzKQW5j3RGe0UMh2BwUhLVk
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.1/zh-hant/System.Runtime.InteropServices.xml

SHA256 443c4b51cc071068c4d270057e785a245f61b08a36b1628a7ce275ea23619c79
MD5 96114d837f9c3da19702f9db29c88238
SHA1 7a5a9de7a22679f10d1ae12c613b0d79c2f04bf4
SHA512 70338223679b581637cb110ee229536b6d964e7e476c82994a0933f93d104247ed2339f94fb5c420a6d2005b38576a5818d9903cb1a5ea65597c2be81c353303
SSDEEP 1536:48ORMOP39TYgydTxfBzL2+XIVEOd5uZkzI/+a/bH0l/ak+9439hI3GEFdMeJ+70k:+ixZOd82I3Ho5IZ+r
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.2/System.Runtime.InteropServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 642c76e8fda6b0510be5cd515efde06d4729e556c9d173d7f6892c90a4cf32f8
MD5 c74f51d732b7353f222ac7acd7fe57d0
SHA1 300b64ea11638ce537d0272171f2ddde70f82f2f
SHA512 b704b3c2fec6b29da59679b07a72b891f02091f775adef6e6a59776c9a0c9716c06489141f9ce5447537838934feb02d1e394bc9177d7b274722c801c59e58fb
SSDEEP 768:cZWuxWExOXw8PTiL0VfJXjj3lfRDILl2FwsTRhJm13QbAzTTkko3yL8iy75b:cjAXq0Hzj3lfRDILl2eAJ6F3TOyL8H1b
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

17:eb:1d:d5:5e:fe:3e:e2:ed:bf:89:ee:7e:1c:e4:f6:71:da:cd:18:37:94:2a:dc:d3:f0:ef:8c:58:22:a8:63

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

0e:9e:f0:02:fe:59:dc:cb:68:2b:f5:78:31:2f:1b:db:87:c9:ee:b9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 3, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 7, 2012 - Oct 7, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

55278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.2/System.Runtime.InteropServices.xml

SHA256 61e34e67b8b618fba5e516f1eeab40e37087132516986844a898ab8c211e1cd1
MD5 f107c34c81428ecb4b119e4a25743ef2
SHA1 cf1a1ac8b8381565550c50d0dc8e732bf2b2d211
SHA512 3f29476bf2f57c9f5ffa00faa420f9fbb90279c2183d4414a0d621705f178e857ab9cf24eaf2ff1398ff21254738eacb4ac915b7b060784167332480d561193f
SSDEEP 1536:3U7n78wao+efXUoeeqB1KEWhsLfXUz/rLtSZOsHN3ZuC39Z+ZPU8IcVo3VD4LlYh:3IhsDUz/rLtSZORAJ4HYcVu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.2/de/System.Runtime.InteropServices.xml

SHA256 7b9f8d777ac21103aac8b664bc58b3839d4867e365135bbe83e63b6fd6afd48e
MD5 7ec8d47be7eec8647e1448f500608060
SHA1 b005c7a7b1bc41ed82a788b99a17e53c8d9514b2
SHA512 2501bf25a1687d982d290e017c61256013349db156f255bc7c09b082ad93a7ddaa6c2757029ef2127bd243ab1b874c1ce4216c213a67ad26c2c1d6167de46888
SSDEEP 12288:7T0c8c1CpHW2PT6CcCNeyV7N1/eQXMdMYl:7T0c8c1CpHW276CcCN7r/eQcMYl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.2/es/System.Runtime.InteropServices.xml

SHA256 d0c00892fbbd320086732d49c8be17d2651f86acc9f96849e9f0f7c729c44c14
MD5 a15f5225b1a54b3c91425264dfc218d5
SHA1 154ddd26f0c41d69cfecc3aafeec837c5f22ba71
SHA512 7b522d6182aa11d374370b9e17eb308265d469b6989c020b2c0cc18f06aa7730c9bb8d1abf5ca1ac3f8819546a3c8569dd85785e6212f12a2f0288d7939d2e8e
SSDEEP 1536:JQ95yJTCJOCUNpvWn58izT585s2Be2Wy6FFbTeKMK3Xg1YFMWy7yryxy4yMyAt4S:ASne2WZ3VfA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.2/fr/System.Runtime.InteropServices.xml

SHA256 c29ddc3902c368de31e340e6c0be998f56e16c0bcf892cad59db7b46a002326e
MD5 6668962bfb6c3010c5cfe386c921fd47
SHA1 211b5c7be67514215fe7b7d4db2d3e8d476beb9e
SHA512 8fbd5483c4671cc2babe549217a569c2e06401b5ea01056a990e125281113e522fdebb3f6efe7fee6799545a93a42d469612781363bcb5194ef527ef5fa8009e
SSDEEP 3072:u+4sqEIBo7SYEFI5VSrzFwmvWkclOIeOwgHSnve1YdnH:u+47F3vWkclOIeOwMSn21YdnH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.2/it/System.Runtime.InteropServices.xml

SHA256 c087e9275c5ae5e9e312fbf2ba1af216aa128564c2866bc77fad614e95727abc
MD5 be38702027bb915dd5557f4c1c6a11ad
SHA1 61a99229ead626ae4103221f59193141ccf736e1
SHA512 cba49b0db0712549e5a1c3095431dfd7b23d1c283119282c1ca048a2b2e45aee97712dc2e85f4306bda42f95e173b1db665483af3419c668bd8eaef715761b0a
SSDEEP 6144:CEWje8mHFTwC97Mo2q2amJ4VYPxm8jUaHDKkj/3ezvy:+f
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.2/ja/System.Runtime.InteropServices.xml

SHA256 ead41445048ce43cd488aa3a06411afcd55d1ddb0632fc03c9f4f920496f7b08
MD5 b66d5385b53ef118cc0e6d08e6e29ba3
SHA1 59b37e8bac03e9919fb4132c822834048a3e75e7
SHA512 359f8faed4aebee86e21c8036ad1d943adf58a9850ff867b7ce52f472caf0b32858534d655dc107562530e189ec9152a471013954ec36bd29b5f85e6a6c6bbcc
SSDEEP 1536:0++pUEO1c7wURPowKjepGa55exqe/ab9zhtmGHi809TL9eO9e:He8Ja55eQe/abNHi809TL9eOs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.2/ko/System.Runtime.InteropServices.xml

SHA256 a3d59d40239a8417c7ebfc28099eb83654429256cae12907283f8f195940525b
MD5 583ef11535d7ba81ef46b7bcd8f7a5db
SHA1 0fede3e0abfb4faa434d52e02562e033fb99a3da
SHA512 f8d92bd2a86f51559d8de99e37a5f944e79a7b8b60049293c706f0d0d56d94d1c746b5d699e640acdffd22c06d348f94b737f4d4c239176ebf50c9efa40ad3e1
SSDEEP 3072:w2ylgzdunxHxK3bGIPE/bV4ysq9bKyQiUC76A+7pdpQTmxhbPC:Z9zdgHN6CiemxhbPC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.2/ru/System.Runtime.InteropServices.xml

SHA256 376ee1a05f16cb9042659d917e59ab68a29c73e1c2a602270421df4494e5ec66
MD5 e1c2455ba3887332cb6684d570c6d4d4
SHA1 a6fa9644303aea3ac11ceef23d8bead9777f5486
SHA512 1ad12eb0324be0ec75cad0dc4dcaf7f41f0f42ab055b69a02bcfc8d917d9b8a73c6427ef0769d0fe01194e6d2b62a151b55a88da59dc7096537de9806ad66dc6
SSDEEP 12288:3clHKor0xftdSopoKz+1+x7rPrgNv7q6eGCEHY1AldOTPCMbZXr3agJsOfMm5j9K:yeAfOTPCaw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.2/zh-hans/System.Runtime.InteropServices.xml

SHA256 1041595ee24dea387f1d1f82c773e747c0827ac9b0168464fba47d39ba274095
MD5 ce890052c1e911a07abd74f887b483b9
SHA1 84395f14df779a81987e5e12ebdd263779b8482d
SHA512 3c6bdfea4b8a3660d27a98f8335649ba7a51e427174159fe9652738832908f23157a0e5d25881b0a0df8ebf2a050395c57aaacd39e81c6166a07a6bc6a8de139
SSDEEP 1536:nedw5CNQljWHO17rIgkhmS9HfmmvRdPOSWElzscHYCVeOqQ5VvYch/hO9QtH2lob:rGHYCzKQW5j3RGe0UMh2BwUhLVk
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.2/zh-hant/System.Runtime.InteropServices.xml

SHA256 443c4b51cc071068c4d270057e785a245f61b08a36b1628a7ce275ea23619c79
MD5 96114d837f9c3da19702f9db29c88238
SHA1 7a5a9de7a22679f10d1ae12c613b0d79c2f04bf4
SHA512 70338223679b581637cb110ee229536b6d964e7e476c82994a0933f93d104247ed2339f94fb5c420a6d2005b38576a5818d9903cb1a5ea65597c2be81c353303
SSDEEP 1536:48ORMOP39TYgydTxfBzL2+XIVEOd5uZkzI/+a/bH0l/ak+9439hI3GEFdMeJ+70k:+ixZOd82I3Ho5IZ+r
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.3/System.Runtime.InteropServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bd7caf50d13804d58118e84070f8100836caf824e1b57010f65af69c7558cc42
MD5 98942c0e79e0565f490bf70bd87dd65c
SHA1 56eae70e3d7fec90002c9a8557c27692620ef522
SHA512 f75997a41dfe3f4a6abe7c2b8a1bf983d951fd4e12e563b2012271ec7795acd5e47db43871c8a1262eb4a949154efab965d8ed640d2d7dfef7fccbc9a0dd9ffd
SSDEEP 768:8Z6wLEdlleEjeO0Nkrj4fSLdFF9as7jBo3Yy8irZmG66:v2Edlot+AW9m3YBmZmp6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

bc:6c:7f:6e:90:fc:07:47:e6:5f:e3:89:d2:1f:f4:f3:ed:03:5c:68:3b:8e:cd:5c:b9:1f:49:3f:34:de:65:7f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d8:e0:a2:2c:6d:16:bd:fa:93:f1:26:27:33:38:91:e7:f6:e9:49:92

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6f:65:2d:58:6d:07:11:46:28:00:00:00:00:00:6f

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

50702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Runtime.InteropServices\4.0.20.0\System.Runtime.InteropServices.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.3/System.Runtime.InteropServices.xml

SHA256 61e34e67b8b618fba5e516f1eeab40e37087132516986844a898ab8c211e1cd1
MD5 f107c34c81428ecb4b119e4a25743ef2
SHA1 cf1a1ac8b8381565550c50d0dc8e732bf2b2d211
SHA512 3f29476bf2f57c9f5ffa00faa420f9fbb90279c2183d4414a0d621705f178e857ab9cf24eaf2ff1398ff21254738eacb4ac915b7b060784167332480d561193f
SSDEEP 1536:3U7n78wao+efXUoeeqB1KEWhsLfXUz/rLtSZOsHN3ZuC39Z+ZPU8IcVo3VD4LlYh:3IhsDUz/rLtSZORAJ4HYcVu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.3/de/System.Runtime.InteropServices.xml

SHA256 7b9f8d777ac21103aac8b664bc58b3839d4867e365135bbe83e63b6fd6afd48e
MD5 7ec8d47be7eec8647e1448f500608060
SHA1 b005c7a7b1bc41ed82a788b99a17e53c8d9514b2
SHA512 2501bf25a1687d982d290e017c61256013349db156f255bc7c09b082ad93a7ddaa6c2757029ef2127bd243ab1b874c1ce4216c213a67ad26c2c1d6167de46888
SSDEEP 12288:7T0c8c1CpHW2PT6CcCNeyV7N1/eQXMdMYl:7T0c8c1CpHW276CcCN7r/eQcMYl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.3/es/System.Runtime.InteropServices.xml

SHA256 d0c00892fbbd320086732d49c8be17d2651f86acc9f96849e9f0f7c729c44c14
MD5 a15f5225b1a54b3c91425264dfc218d5
SHA1 154ddd26f0c41d69cfecc3aafeec837c5f22ba71
SHA512 7b522d6182aa11d374370b9e17eb308265d469b6989c020b2c0cc18f06aa7730c9bb8d1abf5ca1ac3f8819546a3c8569dd85785e6212f12a2f0288d7939d2e8e
SSDEEP 1536:JQ95yJTCJOCUNpvWn58izT585s2Be2Wy6FFbTeKMK3Xg1YFMWy7yryxy4yMyAt4S:ASne2WZ3VfA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.3/fr/System.Runtime.InteropServices.xml

SHA256 c29ddc3902c368de31e340e6c0be998f56e16c0bcf892cad59db7b46a002326e
MD5 6668962bfb6c3010c5cfe386c921fd47
SHA1 211b5c7be67514215fe7b7d4db2d3e8d476beb9e
SHA512 8fbd5483c4671cc2babe549217a569c2e06401b5ea01056a990e125281113e522fdebb3f6efe7fee6799545a93a42d469612781363bcb5194ef527ef5fa8009e
SSDEEP 3072:u+4sqEIBo7SYEFI5VSrzFwmvWkclOIeOwgHSnve1YdnH:u+47F3vWkclOIeOwMSn21YdnH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.3/it/System.Runtime.InteropServices.xml

SHA256 c087e9275c5ae5e9e312fbf2ba1af216aa128564c2866bc77fad614e95727abc
MD5 be38702027bb915dd5557f4c1c6a11ad
SHA1 61a99229ead626ae4103221f59193141ccf736e1
SHA512 cba49b0db0712549e5a1c3095431dfd7b23d1c283119282c1ca048a2b2e45aee97712dc2e85f4306bda42f95e173b1db665483af3419c668bd8eaef715761b0a
SSDEEP 6144:CEWje8mHFTwC97Mo2q2amJ4VYPxm8jUaHDKkj/3ezvy:+f
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.3/ja/System.Runtime.InteropServices.xml

SHA256 ead41445048ce43cd488aa3a06411afcd55d1ddb0632fc03c9f4f920496f7b08
MD5 b66d5385b53ef118cc0e6d08e6e29ba3
SHA1 59b37e8bac03e9919fb4132c822834048a3e75e7
SHA512 359f8faed4aebee86e21c8036ad1d943adf58a9850ff867b7ce52f472caf0b32858534d655dc107562530e189ec9152a471013954ec36bd29b5f85e6a6c6bbcc
SSDEEP 1536:0++pUEO1c7wURPowKjepGa55exqe/ab9zhtmGHi809TL9eO9e:He8Ja55eQe/abNHi809TL9eOs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.3/ko/System.Runtime.InteropServices.xml

SHA256 a3d59d40239a8417c7ebfc28099eb83654429256cae12907283f8f195940525b
MD5 583ef11535d7ba81ef46b7bcd8f7a5db
SHA1 0fede3e0abfb4faa434d52e02562e033fb99a3da
SHA512 f8d92bd2a86f51559d8de99e37a5f944e79a7b8b60049293c706f0d0d56d94d1c746b5d699e640acdffd22c06d348f94b737f4d4c239176ebf50c9efa40ad3e1
SSDEEP 3072:w2ylgzdunxHxK3bGIPE/bV4ysq9bKyQiUC76A+7pdpQTmxhbPC:Z9zdgHN6CiemxhbPC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.3/ru/System.Runtime.InteropServices.xml

SHA256 376ee1a05f16cb9042659d917e59ab68a29c73e1c2a602270421df4494e5ec66
MD5 e1c2455ba3887332cb6684d570c6d4d4
SHA1 a6fa9644303aea3ac11ceef23d8bead9777f5486
SHA512 1ad12eb0324be0ec75cad0dc4dcaf7f41f0f42ab055b69a02bcfc8d917d9b8a73c6427ef0769d0fe01194e6d2b62a151b55a88da59dc7096537de9806ad66dc6
SSDEEP 12288:3clHKor0xftdSopoKz+1+x7rPrgNv7q6eGCEHY1AldOTPCMbZXr3agJsOfMm5j9K:yeAfOTPCaw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.3/zh-hans/System.Runtime.InteropServices.xml

SHA256 1041595ee24dea387f1d1f82c773e747c0827ac9b0168464fba47d39ba274095
MD5 ce890052c1e911a07abd74f887b483b9
SHA1 84395f14df779a81987e5e12ebdd263779b8482d
SHA512 3c6bdfea4b8a3660d27a98f8335649ba7a51e427174159fe9652738832908f23157a0e5d25881b0a0df8ebf2a050395c57aaacd39e81c6166a07a6bc6a8de139
SSDEEP 1536:nedw5CNQljWHO17rIgkhmS9HfmmvRdPOSWElzscHYCVeOqQ5VvYch/hO9QtH2lob:rGHYCzKQW5j3RGe0UMh2BwUhLVk
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.3/zh-hant/System.Runtime.InteropServices.xml

SHA256 443c4b51cc071068c4d270057e785a245f61b08a36b1628a7ce275ea23619c79
MD5 96114d837f9c3da19702f9db29c88238
SHA1 7a5a9de7a22679f10d1ae12c613b0d79c2f04bf4
SHA512 70338223679b581637cb110ee229536b6d964e7e476c82994a0933f93d104247ed2339f94fb5c420a6d2005b38576a5818d9903cb1a5ea65597c2be81c353303
SSDEEP 1536:48ORMOP39TYgydTxfBzL2+XIVEOd5uZkzI/+a/bH0l/ak+9439hI3GEFdMeJ+70k:+ixZOd82I3Ho5IZ+r
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.5/System.Runtime.InteropServices.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0035e82143c5fab8d6586c7f218d249fd38a8eeaac37694718c0da60e673e6c1
MD5 2748cbd5c2b193b7ef76cc6c4bf3e6f8
SHA1 e72c7417c31e24eb587716eaed39cd40f71abd22
SHA512 15fe68a98c3f747f4dc41e022eee968c799c9fed53a9c86f28dbf37e445fed21410852de46ebaef1d8c2c07a44397d39a9d611db53bee7be3f5c17fe2007e0ba
SSDEEP 768:4wZ6wLghwveEjcO0Nkrj4+6dFF9as7jBS32aiXuEBrrFk:E26d3+u9I32a1EBrrFk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

3a:9c:d2:e1:07:a9:f1:87:41:7f:01:83:a9:8b:d4:af:49:78:7e:d2:2a:68:6c:94:8b:b0:11:66:c9:71:8a:42

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

e3:cf:ad:4f:a6:05:46:72:1f:89:c6:44:c5:30:e7:79:f3:78:c2:17

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

49882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Runtime.InteropServices\4.1.0.0\System.Runtime.InteropServices.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.5/System.Runtime.InteropServices.xml

SHA256 61e34e67b8b618fba5e516f1eeab40e37087132516986844a898ab8c211e1cd1
MD5 f107c34c81428ecb4b119e4a25743ef2
SHA1 cf1a1ac8b8381565550c50d0dc8e732bf2b2d211
SHA512 3f29476bf2f57c9f5ffa00faa420f9fbb90279c2183d4414a0d621705f178e857ab9cf24eaf2ff1398ff21254738eacb4ac915b7b060784167332480d561193f
SSDEEP 1536:3U7n78wao+efXUoeeqB1KEWhsLfXUz/rLtSZOsHN3ZuC39Z+ZPU8IcVo3VD4LlYh:3IhsDUz/rLtSZORAJ4HYcVu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.5/de/System.Runtime.InteropServices.xml

SHA256 7b9f8d777ac21103aac8b664bc58b3839d4867e365135bbe83e63b6fd6afd48e
MD5 7ec8d47be7eec8647e1448f500608060
SHA1 b005c7a7b1bc41ed82a788b99a17e53c8d9514b2
SHA512 2501bf25a1687d982d290e017c61256013349db156f255bc7c09b082ad93a7ddaa6c2757029ef2127bd243ab1b874c1ce4216c213a67ad26c2c1d6167de46888
SSDEEP 12288:7T0c8c1CpHW2PT6CcCNeyV7N1/eQXMdMYl:7T0c8c1CpHW276CcCN7r/eQcMYl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.5/es/System.Runtime.InteropServices.xml

SHA256 d0c00892fbbd320086732d49c8be17d2651f86acc9f96849e9f0f7c729c44c14
MD5 a15f5225b1a54b3c91425264dfc218d5
SHA1 154ddd26f0c41d69cfecc3aafeec837c5f22ba71
SHA512 7b522d6182aa11d374370b9e17eb308265d469b6989c020b2c0cc18f06aa7730c9bb8d1abf5ca1ac3f8819546a3c8569dd85785e6212f12a2f0288d7939d2e8e
SSDEEP 1536:JQ95yJTCJOCUNpvWn58izT585s2Be2Wy6FFbTeKMK3Xg1YFMWy7yryxy4yMyAt4S:ASne2WZ3VfA
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.5/fr/System.Runtime.InteropServices.xml

SHA256 c29ddc3902c368de31e340e6c0be998f56e16c0bcf892cad59db7b46a002326e
MD5 6668962bfb6c3010c5cfe386c921fd47
SHA1 211b5c7be67514215fe7b7d4db2d3e8d476beb9e
SHA512 8fbd5483c4671cc2babe549217a569c2e06401b5ea01056a990e125281113e522fdebb3f6efe7fee6799545a93a42d469612781363bcb5194ef527ef5fa8009e
SSDEEP 3072:u+4sqEIBo7SYEFI5VSrzFwmvWkclOIeOwgHSnve1YdnH:u+47F3vWkclOIeOwMSn21YdnH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.5/it/System.Runtime.InteropServices.xml

SHA256 c087e9275c5ae5e9e312fbf2ba1af216aa128564c2866bc77fad614e95727abc
MD5 be38702027bb915dd5557f4c1c6a11ad
SHA1 61a99229ead626ae4103221f59193141ccf736e1
SHA512 cba49b0db0712549e5a1c3095431dfd7b23d1c283119282c1ca048a2b2e45aee97712dc2e85f4306bda42f95e173b1db665483af3419c668bd8eaef715761b0a
SSDEEP 6144:CEWje8mHFTwC97Mo2q2amJ4VYPxm8jUaHDKkj/3ezvy:+f
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.5/ja/System.Runtime.InteropServices.xml

SHA256 ead41445048ce43cd488aa3a06411afcd55d1ddb0632fc03c9f4f920496f7b08
MD5 b66d5385b53ef118cc0e6d08e6e29ba3
SHA1 59b37e8bac03e9919fb4132c822834048a3e75e7
SHA512 359f8faed4aebee86e21c8036ad1d943adf58a9850ff867b7ce52f472caf0b32858534d655dc107562530e189ec9152a471013954ec36bd29b5f85e6a6c6bbcc
SSDEEP 1536:0++pUEO1c7wURPowKjepGa55exqe/ab9zhtmGHi809TL9eO9e:He8Ja55eQe/abNHi809TL9eOs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.5/ko/System.Runtime.InteropServices.xml

SHA256 a3d59d40239a8417c7ebfc28099eb83654429256cae12907283f8f195940525b
MD5 583ef11535d7ba81ef46b7bcd8f7a5db
SHA1 0fede3e0abfb4faa434d52e02562e033fb99a3da
SHA512 f8d92bd2a86f51559d8de99e37a5f944e79a7b8b60049293c706f0d0d56d94d1c746b5d699e640acdffd22c06d348f94b737f4d4c239176ebf50c9efa40ad3e1
SSDEEP 3072:w2ylgzdunxHxK3bGIPE/bV4ysq9bKyQiUC76A+7pdpQTmxhbPC:Z9zdgHN6CiemxhbPC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.5/ru/System.Runtime.InteropServices.xml

SHA256 376ee1a05f16cb9042659d917e59ab68a29c73e1c2a602270421df4494e5ec66
MD5 e1c2455ba3887332cb6684d570c6d4d4
SHA1 a6fa9644303aea3ac11ceef23d8bead9777f5486
SHA512 1ad12eb0324be0ec75cad0dc4dcaf7f41f0f42ab055b69a02bcfc8d917d9b8a73c6427ef0769d0fe01194e6d2b62a151b55a88da59dc7096537de9806ad66dc6
SSDEEP 12288:3clHKor0xftdSopoKz+1+x7rPrgNv7q6eGCEHY1AldOTPCMbZXr3agJsOfMm5j9K:yeAfOTPCaw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.5/zh-hans/System.Runtime.InteropServices.xml

SHA256 1041595ee24dea387f1d1f82c773e747c0827ac9b0168464fba47d39ba274095
MD5 ce890052c1e911a07abd74f887b483b9
SHA1 84395f14df779a81987e5e12ebdd263779b8482d
SHA512 3c6bdfea4b8a3660d27a98f8335649ba7a51e427174159fe9652738832908f23157a0e5d25881b0a0df8ebf2a050395c57aaacd39e81c6166a07a6bc6a8de139
SSDEEP 1536:nedw5CNQljWHO17rIgkhmS9HfmmvRdPOSWElzscHYCVeOqQ5VvYch/hO9QtH2lob:rGHYCzKQW5j3RGe0UMh2BwUhLVk
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.4.3.0/ref/netstandard1.5/zh-hant/System.Runtime.InteropServices.xml

SHA256 443c4b51cc071068c4d270057e785a245f61b08a36b1628a7ce275ea23619c79
MD5 96114d837f9c3da19702f9db29c88238
SHA1 7a5a9de7a22679f10d1ae12c613b0d79c2f04bf4
SHA512 70338223679b581637cb110ee229536b6d964e7e476c82994a0933f93d104247ed2339f94fb5c420a6d2005b38576a5818d9903cb1a5ea65597c2be81c353303
SSDEEP 1536:48ORMOP39TYgydTxfBzL2+XIVEOd5uZkzI/+a/bH0l/ak+9439hI3GEFdMeJ+70k:+ixZOd82I3Ho5IZ+r
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/.signature.p7s

SHA256 9178af5ccd716e198f45472c64026d2bd9a3f6b34ab6e3104452be38cd13ddfc
MD5 f375ca36fed7a500995b3a80cc371e77
SHA1 6551a281de4728af803f9131a773a72b89e6f937
SHA512 96b2e39931b92499024d40d7690b223bdc63f17b0993d8725b4070a3a9c6f79335b28aa139077af50e73bba61b1419d311f3dce8d1d279a4bf1e31573f59edb0
SSDEEP 192:8dy7x0KDWpHhXZCVzV07xriRJ9DH0JOqNG8Fp28Wh8noRg:EYvDGGVp79oJNNzFwhhikg
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/System.Runtime.InteropServices.RuntimeInformation.4.3.0.nupkg

SHA256 318a65ebf6720ba8639b359121efa20e895d38c5b599f6f05ec76e0275c82860
MD5 3252ef18037286d65f84f9cfed000c9e
SHA1 f92137d883bd9d1b318ac17b6fcc8187a43265ed
SHA512 6f4905329a3cc9e62d274c885f275ee31c5af57a6c9fd1a5080d039cb748e0277bef3dc8ce42863cac78365084e00a032279bf3d2b7254a49f3fb1566a29ad1b
SSDEEP 3072:3x6A6ExysAgCuA/3MvYJ4G7Y5SmJX9QCfc27GeO86LZYRHj88GMUnExysAgCSkqx:3U1EPCuAfJuH5SM9QCfTbbuZ0Hj88GMX
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/lib/net45/System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237
MD5 82deb78891f430007e871a35ce28fac4
SHA1 4e490d7ec139a6cde53e3932d3122a48aa379904
SHA512 e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a
SSDEEP 768:vn1VM0JrpNWDcIh6leOiDFIFBYp1+ziBEBMf:vnvXYcIh6yFIFBYpczyEBMf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

05:db:74:2f:88:32:73:ab:f9:54:bf:23:c7:95:38:b8:ec:aa:28:fd:f2:85:57:f2:b9:b4:98:f1:5d:1d:a3:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

56:92:ab:b2:b2:ea:e2:5f:1d:7d:b4:40:b3:91:8f:25:ff:d3:35:1d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

22454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net45\System.Runtime.InteropServices.RuntimeInformation.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/lib/netstandard1.1/System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 01206763cdca9e7d9fa46a42d230d4410b827e217281e6afdf1325f1e7b28a71
MD5 62f27356a101b69a2b04155d5bf3f710
SHA1 4fa8eec0944d31df3d4111d18b650f2f670496b0
SHA512 00bb7e67949bd43aa6367218183ec3841da9523254c662c0f7ab30661b2ed64fa538d52e5e9d6e72f12cdabe39d7a61732a846d5169d0b7544816d4b822b3117
SSDEEP 384:X8DVm9ndbWraW3vT1Nq0GftpBj8oERHRN7Uj6eQldBopP+:aQwX1viHEBUj6zo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

6a:29:95:88:c4:16:5d:30:cc:db:43:dc:8e:31:9c:4a:a8:a2:ce:97:c6:b9:22:66:63:ab:69:8f:2b:6e:d3:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a4:e2:c6:0f:4e:d1:f0:a3:9c:2b:9c:f4:51:84:a9:73:c3:ec:32:8e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\netstandard1.1\System.Runtime.InteropServices.RuntimeInformation.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/lib/win8/System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 25deff983bc994143a27cec9283f940ff0c2a45f2920c24bee0c20902a3b098a
MD5 0e1432a5a1365522cab8e406023fdcd0
SHA1 436afcf4e540fe862306162897f4930c77ab08e0
SHA512 99207fc1ffcf854a3e6fec3136e0d0c446406ea3d3b4fa8a9509a236a5223d9c4c505d5d501f8b98919b582493b4d0fe5681d49958678c2448a074a03092bc74
SSDEEP 768:EWd0vXrPbW9iz2lleOiDFIFBYp1uhiQLGEBrbi:EQwXfqiz2lyFIFBYpIhdGEBrbi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

01:47:f8:b9:22:24:a8:2d:c9:0d:76:f0:d0:0f:cc:3d:7b:f4:73:57:89:a8:08:3c:d4:bb:18:b2:c9:46:45:1b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

b4:f1:4f:53:ce:3a:e7:35:1b:15:67:8d:cc:93:07:90:f6:22:8d:89

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

21874

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\win8\System.Runtime.InteropServices.RuntimeInformation.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/lib/wpa81/System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c6a2cc8198ca267bd54a31ece90ff36528acbfa729c662a77cf6fe7821402c66
MD5 0c35f5b91652ae0449f23d876b1ffeb6
SHA1 80dc3c218b8898472483de04f0f161641d4788cb
SHA512 1c0c4acabac92f406f9620ab00290e692ab41bb46bcbe1843e7ff5d368137a34f274b4515c5935cc3e6378b206553eb17298931029703b6bb8a9a82c99df1571
SSDEEP 768:FUVb06XBrPbW9i5E2l2eOiDFIFBYp1xIuizDEBzHcS:FM9XBfqi+2ltFIFBYpTIusEBIS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

f0:88:96:8b:dd:39:31:a1:20:90:a0:c1:bb:04:64:7e:ed:3c:74:d4:bf:8f:1d:5d:e0:b8:1a:b6:ce:f0:32:5a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d2:9f:bc:e5:0c:2d:d4:47:1f:c8:e0:56:1b:35:5f:a5:8f:d7:f9:c5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

21870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\wpa81\System.Runtime.InteropServices.RuntimeInformation.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/ref/netstandard1.1/System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 feaa1d7d5bb860546e3ce0de21112858266fdc2b1ece2ce59346143e14a593f7
MD5 ea8ab7fd57c2b00200b8579621f72a6f
SHA1 3298367b59c762302cd9c69cfa79ff2496bb9a20
SHA512 91e42ba4f7f4f0af070230a2e802c4fc7a88fcf44351bf1310d9e8e45639010f4c8837fbc984878188719237f19a3b70cc7e4f204a1a5c83c2c2345744d2eb6c
SSDEEP 384:mw9ZTWraWV3rq0GftpBj5ERHRN7lFfl78oWCmt1c:By/ifEBlFZeI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

19:ac:77:0e:5e:83:b1:b9:83:11:29:aa:e6:f7:d5:e3:17:75:42:88:c2:e6:89:51:b3:b9:6e:8e:b3:aa:ac:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

34:a5:d3:39:6c:c9:37:b5:b6:8d:53:a6:e8:5c:4a:e1:de:88:c0:79

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\ref\System.Runtime.InteropServices.RuntimeInformation\4.0.1.0\System.Runtime.InteropServices.RuntimeInformation.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/runtimes/aot/lib/netcore50/System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3c71bcbe164a4034feeaa03238cf1f4b88315c63d05edec1709179d01f56ec36
MD5 82490eb655cf9d39bad49e7c6c623fba
SHA1 49ace5e1636ddc92a488a307e9cc7f79c23180ed
SHA512 b7552ba940b871cc814f4cc527a49710e92346ae3b835819f1d450f68bbf56f7ede0688cb7974bdc7bd83f2da126a613a99672a5e251187d2e3e3fd0588b20e3
SSDEEP 768:yDsD4rPjW9c3pkeOiDFIFBYp1BNVuie1HaEBSbBS:ywMfqc3pnFIFBYpDNVuV16EBSbBS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

1e:c6:4b:60:3a:38:b5:41:9b:bf:be:3b:7e:99:c7:e2:1b:55:4c:8f:23:20:07:54:99:32:7c:e1:73:cb:ec:21

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

69:06:51:56:02:55:0e:84:bc:1c:b9:ee:33:19:02:da:e6:3b:bb:58

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

21958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\netcore50aot\System.Runtime.InteropServices.RuntimeInformation.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/runtimes/unix/lib/netstandard1.1/System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c27547d9e7d080db29b48bbd47e3f7a252b17800633cdfa0f77718c19279cf4b
MD5 d39edbeb5087cab4a05ec33a3bea92c9
SHA1 ee72fcc85bd77bcc6ae8f1b54516f3f112a53207
SHA512 3dced5a4c3291aaa5a0a066e1f2702f4b846f4037a92aff47389fc535e7dbbf8b345a3473d37ff1f0e6eb326c346cd1d381b173e8658e85d3557d17573eec13d
SSDEEP 384:UShaD2vfm5LsxVu9RRTc0WraWaC77q0GftpBjlEl3ERHRN7Kp7lGiz2IXHO:iDl5QxVmRsvioEBYje
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

93:82:78:94:43:c1:0f:2e:19:35:40:88:41:7e:9b:84:ab:10:65:54:42:6e:20:2c:9e:3e:09:59:3f:85:ed:b3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

97:45:48:5c:d1:46:16:b8:15:8c:d0:c9:4d:6f:49:0d:30:95:ef:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

16382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Unix.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\System.Runtime.InteropServices.RuntimeInformation.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/runtimes/win/lib/net45/System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2f141b72a2af0458993e27559395d8a8cdb0b752d79b1703541a61e728b55237
MD5 82deb78891f430007e871a35ce28fac4
SHA1 4e490d7ec139a6cde53e3932d3122a48aa379904
SHA512 e47f741aa9153cfafc5f6be39987d7c7d8fb745566c4d9a4525b9f30cbe6df450d27bcdf8998dec7af824a7be0f5e9eecad2a39072b956a6320d23d94a0da71a
SSDEEP 768:vn1VM0JrpNWDcIh6leOiDFIFBYp1+ziBEBMf:vnvXYcIh6yFIFBYpczyEBMf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

05:db:74:2f:88:32:73:ab:f9:54:bf:23:c7:95:38:b8:ec:aa:28:fd:f2:85:57:f2:b9:b4:98:f1:5d:1d:a3:59

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

56:92:ab:b2:b2:ea:e2:5f:1d:7d:b4:40:b3:91:8f:25:ff:d3:35:1d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

22454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\net45\System.Runtime.InteropServices.RuntimeInformation.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/runtimes/win/lib/netcore50/System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 26355207725c12c96a5c94bf78b3616bf917d4454e8f8a404ad5883162f39c19
MD5 7d7aed240ba03a42892f88dc26555f6b
SHA1 b0a7c90852b0988f9ec4af92fe146f03e6ebb4cb
SHA512 cb5103da7b6c1a0708faaf94c1d0f6af99388c01b8a93b8eebb19dbbff63c23917b0825b9ab67f769e4c63a5bfe04b77c5a79be468bb2b6839f7afc88e480fec
SSDEEP 768:OhtV0g4rPjW9c3O2eOiDFIFBYp1B13iuoEBuavKby:Eti3fqc3OtFIFBYpD13boEBuiKby
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

c1:09:58:f4:7e:d3:6d:e1:a7:8a:07:03:fd:1e:bf:ef:de:ea:50:ac:c3:ee:bf:41:4d:d2:49:59:4a:67:51:bc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

75:61:c1:1b:74:f1:23:dd:5a:82:2e:61:85:2f:ac:e3:6c:fa:b0:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

21950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\netcore50\System.Runtime.InteropServices.RuntimeInformation.pdb

LegionStealer V1 SRC/packages/System.Runtime.InteropServices.RuntimeInformation.4.3.0/runtimes/win/lib/netstandard1.1/System.Runtime.InteropServices.RuntimeInformation.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ce7e6779a430ae44acb0763c7b3d15b53394fd23bd00ade11ec625b18726d4de
MD5 01a644fdd56032867719b9696d4320c3
SHA1 f2431310ba290ca7361ea90e3782fe19551940a3
SHA512 be5731e19f5057215c6d6b518ac3afafc912dd8a4c92d7e6220180b27a2b4f8c4a93e39aad1c520f3f361a74be71c5bba55aa25d6282f086ed9ae6ac98eab1e6
SSDEEP 768:dclrpNWDcIV62eOiDFIFBYp1KUuiQ6EBdH:dMXYcIV6tFIFBYpAUup6EBdH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

1e:05:25:96:3d:5b:c0:1f:6c:6a:24:0d:de:92:e6:90:83:9d:9c:20:5f:76:46:e8:44:ac:2a:b6:b5:51:87:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

79:73:44:c4:3f:39:f3:b2:f8:f1:e1:ce:de:ea:12:68:84:01:ec:e3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

22434

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Runtime.InteropServices.RuntimeInformation\System.Runtime.InteropServices.RuntimeInformation.pdb

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/.signature.p7s

SHA256 ff0bad4c7e625fe615db08a911cd1aad0cadb8c3da964bf22e5037ac8ef94fc5
MD5 b48b787fbb0c1e147ec5a3c7daa45dfa
SHA1 4000b57645711d4f34e04ea162b68be7359bfb30
SHA512 fa15a6d76266eba35fc805af74450af412df74d0fc3ef454f99898482f14303b20786b191cc8cfe86e7e1899060f57713010ed881b05c5880f3e902d67410ad2
SSDEEP 192:xde7x0KDWpHhXZCVzV07VrH319DH0JOqNG8Fp28Wh8nP:j8vDGGVpO19oJNNzFwhhiP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/System.Runtime.Numerics.4.3.0.nupkg

SHA256 3f98c70a031b80531888e36fce668a15e3aa7002033eefd4f1b395acd3d82aa7
MD5 fe9db7248bdc641913aece833059e8a7
SHA1 4748d4fb7c2da4c99b0591359ce9d63aae926fc1
SHA512 3e347faa8e7ec484d481e53b1c219fe1ce346ae8278a214b4508cf0e233c1627bd9c6c6c7c654e8c1f4143271838ddd9593f63a1043577ad87c40e392af7fd34
SSDEEP 6144:jUq00JBfRwE00JBfRwGARUSo+AkAXwsVtedHHkCdxA3Uoo+kkIXkoVtyHMM:wqPBfRwEPBfRwGkoxkdsVInXxWo/k/oy
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/lib/netcore50/System.Runtime.Numerics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1fab9bf69645ecd20e98d7221efd5c9a2562c405d5c77024bbd826af09c521c5
MD5 aad35c6f931ccc5d9b94a395f51a1439
SHA1 923593908a599c2017418b80bad8bd1783cb6935
SHA512 5dd7bac2e5451e7c8e39890806cf6b95e593957aba888c5a93fd8b4b5c82b018b850c02154c789210633080bd05919b5ee2bdbcf64908dc1ca21e513c7babcc7
SSDEEP 1536:dpCtJMD8iokd0gMkXb6F3rCXYv89Vofs6EBhcx:n3D8Bkd0gMkXb6Fbbv8Hofs6Ejcx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

34:04:1f:6a:13:d6:34:f4:e6:91:57:38:94:89:b0:6e:8d:8f:5f:b3:3f:c2:32:57:53:42:0e:c6:5c:33:f6:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

90:fa:7c:d6:cd:b9:14:25:51:da:62:af:86:69:56:a2:7b:c8:8d:1c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

60834

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Runtime.Numerics\System.Runtime.Numerics.pdb

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/lib/netstandard1.3/System.Runtime.Numerics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1fab9bf69645ecd20e98d7221efd5c9a2562c405d5c77024bbd826af09c521c5
MD5 aad35c6f931ccc5d9b94a395f51a1439
SHA1 923593908a599c2017418b80bad8bd1783cb6935
SHA512 5dd7bac2e5451e7c8e39890806cf6b95e593957aba888c5a93fd8b4b5c82b018b850c02154c789210633080bd05919b5ee2bdbcf64908dc1ca21e513c7babcc7
SSDEEP 1536:dpCtJMD8iokd0gMkXb6F3rCXYv89Vofs6EBhcx:n3D8Bkd0gMkXb6Fbbv8Hofs6Ejcx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

34:04:1f:6a:13:d6:34:f4:e6:91:57:38:94:89:b0:6e:8d:8f:5f:b3:3f:c2:32:57:53:42:0e:c6:5c:33:f6:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

90:fa:7c:d6:cd:b9:14:25:51:da:62:af:86:69:56:a2:7b:c8:8d:1c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

60834

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Runtime.Numerics\System.Runtime.Numerics.pdb

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netcore50/System.Runtime.Numerics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cd7a38053c0d0514210d551ac24483549376a9223b5515bf09089fe49450f53c
MD5 e36efc00d1e84bd75098068a8621fe29
SHA1 21f7238d6f588a21937e34d4ae6d56fa0b570f6c
SHA512 6bf082b764e83d67c47cd82434171af0f203697153b21ffad15ab9696af24c674977e709388dd0802cb9465a0051b36f50070578149263a36b2b917edf57bc3a
SSDEEP 384:ApptwqPa8Lqz/9lWNRWmMIA0GftpBjyfXoERHRN7Rlp/mQdQ:ATtU8LFgqiEQEBV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

fe:d1:2b:a9:f4:6f:6e:3a:7f:52:c0:fa:e2:15:4f:9e:cf:b2:80:72:af:e4:61:c5:72:05:a0:91:a0:ed:d2:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

5b:bf:a6:9c:9e:7c:f9:c3:c9:dc:70:af:ee:b7:83:94:0d:df:f5:24

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

18758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Runtime.Numerics\4.0.0.0\System.Runtime.Numerics.pdb

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netcore50/System.Runtime.Numerics.xml

SHA256 2b14423bc12e5cd8fc16cccf7435351ed838215afa757bca46af5fc2f9092647
MD5 e2d272140d1de435b0c859f846d16cc6
SHA1 0f066b28be4bd55cd6148e48debfe6eb26c7f60b
SHA512 30d9663a5a6c6116503ba7655a8309bfb394d3b61d793ede9afd22e31f8a109159c633d5d5533ad0abe91fff11c62b4582507b494b3934a3d1d334ad559956a2
SSDEEP 384:YPsjADqPnQnHESKGI1wFXv4hPADWy/OVelJt0cpGASL/oWu/KWotjQ0rB8fMG0o4:YPQ55bGnSB8OvQo3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netcore50/de/System.Runtime.Numerics.xml

SHA256 9b6e0db36821cdbbb5fff4542846c21d4e3be639ae1f82a76136e14470de0b93
MD5 2d7c126da0009e18c40a955af459ca8d
SHA1 e20cbbabcd5500da4939de110a039b251e72fa29
SHA512 e98255a936e5c306e83050c78d7d314418addf0f8a4492045e58701031d205a5c4ff504d57fd3de93f41574464826a89ece7265b2dc4b71068444f83061f2612
SSDEEP 768:Y2064+d8BNytZc7aF+pEHDzN1PJydHcB2ofm63/NfT1V7O6pPhqM4m8l:j064+d8zEHDzRyeLm63VLLO6uJl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netcore50/es/System.Runtime.Numerics.xml

SHA256 88cfc5877a347a16bf5fa02a245a95835f499bbb2c9b16701be1e8503e461391
MD5 099b58f0deff530fabf165a9c1b3422e
SHA1 1bbec77d1ca63281df7ff44d147a526639219c6b
SHA512 0ecf487274a5305eeb266ce5ca2131ec513ded97ddd17454dd218aa8656caaf18b5cc4a760e38232a87707e9f5d8f5c838ea53d2d21190ebcb030b4e4cb5f27b
SSDEEP 384:Yg3cORjwi2PuJ4P5Q8JUdkdD2KZumAogv/4i/lJkbq5K0CE+R+e+h8EOXi1hqrDf:Yg34Bz4eEyM+MZIuI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netcore50/fr/System.Runtime.Numerics.xml

SHA256 05e3eff0804a695280e0854f25f9995823245a065b1eb79fc98b640f6325d21e
MD5 3bd2a8e2a769ab5545debf44b539ac53
SHA1 59930ab833743bdc02a392bf5ed918617a6705ef
SHA512 fe6d19535aa8266ef66552865af5ced3e66a08186548939560bd1d73662db891fc298e3c80ce3b11a72a2091cc9dcbcbd5bcc3d53899e17f5b0a454bc7fe27ca
SSDEEP 768:YkNt4xWY2K/2Kj5e1kKNrFtBhQ4dbbsiZ2QsZd:Rt4xWY2K/Otz5i
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netcore50/it/System.Runtime.Numerics.xml

SHA256 42e841f83263a91e5fb0a3cf56e0a4ae875a58a0f1108320d2c648cc4d458dd4
MD5 c3d72e42f4cc8b2a647d4ec1ab336d97
SHA1 1cee5478bfae8a2dc1fdba9c658ddefdbc783938
SHA512 bef20e3387f7520dc37f53fc7e6a7579a13ae85b3620e5523a7b7edb88d5061bcdd0600b5b7e17388c1aa6c78f2d7adb0fa5967bcbf2cdc9aec95a07e1d7cf36
SSDEEP 384:YCsW5nTxfjsskFZLX2+a+Qylv4lRtjwPFaBlCRn9aq4qjqMq7qGAqaqhdqx/qznh:Y6W2zby54nBLEFKfR6/p2
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netcore50/ja/System.Runtime.Numerics.xml

SHA256 810413007c2afa403b818076ded5a05f69e60f7b4bd3eca7208b0f2976fbb8d0
MD5 a9715545f57188701a7625bd746893a3
SHA1 de07db163d9c2ddbaad97ca485943a309c2344a7
SHA512 11fff11372946effd0f718d36e02c35e9839d713d768d7a10072001212b699db9323cb9752318b5e7d1a58e42e5a44d4d3f01cd4e8190d3808c1035ebff5827b
SSDEEP 384:YOtfi0oTKOUIz2XrB73Ql5mSzJP0EosdU5vL2KFxHLLDfZCsghrWKhZ4hVpJF/d4:YU6TKOUY2XrB734PFU3xlq8hVpJF/2b
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netcore50/ko/System.Runtime.Numerics.xml

SHA256 8ca82077061dbdf814d01ceb9e1d6e8efe5c6f35f906230bbcac6d8b1a850f3c
MD5 bfb67432b27134326e8fc07296c5a7c0
SHA1 3a47c7b418134740913793b08451251036d856d8
SHA512 c89b95543e02c5017f62b790a44872be188f2e6290148fd8fcef1566b69832ed4272e7b4f83e742791813f078b13f9b5e62675f437804dafe294422aa4dff6dd
SSDEEP 768:Ye2ZA5kc3/rt9B5NOjiFApF5yXgFbuYzimQt5nCJkpxhFlQC+QnDjPNwy3YLUsXd:0MyLBJHl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netcore50/ru/System.Runtime.Numerics.xml

SHA256 80cd936b9850eb988faaa2727133c31a40bb8593aeaac777d36db07ecbc1e4c8
MD5 222f96d932c9e92660600a821b5d2920
SHA1 75aed202759100fced033d4afa0cfc3bf0b30c5b
SHA512 36e26962da3f3cc4d4c002d7f85a694fff017cb55f8b15b583d4ede007c6b2654b3923b3012e1fa7dc5b27755d1254254ac90d7c383303f8b42e9ac8e86f71f0
SSDEEP 3072:dEzjZs1mNfUNIyOFTidAiuiGOUHJoJu4OwXmY:dEzjZs1mNcNIyOFTidAiuiGOUHJoJu4T
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netcore50/zh-hans/System.Runtime.Numerics.xml

SHA256 2f6e627363b0da4de11693dcb6c50758e176f48a3ab4b8dd9c5b2ade336d1ca3
MD5 55090f7a2df5d680cc4944c809a57cca
SHA1 a3e2ae26b2d91e8a5199f4c2e05482d41e190061
SHA512 eca8f4cfc94302b0678e03d457501352fabb5b5d25f01f99410e17bade26137eb7537a48de7013e9c1b9e5b020839bc1fc071625b5cf9444c9ee2cbe0dbd73e7
SSDEEP 1536:TvFjZZjFSCJZYwsWW8x1w6kNYm7L3/rbASI+slThD+y:1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netcore50/zh-hant/System.Runtime.Numerics.xml

SHA256 d8859c2dac76576226807f29caa80b7427b31dc23c44007ce319ff65d6eb2a77
MD5 b185e7401d5dec5cbdca184b9a74ac71
SHA1 aebb24ec2387088c76605bd036ae21c990f60d33
SHA512 cf65bfb305f4fe5191da58e96a7e5060079aa519ad1b0b4d84268b05c2f96c1dd7b970372e2f8b93a47efd23e923b59e3cfdcf42c93ecb0a31c234c94c2fb0a6
SSDEEP 384:YDVpL7l/byal4wxpEvI+/emjQBB/kBJrZfEwX4XwXsXEXXXVXoXcXcXmo:Y5pL7l/by3wxpEvI+/emjQBKRy
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netstandard1.1/System.Runtime.Numerics.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cd7a38053c0d0514210d551ac24483549376a9223b5515bf09089fe49450f53c
MD5 e36efc00d1e84bd75098068a8621fe29
SHA1 21f7238d6f588a21937e34d4ae6d56fa0b570f6c
SHA512 6bf082b764e83d67c47cd82434171af0f203697153b21ffad15ab9696af24c674977e709388dd0802cb9465a0051b36f50070578149263a36b2b917edf57bc3a
SSDEEP 384:ApptwqPa8Lqz/9lWNRWmMIA0GftpBjyfXoERHRN7Rlp/mQdQ:ATtU8LFgqiEQEBV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

fe:d1:2b:a9:f4:6f:6e:3a:7f:52:c0:fa:e2:15:4f:9e:cf:b2:80:72:af:e4:61:c5:72:05:a0:91:a0:ed:d2:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

5b:bf:a6:9c:9e:7c:f9:c3:c9:dc:70:af:ee:b7:83:94:0d:df:f5:24

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

18758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Runtime.Numerics\4.0.0.0\System.Runtime.Numerics.pdb

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netstandard1.1/System.Runtime.Numerics.xml

SHA256 2b14423bc12e5cd8fc16cccf7435351ed838215afa757bca46af5fc2f9092647
MD5 e2d272140d1de435b0c859f846d16cc6
SHA1 0f066b28be4bd55cd6148e48debfe6eb26c7f60b
SHA512 30d9663a5a6c6116503ba7655a8309bfb394d3b61d793ede9afd22e31f8a109159c633d5d5533ad0abe91fff11c62b4582507b494b3934a3d1d334ad559956a2
SSDEEP 384:YPsjADqPnQnHESKGI1wFXv4hPADWy/OVelJt0cpGASL/oWu/KWotjQ0rB8fMG0o4:YPQ55bGnSB8OvQo3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netstandard1.1/de/System.Runtime.Numerics.xml

SHA256 9b6e0db36821cdbbb5fff4542846c21d4e3be639ae1f82a76136e14470de0b93
MD5 2d7c126da0009e18c40a955af459ca8d
SHA1 e20cbbabcd5500da4939de110a039b251e72fa29
SHA512 e98255a936e5c306e83050c78d7d314418addf0f8a4492045e58701031d205a5c4ff504d57fd3de93f41574464826a89ece7265b2dc4b71068444f83061f2612
SSDEEP 768:Y2064+d8BNytZc7aF+pEHDzN1PJydHcB2ofm63/NfT1V7O6pPhqM4m8l:j064+d8zEHDzRyeLm63VLLO6uJl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netstandard1.1/es/System.Runtime.Numerics.xml

SHA256 88cfc5877a347a16bf5fa02a245a95835f499bbb2c9b16701be1e8503e461391
MD5 099b58f0deff530fabf165a9c1b3422e
SHA1 1bbec77d1ca63281df7ff44d147a526639219c6b
SHA512 0ecf487274a5305eeb266ce5ca2131ec513ded97ddd17454dd218aa8656caaf18b5cc4a760e38232a87707e9f5d8f5c838ea53d2d21190ebcb030b4e4cb5f27b
SSDEEP 384:Yg3cORjwi2PuJ4P5Q8JUdkdD2KZumAogv/4i/lJkbq5K0CE+R+e+h8EOXi1hqrDf:Yg34Bz4eEyM+MZIuI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netstandard1.1/fr/System.Runtime.Numerics.xml

SHA256 05e3eff0804a695280e0854f25f9995823245a065b1eb79fc98b640f6325d21e
MD5 3bd2a8e2a769ab5545debf44b539ac53
SHA1 59930ab833743bdc02a392bf5ed918617a6705ef
SHA512 fe6d19535aa8266ef66552865af5ced3e66a08186548939560bd1d73662db891fc298e3c80ce3b11a72a2091cc9dcbcbd5bcc3d53899e17f5b0a454bc7fe27ca
SSDEEP 768:YkNt4xWY2K/2Kj5e1kKNrFtBhQ4dbbsiZ2QsZd:Rt4xWY2K/Otz5i
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netstandard1.1/it/System.Runtime.Numerics.xml

SHA256 42e841f83263a91e5fb0a3cf56e0a4ae875a58a0f1108320d2c648cc4d458dd4
MD5 c3d72e42f4cc8b2a647d4ec1ab336d97
SHA1 1cee5478bfae8a2dc1fdba9c658ddefdbc783938
SHA512 bef20e3387f7520dc37f53fc7e6a7579a13ae85b3620e5523a7b7edb88d5061bcdd0600b5b7e17388c1aa6c78f2d7adb0fa5967bcbf2cdc9aec95a07e1d7cf36
SSDEEP 384:YCsW5nTxfjsskFZLX2+a+Qylv4lRtjwPFaBlCRn9aq4qjqMq7qGAqaqhdqx/qznh:Y6W2zby54nBLEFKfR6/p2
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netstandard1.1/ja/System.Runtime.Numerics.xml

SHA256 810413007c2afa403b818076ded5a05f69e60f7b4bd3eca7208b0f2976fbb8d0
MD5 a9715545f57188701a7625bd746893a3
SHA1 de07db163d9c2ddbaad97ca485943a309c2344a7
SHA512 11fff11372946effd0f718d36e02c35e9839d713d768d7a10072001212b699db9323cb9752318b5e7d1a58e42e5a44d4d3f01cd4e8190d3808c1035ebff5827b
SSDEEP 384:YOtfi0oTKOUIz2XrB73Ql5mSzJP0EosdU5vL2KFxHLLDfZCsghrWKhZ4hVpJF/d4:YU6TKOUY2XrB734PFU3xlq8hVpJF/2b
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netstandard1.1/ko/System.Runtime.Numerics.xml

SHA256 8ca82077061dbdf814d01ceb9e1d6e8efe5c6f35f906230bbcac6d8b1a850f3c
MD5 bfb67432b27134326e8fc07296c5a7c0
SHA1 3a47c7b418134740913793b08451251036d856d8
SHA512 c89b95543e02c5017f62b790a44872be188f2e6290148fd8fcef1566b69832ed4272e7b4f83e742791813f078b13f9b5e62675f437804dafe294422aa4dff6dd
SSDEEP 768:Ye2ZA5kc3/rt9B5NOjiFApF5yXgFbuYzimQt5nCJkpxhFlQC+QnDjPNwy3YLUsXd:0MyLBJHl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netstandard1.1/ru/System.Runtime.Numerics.xml

SHA256 80cd936b9850eb988faaa2727133c31a40bb8593aeaac777d36db07ecbc1e4c8
MD5 222f96d932c9e92660600a821b5d2920
SHA1 75aed202759100fced033d4afa0cfc3bf0b30c5b
SHA512 36e26962da3f3cc4d4c002d7f85a694fff017cb55f8b15b583d4ede007c6b2654b3923b3012e1fa7dc5b27755d1254254ac90d7c383303f8b42e9ac8e86f71f0
SSDEEP 3072:dEzjZs1mNfUNIyOFTidAiuiGOUHJoJu4OwXmY:dEzjZs1mNcNIyOFTidAiuiGOUHJoJu4T
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netstandard1.1/zh-hans/System.Runtime.Numerics.xml

SHA256 2f6e627363b0da4de11693dcb6c50758e176f48a3ab4b8dd9c5b2ade336d1ca3
MD5 55090f7a2df5d680cc4944c809a57cca
SHA1 a3e2ae26b2d91e8a5199f4c2e05482d41e190061
SHA512 eca8f4cfc94302b0678e03d457501352fabb5b5d25f01f99410e17bade26137eb7537a48de7013e9c1b9e5b020839bc1fc071625b5cf9444c9ee2cbe0dbd73e7
SSDEEP 1536:TvFjZZjFSCJZYwsWW8x1w6kNYm7L3/rbASI+slThD+y:1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Runtime.Numerics.4.3.0/ref/netstandard1.1/zh-hant/System.Runtime.Numerics.xml

SHA256 d8859c2dac76576226807f29caa80b7427b31dc23c44007ce319ff65d6eb2a77
MD5 b185e7401d5dec5cbdca184b9a74ac71
SHA1 aebb24ec2387088c76605bd036ae21c990f60d33
SHA512 cf65bfb305f4fe5191da58e96a7e5060079aa519ad1b0b4d84268b05c2f96c1dd7b970372e2f8b93a47efd23e923b59e3cfdcf42c93ecb0a31c234c94c2fb0a6
SSDEEP 384:YDVpL7l/byal4wxpEvI+/emjQBB/kBJrZfEwX4XwXsXEXXXVXoXcXcXmo:Y5pL7l/by3wxpEvI+/emjQBKRy
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/.signature.p7s

SHA256 f6deb651bbf5d5b915228844c5652f570a8a255808a824db043068a8d339037a
MD5 7f827c43ce48b698f4758ce46cfa2389
SHA1 9ef3a8f8126c84c96115cea162b267c0da08d469
SHA512 d24c582270989ad5817a709d2e965e3b8ba1ab989228ec717626bc95f9d0c6beba5fa64f2d70ba3debc296ff8fe6b5b5d2b4b1d6c77838b4556877123e767c6d
SSDEEP 192:xdT7x0KDWpHhXZCVzV07VrasGDH0JOqsmVgz28WhBqZ6zFna:jZvDGGVp0GoJN77hhBzFa
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/System.Security.Cryptography.Algorithms.4.3.0.nupkg

SHA256 b4026f35295ccd8049dc4776e007b6edae79b6afe7e03ddfb9b35077070a580f
MD5 a1f8f097231910e0b4d67dd30f1b6677
SHA1 e73a700cb4e933c3c1467c9d1d46eebaed7dce7e
SHA512 7641d70c2ba6f37bf429d5d949bda427f078098c2dcb8924fd79b23bb22c4b956ef14235422d8b1cc5720cbbcc6cfee8943d5ff87ce7abf0d54c5e8bce2aa5e2
SSDEEP 6144:1UTPmGcfcdPokcfcr1hH8d8TRNuh429/Xvh8eaHDnlPwQcfcUQOTA5A/DiIN+PNV:Sd7r1hH8KTR1/DtUmyuj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/lib/net46/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6a0f94d33609622abd37b85c071cc8f4676af91923d36b47434222ba8c554acb
MD5 4558831716201309f8eecaabe2bc4901
SHA1 3c25b3faaa68cb0e291b537a4991cf413eadb6cf
SHA512 6b0e001a8dec7f2a4923650c2cef21c9ff809b522fb3cb7734cf6cd80c5415f7d7274a09f92dbaf3a443ad9f4bb1c853d894d99d5adf1ac9b467424e0239ff44
SSDEEP 384:tD801M/IHa611rqr7SMvQiBG5gOR+eCoa6Ior4mCVnzoNI76dXKu5X+wHdKPTKKz:W01Ki/rqvSaIgpt1KKb0hNkbiiEBDq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

66:64:64:0c:41:e4:32:9e:f2:51:1a:d3:1d:7d:c6:b2:bd:9e:5c:0d:7d:57:d2:cb:1c:31:57:ca:16:dc:ea:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

0a:20:30:20:32:a5:e1:64:8b:ef:16:2f:24:ee:c8:bd:2d:c4:d4:4a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

27358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/net46\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/lib/net461/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f14df3a548a8c43cfe7f60d325ac5e95d92c605f482bbee17a39f98bcfcc7216
MD5 82bbb4ab9a6a775d34bbbc93c2bd4ebb
SHA1 413c96c3ae407532db4c1ce3085a8f99675a8ad4
SHA512 22a56e6202ca6cea3eb5695bb186593355a243bec92a022d65b02e5222b0dcb9f1fdc6bd17e4963cf76d7fcd8a177d7a49d27aff13c16bcd48de9cb88ba18ed1
SSDEEP 768:301KgnylIXQpIgB81KKb0hD4NzhiwdmKEBARNrqd:3xpIx1KKb0iNzhAKEBW1qd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

4a:14:b5:a7:61:41:00:2c:58:a7:f3:b9:0e:29:ef:da:7f:e6:85:05:a9:ba:96:71:dd:e2:6a:54:d1:ed:2d:e5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

09:d9:f9:ba:40:e0:89:5a:d0:e4:12:bb:07:3f:7c:47:25:5d:f3:67

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

27382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/net461\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/lib/net463/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7076f4cdc5d324296260c7f427b4247fda276553326252d58f58e9951d926f5a
MD5 88de811e921481ccd7520e291fab9b63
SHA1 45abdcbc62b8fc20efd3f8bd799fb40357e3d91a
SHA512 abec52e55b7b22b82dff88ffb12f06aa0e8debce87ce78d73e0e0882f6ea8aa54547f264d3cd71c21804ba18a8dedb3921009cda96d8cb8862327fc943e01a99
SSDEEP 384:27801M/gn+1lINQDvQiBG5g2R+eCoa6Ior4mC6nzoNI76dXKu5X+wHdKPTKK7O62:X01KgnylINQpIgBQ1KKb0hnZJinEBbbt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

12:68:69:8c:81:d7:dd:fc:3b:c0:3a:99:5d:5b:15:1a:80:b0:69:39:2b:9b:9d:d5:00:9b:a3:1d:42:ae:58:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

95:41:25:3e:a5:c5:ce:06:f3:3c:71:87:ef:e6:e1:de:2b:05:30:bd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

27382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/net463\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/ref/net46/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6a0f94d33609622abd37b85c071cc8f4676af91923d36b47434222ba8c554acb
MD5 4558831716201309f8eecaabe2bc4901
SHA1 3c25b3faaa68cb0e291b537a4991cf413eadb6cf
SHA512 6b0e001a8dec7f2a4923650c2cef21c9ff809b522fb3cb7734cf6cd80c5415f7d7274a09f92dbaf3a443ad9f4bb1c853d894d99d5adf1ac9b467424e0239ff44
SSDEEP 384:tD801M/IHa611rqr7SMvQiBG5gOR+eCoa6Ior4mCVnzoNI76dXKu5X+wHdKPTKKz:W01Ki/rqvSaIgpt1KKb0hNkbiiEBDq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

66:64:64:0c:41:e4:32:9e:f2:51:1a:d3:1d:7d:c6:b2:bd:9e:5c:0d:7d:57:d2:cb:1c:31:57:ca:16:dc:ea:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

0a:20:30:20:32:a5:e1:64:8b:ef:16:2f:24:ee:c8:bd:2d:c4:d4:4a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

27358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/net46\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/ref/net461/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f14df3a548a8c43cfe7f60d325ac5e95d92c605f482bbee17a39f98bcfcc7216
MD5 82bbb4ab9a6a775d34bbbc93c2bd4ebb
SHA1 413c96c3ae407532db4c1ce3085a8f99675a8ad4
SHA512 22a56e6202ca6cea3eb5695bb186593355a243bec92a022d65b02e5222b0dcb9f1fdc6bd17e4963cf76d7fcd8a177d7a49d27aff13c16bcd48de9cb88ba18ed1
SSDEEP 768:301KgnylIXQpIgB81KKb0hD4NzhiwdmKEBARNrqd:3xpIx1KKb0iNzhAKEBW1qd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

4a:14:b5:a7:61:41:00:2c:58:a7:f3:b9:0e:29:ef:da:7f:e6:85:05:a9:ba:96:71:dd:e2:6a:54:d1:ed:2d:e5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

09:d9:f9:ba:40:e0:89:5a:d0:e4:12:bb:07:3f:7c:47:25:5d:f3:67

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

27382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/net461\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/ref/net463/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7076f4cdc5d324296260c7f427b4247fda276553326252d58f58e9951d926f5a
MD5 88de811e921481ccd7520e291fab9b63
SHA1 45abdcbc62b8fc20efd3f8bd799fb40357e3d91a
SHA512 abec52e55b7b22b82dff88ffb12f06aa0e8debce87ce78d73e0e0882f6ea8aa54547f264d3cd71c21804ba18a8dedb3921009cda96d8cb8862327fc943e01a99
SSDEEP 384:27801M/gn+1lINQDvQiBG5g2R+eCoa6Ior4mC6nzoNI76dXKu5X+wHdKPTKK7O62:X01KgnylINQpIgBQ1KKb0hnZJinEBbbt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

12:68:69:8c:81:d7:dd:fc:3b:c0:3a:99:5d:5b:15:1a:80:b0:69:39:2b:9b:9d:d5:00:9b:a3:1d:42:ae:58:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

95:41:25:3e:a5:c5:ce:06:f3:3c:71:87:ef:e6:e1:de:2b:05:30:bd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

27382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/net463\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/ref/netstandard1.3/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 23a08269ef1c1743927a52177f350ead8e7276abe0d13e4add5ee0abc57b6e24
MD5 2ec557d432e7ecc146da11d8d06506ff
SHA1 a2d8d4c50ecd4342db75f278f551e1ccbebdc06c
SHA512 b266ff0448ae047554bc63d3ee10c4dbcb1750f8228ee6ab1b90e0f6bb41425ec84bc77a98c4a57e6a3fc49523e301fd46fdbd62d3866e37af6ec726a5224523
SSDEEP 384:Ki981EYJVRQEDIeZWd/W9JyAA0GftpBj07SiFERHRN73NlraGx:THE7gcioSeEB37R
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

3a:ea:8c:14:a0:de:de:7c:30:30:70:4b:00:af:c0:99:70:c5:d8:35:e5:f4:aa:3d:d1:68:02:34:c2:6e:04:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8d:43:16:f9:1b:25:eb:de:f3:76:82:2f:67:db:d8:36:fd:88:ab:48

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

15878

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Security.Cryptography.Algorithms\4.0.0.0\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/ref/netstandard1.4/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 13f9f33e9fb523df7f733cf57a125ce945961eeaffdaf58b0bf7924efadc5d18
MD5 3ede607ada5aab8d429383b1e4d90d22
SHA1 5bb06cee9c9d6196366269407e5556155f76be2c
SHA512 626a7ec28d35ac72ec3bc95354df21af4b5573256b9cc7f45e18dc8d7395bdc7c8818366aed8c0e865e873f3b16d6661e797c63d061f2194df09c696bde849da
SSDEEP 384:38mIlYnD8YJVRQ6PEWd/WHyAA0GftpBjBB6r6ERHRN7Ygl2IwnDM:38zlF63oid7EBoIl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

15:62:66:21:c1:38:62:84:16:32:c4:14:80:39:29:87:41:cb:67:9a:16:c7:6d:33:6d:39:28:2f:e6:8f:5f:55

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

9e:21:b1:90:fa:1c:f1:46:ae:1b:27:ef:a7:0f:6b:44:cc:40:7c:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

16278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Security.Cryptography.Algorithms\4.1.0.0\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/ref/netstandard1.6/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 443fe2e62e758908aad48a76b1fd221570ffd97e099c315ebd09171d7f2dc376
MD5 7f7725c191cf6a03dad9bdfe1aa8ee9a
SHA1 3320fcba57587e91184013bbd6cd189f5d111062
SHA512 7b189da5266d34f8b1e3bb2712251dbe2e4e16e73cdf2ce2cb3c5777272d41da9231e5373ede6b3bc6a4b313e84de5d48e0bb9160d0d892fe355834bd3677673
SSDEEP 384:6zem59yuy6EeMzeDd/DTh4vl/VzZWd/W6JA0GftpBjh/ERHRN7+l2Iwn2fF:6zembCFeMLt/m/ir/EB1I
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a6:2b:df:24:9c:45:4a:cc:3e:bb:32:48:e0:df:6a:6c:20:3a:26:59:e6:f1:58:44:ff:e6:f4:76:f3:6c:19:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

54:0e:60:c6:55:ff:5c:0e:57:ab:bc:a0:e5:4a:3e:ab:5d:54:a1:25

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9d:42:68:ee:31:1c:d7:56:bd:00:00:00:00:00:9d

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

18758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Security.Cryptography.Algorithms\4.2.0.0\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/runtimes/osx/lib/netstandard1.6/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4c3258fd1a1de5673d535c1be7a7e4c176b56417ab6fa22a9c5a36f32c014026
MD5 1781125da1aa98df7252e390bbdc7bfa
SHA1 f4fe4649ac922b4c0709c937a2dcee71a62c5b0f
SHA512 1dbeeaa3b2f86366f5770ba272d4b5347aa1283da536bd04c8f722e2905c105e834f568dcb197bc72715bab812daa3e1e23dbc40d5bce7bfdce8701d211789e2
SSDEEP 1536:YsNTz1qJDMkcqjwfknOCm/bFVYPm7zVB/tthnfYI/dBZvbyKKb0co89EB4Cbc:Ys5z1c2O5OLVB/tthnJ/dBZvbab0c59d
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

58:6d:c8:7b:5e:1f:cf:ec:55:72:bb:ac:2e:4d:c1:15:b4:fa:b7:c7:8c:4e:7e:16:23:ff:bc:3a:53:30:c2:cd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d8:23:0f:d4:55:38:c0:9a:77:23:55:e9:c5:b6:50:fa:bd:7e:30:c0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

82682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\OSX.AnyCPU.Release\System.Security.Cryptography.Algorithms\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/runtimes/unix/lib/netstandard1.6/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1c337236883f5155649fa0c2f2aa3322d41a589b792632c490f6771d98b4e696
MD5 d566d40c13da01c69e2ace2de20b48c4
SHA1 b8dea21bec9d516bc3e66f499f1462f6651b1795
SHA512 65b4a95868365d7956419679dc680e447c40b220e72f4f580cd6e81d1d4214e39ef559050dcaf24e76628f6a7dd7fad279877e08bbd9a58cfbdcf39a12cf9898
SSDEEP 1536:uO/IJmR13B4yycxteIgdiJBGMToFq/0Ev9F7INEwthnIiqWkWH3maKKb0fquhEBA:uO/v0CWsTMq/0mDQEwthnUWkWHFb0fHd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

4b:66:11:cd:be:15:90:11:67:da:78:31:2e:b4:32:fb:ab:4b:5a:b2:91:1c:b4:51:d8:55:87:16:4d:f6:45:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

7f:07:2f:98:d0:ae:d4:af:29:a3:b5:b0:ee:a4:8d:ce:6d:15:92:e4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

81510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Unix.AnyCPU.Release\System.Security.Cryptography.Algorithms\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/runtimes/win/lib/net46/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6a0f94d33609622abd37b85c071cc8f4676af91923d36b47434222ba8c554acb
MD5 4558831716201309f8eecaabe2bc4901
SHA1 3c25b3faaa68cb0e291b537a4991cf413eadb6cf
SHA512 6b0e001a8dec7f2a4923650c2cef21c9ff809b522fb3cb7734cf6cd80c5415f7d7274a09f92dbaf3a443ad9f4bb1c853d894d99d5adf1ac9b467424e0239ff44
SSDEEP 384:tD801M/IHa611rqr7SMvQiBG5gOR+eCoa6Ior4mCVnzoNI76dXKu5X+wHdKPTKKz:W01Ki/rqvSaIgpt1KKb0hNkbiiEBDq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

66:64:64:0c:41:e4:32:9e:f2:51:1a:d3:1d:7d:c6:b2:bd:9e:5c:0d:7d:57:d2:cb:1c:31:57:ca:16:dc:ea:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

0a:20:30:20:32:a5:e1:64:8b:ef:16:2f:24:ee:c8:bd:2d:c4:d4:4a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

27358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/net46\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/runtimes/win/lib/net461/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f14df3a548a8c43cfe7f60d325ac5e95d92c605f482bbee17a39f98bcfcc7216
MD5 82bbb4ab9a6a775d34bbbc93c2bd4ebb
SHA1 413c96c3ae407532db4c1ce3085a8f99675a8ad4
SHA512 22a56e6202ca6cea3eb5695bb186593355a243bec92a022d65b02e5222b0dcb9f1fdc6bd17e4963cf76d7fcd8a177d7a49d27aff13c16bcd48de9cb88ba18ed1
SSDEEP 768:301KgnylIXQpIgB81KKb0hD4NzhiwdmKEBARNrqd:3xpIx1KKb0iNzhAKEBW1qd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

4a:14:b5:a7:61:41:00:2c:58:a7:f3:b9:0e:29:ef:da:7f:e6:85:05:a9:ba:96:71:dd:e2:6a:54:d1:ed:2d:e5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

09:d9:f9:ba:40:e0:89:5a:d0:e4:12:bb:07:3f:7c:47:25:5d:f3:67

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

27382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/net461\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/runtimes/win/lib/net463/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7076f4cdc5d324296260c7f427b4247fda276553326252d58f58e9951d926f5a
MD5 88de811e921481ccd7520e291fab9b63
SHA1 45abdcbc62b8fc20efd3f8bd799fb40357e3d91a
SHA512 abec52e55b7b22b82dff88ffb12f06aa0e8debce87ce78d73e0e0882f6ea8aa54547f264d3cd71c21804ba18a8dedb3921009cda96d8cb8862327fc943e01a99
SSDEEP 384:27801M/gn+1lINQDvQiBG5g2R+eCoa6Ior4mC6nzoNI76dXKu5X+wHdKPTKK7O62:X01KgnylINQpIgBQ1KKb0hnZJinEBbbt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

12:68:69:8c:81:d7:dd:fc:3b:c0:3a:99:5d:5b:15:1a:80:b0:69:39:2b:9b:9d:d5:00:9b:a3:1d:42:ae:58:5c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

95:41:25:3e:a5:c5:ce:06:f3:3c:71:87:ef:e6:e1:de:2b:05:30:bd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

27382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Algorithms/net463\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/runtimes/win/lib/netcore50/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 32ef8566291147800c437e56d3e5d01e666d2e52fd7b065822f7df5cd79a0ace
MD5 745bf792dcf7b30fdc1b83519c567f23
SHA1 2f1b5dd94f94c7bea4a6130d4dad597ebe5a62f4
SHA512 1f92bc0dcf2bcac4a3fc629d732a373bfb4f7b71edfb9582b29e56d20a682bf372572e47e483cfb21ae2163c1affbd23886da57745779e5399fcbd9220a26bbb
SSDEEP 3072:5TuBLIbDlUUUU20nD00LhzbpNEuFIFBYp7jb0lcdsEUo:BtbDlUUUU20nD00xbpNrUo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

12:57:77:f8:84:93:28:0f:f7:0d:8a:6b:cd:05:41:55:6c:00:d9:3e:f6:7c:5b:2b:40:34:65:0b:97:fd:3e:73

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

5e:5c:f1:7c:72:43:3d:37:5b:d4:8f:a6:ac:19:8c:ce:39:62:34:95

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

88586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Security.Cryptography.Algorithms\netcore50\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Algorithms.4.3.0/runtimes/win/lib/netstandard1.6/System.Security.Cryptography.Algorithms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2b1066896d2f1c40b467ded4a786902f3a592dcbf8dfec742acfcc2dea87c6ca
MD5 1763fc471753a4561beab3b2649ce5f7
SHA1 bf73406ff90f6cc0bc1ee58c82a79952ebceea1f
SHA512 a472422f70f0888eb22c5b3d1aafbb7169228c1416048314bfc6d9a1ef68b96a4533b965bf10ffcd736a5f02674c6b65e1f843c381f5b5640e611657bc78cb55
SSDEEP 3072:hyt5Kc8W8F58NHHHH5TZ/zbplEuFIFBYpwd2zb0hX5EAG:h0yW8F58NHHHH5dbplAd2+G
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

4f:c1:b4:2e:6d:ed:f7:c0:bc:61:05:20:d2:1a:19:82:2f:3d:7a:e4:35:fb:53:2e:b5:cf:43:85:73:b4:00:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

8a:a4:3c:97:bf:2d:a0:ec:59:c0:ec:34:9c:fd:15:5f:a3:2a:a4:77

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

88514

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Security.Cryptography.Algorithms\System.Security.Cryptography.Algorithms.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/.signature.p7s

SHA256 4c68d640e354fe2e923e0c2ccfe6435ebc26a61ce96f709a57cb3761dea54e36
MD5 a5b0cb0243a0cabf94ba2e122c64c150
SHA1 585096ead829f1b92af054c426129e526acc9a96
SHA512 e1a68fc8a58fd202b486dfc27efc93a397332c56db1dae60a8ed683b4b4d8aa9964d73f2fcda1c004b0b918c4f1e4ad6246673f72fedffd6de9c05dd4b0127d3
SSDEEP 192:xdTZf7x0KDWpHhXZCVzV07VrHt9DH0JOqNG8Fp28Wh8nrB:jTZ9vDGGVpi9oJNNzFwhhirB
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/System.Security.Cryptography.Encoding.4.3.0.nupkg

SHA256 62e81ef3d37a33e35c6e572f5cc7b21d9ea46437f006fdcb3cc0e217c1e126cb
MD5 fafb48108f8a3c4d41e39ea40d58f490
SHA1 649ae4f51f2849c2fea83e5b3f992c7bf52c5a38
SHA512 5c26add23e63542f37506f5fa1f72e8980f03743d529cd8e583d1054b8d8a579fb773fa035a00d9073db84db6be4f47cac340d1ebc6d23dd761dbdbd600075e0
SSDEEP 3072:3Ux6Ayk3RZk3RFgpcK/cF2liZ89U8AS/HIQCfk3RkCtvgvq5Kpb5qt7V:EUnkRZkRFyLkgAkHAS/ojkRyC5Kptw
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/lib/net46/System.Security.Cryptography.Encoding.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 91c7c02d46f754193b3988c28050135c804e47dc3456d0c3dde028ac0341fbe2
MD5 5f859d35ca74d84cce62533e086dc27f
SHA1 a0f2c03cb813317460133de80231d7b1fb62dcc5
SHA512 eab5017628e4c576a1076eab0e906523987cd82e6accc5b01b19b048faed81b6a4ee7c4d09454a7a9516f72a87a34d0c4cc83c74494f8854cc7d83583459dbfa
SSDEEP 384:czoy4YE5WP4WnWW4Wo+10vq0GftpBjFLqpERHRN7F9lXhWjW:czoyTDoiXL6EBF3x
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

5d:c7:27:fe:ae:11:ee:f9:e8:13:89:07:05:58:50:5b:cd:bc:10:ea:02:3a:60:4b:3b:45:46:28:a7:8a:4e:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

bc:e7:dc:08:18:1c:3a:87:bf:7e:3d:66:64:60:7e:24:33:ac:f3:fd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Encoding/net46\System.Security.Cryptography.Encoding.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/net46/System.Security.Cryptography.Encoding.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 91c7c02d46f754193b3988c28050135c804e47dc3456d0c3dde028ac0341fbe2
MD5 5f859d35ca74d84cce62533e086dc27f
SHA1 a0f2c03cb813317460133de80231d7b1fb62dcc5
SHA512 eab5017628e4c576a1076eab0e906523987cd82e6accc5b01b19b048faed81b6a4ee7c4d09454a7a9516f72a87a34d0c4cc83c74494f8854cc7d83583459dbfa
SSDEEP 384:czoy4YE5WP4WnWW4Wo+10vq0GftpBjFLqpERHRN7F9lXhWjW:czoyTDoiXL6EBF3x
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

5d:c7:27:fe:ae:11:ee:f9:e8:13:89:07:05:58:50:5b:cd:bc:10:ea:02:3a:60:4b:3b:45:46:28:a7:8a:4e:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

bc:e7:dc:08:18:1c:3a:87:bf:7e:3d:66:64:60:7e:24:33:ac:f3:fd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Encoding/net46\System.Security.Cryptography.Encoding.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/netstandard1.3/System.Security.Cryptography.Encoding.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f6a58817ffa71d60e5664c775ba9d2994db3716a29800fc38000f8af60388f89
MD5 01ac68eee55696e6a95f2c63851517a2
SHA1 b3acaba655652508df90e118ed0c50060d07cdc2
SHA512 383624f8afa235b1364d7b15a3c6a03989ea79c50dc57c88c646bc42c37ef66ea93a12fcaef0ec2a7c5652ef2fb236d6d35dcb0f22b723cca911def59652fe83
SSDEEP 384:6Zf7WUj8603DMIijYXA1eRWX4W3yAA0GftpBj1IERHRN7PQlCADhR:6/2o5rjiTIEBPpADH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

88:2b:c7:7e:15:27:c6:f6:01:11:a1:e9:bf:94:81:30:c0:77:67:b1:b3:51:8e:c8:fd:3c:09:34:2a:a5:0d:3f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

71:23:fc:95:0b:b0:71:6a:24:6b:99:a0:96:47:b4:7d:98:5c:46:a7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13458

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Security.Cryptography.Encoding\4.0.0.0\System.Security.Cryptography.Encoding.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/netstandard1.3/System.Security.Cryptography.Encoding.xml

SHA256 6eb3a7e08e22d3f7136afe83745936b0c1de816025607cbc684ea776f52aa25d
MD5 7d72918afbb3fa65f1585af202e69490
SHA1 5e0e5925582b60511229dba5e59da6b70d111e6d
SHA512 dcd5f1bc9070b5a573cf14d89a952f19735ca3093ae7b130ed7d051a13e95ffc09eeb0f8566ec424c04782605f142bded9a560fa6428e542b8fcf24687687673
SSDEEP 384:YFCelpsEXylIxhSl9vy+mWwyUX0ZelZoE/m+Hmhhk0XSY/7QS73BWGvozGyDzAo3:YjlpflxUl9vy+mWwyUX0ZelZoE/m+Hmk
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/netstandard1.3/de/System.Security.Cryptography.Encoding.xml

SHA256 09cc34294ea618ea444c472dd7f6d58f23d065ef2c711cf5cb3394213c6afde7
MD5 a7d85e2eba82fd1a47a178fafdcd278a
SHA1 8f60714c3337447b550d16074bab99bf5674cf20
SHA512 9eac8ce09912dac2a782d9d00a39ab6ef01229ae45b670a1ead5c5e517cd8635edd16dcc872e36488f0351fec1d59cec33ca246770fd78e40b2ab047328524fb
SSDEEP 384:YLkuP/kr7V9ydMLifHAW06Kl6JWWtv66WhkNSALY3/q5CZqVvMOHYbL8dMcEaxbr:YLkuPsr7V9ydMLifHAW06Kl6JWEv66We
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/netstandard1.3/es/System.Security.Cryptography.Encoding.xml

SHA256 d39c0cef063452f930b2d163b9c8a86234e61cf159b326ca48ae8808baca7815
MD5 4d91294561ae1cd7a632759858641887
SHA1 948ec59db37bbddde0060c7d8a9b92880edd76e2
SHA512 78347c9518004fddc0c63a73c99af076fb3201b3822ea6dd776a78c76c2a4f23ba9fcc97bc5cc48e380018cc285e356b68ee5d8f42bafda57c5abb2b3190e8a0
SSDEEP 384:YyauIFhN+pjhbI9U553JhzJuj04Jl4+1xdpgcChRDB0IKY/NygTvtfg4acf4nmAE:YyauIN+pjhbI9U553JhzJuj04Jl4+1xG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/netstandard1.3/fr/System.Security.Cryptography.Encoding.xml

SHA256 b5caa28c26b80fe6cc552836181969cd2edc275f9f5ec34a3cd223b9ab4dfa97
MD5 c6f8d0389336042254840ee49efdf9d8
SHA1 65acebb3ed3656df98127e59b7a014ad7bc3df3e
SHA512 29dee64bc388a405175efae98339c47155ec80de09420fdd7adbd5d9928af3798872a07680742daf33bee726f677bbca10e4bdcb4cf90d50f39ec89387db5a03
SSDEEP 384:YdLeLt6D8p9rkfmSFQWfF0QOflQcZXd9TCh9ltryY8r4jpRx49GkaoqkizJtlvX7:YdLeLgD8p9rkfmSFQWfF0QOflQcZXd9m
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/netstandard1.3/it/System.Security.Cryptography.Encoding.xml

SHA256 ca742c9145efe91ea0d2fd84962343e1cf61b35980149220fce56e13ca64a95a
MD5 2e1e93db5c8ed7e2f23675d2bd4f0e90
SHA1 c3b4272b2bec252bd3cdfd6d8b2145bd2bfe7cdf
SHA512 61e4b73d0ea25e56f47e0c0c03dc326564cffb9f7290e75d5a5ac1117e0383e5d83d8a82dd08fad4314233ed5733cb899554270314bcd731547acd11f28470d9
SSDEEP 384:YMeBDYc9EmVb22n922gp1CCR/br0alGlamitbtOChTbI50AYlRWxcSpXaaY4aC0M:YMeBDrPVb22n922i1CCRTr0alGlamitI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/netstandard1.3/ja/System.Security.Cryptography.Encoding.xml

SHA256 81f069c7bac2540b065554ece2fd354aef1416f3e8ada2b8dfb0a628ccc16d82
MD5 bba1a0f90d10fb7849aba22d083704ea
SHA1 56d0cae316a9cc44d8d6495e3af5a340880a03e0
SHA512 9c7380089c34a4d210d8e0cba70710fab990cd848403a138faccf737e16a22b40382a6d74fdfa51f118825d422247769f26b56e36e442bd0676bcb4c71f06de4
SSDEEP 384:YupsDLXA/3HMT79PUcizp6uD0ETlUIX9g2/Jh3+ftIY6GblUbBQ5qjb0p5comca7:Y8sDjMMT79PUcizp6uD0ETlUIX9g2/JP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/netstandard1.3/ko/System.Security.Cryptography.Encoding.xml

SHA256 b4df30d93b4d4cac34fadb096e4bcd2cd5a6a22a5b8761132479b96a9c6383f6
MD5 7e88922eb4061ef6ad31e0f7ea9880b4
SHA1 0ee669d1bc71262ad8cde88bb05fa14a88204939
SHA512 f6561b6cdf8fd3698cfa94a916c0a0b1e01e7fd475d50109e448be0d65c722bd2ce23f3aa9d12c8462513a045a7a66746a1b93ed81f89413c3d2636627c484b3
SSDEEP 384:YXsifKvPS2fV99vPi5mGsO0LrGlToP5gGS/mh34CI6Y6X5taRQHMP7AbiGFzobmm:YXsifOPS2fV99vPi5mGsO0LKlToP5gG4
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/netstandard1.3/ru/System.Security.Cryptography.Encoding.xml

SHA256 409c66dcf38d576826b862bc0e3e4fc4e2c2c0d9324b5a7c9881c9083f98c737
MD5 dadaf83f4950d697d2aff289fbe5d0d2
SHA1 3e349eb68edc8bdd6c95fd8a29da47cb17fd1edc
SHA512 5627b423b845275bcff2abee162c2fa0d11d024256ee40d4d77028ea27469e398875bce2a2794499023c7cba8ecd13d28ceca097b6bcc92fbcd2c9bcba61675a
SSDEEP 384:Y1gVweRJUH/89/rze7Sit9yKDf0FhHlFXCEbI1S8XChivuz/Y1n85U/7seaeoegr:Y1gVwmJC/89/rze7SiOa0FZlFXCuI1S7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/netstandard1.3/zh-hans/System.Security.Cryptography.Encoding.xml

SHA256 71cb263344aee324d65cbe6c73022a98e16e28c401dbbe3d96de6a0920e55c57
MD5 f7ac8458e4e05f6a05c5773c900322f3
SHA1 13da94b6240c9336f128a3051d6c36b1cf743ca2
SHA512 27cd4f93978e26a3059a3c72b6e2d1d08ef2ab54468ea10cb8f4a4d587a8641aca6dcfac84b58cd93e690e45f27b1ce3b5cd90e5aa4f337cff0fee71d6dd40bc
SSDEEP 384:Ycq058p09ms4nE9SUSGCcdil5r0A0l27ch3Jfc9KNh/dcFcu915YOo4/cDc2Af3u:Ycq05829ms4nE9SUSGCcdil5r0A0l27E
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/ref/netstandard1.3/zh-hant/System.Security.Cryptography.Encoding.xml

SHA256 87444ad049f4858d89c1d834c5326528d94032539f2b4342549213ec4c5e4aec
MD5 0ef0f3a0f62dbc7a2eb602903a3710e7
SHA1 be73ac9ea06ed684b6564ac274e94693ad24b3b1
SHA512 a8de91f64feec05c73c1df8c4e522334a5ec40a272f3b116ab841dfa967062d74580e754e87dbb479a6805cd1cd23591abca5989922cb19c5708342453edc02f
SSDEEP 384:YTM54ISs4w069SCSCLG1XS04YKl+E30UfYKkhCNpx8AYbYNCJkNxYPljESO4y+NG:YTM54xs4wB9SCSCLG1XS0VKl+E30UfYG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/runtimes/unix/lib/netstandard1.3/System.Security.Cryptography.Encoding.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1cc2457d821fa725d1511fa5866254928b7c8fd43dd604a59b199efb3277f778
MD5 6c625d84679e83c57454319411517c97
SHA1 e282471881bcaf54451f79327e044f9cf849d0bb
SHA512 b463804b97420ab9380077a372bfd8362cc87a2fcdb8f15b7e65c21b2a1e27899518a7d8399f9f46ffe6cc759ab133791b021e0c18190ebaeb22d0dd000048c5
SSDEEP 768:0VyCPBlzXfOeAAYtyxSyFpjkTmllDIh3ri5ZEBuJhDW6I:0VRlzXfOeAAYtyvFpjkTmIJrkEB6hq6I
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

6a:3d:87:e8:4a:2b:33:79:af:a7:5d:9b:41:28:a3:c1:e5:2e:6f:f2:e3:c5:ce:94:70:5f:09:98:5b:2f:a1:64

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

5b:91:de:ae:74:84:0a:e2:53:17:88:c4:e3:34:46:a8:16:1f:10:91

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

36150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Unix.AnyCPU.Release\System.Security.Cryptography.Encoding\System.Security.Cryptography.Encoding.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/runtimes/win/lib/net46/System.Security.Cryptography.Encoding.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 91c7c02d46f754193b3988c28050135c804e47dc3456d0c3dde028ac0341fbe2
MD5 5f859d35ca74d84cce62533e086dc27f
SHA1 a0f2c03cb813317460133de80231d7b1fb62dcc5
SHA512 eab5017628e4c576a1076eab0e906523987cd82e6accc5b01b19b048faed81b6a4ee7c4d09454a7a9516f72a87a34d0c4cc83c74494f8854cc7d83583459dbfa
SSDEEP 384:czoy4YE5WP4WnWW4Wo+10vq0GftpBjFLqpERHRN7F9lXhWjW:czoyTDoiXL6EBF3x
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

5d:c7:27:fe:ae:11:ee:f9:e8:13:89:07:05:58:50:5b:cd:bc:10:ea:02:3a:60:4b:3b:45:46:28:a7:8a:4e:78

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

bc:e7:dc:08:18:1c:3a:87:bf:7e:3d:66:64:60:7e:24:33:ac:f3:fd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11018

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.Encoding/net46\System.Security.Cryptography.Encoding.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Encoding.4.3.0/runtimes/win/lib/netstandard1.3/System.Security.Cryptography.Encoding.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8b0fedc24845794ccf36e9cfe579f70d4fe4ff48e07b0589098fece7839a6c04
MD5 4e594b8c49659ec7d93af482d180f495
SHA1 abfbc4c5b5d2b4aa6f4b8529b244463bdf1994c5
SHA512 cb4f9a50f0e4ea6fd84506839a48b307bf83a857f735608f75f3d2e44861aae5d8f2e0ae4658f92f79ad772de3ed2f827ef8df995066046f28849831fa155391
SSDEEP 1536:+m3NEvRDaQ2p2diOwTtbEvqFIFBYpdJ1afEBSe:+m3NmR+jpGiOwTtbEvqFIFBYpP1afEce
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

86:2b:bb:ae:84:11:7a:db:70:b1:cd:f5:0d:ba:cb:41:f7:57:33:80:ee:56:be:df:7e:2a:bf:f9:cb:e2:96:52

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

6f:02:1c:2a:b8:d7:c6:01:33:06:60:b0:57:c7:ba:84:66:9e:42:a3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

42494

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Security.Cryptography.Encoding\System.Security.Cryptography.Encoding.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Primitives.4.3.0/.signature.p7s

SHA256 a624b6788e26b44f366d8c2e99872a4ce5e6a1e337bd92d5371bef6ee2ccfa3b
MD5 0ceb19bb50c8421199112467d1fd94f6
SHA1 8c96c1f4f2ef9c2241a44adf4e4f163f996b2e80
SHA512 8412c8211dae2ac35650b4cddfc18bf5ef75559ea91a3a2ae387cfdb724eb2091721ac7c71f3c8c2a2565295eeeb2600e93f09c624f45a8cac4c0e3e49b36d70
SSDEEP 192:xdw7x0KDWpHhXZCVzV07VrvGDH0JOqsmVgz28WhBq5uCAUA:jivDGGVpcGoJN77hhgu79
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Primitives.4.3.0/System.Security.Cryptography.Primitives.4.3.0.nupkg

SHA256 7e7162ec1dd29d58f96be05b8179db8e718dbd6ac2114e87a7fc23b235b3df5f
MD5 a712fdc2fa545cae6c315e3323becb4c
SHA1 0ef67154dd29ee12abb238a2cd759cbf638ce794
SHA512 5ad8273f998ebb9cca2f7bd03143d3f6d57b5d560657b26d6f4e78d038010fb30c379a23a27c08730f15c9b66f4ba565a06984ec246dfc79acf1a741b0dd4347
SSDEEP 1536:zsx6voUv2mY+h5Qn7A9ERYvENQwOQiopKIrlSKKY+h5Qn7A9Wrb1IBdmwJ1HOoKF:zsx6AYYISn7AiYsewOQ7KIr9KYISn7A8
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Primitives.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Security.Cryptography.Primitives.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.Primitives.4.3.0/lib/net46/System.Security.Cryptography.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5a6c8f69a8dea8a775331273aaae707eee2a2743fb1498c3cc4dbab679125d11
MD5 ecac83e551b639409899919d47cd7588
SHA1 62a622557cc0d6fced9c1a14be28dbc39e9bd6fc
SHA512 fb618860626b72d6fcf959e35bf9b3785a8b0d01b29fc8931d0151ebf001dc4470ca55ac62d5cecfec97fcd5973858185050e3ef414d1282b674cd880ea0e1b0
SSDEEP 384:dMqKW1pWEWwpWA80aq0GftpBj4PaERHRN76XOldBopPP3:dMgzEiOPaEB6Ko53
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

6e:9f:00:6b:8a:d0:7f:c5:6f:21:8b:48:80:5c:6b:f8:4a:ee:89:89:32:bd:35:75:74:3b:20:61:aa:38:47:8c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

1d:74:b2:f1:29:c8:08:eb:99:2d:d5:f5:61:0d:48:4b:7e:c1:57:a3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Security.Cryptography.Primitives/net46\System.Security.Cryptography.Primitives.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Primitives.4.3.0/lib/netstandard1.3/System.Security.Cryptography.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f9152d6c04771662bb10a2cced1f9da7da4ce948a89ec4eb40c5c5cf78506e7e
MD5 012ace0a093c0249a601c9f877f6146c
SHA1 056f2ddbcc1f0bffe7d53c1e70258f62fb459f7d
SHA512 2ae63dd8c6f6618556ac17b0359158e6892e9fee76c980da0227759468f59256045a99ae49d67df088dbec5850bba0366dcba031ca3bb561731a12c89212e4ca
SSDEEP 768:/tcLYQaVxfKxysWF6gFx/fsg+RtILR3uimmBEBDrol:/tcL5xysIfsrRtILR3uuEBAl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

1f:e3:bf:a4:c8:f7:fb:b6:d0:a7:1e:92:1f:83:f7:d4:63:b3:2d:6f:73:86:75:8a:3c:57:fb:8c:38:fd:fc:68

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

e9:2e:46:74:5b:ab:b1:97:69:23:61:50:d9:cb:ff:bb:16:d6:22:44

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

34602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Security.Cryptography.Primitives\System.Security.Cryptography.Primitives.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Primitives.4.3.0/ref/net46/System.Security.Cryptography.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5a6c8f69a8dea8a775331273aaae707eee2a2743fb1498c3cc4dbab679125d11
MD5 ecac83e551b639409899919d47cd7588
SHA1 62a622557cc0d6fced9c1a14be28dbc39e9bd6fc
SHA512 fb618860626b72d6fcf959e35bf9b3785a8b0d01b29fc8931d0151ebf001dc4470ca55ac62d5cecfec97fcd5973858185050e3ef414d1282b674cd880ea0e1b0
SSDEEP 384:dMqKW1pWEWwpWA80aq0GftpBj4PaERHRN76XOldBopPP3:dMgzEiOPaEB6Ko53
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

6e:9f:00:6b:8a:d0:7f:c5:6f:21:8b:48:80:5c:6b:f8:4a:ee:89:89:32:bd:35:75:74:3b:20:61:aa:38:47:8c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

1d:74:b2:f1:29:c8:08:eb:99:2d:d5:f5:61:0d:48:4b:7e:c1:57:a3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10678

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Security.Cryptography.Primitives/net46\System.Security.Cryptography.Primitives.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.Primitives.4.3.0/ref/netstandard1.3/System.Security.Cryptography.Primitives.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 64692c609c4dd04d292e79dc1bcf8ebbd91efc4e4031889b8bec27365fd7a47a
MD5 a2b37691d901b39654ca0e0b0e28deb4
SHA1 8dd517b2dac787056900ba08dd00940e74dac150
SHA512 20eb9881fdd3d12e50c723087afd0862bd6844480d71bde234e4b28d7458c4eeb291925876ce43f393678b8b10dea267af42468604200df2f94b03d13bc90fce
SSDEEP 384:ZaqNjlVPwLJrjeiY8WNpWLyAA0GftpBjuERHRN7vHlp/mQdlRBr:ZaWnYdiRuicEBvX7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

35:f5:b6:6a:c4:f3:c1:ed:b7:65:24:39:62:d8:d7:78:96:58:60:1a:8c:9a:98:8d:22:86:19:03:ca:ec:6c:b7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

39:93:0f:bd:91:e8:69:ec:88:31:1c:d4:81:8d:ec:b0:e4:64:cb:2a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

15462

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Security.Cryptography.Primitives\4.0.0.0\System.Security.Cryptography.Primitives.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/.signature.p7s

SHA256 9e2bb1679855a4ebbd97f9318f7ad6123bb0829d25b3477426fabbd04e0e7801
MD5 a51248f9c0d0c4a617fd3c68f5effc8b
SHA1 613465eb47842d4853f34cfd4d26110f16f82aef
SHA512 2de91c379cdb9b5dbd8de183c234501e424c384b19f3bda5eb5af4016e47ebbfe10800e0ddad29a34130a45087264a3cb4ccce1351c78d200ce8ed15472b2fa5
SSDEEP 192:xdcoT7x0KDWpHhXZCVzV07VrZOx/J9DH0JOqNG8Fp28Wh8nG:jcoZvDGGVp+mJ9oJNNzFwhhiG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/System.Security.Cryptography.X509Certificates.4.3.0.nupkg

SHA256 306dd5fe8c03876ef718250fb061ab68dc1a56973276ea65dc4b4f5e3e93546d
MD5 d8f85cbf88da8acee9e3034c3e7fd041
SHA1 7f7c9fb549464045ff4a6ef641067a794f8c6c87
SHA512 318d86ab5528e2b444ec3e4b9824c1be82bb93db513eab34b238e486f886c4d74310ed82c2110401fe5cd790e4d97f4a023a0b2d5c2e29952d3fd02e42734d00
SSDEEP 12288:RNR+ey+8dErB5tC6b+8m1rB5smrBA/3VkKaZDD6mrR:RX+r+TtC++9sCW3VkpVWCR
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/lib/net46/System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f415a437f4743355068198b3fc152216526f4af93f02e50bc52f8b91dc4a402a
MD5 ad0f84569d2b03838912788a6c3d66b9
SHA1 e9911b3c59f15474391811e17940faa6a6c217ce
SHA512 1b4dfb91f7a6e3a93ff86731b7a271ac594a6970c270a912e043eebf70e22c0913b7dc529647b351b35733f4c372707fc944f309576b3fadf8855c158ff86fea
SSDEEP 384:gSz8rS6cp1LFMZ4cDuwZc1uphNxwoMg3hg5N7Eu1h0Al1HW8OQnKd4fd9nXW3hW3:aOjIVDuwZ2uQ5SOF0osiE5EBF0E
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

6d:b3:4c:9e:7d:7c:9a:03:91:57:72:dc:2c:ec:5e:5b:05:be:7a:07:5d:59:5a:f2:7a:68:e8:0d:ee:b1:68:1b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

5e:99:90:3e:ca:9f:e8:e2:57:69:a8:7c:88:44:1e:3d:f9:8b:11:56

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

26222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.X509Certificates/net46\System.Security.Cryptography.X509Certificates.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/lib/net461/System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 132ae80c89f38750d1ade43bd1e588f4d0971ea813b4df5dca5af3c113e9e713
MD5 480ca4042ff3cbb3cdbb14ef0643c14d
SHA1 4beb5c11208affad40bdac6672a7b0b7b4558e7b
SHA512 7630bd40398fa55eedad8807cadcb7d0142717ae60073dc5187b9463824eebab993e8867ab3e43fcd34de73f2990d58397008cb1880882569e83b22f5d6b3175
SSDEEP 384:2Zz8reFd12yMZ4cDuwZc1tfhNxwoMg3hg5JF7Eu1h0Al1HW8OQnKd4fd9YW3hW/7:zqNQVDuwZ2tiJRSOzoti9FuEBFNXy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

87:58:ee:84:2b:dd:78:60:b7:49:0c:b2:65:54:da:b3:51:6c:8b:ce:c3:bf:26:16:65:86:15:62:7f:1a:51:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

00:1d:98:dd:e8:bb:d4:1e:87:15:76:37:32:bb:32:c5:92:eb:99:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

26266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.X509Certificates/net461\System.Security.Cryptography.X509Certificates.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/net46/System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f415a437f4743355068198b3fc152216526f4af93f02e50bc52f8b91dc4a402a
MD5 ad0f84569d2b03838912788a6c3d66b9
SHA1 e9911b3c59f15474391811e17940faa6a6c217ce
SHA512 1b4dfb91f7a6e3a93ff86731b7a271ac594a6970c270a912e043eebf70e22c0913b7dc529647b351b35733f4c372707fc944f309576b3fadf8855c158ff86fea
SSDEEP 384:gSz8rS6cp1LFMZ4cDuwZc1uphNxwoMg3hg5N7Eu1h0Al1HW8OQnKd4fd9nXW3hW3:aOjIVDuwZ2uQ5SOF0osiE5EBF0E
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

6d:b3:4c:9e:7d:7c:9a:03:91:57:72:dc:2c:ec:5e:5b:05:be:7a:07:5d:59:5a:f2:7a:68:e8:0d:ee:b1:68:1b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

5e:99:90:3e:ca:9f:e8:e2:57:69:a8:7c:88:44:1e:3d:f9:8b:11:56

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

26222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.X509Certificates/net46\System.Security.Cryptography.X509Certificates.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/net461/System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 132ae80c89f38750d1ade43bd1e588f4d0971ea813b4df5dca5af3c113e9e713
MD5 480ca4042ff3cbb3cdbb14ef0643c14d
SHA1 4beb5c11208affad40bdac6672a7b0b7b4558e7b
SHA512 7630bd40398fa55eedad8807cadcb7d0142717ae60073dc5187b9463824eebab993e8867ab3e43fcd34de73f2990d58397008cb1880882569e83b22f5d6b3175
SSDEEP 384:2Zz8reFd12yMZ4cDuwZc1tfhNxwoMg3hg5JF7Eu1h0Al1HW8OQnKd4fd9YW3hW/7:zqNQVDuwZ2tiJRSOzoti9FuEBFNXy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

87:58:ee:84:2b:dd:78:60:b7:49:0c:b2:65:54:da:b3:51:6c:8b:ce:c3:bf:26:16:65:86:15:62:7f:1a:51:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

00:1d:98:dd:e8:bb:d4:1e:87:15:76:37:32:bb:32:c5:92:eb:99:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

26266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.X509Certificates/net461\System.Security.Cryptography.X509Certificates.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.3/System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fc7bbf5bee39dd258b8f62c0774b9250ab5654b33c1de9503f290bb77eb11388
MD5 86bca1e0143cdeed71ff0520525a4c5a
SHA1 b405968928c482e8913753a4ada7dc2c58a5aa62
SHA512 e4abc5bc8cf007007545dcebee255309eac7e1bc93227ef96db3ecb95e7f516035b546d65911e59a4fa6515616d3b53456f8d367b7353af1b3e7dbd4f71af0fb
SSDEEP 768:rCit7OE7KZytHPJtsTRflb4i8SEBqADHCP:3LsEJAfB4OEBjzQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

34:12:3a:35:d5:11:11:a5:4a:ca:da:44:f3:20:85:90:f8:3c:04:ca:de:aa:1c:11:da:e8:4d:9d:f9:dc:ec:11

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

f8:06:e2:8c:a3:5d:07:cf:00:6b:0d:ec:40:a8:c7:ad:83:ce:a0:56

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

25654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Security.Cryptography.X509Certificates\4.0.0.0\System.Security.Cryptography.X509Certificates.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.3/System.Security.Cryptography.X509Certificates.xml

SHA256 c9f8095a21e2b8c89f13dbadbf614b9cdd58e6081f66cde5b7b9bf0fa9d05790
MD5 49f8be4f059861d643db90b1c5b38c6a
SHA1 4e8d90a8d98027cc92e307ad212886d7c8ed537a
SHA512 0504f340633e134d43995814768e769990cf533a8ff7fff01c9fa7810409144ebf89bcdbf5166f7031433457eca40420315682d87f6298b67273b071a6cd1aaf
SSDEEP 1536:Fgung2Lv/xbFdqopezSXtGiDgAtvOYAAesHtKVhK:Vlx1hGsHtKVhK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.3/de/System.Security.Cryptography.X509Certificates.xml

SHA256 5db9c16858b40ba5b07c917b31f34732f0dd5e305026d51a56aecf5e902026f7
MD5 b31ec260d246ade89299458e9d6269d1
SHA1 3b598872effd075828144689168e51e24b5ddf0b
SHA512 dbb4fe34e791a62212fbea0b94960ed5b86ea8b51301cfbd186272e168bd2124b1ad391b426212e3c5c795bf12886599a160b8d1f6ad5547390358fe3d0a2683
SSDEEP 1536:IAp654CoWSrxr8Qrrro/ecSrkP5TVHvDPmerjWqKBy8rTCxlK:vp65Nk+KBy8r+xlK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.3/es/System.Security.Cryptography.X509Certificates.xml

SHA256 f7d72db9738e361a915ae41c4324a1e885bcb82e9b3f472c23b21c25cc5943a5
MD5 61871841cf2a81b691cfecaf9cd5b859
SHA1 2d0e93233703f4da916dd475629a3b870d0528dd
SHA512 49ab52257723a5b5f8534bcde9f63c80cfab4c35ef2110b9ae6173c7b217cce62d22aeea8e2c1213a25a3dd3e9dfe6f2989f3b9216d51328797b69aa7888f999
SSDEEP 1536:BIPzft+2kOxHibFdTvtBVgMPX7ZJbSQNjTGf9GGL8+HWXg+qZ98:erirLxOf9GGLU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.3/fr/System.Security.Cryptography.X509Certificates.xml

SHA256 71a6ed8880c1aba7b3128cd2a9be3adf077009c4256c1c038c540dfe983a1277
MD5 0000824935f564ac03122ec9fed13d6b
SHA1 e97ab9984dc0ab4923fcf86f0958b80287b39181
SHA512 d5548953a7b6718ea2ddb856b87d6c95a6a92f4d3d9f6116a29bf960439929666084be210b828436df718af9d40f2d94455e1338105e5544cf2763b4a41e3042
SSDEEP 1536:/4Gnt6Gtl99yZVHRVgxnIkm98X8CMkRyiemlAQepdGH/gl5F:AGt6GuYBIkm9BCMkRyieZQepcf6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.3/it/System.Security.Cryptography.X509Certificates.xml

SHA256 6f6e8a8c87c2e0892207fdea0033b0beb4fb4b5cc1ca3fa97ae20f9a35bca8e1
MD5 876880b7d7d2d76a5bea5960c35a61ec
SHA1 2679de5f80c6537a119e94c28f65b843061edf84
SHA512 7d71787c2c1ee5e114a7ac91608ec4af622a5e9d59ff0942045a4d5d2914f5524a287569e4ab00260435531ce7e0e1623dabf4245b6d5ee737a502654c225936
SSDEEP 3072:FJjQOBlBWUhbLsLsHLwLYL2HL1MjloeHnR6aHnDEYK113ge86/dbpoJW52PifINb:FJjQOBlBWUhbLsLsHLwLYL2HL1MjloeN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.3/ja/System.Security.Cryptography.X509Certificates.xml

SHA256 101d2bcb511d2aca7de4c574cabd5d0ac94d5df32a0520ae5ac3104755f51d16
MD5 cd2da6ead12bb8e3edc3177aa9309baa
SHA1 326a49d813151075b91e4820f2df80ddccccb2d2
SHA512 17c3d8ba5415d02d50b8538beb99f1312b9512ab4fc0706be60f289d830648e3d90f873661aa49d64ff80c6792af531dd73a5dc10a999991ce11e3914a4f10a5
SSDEEP 768:YVe1JTH75yMVYMUKbejt/xA/BpVEgk9Wrgon7pJ:aobYMU2ejt/xA/BpVEgkE
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.3/ko/System.Security.Cryptography.X509Certificates.xml

SHA256 4ab2cbe3e0c8214a197bedd1cb7e6ebbf0b21f32bd2cfeeaae4dee938bdd87bb
MD5 917279687a728b6882fc13e72b820842
SHA1 e72f6749c450690f2921f0d2a22460e20ee8f3c8
SHA512 8395e5ee8b1244fa2dbf8073258488c74bda3aa65fb996c8d93c7ade5493ea88e84381f089e99ee98732c539d73d61b692cb4562f3f0fe24e3b2728fc403b8ab
SSDEEP 3072:Fw6pYJnMMc3fr215D5nde5/Lr4PFi1n+F1qFbn+FrGf495MurWYBK2YLwnj56x0f:e8qZvD5nde5/Lr4PFi1n+F1qFjwrGf4l
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.3/ru/System.Security.Cryptography.X509Certificates.xml

SHA256 b3de0799acc614ce723cd3d20114c363ea1037777c3ceb42551430b81c0f7a6b
MD5 2d9a76659816aa0b6ac8f484a7ab3e66
SHA1 3d57acfcbdc046fdff95c0b9d94e36ee5c9cb257
SHA512 f1f15f35269d1106c63a8a0202aefdcd88167bef33ccd89da2b793610edc1fdb51c32465a1c6bf39baae4bddcc0ac67d28925bc2a66b7e5c689f52ecbf5f7224
SSDEEP 6144:C2kZOkWR9uXbg0bbafNO4dvpf98czlVi6u54:C2kZOkWR9uXbg0bbafNO4dvpf98czlVl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.3/zh-hans/System.Security.Cryptography.X509Certificates.xml

SHA256 a0e7b316b39186c8ea90f5fccd70f87e569dd9aa6868c456cdf60f9cc8f74731
MD5 3bdb07622f31d3d5530a7b96ffde4b38
SHA1 a61584cb49db0b120579c8315e3fdac8a25ef858
SHA512 e0aec29eba7ba5dbcf0e9ae7356e4f00d5d2696f10b71e6ae8979547e02499042924f9aa7a6b24a21b2650d533e077301b49d872f6d608f0f2ccb16c48c959d5
SSDEEP 3072:2Xn7Zwktc87QBqGEBwVlHo3joJDdrBswhX//BVHPBmVYTW:bo/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.3/zh-hant/System.Security.Cryptography.X509Certificates.xml

SHA256 f7b51c813c0e2eeb441fb7946d7d08b625beab726f991b6c1774c5a5faaf8de2
MD5 e3de571204e13b7cbc52ea9f717c55f3
SHA1 88856cb54b4573cd4224710dcd7c557ee825abdd
SHA512 021eb80b035fafbfb8975fdde5e1ad34689ce28b8662e6b4e30c8fd6864140a00e10b7feee6a1fc05597c4356384ec4b487de79cd82c61b35f927dbf8de1e6db
SSDEEP 1536:47QOrY6F59Cds5gm85HxfUFdxvwu1qL3zVu9sp9mSQcd:CHp3xvwu1M
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.4/System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c8069182634ccc326f989ed9a42c4ccfa6aef7e13005e6a0cd7d8d31a0f5eb15
MD5 43f2889b043b5881159e7ecff96cb6ca
SHA1 858cddef21941b561fd3642477aed777fda34568
SHA512 c5a196ca68e7a0f9ae01bbece57efe6f6306758988c9338a7f946eb77ae8d5b96c72ad3faa03aaf07ea1d3fc3a92f09ad76e33298d4a2509b4b7769e34f24df0
SSDEEP 384:KyZG5g/yUwcReJnWIJKzwj8p7WJL8il5TH4scvEjzX8Pf16DxuXVMoWPhW1aCIc6:KcimXwcRgPJEsT2OxAk+i0EBAADH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

b1:3e:f1:33:88:56:1e:65:8b:b4:ea:2d:f9:6b:e4:15:e4:15:8c:44:d8:ba:4a:50:c3:d6:7b:44:5a:e2:13:17

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

7f:b7:80:6f:df:ad:3b:14:c8:6d:36:50:c8:2e:9d:f5:bb:4c:b1:39

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

25930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Security.Cryptography.X509Certificates\4.1.0.0\System.Security.Cryptography.X509Certificates.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.4/System.Security.Cryptography.X509Certificates.xml

SHA256 c9f8095a21e2b8c89f13dbadbf614b9cdd58e6081f66cde5b7b9bf0fa9d05790
MD5 49f8be4f059861d643db90b1c5b38c6a
SHA1 4e8d90a8d98027cc92e307ad212886d7c8ed537a
SHA512 0504f340633e134d43995814768e769990cf533a8ff7fff01c9fa7810409144ebf89bcdbf5166f7031433457eca40420315682d87f6298b67273b071a6cd1aaf
SSDEEP 1536:Fgung2Lv/xbFdqopezSXtGiDgAtvOYAAesHtKVhK:Vlx1hGsHtKVhK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.4/de/System.Security.Cryptography.X509Certificates.xml

SHA256 5db9c16858b40ba5b07c917b31f34732f0dd5e305026d51a56aecf5e902026f7
MD5 b31ec260d246ade89299458e9d6269d1
SHA1 3b598872effd075828144689168e51e24b5ddf0b
SHA512 dbb4fe34e791a62212fbea0b94960ed5b86ea8b51301cfbd186272e168bd2124b1ad391b426212e3c5c795bf12886599a160b8d1f6ad5547390358fe3d0a2683
SSDEEP 1536:IAp654CoWSrxr8Qrrro/ecSrkP5TVHvDPmerjWqKBy8rTCxlK:vp65Nk+KBy8r+xlK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.4/es/System.Security.Cryptography.X509Certificates.xml

SHA256 f7d72db9738e361a915ae41c4324a1e885bcb82e9b3f472c23b21c25cc5943a5
MD5 61871841cf2a81b691cfecaf9cd5b859
SHA1 2d0e93233703f4da916dd475629a3b870d0528dd
SHA512 49ab52257723a5b5f8534bcde9f63c80cfab4c35ef2110b9ae6173c7b217cce62d22aeea8e2c1213a25a3dd3e9dfe6f2989f3b9216d51328797b69aa7888f999
SSDEEP 1536:BIPzft+2kOxHibFdTvtBVgMPX7ZJbSQNjTGf9GGL8+HWXg+qZ98:erirLxOf9GGLU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.4/fr/System.Security.Cryptography.X509Certificates.xml

SHA256 71a6ed8880c1aba7b3128cd2a9be3adf077009c4256c1c038c540dfe983a1277
MD5 0000824935f564ac03122ec9fed13d6b
SHA1 e97ab9984dc0ab4923fcf86f0958b80287b39181
SHA512 d5548953a7b6718ea2ddb856b87d6c95a6a92f4d3d9f6116a29bf960439929666084be210b828436df718af9d40f2d94455e1338105e5544cf2763b4a41e3042
SSDEEP 1536:/4Gnt6Gtl99yZVHRVgxnIkm98X8CMkRyiemlAQepdGH/gl5F:AGt6GuYBIkm9BCMkRyieZQepcf6
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.4/it/System.Security.Cryptography.X509Certificates.xml

SHA256 6f6e8a8c87c2e0892207fdea0033b0beb4fb4b5cc1ca3fa97ae20f9a35bca8e1
MD5 876880b7d7d2d76a5bea5960c35a61ec
SHA1 2679de5f80c6537a119e94c28f65b843061edf84
SHA512 7d71787c2c1ee5e114a7ac91608ec4af622a5e9d59ff0942045a4d5d2914f5524a287569e4ab00260435531ce7e0e1623dabf4245b6d5ee737a502654c225936
SSDEEP 3072:FJjQOBlBWUhbLsLsHLwLYL2HL1MjloeHnR6aHnDEYK113ge86/dbpoJW52PifINb:FJjQOBlBWUhbLsLsHLwLYL2HL1MjloeN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.4/ja/System.Security.Cryptography.X509Certificates.xml

SHA256 101d2bcb511d2aca7de4c574cabd5d0ac94d5df32a0520ae5ac3104755f51d16
MD5 cd2da6ead12bb8e3edc3177aa9309baa
SHA1 326a49d813151075b91e4820f2df80ddccccb2d2
SHA512 17c3d8ba5415d02d50b8538beb99f1312b9512ab4fc0706be60f289d830648e3d90f873661aa49d64ff80c6792af531dd73a5dc10a999991ce11e3914a4f10a5
SSDEEP 768:YVe1JTH75yMVYMUKbejt/xA/BpVEgk9Wrgon7pJ:aobYMU2ejt/xA/BpVEgkE
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.4/ko/System.Security.Cryptography.X509Certificates.xml

SHA256 4ab2cbe3e0c8214a197bedd1cb7e6ebbf0b21f32bd2cfeeaae4dee938bdd87bb
MD5 917279687a728b6882fc13e72b820842
SHA1 e72f6749c450690f2921f0d2a22460e20ee8f3c8
SHA512 8395e5ee8b1244fa2dbf8073258488c74bda3aa65fb996c8d93c7ade5493ea88e84381f089e99ee98732c539d73d61b692cb4562f3f0fe24e3b2728fc403b8ab
SSDEEP 3072:Fw6pYJnMMc3fr215D5nde5/Lr4PFi1n+F1qFbn+FrGf495MurWYBK2YLwnj56x0f:e8qZvD5nde5/Lr4PFi1n+F1qFjwrGf4l
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.4/ru/System.Security.Cryptography.X509Certificates.xml

SHA256 b3de0799acc614ce723cd3d20114c363ea1037777c3ceb42551430b81c0f7a6b
MD5 2d9a76659816aa0b6ac8f484a7ab3e66
SHA1 3d57acfcbdc046fdff95c0b9d94e36ee5c9cb257
SHA512 f1f15f35269d1106c63a8a0202aefdcd88167bef33ccd89da2b793610edc1fdb51c32465a1c6bf39baae4bddcc0ac67d28925bc2a66b7e5c689f52ecbf5f7224
SSDEEP 6144:C2kZOkWR9uXbg0bbafNO4dvpf98czlVi6u54:C2kZOkWR9uXbg0bbafNO4dvpf98czlVl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.4/zh-hans/System.Security.Cryptography.X509Certificates.xml

SHA256 a0e7b316b39186c8ea90f5fccd70f87e569dd9aa6868c456cdf60f9cc8f74731
MD5 3bdb07622f31d3d5530a7b96ffde4b38
SHA1 a61584cb49db0b120579c8315e3fdac8a25ef858
SHA512 e0aec29eba7ba5dbcf0e9ae7356e4f00d5d2696f10b71e6ae8979547e02499042924f9aa7a6b24a21b2650d533e077301b49d872f6d608f0f2ccb16c48c959d5
SSDEEP 3072:2Xn7Zwktc87QBqGEBwVlHo3joJDdrBswhX//BVHPBmVYTW:bo/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/ref/netstandard1.4/zh-hant/System.Security.Cryptography.X509Certificates.xml

SHA256 f7b51c813c0e2eeb441fb7946d7d08b625beab726f991b6c1774c5a5faaf8de2
MD5 e3de571204e13b7cbc52ea9f717c55f3
SHA1 88856cb54b4573cd4224710dcd7c557ee825abdd
SHA512 021eb80b035fafbfb8975fdde5e1ad34689ce28b8662e6b4e30c8fd6864140a00e10b7feee6a1fc05597c4356384ec4b487de79cd82c61b35f927dbf8de1e6db
SSDEEP 1536:47QOrY6F59Cds5gm85HxfUFdxvwu1qL3zVu9sp9mSQcd:CHp3xvwu1M
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/runtimes/unix/lib/netstandard1.6/System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ddc86596ddd2eb79d27a7bbda606f17a04a424742b64901a7b1c41425fe008b6
MD5 32cc365ab6ab7aef64ea7bd823b60150
SHA1 3a19e7de0dc673b65ee282fd9cce9b36bc6c11f8
SHA512 e6f56ba5b7156d628b032ba6df677ea4d8efb38b5ca32a488f43c0b55d1cf08862ed62a868d00d0832f3c870bbf560ef373e6bb269d3cee5f7ef53a6c3438aea
SSDEEP 3072:nmj9QrJaJXoChajivRnypJFmFgtEjiXhD5thnkxRXOffyObzJ0egEePd:nceJOXJhaOv4iTeXv+d
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

72:27:a1:9f:70:47:53:47:30:76:1e:c1:67:b1:c4:0a:90:c0:bf:1e:de:3d:79:0b:50:7b:7e:ec:f8:e8:37:38

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

56:8c:9f:45:4d:be:6e:af:e0:38:38:0b:42:d5:ea:e9:d1:20:e3:3a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

153446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Unix.AnyCPU.Release\System.Security.Cryptography.X509Certificates\System.Security.Cryptography.X509Certificates.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/runtimes/win/lib/net46/System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f415a437f4743355068198b3fc152216526f4af93f02e50bc52f8b91dc4a402a
MD5 ad0f84569d2b03838912788a6c3d66b9
SHA1 e9911b3c59f15474391811e17940faa6a6c217ce
SHA512 1b4dfb91f7a6e3a93ff86731b7a271ac594a6970c270a912e043eebf70e22c0913b7dc529647b351b35733f4c372707fc944f309576b3fadf8855c158ff86fea
SSDEEP 384:gSz8rS6cp1LFMZ4cDuwZc1uphNxwoMg3hg5N7Eu1h0Al1HW8OQnKd4fd9nXW3hW3:aOjIVDuwZ2uQ5SOF0osiE5EBF0E
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

6d:b3:4c:9e:7d:7c:9a:03:91:57:72:dc:2c:ec:5e:5b:05:be:7a:07:5d:59:5a:f2:7a:68:e8:0d:ee:b1:68:1b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

5e:99:90:3e:ca:9f:e8:e2:57:69:a8:7c:88:44:1e:3d:f9:8b:11:56

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

26222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.X509Certificates/net46\System.Security.Cryptography.X509Certificates.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/runtimes/win/lib/net461/System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 132ae80c89f38750d1ade43bd1e588f4d0971ea813b4df5dca5af3c113e9e713
MD5 480ca4042ff3cbb3cdbb14ef0643c14d
SHA1 4beb5c11208affad40bdac6672a7b0b7b4558e7b
SHA512 7630bd40398fa55eedad8807cadcb7d0142717ae60073dc5187b9463824eebab993e8867ab3e43fcd34de73f2990d58397008cb1880882569e83b22f5d6b3175
SSDEEP 384:2Zz8reFd12yMZ4cDuwZc1tfhNxwoMg3hg5JF7Eu1h0Al1HW8OQnKd4fd9YW3hW/7:zqNQVDuwZ2tiJRSOzoti9FuEBFNXy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

87:58:ee:84:2b:dd:78:60:b7:49:0c:b2:65:54:da:b3:51:6c:8b:ce:c3:bf:26:16:65:86:15:62:7f:1a:51:5f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

00:1d:98:dd:e8:bb:d4:1e:87:15:76:37:32:bb:32:c5:92:eb:99:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b5:ac:7d:6d:87:6b:26:11:47:00:00:00:00:00:b5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

26266

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/Windows_NT.AnyCPU.Release/System.Security.Cryptography.X509Certificates/net461\System.Security.Cryptography.X509Certificates.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/runtimes/win/lib/netcore50/System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fc6d5580f5b8b3d2aa38f375c17ea46bf0ffec07dfc78fccead29e78134bfef7
MD5 1e2114b112dd4a5bf2c005a60be46096
SHA1 6d61e03f223b966419d6fe192d955b209037a8a1
SHA512 28361d7beac7996937c9560f8d144ff1b74ede3614764ab14b18a7e8c9ae61001efa2ee41f10841b9a3e5282355f482a3a4fba27020de6b790e9c4aac86d839f
SSDEEP 3072:sWILI6+S44+GobXVwKV4gIyh6g+ufYZgQKphI2AwqJFIFBYpmsUnmidPEuo7:sh44+GoTVwKdJhwuf4EI2AwC7R7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

b7:3c:d0:bc:24:fd:0f:b4:eb:65:f9:35:3b:50:26:93:33:47:d4:23:93:48:06:25:3d:ee:46:2d:2e:28:34:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

d6:41:79:bd:64:82:c8:62:bb:7e:8d:6d:0b:64:07:f7:ce:9a:17:8b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

126378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Security.Cryptography.X509Certificates\netcore50\System.Security.Cryptography.X509Certificates.pdb

LegionStealer V1 SRC/packages/System.Security.Cryptography.X509Certificates.4.3.0/runtimes/win/lib/netstandard1.6/System.Security.Cryptography.X509Certificates.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3d839f68526d3573261e397c6536f398a0c6c6cff12064e9ac67fdf5729d79c8
MD5 a1191c01dae20eca9aefe22b9e85f568
SHA1 b172e5802818ed96421273a74f0f36ec7eaf6422
SHA512 4ff42d6aa42e9ac4d2e4e1fcc3dd146741b6117c94d6f853b843ea96db51aaef5b18b6cada24bb4a8f21679f5107184d3f55273c6d39310ebececd368f4d8a35
SSDEEP 3072:G1tsob+NMOgBrhersZreFCCMrgugqufOl5F+cs2bavR0JFIFBYp9AUdSa41Ehs:GZblTfrgkufyS2baZV1Cs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

65:24:75:b4:d1:42:86:09:c2:b8:7f:b2:8e:3e:57:47:91:5e:06:0e:bf:77:af:4d:9e:a5:23:d6:80:51:f1:ec

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

b1:f9:29:b7:45:71:5f:45:d0:c0:ee:b8:f0:6e:f6:6b:33:64:5b:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c5:96:40:60:4b:f4:de:ae:2e:00:00:00:00:00:c5

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

128894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\Windows_NT.AnyCPU.Release\System.Security.Cryptography.X509Certificates\System.Security.Cryptography.X509Certificates.pdb

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/.signature.p7s

SHA256 b43a01348f5a81ededd8369bd522f3e8b5f0dd0ee1911b56555622a76c0f2d91
MD5 e1aa4f8ea66334fc547840a69a97c652
SHA1 36278a93316f40d899542cbbc5699bdb09b33eb3
SHA512 4e84113f89d4d876fac51770cf0965c1f9a10ddce98459d63fc38f241a7266eb78bea610de2622bd374782407a9cd6cca01ccde8eb8f4c0017d302828de244b3
SSDEEP 192:8drB7x0KDWpHhXZCVzV07xrj/kr9DH0JOqNG8Fp28Wh8nWhFf:EHvDGGVp7r9oJNNzFwhhiWhFf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/System.Text.Encoding.4.3.0.nupkg

SHA256 19cb475462d901afebaa404d86c0469ec89674acafe950ee6d8a4692e3a404b8
MD5 0ece90b64e8079b79c163fccd067647c
SHA1 b1b83606b6c1da0f167d881937472e3a91397518
SHA512 6ff7feec7313a7121f795ec7d376e4b8728c17294219fafdfd4ea078f9df1455b4685f0b3962c3810098e95d68594a8392c0b799d36ec8284cd6fcbd4cfe2c67
SSDEEP 6144:/UIFgHNj3RtXIda8OqdlgHNl3Riiu8daQPgHNx3RlvtE:MPN3pqs33E73K
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netcore50/System.Text.Encoding.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c6d631beeb7b008732aa4e46ceb30993f946d9271f1f690cb44703c492dd8b5c
MD5 86a638229355e3385f83af261c439502
SHA1 be702c59290b7033d9c247fcc7c1265d82a34d79
SHA512 12a97e585711d68393bdfdce645ef0d950e9b5828d4f64795df13122eb507f0a6011a9b1a6cc5b8d6a2e631844a6ebc17aa954e38f04334b64a1bf3bb8f054c5
SSDEEP 384:yfYMgyyxeuWYTWgaCIcPA0GftpBjkPWPERHRN76YzUlp/mQdVM0:yfYMg1pNiGePEBlo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

92:ba:2c:d3:3d:32:46:d3:20:3a:b1:78:2a:e3:6b:d7:3d:29:a5:09:ec:b2:c8:49:30:d9:8a:35:74:48:ab:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

fd:9a:99:f9:bf:a9:90:e4:88:59:7f:7c:4a:16:24:78:c5:be:33:e0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

15894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Text.Encoding\4.0.10.0\System.Text.Encoding.pdb

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netcore50/System.Text.Encoding.xml

SHA256 9bc676405dc6628d74bcaaa427b171c164b85c950ecaa31a236fe92b0ba6d46b
MD5 57a7efa243cb500c2dcaa1ff5037baab
SHA1 82dbf1950c32bc87e3aec66900a46ae99305c95b
SHA512 69ba8e6f9f37b29c5790d88988f9bdbc8c3926b80b457abdf0c5d1e2d34b454774ee2824a2f9ab5b880707c435a0b14f0bf43d0a2f87d80bd3eb60856269818d
SSDEEP 1536:EoEMQlNYD39FIeKLcccArEnykE4BPI59bFpMNFqKJsW2I:KMQlNYRFIeKLcccArEnykE4BPI59bFpY
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netcore50/de/System.Text.Encoding.xml

SHA256 4b80f4693521d49a2adc07b58854a6d7f0f316e6c679f19c1e285583f785d727
MD5 ca21a5c77eb61666d57eb4d7e7503641
SHA1 bc9368dd6441ca7ab341e9b2d23e3e27bd007f4f
SHA512 810f292016816b1a32dfb86217124cd9096c6a8e216245b58eb71f98861302c5b86be32c3be4065330f8e4dc460b23187468341c3e3f5ecd12705eb4b9405956
SSDEEP 1536:5jQsJsZmHmheoCE/pwVp4xUeUvfjE8CnhNwVaZjqdwVm4xmF+xFPsHOmsym8fA/u:f7yXuUggY
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netcore50/es/System.Text.Encoding.xml

SHA256 62755dfe04ac6079d7f552930b582dcae4ef10064632e3581a629c52360f54ef
MD5 baf5c54a8098f3302fea6c428faa36ea
SHA1 04b7bb4d2969753529c6ff7fb0e6107ee898b5df
SHA512 ed8c02a88b8733285ab9ee95f6cf5f4455d831b63cf5b33942030624f406206ee9861391b47719f28b4125fb58854e1aa2694716122ca0e7ca436e351080b998
SSDEEP 1536:r/2mS/TTTTausV6uspdmWSE/zJMC9GMIeiIY86UVjU/C9jtWUh0WUHBvRZGyRDOa:OPXG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netcore50/fr/System.Text.Encoding.xml

SHA256 274dba60a8bef18e3c6b72c1d321df8bc6bc0397ad8805eb8f0a99d1081b51ff
MD5 3eacff68877a58431aac3d5b7f0ac4d8
SHA1 e5f65c3d5fbe395bc77953ab596cd5af40119894
SHA512 3711ad52843688a4f2ff41565935d00f8938fa738bde6466ff2f5e7bfb88af81c3c08b8caa56c2649dd170b306ff8df0e6d3a1293010a5694bc577ef507b77b7
SSDEEP 384:YZJJlgCBICxx6IEI0omI0+mIS2I/lh7VvKgtnM8fzMYvMSfMZxqbMnFlMYg/Yqeo:YNjgL9l73Ljk45KPoKDT0tzH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netcore50/it/System.Text.Encoding.xml

SHA256 cd0261a5f6793b3e814dd46ea6ffcbdee629701321a2d63626631d8c546ea053
MD5 2633b81e0ef3e2899b091d3718184c4b
SHA1 84b3e9fe0ff920d0e1e181dc21be0de6c21a4ea4
SHA512 dc023c8c364bbc029ba426cf1e9baa8f19e4031c1b64cba39810aa9828c03360b8e41fe6f87d44bfed02e9def928b407c3ce3fe80f8b374c91afb8f14fb6848b
SSDEEP 768:Y74n5p0i4hTfP4EG16W59t/ZI6W49xJ7sF8M/tw8gl4uxVNa/uBVZ6MbK3BRFgud:asKtHHXZE4f
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netcore50/ja/System.Text.Encoding.xml

SHA256 5f048a40d1b5fc6fe15d3450da02cfc42a339f26b15885909e7d07934904e16e
MD5 e34da4193de6f6a8bdd07839a1386ad1
SHA1 ce13f7b217f23dd78fbeac197becae37c1eb2af3
SHA512 10c58e285920eb9a7571636d41324e8dfdada77f6005c7c93e90b615152c0b704568d1e85791f0270e1654c3b89973498de0aad1f16cfe636a27c7a7afb68f17
SSDEEP 384:YIk2UlbqCmhSxPYv1eUx1o6dmol6TBz8Z8jW6kAZA4pOJZ0/tl3j5qsa94hx130i:Y1FaiHeHTPmKrVOiOZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netcore50/ko/System.Text.Encoding.xml

SHA256 929854f412a25cd4f2dbaf952ecc30952b577221abb2f7828a80b5c3f2adba96
MD5 0b864aaf7ae3f3e1cca070c3c6dc8279
SHA1 8cbd70de72fb0893a7dd8309722448e0d0d287c3
SHA512 3203a18ccde43824c147497fbf93d7256c5562d46ffe8b1fcac4665e671358615e4ef9ddd5ddcb54e6235032a897d42202eb6493698f69d466da4114366f9858
SSDEEP 768:Y0pFE3JAISIjk54igPMXaO37XMiyxd6MwcgW7PqtRaR3g0UMFiBqePelvM+lpzrW:ZE3JnS/4i7+d6lY+0UMFiBEMup3Vc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netcore50/ru/System.Text.Encoding.xml

SHA256 76bf0ec613a8352ba25b5d99572cc8ed18a19449f5012eddbc7851f8cc489af1
MD5 d812593819b412a618b581b603624d83
SHA1 c8ab272cd8bd963f49a9efe88010d2bb87adc7fb
SHA512 16e85afdd1306aa7115518b55806975083343c036d255a36374242fea776f1943edd9af37f6bef8b6ac95ed3bbbd9d7aebf639cf3b3e09820b87181bed922fc4
SSDEEP 768:YFFQF6Fk7VR29mTCXuciwFrFAFkStby4eXuXQkvpgMSMnUN4bK93bKZSjHPPLzf:uOMk7VJuR+kS2kvpgMSMnSK4GSjHv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netcore50/zh-hans/System.Text.Encoding.xml

SHA256 e2f4f6ccc45bd9d1444c0e73275233d72d27c148f1ca8c11a60657a0f8bc724a
MD5 78fb41a8800f299505d760d1b3a060ce
SHA1 e568946ecb66a284cdd3d90368192ee6cbbbbdd0
SHA512 16447cb765bc193f0d4690927b88547c18f797deecf1bdbc1bc9618398419567e1fd6c61f912301f8f7537489b44c265f0914705e59b163ca045efc1c0bf63db
SSDEEP 1536:J2kdc0yRBv9yZ4Az3JW9avF+71JtRL++fCl:g++fCl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netcore50/zh-hant/System.Text.Encoding.xml

SHA256 7f44364cb5bd53020480a68393515d6e9f792682724aa8f20fdf087e72dd6ad4
MD5 f571031200dfbdf11a822d9b5a1907cf
SHA1 cacdcb3843c1c53734a47dd7e565d742a8a4255b
SHA512 c3cf6df0e3c6c2143da407e5205df2bf24d6c61d5ad6eb87ef393a9c9b90355560463e0679bbe25d2e6049b2a514dd771a443aa66e338480c6f028aedac217b2
SSDEEP 384:YHu/HzSbx7iw9yiw/3SA/P04SAPiGmFSh0FHhrLSUYxTU08s/UxLL18g4AaaxRwV:YuhISuCjCNCVrK8tL
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.0/System.Text.Encoding.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0e7a38a927fd90083c88fa00811f15344a686a2f90ef9d6581fc583a224facee
MD5 951cec14c9a1ea221e2005b1a4514377
SHA1 88be05cde897991f30cf11d089e35e52fc3da801
SHA512 03995930eee3cc81c3d772b6f0fd80269de5c4e3aebc8a22eedf3c71811ba7d0baa8b0881397ddc53a8769f9033f0bc04e66fc1d2200efc55335bdf5bd0cd708
SSDEEP 384:DR1sBWCTWh1ae00GftpBjiPoDHRN70FlXxHRW2:DRWD+asikPoD0pj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

82:4c:ce:a6:fc:15:0b:11:2f:3d:75:8c:c3:5e:ee:6b:d4:90:f1:4c:d9:3e:45:5d:44:19:06:46:44:ed:8d:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

3f:ca:c7:90:17:bc:9b:55:75:d3:99:63:14:4a:54:d4:1a:65:46:e3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:13:36:00:00:00:00:00:1a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

13006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.0/System.Text.Encoding.xml

SHA256 9bc676405dc6628d74bcaaa427b171c164b85c950ecaa31a236fe92b0ba6d46b
MD5 57a7efa243cb500c2dcaa1ff5037baab
SHA1 82dbf1950c32bc87e3aec66900a46ae99305c95b
SHA512 69ba8e6f9f37b29c5790d88988f9bdbc8c3926b80b457abdf0c5d1e2d34b454774ee2824a2f9ab5b880707c435a0b14f0bf43d0a2f87d80bd3eb60856269818d
SSDEEP 1536:EoEMQlNYD39FIeKLcccArEnykE4BPI59bFpMNFqKJsW2I:KMQlNYRFIeKLcccArEnykE4BPI59bFpY
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.0/de/System.Text.Encoding.xml

SHA256 4b80f4693521d49a2adc07b58854a6d7f0f316e6c679f19c1e285583f785d727
MD5 ca21a5c77eb61666d57eb4d7e7503641
SHA1 bc9368dd6441ca7ab341e9b2d23e3e27bd007f4f
SHA512 810f292016816b1a32dfb86217124cd9096c6a8e216245b58eb71f98861302c5b86be32c3be4065330f8e4dc460b23187468341c3e3f5ecd12705eb4b9405956
SSDEEP 1536:5jQsJsZmHmheoCE/pwVp4xUeUvfjE8CnhNwVaZjqdwVm4xmF+xFPsHOmsym8fA/u:f7yXuUggY
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.0/es/System.Text.Encoding.xml

SHA256 62755dfe04ac6079d7f552930b582dcae4ef10064632e3581a629c52360f54ef
MD5 baf5c54a8098f3302fea6c428faa36ea
SHA1 04b7bb4d2969753529c6ff7fb0e6107ee898b5df
SHA512 ed8c02a88b8733285ab9ee95f6cf5f4455d831b63cf5b33942030624f406206ee9861391b47719f28b4125fb58854e1aa2694716122ca0e7ca436e351080b998
SSDEEP 1536:r/2mS/TTTTausV6uspdmWSE/zJMC9GMIeiIY86UVjU/C9jtWUh0WUHBvRZGyRDOa:OPXG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.0/fr/System.Text.Encoding.xml

SHA256 274dba60a8bef18e3c6b72c1d321df8bc6bc0397ad8805eb8f0a99d1081b51ff
MD5 3eacff68877a58431aac3d5b7f0ac4d8
SHA1 e5f65c3d5fbe395bc77953ab596cd5af40119894
SHA512 3711ad52843688a4f2ff41565935d00f8938fa738bde6466ff2f5e7bfb88af81c3c08b8caa56c2649dd170b306ff8df0e6d3a1293010a5694bc577ef507b77b7
SSDEEP 384:YZJJlgCBICxx6IEI0omI0+mIS2I/lh7VvKgtnM8fzMYvMSfMZxqbMnFlMYg/Yqeo:YNjgL9l73Ljk45KPoKDT0tzH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.0/it/System.Text.Encoding.xml

SHA256 cd0261a5f6793b3e814dd46ea6ffcbdee629701321a2d63626631d8c546ea053
MD5 2633b81e0ef3e2899b091d3718184c4b
SHA1 84b3e9fe0ff920d0e1e181dc21be0de6c21a4ea4
SHA512 dc023c8c364bbc029ba426cf1e9baa8f19e4031c1b64cba39810aa9828c03360b8e41fe6f87d44bfed02e9def928b407c3ce3fe80f8b374c91afb8f14fb6848b
SSDEEP 768:Y74n5p0i4hTfP4EG16W59t/ZI6W49xJ7sF8M/tw8gl4uxVNa/uBVZ6MbK3BRFgud:asKtHHXZE4f
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.0/ja/System.Text.Encoding.xml

SHA256 5f048a40d1b5fc6fe15d3450da02cfc42a339f26b15885909e7d07934904e16e
MD5 e34da4193de6f6a8bdd07839a1386ad1
SHA1 ce13f7b217f23dd78fbeac197becae37c1eb2af3
SHA512 10c58e285920eb9a7571636d41324e8dfdada77f6005c7c93e90b615152c0b704568d1e85791f0270e1654c3b89973498de0aad1f16cfe636a27c7a7afb68f17
SSDEEP 384:YIk2UlbqCmhSxPYv1eUx1o6dmol6TBz8Z8jW6kAZA4pOJZ0/tl3j5qsa94hx130i:Y1FaiHeHTPmKrVOiOZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.0/ko/System.Text.Encoding.xml

SHA256 929854f412a25cd4f2dbaf952ecc30952b577221abb2f7828a80b5c3f2adba96
MD5 0b864aaf7ae3f3e1cca070c3c6dc8279
SHA1 8cbd70de72fb0893a7dd8309722448e0d0d287c3
SHA512 3203a18ccde43824c147497fbf93d7256c5562d46ffe8b1fcac4665e671358615e4ef9ddd5ddcb54e6235032a897d42202eb6493698f69d466da4114366f9858
SSDEEP 768:Y0pFE3JAISIjk54igPMXaO37XMiyxd6MwcgW7PqtRaR3g0UMFiBqePelvM+lpzrW:ZE3JnS/4i7+d6lY+0UMFiBEMup3Vc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.0/ru/System.Text.Encoding.xml

SHA256 76bf0ec613a8352ba25b5d99572cc8ed18a19449f5012eddbc7851f8cc489af1
MD5 d812593819b412a618b581b603624d83
SHA1 c8ab272cd8bd963f49a9efe88010d2bb87adc7fb
SHA512 16e85afdd1306aa7115518b55806975083343c036d255a36374242fea776f1943edd9af37f6bef8b6ac95ed3bbbd9d7aebf639cf3b3e09820b87181bed922fc4
SSDEEP 768:YFFQF6Fk7VR29mTCXuciwFrFAFkStby4eXuXQkvpgMSMnUN4bK93bKZSjHPPLzf:uOMk7VJuR+kS2kvpgMSMnSK4GSjHv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.0/zh-hans/System.Text.Encoding.xml

SHA256 e2f4f6ccc45bd9d1444c0e73275233d72d27c148f1ca8c11a60657a0f8bc724a
MD5 78fb41a8800f299505d760d1b3a060ce
SHA1 e568946ecb66a284cdd3d90368192ee6cbbbbdd0
SHA512 16447cb765bc193f0d4690927b88547c18f797deecf1bdbc1bc9618398419567e1fd6c61f912301f8f7537489b44c265f0914705e59b163ca045efc1c0bf63db
SSDEEP 1536:J2kdc0yRBv9yZ4Az3JW9avF+71JtRL++fCl:g++fCl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.0/zh-hant/System.Text.Encoding.xml

SHA256 7f44364cb5bd53020480a68393515d6e9f792682724aa8f20fdf087e72dd6ad4
MD5 f571031200dfbdf11a822d9b5a1907cf
SHA1 cacdcb3843c1c53734a47dd7e565d742a8a4255b
SHA512 c3cf6df0e3c6c2143da407e5205df2bf24d6c61d5ad6eb87ef393a9c9b90355560463e0679bbe25d2e6049b2a514dd771a443aa66e338480c6f028aedac217b2
SSDEEP 384:YHu/HzSbx7iw9yiw/3SA/P04SAPiGmFSh0FHhrLSUYxTU08s/UxLL18g4AaaxRwV:YuhISuCjCNCVrK8tL
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.3/System.Text.Encoding.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c6d631beeb7b008732aa4e46ceb30993f946d9271f1f690cb44703c492dd8b5c
MD5 86a638229355e3385f83af261c439502
SHA1 be702c59290b7033d9c247fcc7c1265d82a34d79
SHA512 12a97e585711d68393bdfdce645ef0d950e9b5828d4f64795df13122eb507f0a6011a9b1a6cc5b8d6a2e631844a6ebc17aa954e38f04334b64a1bf3bb8f054c5
SSDEEP 384:yfYMgyyxeuWYTWgaCIcPA0GftpBjkPWPERHRN76YzUlp/mQdVM0:yfYMg1pNiGePEBlo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

92:ba:2c:d3:3d:32:46:d3:20:3a:b1:78:2a:e3:6b:d7:3d:29:a5:09:ec:b2:c8:49:30:d9:8a:35:74:48:ab:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

fd:9a:99:f9:bf:a9:90:e4:88:59:7f:7c:4a:16:24:78:c5:be:33:e0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

15894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Text.Encoding\4.0.10.0\System.Text.Encoding.pdb

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.3/System.Text.Encoding.xml

SHA256 9bc676405dc6628d74bcaaa427b171c164b85c950ecaa31a236fe92b0ba6d46b
MD5 57a7efa243cb500c2dcaa1ff5037baab
SHA1 82dbf1950c32bc87e3aec66900a46ae99305c95b
SHA512 69ba8e6f9f37b29c5790d88988f9bdbc8c3926b80b457abdf0c5d1e2d34b454774ee2824a2f9ab5b880707c435a0b14f0bf43d0a2f87d80bd3eb60856269818d
SSDEEP 1536:EoEMQlNYD39FIeKLcccArEnykE4BPI59bFpMNFqKJsW2I:KMQlNYRFIeKLcccArEnykE4BPI59bFpY
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.3/de/System.Text.Encoding.xml

SHA256 4b80f4693521d49a2adc07b58854a6d7f0f316e6c679f19c1e285583f785d727
MD5 ca21a5c77eb61666d57eb4d7e7503641
SHA1 bc9368dd6441ca7ab341e9b2d23e3e27bd007f4f
SHA512 810f292016816b1a32dfb86217124cd9096c6a8e216245b58eb71f98861302c5b86be32c3be4065330f8e4dc460b23187468341c3e3f5ecd12705eb4b9405956
SSDEEP 1536:5jQsJsZmHmheoCE/pwVp4xUeUvfjE8CnhNwVaZjqdwVm4xmF+xFPsHOmsym8fA/u:f7yXuUggY
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.3/es/System.Text.Encoding.xml

SHA256 62755dfe04ac6079d7f552930b582dcae4ef10064632e3581a629c52360f54ef
MD5 baf5c54a8098f3302fea6c428faa36ea
SHA1 04b7bb4d2969753529c6ff7fb0e6107ee898b5df
SHA512 ed8c02a88b8733285ab9ee95f6cf5f4455d831b63cf5b33942030624f406206ee9861391b47719f28b4125fb58854e1aa2694716122ca0e7ca436e351080b998
SSDEEP 1536:r/2mS/TTTTausV6uspdmWSE/zJMC9GMIeiIY86UVjU/C9jtWUh0WUHBvRZGyRDOa:OPXG
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.3/fr/System.Text.Encoding.xml

SHA256 274dba60a8bef18e3c6b72c1d321df8bc6bc0397ad8805eb8f0a99d1081b51ff
MD5 3eacff68877a58431aac3d5b7f0ac4d8
SHA1 e5f65c3d5fbe395bc77953ab596cd5af40119894
SHA512 3711ad52843688a4f2ff41565935d00f8938fa738bde6466ff2f5e7bfb88af81c3c08b8caa56c2649dd170b306ff8df0e6d3a1293010a5694bc577ef507b77b7
SSDEEP 384:YZJJlgCBICxx6IEI0omI0+mIS2I/lh7VvKgtnM8fzMYvMSfMZxqbMnFlMYg/Yqeo:YNjgL9l73Ljk45KPoKDT0tzH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.3/it/System.Text.Encoding.xml

SHA256 cd0261a5f6793b3e814dd46ea6ffcbdee629701321a2d63626631d8c546ea053
MD5 2633b81e0ef3e2899b091d3718184c4b
SHA1 84b3e9fe0ff920d0e1e181dc21be0de6c21a4ea4
SHA512 dc023c8c364bbc029ba426cf1e9baa8f19e4031c1b64cba39810aa9828c03360b8e41fe6f87d44bfed02e9def928b407c3ce3fe80f8b374c91afb8f14fb6848b
SSDEEP 768:Y74n5p0i4hTfP4EG16W59t/ZI6W49xJ7sF8M/tw8gl4uxVNa/uBVZ6MbK3BRFgud:asKtHHXZE4f
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.3/ja/System.Text.Encoding.xml

SHA256 5f048a40d1b5fc6fe15d3450da02cfc42a339f26b15885909e7d07934904e16e
MD5 e34da4193de6f6a8bdd07839a1386ad1
SHA1 ce13f7b217f23dd78fbeac197becae37c1eb2af3
SHA512 10c58e285920eb9a7571636d41324e8dfdada77f6005c7c93e90b615152c0b704568d1e85791f0270e1654c3b89973498de0aad1f16cfe636a27c7a7afb68f17
SSDEEP 384:YIk2UlbqCmhSxPYv1eUx1o6dmol6TBz8Z8jW6kAZA4pOJZ0/tl3j5qsa94hx130i:Y1FaiHeHTPmKrVOiOZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.3/ko/System.Text.Encoding.xml

SHA256 929854f412a25cd4f2dbaf952ecc30952b577221abb2f7828a80b5c3f2adba96
MD5 0b864aaf7ae3f3e1cca070c3c6dc8279
SHA1 8cbd70de72fb0893a7dd8309722448e0d0d287c3
SHA512 3203a18ccde43824c147497fbf93d7256c5562d46ffe8b1fcac4665e671358615e4ef9ddd5ddcb54e6235032a897d42202eb6493698f69d466da4114366f9858
SSDEEP 768:Y0pFE3JAISIjk54igPMXaO37XMiyxd6MwcgW7PqtRaR3g0UMFiBqePelvM+lpzrW:ZE3JnS/4i7+d6lY+0UMFiBEMup3Vc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.3/ru/System.Text.Encoding.xml

SHA256 76bf0ec613a8352ba25b5d99572cc8ed18a19449f5012eddbc7851f8cc489af1
MD5 d812593819b412a618b581b603624d83
SHA1 c8ab272cd8bd963f49a9efe88010d2bb87adc7fb
SHA512 16e85afdd1306aa7115518b55806975083343c036d255a36374242fea776f1943edd9af37f6bef8b6ac95ed3bbbd9d7aebf639cf3b3e09820b87181bed922fc4
SSDEEP 768:YFFQF6Fk7VR29mTCXuciwFrFAFkStby4eXuXQkvpgMSMnUN4bK93bKZSjHPPLzf:uOMk7VJuR+kS2kvpgMSMnSK4GSjHv
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.3/zh-hans/System.Text.Encoding.xml

SHA256 e2f4f6ccc45bd9d1444c0e73275233d72d27c148f1ca8c11a60657a0f8bc724a
MD5 78fb41a8800f299505d760d1b3a060ce
SHA1 e568946ecb66a284cdd3d90368192ee6cbbbbdd0
SHA512 16447cb765bc193f0d4690927b88547c18f797deecf1bdbc1bc9618398419567e1fd6c61f912301f8f7537489b44c265f0914705e59b163ca045efc1c0bf63db
SSDEEP 1536:J2kdc0yRBv9yZ4Az3JW9avF+71JtRL++fCl:g++fCl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.4.3.0/ref/netstandard1.3/zh-hant/System.Text.Encoding.xml

SHA256 7f44364cb5bd53020480a68393515d6e9f792682724aa8f20fdf087e72dd6ad4
MD5 f571031200dfbdf11a822d9b5a1907cf
SHA1 cacdcb3843c1c53734a47dd7e565d742a8a4255b
SHA512 c3cf6df0e3c6c2143da407e5205df2bf24d6c61d5ad6eb87ef393a9c9b90355560463e0679bbe25d2e6049b2a514dd771a443aa66e338480c6f028aedac217b2
SSDEEP 384:YHu/HzSbx7iw9yiw/3SA/P04SAPiGmFSh0FHhrLSUYxTU08s/UxLL18g4AaaxRwV:YuhISuCjCNCVrK8tL
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/.signature.p7s

SHA256 a2d1132742e9bcc7f4ca3e92fa2c14c20f2b81384f329017d96b87dfc49828a4
MD5 50de583e058038a6e494632367189d39
SHA1 f49f2f193c76ef0e63dba823fae4aecbd3745a29
SHA512 eff9c53446d28c69d3f8b1a44a5511c8bdc569161045343ffbc4da63edfaccf9d004d201f8ffd79682d6e765b39646e01d7153fe61f5b854b2179194d9dc429f
SSDEEP 192:xd97x0KDWpHhXZCVzV07VrljGDH0JOqsmVgz28WhBqc6G:jfvDGGVpmGoJN77hhh6G
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/System.Text.Encoding.Extensions.4.3.0.nupkg

SHA256 bee7c75e0f1000ac4796e8cf1c772bb46c00a859ac083e872a37c30221f20187
MD5 60cf3d9e97fc992a250d84b030048726
SHA1 47754eab02280601b63d810bad557ceeb8b24d3e
SHA512 e648c5dc781e35cf00c5cc8e7e42e815b963cf8fb788e8a817f9b53e318b2b42e2f7a556e9c3c64bf2f6a2fd4615f26ab4f0d4eb713a0151e71e0af3fe9c3eed
SSDEEP 6144:1UGSX2n0DPQ0ZZUnm2sHDKQPxOmN2RKDpQozT:Sk0ZZlPxmo3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netcore50/System.Text.Encoding.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41704e7109ce62bb3d688f63ef3af2a2de28c893633981dccbe2108a83cf86a4
MD5 2b72ca627f3bd6e6bcc500fdf8cbb801
SHA1 eb15026982d551d1a8c997b18d01bcc7448f3612
SHA512 313fa3d5318d0b9decfaf04557853e2e4e1feaaa80701caef63e9899acbd2409d7dcddbb8dc9221f7d2b6e286618586c428df9af2db4ca72cb38cb5f9a0b8f8e
SSDEEP 384:wbVe7LppWVXWMyAA0GftpBj+2VdRCgERHRN7IdKWclfhQ:WVe7yJivEBKKWey
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

c9:80:e3:2c:9d:9a:29:72:9c:63:bd:92:88:4c:7c:2b:0b:a0:e9:d5:bc:c0:c9:f9:f9:13:b3:95:e6:8c:dc:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

1a:ef:93:7c:c3:20:6c:12:e3:ab:36:cf:8e:5b:ff:1e:47:a6:a6:82

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

14050

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Text.Encoding.Extensions\4.0.10.0\System.Text.Encoding.Extensions.pdb

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netcore50/System.Text.Encoding.Extensions.xml

SHA256 96cc6271f8c5bcbffeb2e7cc3a69e9911b3d2214021bc1d7ee20400b10f4c5a5
MD5 c6b1965d1e85c42132e90aac02aa9e0a
SHA1 e0cb4745fa76e81311bf39304dfa1bd41e3aad6c
SHA512 272b624a37046ec701c38add5f6f176a258160b320d71650ad751631577a38afe5945617e7fbf4d6b0ffb3deb5585221832e3c7dc21912d99ad50bd5875d55f5
SSDEEP 3072:WZlsIR3alGcO2ir0ogBjbviis/3AF8rGuZnlDxwcU7nzwPcJcRw9xeqFmFqJheYS:WZlsIR3alGz2ir0ogBjriis/3AF8rGu5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netcore50/de/System.Text.Encoding.Extensions.xml

SHA256 ed4adb246dd77cfb04197a4eecb9f4ad5ef76a94a0111a2f3d6cb8bcf3d4f2f5
MD5 ddff478a5683a8da3c269d0043882023
SHA1 b0aa4670ac47c2d8e1515302f644370807c22864
SHA512 b2367d9768bfd8fe6e06b4b7c753094820d9d7a4a06ac62b1ca809c5dffd4eec0e9fd28b9a3b37d456fb4d2622555a72c86adb483019a8d08f97be7c5d140f99
SSDEEP 3072:rFvV0XyIWHZ7YU3Y6BNN9FBo16dQVehNawyd4FyViMZS2KFnnGTMxVeO/V0yk:6yIWHZ7YUI6BNNho16dlhNafdRZS2ens
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netcore50/es/System.Text.Encoding.Extensions.xml

SHA256 076224f36e12b86654b0ef633c20d369473737f40c732412eb389ab58d29b897
MD5 1355d28a7441757a6dd223e7d26db1df
SHA1 aea375d31301f7e5c38d3e305313f0f0a0f38bc9
SHA512 9d5053d26aa6aa4c088a235094082c1566afd63f5ea8b7337a32df2e5bc40e0ca06f18d78a7ff3f15d9be615389e7367aeb2011bccf474d8d5c40a71f7fa639c
SSDEEP 3072:IfMtI/9pBGS7e0YI6mRrvCZ0ozgqECzb8RScQrE5/Ogk:/tI/9pBGq/YI6mRrvCZ0okCzb8RScQrj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netcore50/fr/System.Text.Encoding.Extensions.xml

SHA256 cec9d53ca43b0ee5c65fe28958b1f358d3c552f0123b713056abb1b23aa3ebd2
MD5 da3daca83b600b9024af0336c7f651d1
SHA1 b0d630ba9c70f73e39c3855f0dba3ba867c50014
SHA512 335bb5c55467edf27a818412341feead8e417c212b326c5244eb4770a0fc349db4a82fbfe50fc0b6d6a8557070e375c246a4ad7317ebb4f966520c23d3edf8a6
SSDEEP 3072:1/ME5Zsd488QgqEaLEk+C/84jzOIQHeKRjxwEAFx8j4x6t1Qk:1/P5Zsd488NqEaLEk+C/84jzOlHeqjxB
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netcore50/it/System.Text.Encoding.Extensions.xml

SHA256 c4b2700dbe40a88d1c7b8d801f657cf66d0a3b003b023929e82c7b907b56f895
MD5 bf802134e8a0db97abe986949328f154
SHA1 e82c66fb81b9ce578ab3d6c5ed23fac73f747bbd
SHA512 76dfd0ce27a59a0d2f445f58408b0a0cad6c851757fca3c2bb50f6f712629408604d495dcbcf964e1c5bf42428ca88112c5691e5e2ff06c6d4a232475458a399
SSDEEP 3072:ARO8DWoiUwtHBKwArDWdIKaKSlXOBC18wHmFaZHSk:OO8DWoiUmHBKwArDWdIKarJOBC18wHmy
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netcore50/ja/System.Text.Encoding.Extensions.xml

SHA256 473e1663171d6fbe42cac8f7a02b87e3a5cca9cf5e6090074688698b8459a692
MD5 d69b1275eb9a30066007e70191d61373
SHA1 49e7c7f1ea88e154ba5451ec1b4fb19d1860654f
SHA512 6808a0acb59038017ce584f99239e232e887013a60108e7a958b3313ca6f08d9904fb25b6b9c5adfc729ab7b78bf658f9427ae3f8b9065c8ca68d90fe07029a3
SSDEEP 3072:f+yxMlxmLxl8WSJZflTWBWtjKrdt/hsmY8p0XSVfKk:2yxMlxmLH8WSJZflTWBWtWJt/hsmY8px
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netcore50/ko/System.Text.Encoding.Extensions.xml

SHA256 0ff9648aa9d68471e824d41a01414b523522fb4030a5ec92a72d25eb8b683f88
MD5 b6da43d182de8a768068bfcad77e418a
SHA1 e0cab4fde4cd9f0869f3826c78cd0a43788ce817
SHA512 971578bc71698f74300e46cf804974e0e480972046bc90f140a1baa0c0d5ef8950dec318b388416b370b19ae23f16fc86c7eddf3d6a7153fa0a66d4a424547bc
SSDEEP 3072:JNyQvcfPaIM3FTgTRnIvgjWs2jLKhz/OonXgG/AnMP4gvsWpz5cQsZC3vlEMVvn3:YqFT4RIoqrP8z/OcQG/6Azu+NEMV/dtf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netcore50/ru/System.Text.Encoding.Extensions.xml

SHA256 411988f0b7ca0eb01c4c67a4c02199075eb758f8499d3ebcfba24e149f6d7d33
MD5 3933ae4b77d7d90c1ac0cd3ab285f7d9
SHA1 5d948e2c7ed7a2e65f752453b8a44bf8b50e252d
SHA512 a75ba6dea4af0c58e183c953c8cad9f0de3c2e2cdd90417ef9845b366811dcb9760e211e75dff6da85e9e93978c85c86898dbd592f726fc0b03d7f5caffd583c
SSDEEP 3072:9jtENcinkJdbgxIaGrsLrLK9MBNiwizSKrmnoIZt1TAnz29nuZYMU8YhLBzS3l99:9jtENcinkJhgxIaGrsHLK9MBNiwizSK1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netcore50/zh-hans/System.Text.Encoding.Extensions.xml

SHA256 d441900423cf0364b1fb4336eaac10dfc4a41f9dcd21bd04113a5d8bd729530c
MD5 df340880465d2842944e3d62ff823dae
SHA1 650f56d7e7ae017040e88c671b83c529eaf4eff3
SHA512 8574b222bcf4ea699d24216d24957ff9fef4e0c7af925643c0f09ec5069248e827da2fc20587c6e44ad21df157d328c78635fc3b1ecc5df393e8f462128e9b09
SSDEEP 3072:8cyuUAecBhvU5sJcNH0k2bfhB32oJhfIkVTrFg6Bk:jyuUAecBBU5sJcNH0k2bfrGoJhfIkVTU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netcore50/zh-hant/System.Text.Encoding.Extensions.xml

SHA256 0ae0e4b9721d5a3bee05682bca26f6bf11231fb316bd52fc067cb8cacaf7aaac
MD5 1c0f3bc281ac5707843629f838154264
SHA1 c9940f02772280e7500d3e86a1890e767d7b5a10
SHA512 23518746a836dae8b65c7c9be499c3905aa254dde08bad517782d90da4b52620a59f65336584f61968fc15bf9fc38aec0f0528e861d7594bed608346ef608f42
SSDEEP 3072:0pUssp2E6kJbTTdZK/yrAcsCd6wRc+yrZUvotDT/kGwk:mUssp2E6gTTdZK/yrAcsCta+yrZUvott
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.0/System.Text.Encoding.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 676165ebedf08d1e16b6981fc136cb4fc057530591e8857e56fea652c985aa4b
MD5 3f7e833f9e9fa85f14cac50f624c2bd5
SHA1 a372eda9efc21fd6ce607f0b82df81801ffc15cd
SHA512 29ab0e634dc271bf4e4452cd85660614e176770f70efd77f3eea2b1a9ac6818d7f415a310cedd917a06b58677cc818c94b9ddf59c3189f7300f3de73d4aa0617
SSDEEP 384:cfCAXLX8G3j5qWFXWb1LHB0GftpBjVZvUPDHRN7zX98lXxHq:cf7XLX8Gz5J0WiXNUPDzXkK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

7d:19:33:83:ed:fe:3f:46:d3:7c:0b:3b:6f:73:ec:a0:a0:80:1d:90:5e:43:f0:e7:de:ca:5b:83:2b:cc:bd:2f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

b8:c5:eb:99:27:0e:22:7b:64:c6:f6:0c:4d:48:f6:7a:ac:72:71:a5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.0/System.Text.Encoding.Extensions.xml

SHA256 96cc6271f8c5bcbffeb2e7cc3a69e9911b3d2214021bc1d7ee20400b10f4c5a5
MD5 c6b1965d1e85c42132e90aac02aa9e0a
SHA1 e0cb4745fa76e81311bf39304dfa1bd41e3aad6c
SHA512 272b624a37046ec701c38add5f6f176a258160b320d71650ad751631577a38afe5945617e7fbf4d6b0ffb3deb5585221832e3c7dc21912d99ad50bd5875d55f5
SSDEEP 3072:WZlsIR3alGcO2ir0ogBjbviis/3AF8rGuZnlDxwcU7nzwPcJcRw9xeqFmFqJheYS:WZlsIR3alGz2ir0ogBjriis/3AF8rGu5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.0/de/System.Text.Encoding.Extensions.xml

SHA256 ed4adb246dd77cfb04197a4eecb9f4ad5ef76a94a0111a2f3d6cb8bcf3d4f2f5
MD5 ddff478a5683a8da3c269d0043882023
SHA1 b0aa4670ac47c2d8e1515302f644370807c22864
SHA512 b2367d9768bfd8fe6e06b4b7c753094820d9d7a4a06ac62b1ca809c5dffd4eec0e9fd28b9a3b37d456fb4d2622555a72c86adb483019a8d08f97be7c5d140f99
SSDEEP 3072:rFvV0XyIWHZ7YU3Y6BNN9FBo16dQVehNawyd4FyViMZS2KFnnGTMxVeO/V0yk:6yIWHZ7YUI6BNNho16dlhNafdRZS2ens
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.0/es/System.Text.Encoding.Extensions.xml

SHA256 076224f36e12b86654b0ef633c20d369473737f40c732412eb389ab58d29b897
MD5 1355d28a7441757a6dd223e7d26db1df
SHA1 aea375d31301f7e5c38d3e305313f0f0a0f38bc9
SHA512 9d5053d26aa6aa4c088a235094082c1566afd63f5ea8b7337a32df2e5bc40e0ca06f18d78a7ff3f15d9be615389e7367aeb2011bccf474d8d5c40a71f7fa639c
SSDEEP 3072:IfMtI/9pBGS7e0YI6mRrvCZ0ozgqECzb8RScQrE5/Ogk:/tI/9pBGq/YI6mRrvCZ0okCzb8RScQrj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.0/fr/System.Text.Encoding.Extensions.xml

SHA256 cec9d53ca43b0ee5c65fe28958b1f358d3c552f0123b713056abb1b23aa3ebd2
MD5 da3daca83b600b9024af0336c7f651d1
SHA1 b0d630ba9c70f73e39c3855f0dba3ba867c50014
SHA512 335bb5c55467edf27a818412341feead8e417c212b326c5244eb4770a0fc349db4a82fbfe50fc0b6d6a8557070e375c246a4ad7317ebb4f966520c23d3edf8a6
SSDEEP 3072:1/ME5Zsd488QgqEaLEk+C/84jzOIQHeKRjxwEAFx8j4x6t1Qk:1/P5Zsd488NqEaLEk+C/84jzOlHeqjxB
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.0/it/System.Text.Encoding.Extensions.xml

SHA256 c4b2700dbe40a88d1c7b8d801f657cf66d0a3b003b023929e82c7b907b56f895
MD5 bf802134e8a0db97abe986949328f154
SHA1 e82c66fb81b9ce578ab3d6c5ed23fac73f747bbd
SHA512 76dfd0ce27a59a0d2f445f58408b0a0cad6c851757fca3c2bb50f6f712629408604d495dcbcf964e1c5bf42428ca88112c5691e5e2ff06c6d4a232475458a399
SSDEEP 3072:ARO8DWoiUwtHBKwArDWdIKaKSlXOBC18wHmFaZHSk:OO8DWoiUmHBKwArDWdIKarJOBC18wHmy
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.0/ja/System.Text.Encoding.Extensions.xml

SHA256 473e1663171d6fbe42cac8f7a02b87e3a5cca9cf5e6090074688698b8459a692
MD5 d69b1275eb9a30066007e70191d61373
SHA1 49e7c7f1ea88e154ba5451ec1b4fb19d1860654f
SHA512 6808a0acb59038017ce584f99239e232e887013a60108e7a958b3313ca6f08d9904fb25b6b9c5adfc729ab7b78bf658f9427ae3f8b9065c8ca68d90fe07029a3
SSDEEP 3072:f+yxMlxmLxl8WSJZflTWBWtjKrdt/hsmY8p0XSVfKk:2yxMlxmLH8WSJZflTWBWtWJt/hsmY8px
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.0/ko/System.Text.Encoding.Extensions.xml

SHA256 0ff9648aa9d68471e824d41a01414b523522fb4030a5ec92a72d25eb8b683f88
MD5 b6da43d182de8a768068bfcad77e418a
SHA1 e0cab4fde4cd9f0869f3826c78cd0a43788ce817
SHA512 971578bc71698f74300e46cf804974e0e480972046bc90f140a1baa0c0d5ef8950dec318b388416b370b19ae23f16fc86c7eddf3d6a7153fa0a66d4a424547bc
SSDEEP 3072:JNyQvcfPaIM3FTgTRnIvgjWs2jLKhz/OonXgG/AnMP4gvsWpz5cQsZC3vlEMVvn3:YqFT4RIoqrP8z/OcQG/6Azu+NEMV/dtf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.0/ru/System.Text.Encoding.Extensions.xml

SHA256 411988f0b7ca0eb01c4c67a4c02199075eb758f8499d3ebcfba24e149f6d7d33
MD5 3933ae4b77d7d90c1ac0cd3ab285f7d9
SHA1 5d948e2c7ed7a2e65f752453b8a44bf8b50e252d
SHA512 a75ba6dea4af0c58e183c953c8cad9f0de3c2e2cdd90417ef9845b366811dcb9760e211e75dff6da85e9e93978c85c86898dbd592f726fc0b03d7f5caffd583c
SSDEEP 3072:9jtENcinkJdbgxIaGrsLrLK9MBNiwizSKrmnoIZt1TAnz29nuZYMU8YhLBzS3l99:9jtENcinkJhgxIaGrsHLK9MBNiwizSK1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.0/zh-hans/System.Text.Encoding.Extensions.xml

SHA256 d441900423cf0364b1fb4336eaac10dfc4a41f9dcd21bd04113a5d8bd729530c
MD5 df340880465d2842944e3d62ff823dae
SHA1 650f56d7e7ae017040e88c671b83c529eaf4eff3
SHA512 8574b222bcf4ea699d24216d24957ff9fef4e0c7af925643c0f09ec5069248e827da2fc20587c6e44ad21df157d328c78635fc3b1ecc5df393e8f462128e9b09
SSDEEP 3072:8cyuUAecBhvU5sJcNH0k2bfhB32oJhfIkVTrFg6Bk:jyuUAecBBU5sJcNH0k2bfrGoJhfIkVTU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.0/zh-hant/System.Text.Encoding.Extensions.xml

SHA256 0ae0e4b9721d5a3bee05682bca26f6bf11231fb316bd52fc067cb8cacaf7aaac
MD5 1c0f3bc281ac5707843629f838154264
SHA1 c9940f02772280e7500d3e86a1890e767d7b5a10
SHA512 23518746a836dae8b65c7c9be499c3905aa254dde08bad517782d90da4b52620a59f65336584f61968fc15bf9fc38aec0f0528e861d7594bed608346ef608f42
SSDEEP 3072:0pUssp2E6kJbTTdZK/yrAcsCd6wRc+yrZUvotDT/kGwk:mUssp2E6gTTdZK/yrAcsCta+yrZUvott
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.3/System.Text.Encoding.Extensions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 41704e7109ce62bb3d688f63ef3af2a2de28c893633981dccbe2108a83cf86a4
MD5 2b72ca627f3bd6e6bcc500fdf8cbb801
SHA1 eb15026982d551d1a8c997b18d01bcc7448f3612
SHA512 313fa3d5318d0b9decfaf04557853e2e4e1feaaa80701caef63e9899acbd2409d7dcddbb8dc9221f7d2b6e286618586c428df9af2db4ca72cb38cb5f9a0b8f8e
SSDEEP 384:wbVe7LppWVXWMyAA0GftpBj+2VdRCgERHRN7IdKWclfhQ:WVe7yJivEBKKWey
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

c9:80:e3:2c:9d:9a:29:72:9c:63:bd:92:88:4c:7c:2b:0b:a0:e9:d5:bc:c0:c9:f9:f9:13:b3:95:e6:8c:dc:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

1a:ef:93:7c:c3:20:6c:12:e3:ab:36:cf:8e:5b:ff:1e:47:a6:a6:82

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

14050

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Text.Encoding.Extensions\4.0.10.0\System.Text.Encoding.Extensions.pdb

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.3/System.Text.Encoding.Extensions.xml

SHA256 96cc6271f8c5bcbffeb2e7cc3a69e9911b3d2214021bc1d7ee20400b10f4c5a5
MD5 c6b1965d1e85c42132e90aac02aa9e0a
SHA1 e0cb4745fa76e81311bf39304dfa1bd41e3aad6c
SHA512 272b624a37046ec701c38add5f6f176a258160b320d71650ad751631577a38afe5945617e7fbf4d6b0ffb3deb5585221832e3c7dc21912d99ad50bd5875d55f5
SSDEEP 3072:WZlsIR3alGcO2ir0ogBjbviis/3AF8rGuZnlDxwcU7nzwPcJcRw9xeqFmFqJheYS:WZlsIR3alGz2ir0ogBjriis/3AF8rGu5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.3/de/System.Text.Encoding.Extensions.xml

SHA256 ed4adb246dd77cfb04197a4eecb9f4ad5ef76a94a0111a2f3d6cb8bcf3d4f2f5
MD5 ddff478a5683a8da3c269d0043882023
SHA1 b0aa4670ac47c2d8e1515302f644370807c22864
SHA512 b2367d9768bfd8fe6e06b4b7c753094820d9d7a4a06ac62b1ca809c5dffd4eec0e9fd28b9a3b37d456fb4d2622555a72c86adb483019a8d08f97be7c5d140f99
SSDEEP 3072:rFvV0XyIWHZ7YU3Y6BNN9FBo16dQVehNawyd4FyViMZS2KFnnGTMxVeO/V0yk:6yIWHZ7YUI6BNNho16dlhNafdRZS2ens
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.3/es/System.Text.Encoding.Extensions.xml

SHA256 076224f36e12b86654b0ef633c20d369473737f40c732412eb389ab58d29b897
MD5 1355d28a7441757a6dd223e7d26db1df
SHA1 aea375d31301f7e5c38d3e305313f0f0a0f38bc9
SHA512 9d5053d26aa6aa4c088a235094082c1566afd63f5ea8b7337a32df2e5bc40e0ca06f18d78a7ff3f15d9be615389e7367aeb2011bccf474d8d5c40a71f7fa639c
SSDEEP 3072:IfMtI/9pBGS7e0YI6mRrvCZ0ozgqECzb8RScQrE5/Ogk:/tI/9pBGq/YI6mRrvCZ0okCzb8RScQrj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.3/fr/System.Text.Encoding.Extensions.xml

SHA256 cec9d53ca43b0ee5c65fe28958b1f358d3c552f0123b713056abb1b23aa3ebd2
MD5 da3daca83b600b9024af0336c7f651d1
SHA1 b0d630ba9c70f73e39c3855f0dba3ba867c50014
SHA512 335bb5c55467edf27a818412341feead8e417c212b326c5244eb4770a0fc349db4a82fbfe50fc0b6d6a8557070e375c246a4ad7317ebb4f966520c23d3edf8a6
SSDEEP 3072:1/ME5Zsd488QgqEaLEk+C/84jzOIQHeKRjxwEAFx8j4x6t1Qk:1/P5Zsd488NqEaLEk+C/84jzOlHeqjxB
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.3/it/System.Text.Encoding.Extensions.xml

SHA256 c4b2700dbe40a88d1c7b8d801f657cf66d0a3b003b023929e82c7b907b56f895
MD5 bf802134e8a0db97abe986949328f154
SHA1 e82c66fb81b9ce578ab3d6c5ed23fac73f747bbd
SHA512 76dfd0ce27a59a0d2f445f58408b0a0cad6c851757fca3c2bb50f6f712629408604d495dcbcf964e1c5bf42428ca88112c5691e5e2ff06c6d4a232475458a399
SSDEEP 3072:ARO8DWoiUwtHBKwArDWdIKaKSlXOBC18wHmFaZHSk:OO8DWoiUmHBKwArDWdIKarJOBC18wHmy
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.3/ja/System.Text.Encoding.Extensions.xml

SHA256 473e1663171d6fbe42cac8f7a02b87e3a5cca9cf5e6090074688698b8459a692
MD5 d69b1275eb9a30066007e70191d61373
SHA1 49e7c7f1ea88e154ba5451ec1b4fb19d1860654f
SHA512 6808a0acb59038017ce584f99239e232e887013a60108e7a958b3313ca6f08d9904fb25b6b9c5adfc729ab7b78bf658f9427ae3f8b9065c8ca68d90fe07029a3
SSDEEP 3072:f+yxMlxmLxl8WSJZflTWBWtjKrdt/hsmY8p0XSVfKk:2yxMlxmLH8WSJZflTWBWtWJt/hsmY8px
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.3/ko/System.Text.Encoding.Extensions.xml

SHA256 0ff9648aa9d68471e824d41a01414b523522fb4030a5ec92a72d25eb8b683f88
MD5 b6da43d182de8a768068bfcad77e418a
SHA1 e0cab4fde4cd9f0869f3826c78cd0a43788ce817
SHA512 971578bc71698f74300e46cf804974e0e480972046bc90f140a1baa0c0d5ef8950dec318b388416b370b19ae23f16fc86c7eddf3d6a7153fa0a66d4a424547bc
SSDEEP 3072:JNyQvcfPaIM3FTgTRnIvgjWs2jLKhz/OonXgG/AnMP4gvsWpz5cQsZC3vlEMVvn3:YqFT4RIoqrP8z/OcQG/6Azu+NEMV/dtf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.3/ru/System.Text.Encoding.Extensions.xml

SHA256 411988f0b7ca0eb01c4c67a4c02199075eb758f8499d3ebcfba24e149f6d7d33
MD5 3933ae4b77d7d90c1ac0cd3ab285f7d9
SHA1 5d948e2c7ed7a2e65f752453b8a44bf8b50e252d
SHA512 a75ba6dea4af0c58e183c953c8cad9f0de3c2e2cdd90417ef9845b366811dcb9760e211e75dff6da85e9e93978c85c86898dbd592f726fc0b03d7f5caffd583c
SSDEEP 3072:9jtENcinkJdbgxIaGrsLrLK9MBNiwizSKrmnoIZt1TAnz29nuZYMU8YhLBzS3l99:9jtENcinkJhgxIaGrsHLK9MBNiwizSK1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.3/zh-hans/System.Text.Encoding.Extensions.xml

SHA256 d441900423cf0364b1fb4336eaac10dfc4a41f9dcd21bd04113a5d8bd729530c
MD5 df340880465d2842944e3d62ff823dae
SHA1 650f56d7e7ae017040e88c671b83c529eaf4eff3
SHA512 8574b222bcf4ea699d24216d24957ff9fef4e0c7af925643c0f09ec5069248e827da2fc20587c6e44ad21df157d328c78635fc3b1ecc5df393e8f462128e9b09
SSDEEP 3072:8cyuUAecBhvU5sJcNH0k2bfhB32oJhfIkVTrFg6Bk:jyuUAecBBU5sJcNH0k2bfrGoJhfIkVTU
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.Encoding.Extensions.4.3.0/ref/netstandard1.3/zh-hant/System.Text.Encoding.Extensions.xml

SHA256 0ae0e4b9721d5a3bee05682bca26f6bf11231fb316bd52fc067cb8cacaf7aaac
MD5 1c0f3bc281ac5707843629f838154264
SHA1 c9940f02772280e7500d3e86a1890e767d7b5a10
SHA512 23518746a836dae8b65c7c9be499c3905aa254dde08bad517782d90da4b52620a59f65336584f61968fc15bf9fc38aec0f0528e861d7594bed608346ef608f42
SSDEEP 3072:0pUssp2E6kJbTTdZK/yrAcsCd6wRc+yrZUvotDT/kGwk:mUssp2E6gTTdZK/yrAcsCta+yrZUvott
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/.signature.p7s

SHA256 47e3c3aee0e2f4e4c0e48dcaf91498cba0daaf6a6d9e1c56e764595d07bf2189
MD5 94b76218db3fcc26b897720cec3cf538
SHA1 8161cfeac470e1871da79d7beec8a7d5777c9b1b
SHA512 ef3ef2a6b159810264cae1d29ca6be489a36e4dcfef869e4f406ed718c4173382dfb52a017ecdb6ff02af900cd766e080f08442247282274c932eeb7e4a4038a
SSDEEP 192:8dlU7x0KDWpHhXZCVzV07xr5tGDH0JOqsmVgz28WhBqoozr:EYvDGGVp+GoJN77hhhc
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/System.Text.RegularExpressions.4.3.0.nupkg

SHA256 54b0a4d43d6470ddb06c07b777461033f3ea0ac3c73aeaa5058d72776628f8ad
MD5 39e760b1280619915311dfe4905f41f6
SHA1 34f3f8fd4fb9ed3a2a4344e9db702eb76ee92a8c
SHA512 80353c148df30d9a2c03ee10a624d91b64d7ccc3218cb966344cfa70657f0b59c867fed2ab94057f64ab281ad9318353f25c23375c00e1376b6589ae0a70aad3
SSDEEP 12288:PXrSx90NUKRS7erq6xDNBxlssg9L67Z6O:P7SxKRS70q6xTxlpg9u7Zn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/lib/net463/System.Text.RegularExpressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cd113a5c75cbaf9e565c9bc7bcbe09156b82d81d7c73ece0351472f60f0c8913
MD5 a73b83d7e6f1f1cc25016c5104fe321e
SHA1 634c12f169b3e13140f19b6f7f01e3725a2dc4d6
SHA512 17ac97400f167bd344c00493036f431f11289c7f276cb96dbacd23904dca8c8969ee6ac22b6407661e17b16f31b82baa89956cf2db1711652b7328a7322eaac4
SSDEEP 384:2rkxHuHWCzWYWNzW0MIA0GftpBjY7ERHRN7/+ldlHDNT:EkFuVwYqiYEBmNh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

58:69:0c:25:f7:4b:6f:32:f1:28:ee:47:97:eb:52:1e:ab:e3:88:3e:2f:d7:c4:0f:75:81:0c:b4:5b:8b:02:71

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

aa:76:16:8a:07:47:ae:95:97:93:26:01:c4:5f:e7:6e:df:8d:49:c6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin/obj/AnyOS.AnyCPU.Release/System.Text.RegularExpressions/net463\System.Text.RegularExpressions.pdb

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/lib/netcore50/System.Text.RegularExpressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ad9303cf427279ceb3abe3b79f1d69432377a20297d216ec9c9175ba6efb2bba
MD5 2c54587e09297ccfe8163e1dd08c84a0
SHA1 cfada00bdcf98bf8eca762fdc802634ffd807a5a
SHA512 5c360cb32be15d9fe477afa86436dba552c26d74263839494a704801616291e949a8004fbd15da449f3acc88823d1204de8fc4fecd83caa3e2bebc8f4653a234
SSDEEP 1536:2ayFdYhid0k3apzPRyF+1KXNp0e/TdLwdqFtCEMXJLILWAeOQjK9mDao:2aadXn34L4yKXEe5wyCRXROIjK9c7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

ca:9c:14:6a:33:32:8f:77:5a:05:2d:02:9b:39:44:2c:0b:86:30:70:74:37:1a:69:6b:7f:a2:7b:d3:5b:ca:72

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

cb:04:eb:62:73:86:fd:35:8e:35:a1:f6:fb:5c:6c:54:ff:0e:4f:a2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:70:f4:18:bf:23:21:fc:50:9d:00:00:00:00:00:70

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

102882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\\FxCore\x86ret\System.Text.RegularExpressions\System.Text.RegularExpressions.pdb

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/lib/netstandard1.6/System.Text.RegularExpressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 59d507b0f9cf620c29114e46e58baceeff980e319cc3e2a47aa97081a86c9d3b
MD5 92ca300ec22cee0b5213c006d5166b88
SHA1 0d5569664c2c25a1fc8d9ea2d582e5d299e5ab1c
SHA512 6b53340ab078f92721df7391b0e1c5ed665751aea2f1be56e9cf8a5ec000995cee132f4a99fc0a68c6fcae0a5862c59bd25504854322aa8adb6a8e37cb52afef
SSDEEP 1536:atMsaY0u/oZO8q/HQxLYzccendmlXdb8rILW9+VOvxFd0r5uWEBOa:aisyuQqYA9dbI/pU5uWEUa
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d7:9e:fd:71:ad:16:d0:08:de:8c:25:b1:de:59:7f:aa:2c:83:16:7f:60:57:9b:57:98:67:bc:b5:f8:01:6a:92

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

e3:8a:5e:83:5a:c1:c1:1d:1e:77:6d:d1:70:be:fa:67:91:67:01:1d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

103270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Text.RegularExpressions\System.Text.RegularExpressions.pdb

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/net463/System.Text.RegularExpressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cd113a5c75cbaf9e565c9bc7bcbe09156b82d81d7c73ece0351472f60f0c8913
MD5 a73b83d7e6f1f1cc25016c5104fe321e
SHA1 634c12f169b3e13140f19b6f7f01e3725a2dc4d6
SHA512 17ac97400f167bd344c00493036f431f11289c7f276cb96dbacd23904dca8c8969ee6ac22b6407661e17b16f31b82baa89956cf2db1711652b7328a7322eaac4
SSDEEP 384:2rkxHuHWCzWYWNzW0MIA0GftpBjY7ERHRN7/+ldlHDNT:EkFuVwYqiYEBmNh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

58:69:0c:25:f7:4b:6f:32:f1:28:ee:47:97:eb:52:1e:ab:e3:88:3e:2f:d7:c4:0f:75:81:0c:b4:5b:8b:02:71

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

aa:76:16:8a:07:47:ae:95:97:93:26:01:c4:5f:e7:6e:df:8d:49:c6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

10594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin/obj/AnyOS.AnyCPU.Release/System.Text.RegularExpressions/net463\System.Text.RegularExpressions.pdb

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcore50/System.Text.RegularExpressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f1d12a4c586a8c32d00310f03596dcf5e7779f482386b0bf4cf806f5a6e08f5f
MD5 077e885f8a0ad993cff8973c1f89b1a3
SHA1 6d3f69b92308a679d921d77f5aebdd992d8eb0f1
SHA512 57a23efca942a355ca998a0d924022fd85a45f34a4bdf42fef4e6dedc463a6e15da3347fb3e5152ca73401986822a583773b223326691f3bcb549921a024ec56
SSDEEP 384:AKcQBJWTjuAwidXLJWWoJWY7QA0GftpBjEr+ILKHRN7IeYUlI66nt:AKcQBrOJg5yiYm/w66
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

30:c9:ae:0a:51:d5:1a:c3:19:bd:db:84:91:21:85:17:81:ad:53:3e:2e:52:61:1d:ad:84:e9:fd:5d:07:86:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

56:c1:9f:80:f5:8c:11:d3:ca:e2:b1:b2:28:1b:a9:d5:01:e4:5d:01

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

15518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Text.RegularExpressions\4.0.10.0\System.Text.RegularExpressions.pdb

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcore50/System.Text.RegularExpressions.xml

SHA256 27e9a1fb2c4f67dad6ac90fba0292a9200f09aa58a57271a67cc3f72624066a9
MD5 5c71f5a4ffd6d82d73fea14b6291ea93
SHA1 bb5936dc9b7041751b16e050365b08f83ae333a2
SHA512 cd199e242ec03803f858e86208685c17f08c32ee041c114e9ebbf5c01b641e69f2940ef29cf3e13ca87ab439c41c4ec5fa03d8624099da71c6a04caa5ba4699d
SSDEEP 384:YEPsoKTKUPImPe/81aOd+JWt9vmYgtUvp0GZtmb0VISg2QJvlk:Y4soK+IIOr+JWt9vmFSsvlk
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcore50/de/System.Text.RegularExpressions.xml

SHA256 33ad3dc7e7ce87f893fa86380a945c40afe4050b866a73c6456a09897a23b3fc
MD5 de891d0220b47eb8e7d3641b0fe849be
SHA1 52d9df04e7b78d38b836439358a1033590487311
SHA512 b21e4b4f939be6396b098c2ed49484261b70e9c8f30fddd5a5ab08bf5e855aecc0a30e71a7bc0dd828ed36792607bd0fb3d0cd07d125285f20a1f43686408ea3
SSDEEP 768:YCZ+Nt9IO8+5C9+9+ARO785HOTFYpEW1HUrEDsVwa7c:FYDy+5Cbf8AKjHUrEDsVw7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcore50/es/System.Text.RegularExpressions.xml

SHA256 ab27211860d03a619133468bbcb6438339d8e0aa3533c936095492b34dbf35aa
MD5 ea030c1243245d3160886e5811b138fb
SHA1 4a78d04d68a8e3b115f7ec9e48c987920d824dac
SHA512 a1c9f30cef7e1872fd4290ef5167e7ede659621b9712891aa6dc6368bb312f646881a7ddb7d25e59c073a3c42f846993675e4c4b11f4332a6a6d91737c945643
SSDEEP 768:YquDZga45WE2/zczvpzvrthlQEp7iFKsosWoHXfqK:keBtKtWoHXfqK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcore50/fr/System.Text.RegularExpressions.xml

SHA256 469c8ad0ba720725f0e16a6439a6508d8d6eb13ff712230af5416a4c5a7cf505
MD5 23e57b296e90d9439e2d3bbad054f78b
SHA1 618738c8527f778c94af38f7f7a5c011ad3f2ab6
SHA512 4295b8a172a91f7acd2f0a181db0b2f7d4559e4a26e548d557e6e3cc334756703d4e1fd679b1b2c748aa50ab1357872b1c7bb2922ae87685d2c2e520924733b6
SSDEEP 384:YD1XOpsU7pp2iGpHqdILs8jtK+jytRFLyoau13WGfiD9biwhTHnUtWMBN6Ks5CUd:YTEILs8jtK+HTthf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcore50/it/System.Text.RegularExpressions.xml

SHA256 7fc6bb35237f31c01499779b1a9850b8b65ebd4848ff986043ab936ff96b9e25
MD5 30e053980f1553190a5688a3b6610b05
SHA1 ea16890ad7095e056f528e9cf596ef0d0977df8e
SHA512 a45f95100ef8285c4af8837ae1ab06c83a619f9075263ca27fd158a3533cbf107a39c8f541d2de8b9b7f2e9c6f84a4922e4a40517734708d6357b744c00f62d2
SSDEEP 1536:yIvZh+e2+7n+tKpnSStS/VBSObSKOYnvntvNbn+Lt+JtnSltSP:yIvn+e2+7n+tKpnSStS/VBSObSKOYnv3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcore50/ja/System.Text.RegularExpressions.xml

SHA256 c0265fddc8e591e529d852f5daaa9f4c9729c15de0e4f1f1b69b629c0663e8ce
MD5 8d032dc93b087b95583a5b1c93e4923b
SHA1 ee1a9dbfdb4b130f0569ef1c499bf8ce252101f5
SHA512 dccd0967d27948a7cd758f2c4b93ad5911350ad8ae34375d992f264201771d47140fc6411f64476d7fb219f5f5d4019818698629b2398706ad3e2af635372743
SSDEEP 384:YCyw+yyLKyWz4x4Sf3yeIzmOKxbqwpWfh367hO6gpc36yO6g1q3Af4IgFGzRgBWB:Yo+TGoD3yk/OfuB9eLh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcore50/ko/System.Text.RegularExpressions.xml

SHA256 0ace8f4924ca8c77a5a2788da3b9852599e2bea6dd21a3ee3ffc2da64381a9d7
MD5 8ce43b61c5c9c64ad93d08ae5069acb9
SHA1 28dd5d7c8c09abd656977244f891aae96cbb5306
SHA512 308ee484f42aa1eb1e1fd6dc2c431cf4dc70eb34702f90d812f1357fdd19756b374a0369ce573865892100edddd62dc0823089428ed0ace69a627431e85abf37
SSDEEP 1536:YY8nxmAXH7OmpWfXcdzd7dEdcdqlr+jl8Liq:YY8nxmAXH7OmpWfsdzd7dEdcdpq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcore50/ru/System.Text.RegularExpressions.xml

SHA256 dff18d92e829e24d933cbbf507610f5470a4694ef15b2918e237280493da521d
MD5 acb7dfd8a0b06b93ef1266efbe660dc2
SHA1 e4e0842b6b594e6a1b9baccd0a529008ffb12024
SHA512 3eab1f86a1c812e07f5ae2da5cf975f376819e14f73607b9ffcdedffefb6824da0ae6e83b0464fac2b3d24304616ac4b2a8cf98390c7c12165c3592825941e83
SSDEEP 768:YxMQEVFN9g/DFfQNL6VOROtXoV1EWeVFAVr99BBVxDCkaSkV9hzm1m7VWwc1DyXF:gMQEVFbg/5fQR6JXonEWeLAlX8wm7h1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcore50/zh-hans/System.Text.RegularExpressions.xml

SHA256 d1073497cde4860567c589cb88ea4e99bff7e597643ee9fc305c06103d2624be
MD5 ff918c56871c7abf8953509f2e8489ed
SHA1 91b1b34bd9ae2b102feeab3a09526659d139cd16
SHA512 e4c7e0822e3dd1b93df8269cd93f7c5c39589fb29b85368f3942b619053d1b3607cd89a3653f16d36bc4e2355171bb83d68d011319812ad10b9618fa19cbae28
SSDEEP 768:Y7KyFk2H0/9JPPPKKT8YO76cqjrpNdymv0rna:yuW0zPKKT8YvcqjrpNdymcTa
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcore50/zh-hant/System.Text.RegularExpressions.xml

SHA256 e608fed3c455e1a6a427c6e4cb54e89aa31525a71c218b9d44f9dd812fd986bf
MD5 2688ce7450a769cd6150457754211d3e
SHA1 be7b5c2ff8e5fe4ad2762fee26fb650fe88b9171
SHA512 a0cae875f650ec760c65c7b319cca275ba7caf24e73dbbe0ab30fd5f27104b7134170f03a5bde2ed601fe292270901b8ca8de4f127ce793a23932d19c2e04b4f
SSDEEP 384:YqciUivZYDQ/e8fpwJ+4gHc7Hflyesf+HhO/Xlvzy9aCgFvw6ip1YFeJxsFyJZY4:YikGlz9CeWvBCFxKlYV7D7xI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netcoreapp1.1/System.Text.RegularExpressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 93bba52669a3c709cd2afd6702b3ab71167d33f10aa5f8e4890a8472412814e2
MD5 4f5681d5982c50fbcb722bb117435fd6
SHA1 9aafaa7dfcf35b43695e3e70e659470b61b7d527
SHA512 2bdb8ac201ccbb38a7b0169bad84ba5c6e0fdecfd9bd54253f38a31990b5994042a3217f370713d68001d083eab6591c320c0748e4454c4433e3d21f2a5cf742
SSDEEP 384:kn0W50o9AWGLjFv6RU26NXorRpWqzW3+10vq0GftpBj2jERHRN7rlJrv:pW50CksUEpoi4jEB/b
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

d1:74:c0:24:69:9b:25:5e:0d:9b:e1:5b:19:61:e9:72:9c:e0:31:47:a7:70:9a:21:71:87:26:55:11:89:70:c2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

0f:4f:d9:3d:a0:dd:2c:cf:c7:56:c5:ba:98:19:2c:e1:f8:56:ed:d2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c8:47:22:9d:a3:0d:ca:c0:58:00:00:00:00:00:c8

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

17386

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\ref\System.Text.RegularExpressions\4.1.1.0\System.Text.RegularExpressions.pdb

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.0/System.Text.RegularExpressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e5e56f9e34d4309ff55ef7c3afbdbbab7bb67fdcfd67a31b67e5723f5973862e
MD5 4b36b05824a2b3e1f285df0ee4667d05
SHA1 c8f3da195b23eda7179eec58492f19d37dae7cd0
SHA512 eb0cea19242e70267be8922149ca2caddf3f473b28603b2e70f2d04d31c6eb631a8ed984ff239c4ae6ae87598c92a35b3b5472c3183a1fa244a56f3641c950c1
SSDEEP 384:FGdceOHHm3hQGS6KWnE76zWgzWYw1LHB0GftpBjFXK/DHRN7+al15ncY:FGdlxZQ6vJQWicD+w1z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

59:5e:89:70:08:25:f6:0f:85:ce:ad:22:59:3c:dd:a8:44:00:1e:34:64:83:15:b3:d9:ec:4b:4b:72:da:9a:e7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

35:eb:9f:f2:fc:6c:cb:5a:a2:f8:e6:63:a8:68:77:d2:3b:27:97:7b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:19:96:00:00:00:00:00:1b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

15470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.0/System.Text.RegularExpressions.xml

SHA256 27e9a1fb2c4f67dad6ac90fba0292a9200f09aa58a57271a67cc3f72624066a9
MD5 5c71f5a4ffd6d82d73fea14b6291ea93
SHA1 bb5936dc9b7041751b16e050365b08f83ae333a2
SHA512 cd199e242ec03803f858e86208685c17f08c32ee041c114e9ebbf5c01b641e69f2940ef29cf3e13ca87ab439c41c4ec5fa03d8624099da71c6a04caa5ba4699d
SSDEEP 384:YEPsoKTKUPImPe/81aOd+JWt9vmYgtUvp0GZtmb0VISg2QJvlk:Y4soK+IIOr+JWt9vmFSsvlk
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.0/de/System.Text.RegularExpressions.xml

SHA256 33ad3dc7e7ce87f893fa86380a945c40afe4050b866a73c6456a09897a23b3fc
MD5 de891d0220b47eb8e7d3641b0fe849be
SHA1 52d9df04e7b78d38b836439358a1033590487311
SHA512 b21e4b4f939be6396b098c2ed49484261b70e9c8f30fddd5a5ab08bf5e855aecc0a30e71a7bc0dd828ed36792607bd0fb3d0cd07d125285f20a1f43686408ea3
SSDEEP 768:YCZ+Nt9IO8+5C9+9+ARO785HOTFYpEW1HUrEDsVwa7c:FYDy+5Cbf8AKjHUrEDsVw7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.0/es/System.Text.RegularExpressions.xml

SHA256 ab27211860d03a619133468bbcb6438339d8e0aa3533c936095492b34dbf35aa
MD5 ea030c1243245d3160886e5811b138fb
SHA1 4a78d04d68a8e3b115f7ec9e48c987920d824dac
SHA512 a1c9f30cef7e1872fd4290ef5167e7ede659621b9712891aa6dc6368bb312f646881a7ddb7d25e59c073a3c42f846993675e4c4b11f4332a6a6d91737c945643
SSDEEP 768:YquDZga45WE2/zczvpzvrthlQEp7iFKsosWoHXfqK:keBtKtWoHXfqK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.0/fr/System.Text.RegularExpressions.xml

SHA256 469c8ad0ba720725f0e16a6439a6508d8d6eb13ff712230af5416a4c5a7cf505
MD5 23e57b296e90d9439e2d3bbad054f78b
SHA1 618738c8527f778c94af38f7f7a5c011ad3f2ab6
SHA512 4295b8a172a91f7acd2f0a181db0b2f7d4559e4a26e548d557e6e3cc334756703d4e1fd679b1b2c748aa50ab1357872b1c7bb2922ae87685d2c2e520924733b6
SSDEEP 384:YD1XOpsU7pp2iGpHqdILs8jtK+jytRFLyoau13WGfiD9biwhTHnUtWMBN6Ks5CUd:YTEILs8jtK+HTthf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.0/it/System.Text.RegularExpressions.xml

SHA256 7fc6bb35237f31c01499779b1a9850b8b65ebd4848ff986043ab936ff96b9e25
MD5 30e053980f1553190a5688a3b6610b05
SHA1 ea16890ad7095e056f528e9cf596ef0d0977df8e
SHA512 a45f95100ef8285c4af8837ae1ab06c83a619f9075263ca27fd158a3533cbf107a39c8f541d2de8b9b7f2e9c6f84a4922e4a40517734708d6357b744c00f62d2
SSDEEP 1536:yIvZh+e2+7n+tKpnSStS/VBSObSKOYnvntvNbn+Lt+JtnSltSP:yIvn+e2+7n+tKpnSStS/VBSObSKOYnv3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.0/ja/System.Text.RegularExpressions.xml

SHA256 c0265fddc8e591e529d852f5daaa9f4c9729c15de0e4f1f1b69b629c0663e8ce
MD5 8d032dc93b087b95583a5b1c93e4923b
SHA1 ee1a9dbfdb4b130f0569ef1c499bf8ce252101f5
SHA512 dccd0967d27948a7cd758f2c4b93ad5911350ad8ae34375d992f264201771d47140fc6411f64476d7fb219f5f5d4019818698629b2398706ad3e2af635372743
SSDEEP 384:YCyw+yyLKyWz4x4Sf3yeIzmOKxbqwpWfh367hO6gpc36yO6g1q3Af4IgFGzRgBWB:Yo+TGoD3yk/OfuB9eLh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.0/ko/System.Text.RegularExpressions.xml

SHA256 0ace8f4924ca8c77a5a2788da3b9852599e2bea6dd21a3ee3ffc2da64381a9d7
MD5 8ce43b61c5c9c64ad93d08ae5069acb9
SHA1 28dd5d7c8c09abd656977244f891aae96cbb5306
SHA512 308ee484f42aa1eb1e1fd6dc2c431cf4dc70eb34702f90d812f1357fdd19756b374a0369ce573865892100edddd62dc0823089428ed0ace69a627431e85abf37
SSDEEP 1536:YY8nxmAXH7OmpWfXcdzd7dEdcdqlr+jl8Liq:YY8nxmAXH7OmpWfsdzd7dEdcdpq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.0/ru/System.Text.RegularExpressions.xml

SHA256 dff18d92e829e24d933cbbf507610f5470a4694ef15b2918e237280493da521d
MD5 acb7dfd8a0b06b93ef1266efbe660dc2
SHA1 e4e0842b6b594e6a1b9baccd0a529008ffb12024
SHA512 3eab1f86a1c812e07f5ae2da5cf975f376819e14f73607b9ffcdedffefb6824da0ae6e83b0464fac2b3d24304616ac4b2a8cf98390c7c12165c3592825941e83
SSDEEP 768:YxMQEVFN9g/DFfQNL6VOROtXoV1EWeVFAVr99BBVxDCkaSkV9hzm1m7VWwc1DyXF:gMQEVFbg/5fQR6JXonEWeLAlX8wm7h1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.0/zh-hans/System.Text.RegularExpressions.xml

SHA256 d1073497cde4860567c589cb88ea4e99bff7e597643ee9fc305c06103d2624be
MD5 ff918c56871c7abf8953509f2e8489ed
SHA1 91b1b34bd9ae2b102feeab3a09526659d139cd16
SHA512 e4c7e0822e3dd1b93df8269cd93f7c5c39589fb29b85368f3942b619053d1b3607cd89a3653f16d36bc4e2355171bb83d68d011319812ad10b9618fa19cbae28
SSDEEP 768:Y7KyFk2H0/9JPPPKKT8YO76cqjrpNdymv0rna:yuW0zPKKT8YvcqjrpNdymcTa
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.0/zh-hant/System.Text.RegularExpressions.xml

SHA256 e608fed3c455e1a6a427c6e4cb54e89aa31525a71c218b9d44f9dd812fd986bf
MD5 2688ce7450a769cd6150457754211d3e
SHA1 be7b5c2ff8e5fe4ad2762fee26fb650fe88b9171
SHA512 a0cae875f650ec760c65c7b319cca275ba7caf24e73dbbe0ab30fd5f27104b7134170f03a5bde2ed601fe292270901b8ca8de4f127ce793a23932d19c2e04b4f
SSDEEP 384:YqciUivZYDQ/e8fpwJ+4gHc7Hflyesf+HhO/Xlvzy9aCgFvw6ip1YFeJxsFyJZY4:YikGlz9CeWvBCFxKlYV7D7xI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.3/System.Text.RegularExpressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f1d12a4c586a8c32d00310f03596dcf5e7779f482386b0bf4cf806f5a6e08f5f
MD5 077e885f8a0ad993cff8973c1f89b1a3
SHA1 6d3f69b92308a679d921d77f5aebdd992d8eb0f1
SHA512 57a23efca942a355ca998a0d924022fd85a45f34a4bdf42fef4e6dedc463a6e15da3347fb3e5152ca73401986822a583773b223326691f3bcb549921a024ec56
SSDEEP 384:AKcQBJWTjuAwidXLJWWoJWY7QA0GftpBjEr+ILKHRN7IeYUlI66nt:AKcQBrOJg5yiYm/w66
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

30:c9:ae:0a:51:d5:1a:c3:19:bd:db:84:91:21:85:17:81:ad:53:3e:2e:52:61:1d:ad:84:e9:fd:5d:07:86:b4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

56:c1:9f:80:f5:8c:11:d3:ca:e2:b1:b2:28:1b:a9:d5:01:e4:5d:01

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 23, 2015

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:71:b3:2e:8a:6b:82:aa:1f:4e:00:00:00:00:00:71

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 20, 2015 - Jun 20, 2016

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 1, 2014 - Jan 1, 2016

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

15518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

f:\binaries\Intermediate\FxCore\x86ret\contracts\System.Text.RegularExpressions\4.0.10.0\System.Text.RegularExpressions.pdb

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.3/System.Text.RegularExpressions.xml

SHA256 27e9a1fb2c4f67dad6ac90fba0292a9200f09aa58a57271a67cc3f72624066a9
MD5 5c71f5a4ffd6d82d73fea14b6291ea93
SHA1 bb5936dc9b7041751b16e050365b08f83ae333a2
SHA512 cd199e242ec03803f858e86208685c17f08c32ee041c114e9ebbf5c01b641e69f2940ef29cf3e13ca87ab439c41c4ec5fa03d8624099da71c6a04caa5ba4699d
SSDEEP 384:YEPsoKTKUPImPe/81aOd+JWt9vmYgtUvp0GZtmb0VISg2QJvlk:Y4soK+IIOr+JWt9vmFSsvlk
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.3/de/System.Text.RegularExpressions.xml

SHA256 33ad3dc7e7ce87f893fa86380a945c40afe4050b866a73c6456a09897a23b3fc
MD5 de891d0220b47eb8e7d3641b0fe849be
SHA1 52d9df04e7b78d38b836439358a1033590487311
SHA512 b21e4b4f939be6396b098c2ed49484261b70e9c8f30fddd5a5ab08bf5e855aecc0a30e71a7bc0dd828ed36792607bd0fb3d0cd07d125285f20a1f43686408ea3
SSDEEP 768:YCZ+Nt9IO8+5C9+9+ARO785HOTFYpEW1HUrEDsVwa7c:FYDy+5Cbf8AKjHUrEDsVw7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.3/es/System.Text.RegularExpressions.xml

SHA256 ab27211860d03a619133468bbcb6438339d8e0aa3533c936095492b34dbf35aa
MD5 ea030c1243245d3160886e5811b138fb
SHA1 4a78d04d68a8e3b115f7ec9e48c987920d824dac
SHA512 a1c9f30cef7e1872fd4290ef5167e7ede659621b9712891aa6dc6368bb312f646881a7ddb7d25e59c073a3c42f846993675e4c4b11f4332a6a6d91737c945643
SSDEEP 768:YquDZga45WE2/zczvpzvrthlQEp7iFKsosWoHXfqK:keBtKtWoHXfqK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.3/fr/System.Text.RegularExpressions.xml

SHA256 469c8ad0ba720725f0e16a6439a6508d8d6eb13ff712230af5416a4c5a7cf505
MD5 23e57b296e90d9439e2d3bbad054f78b
SHA1 618738c8527f778c94af38f7f7a5c011ad3f2ab6
SHA512 4295b8a172a91f7acd2f0a181db0b2f7d4559e4a26e548d557e6e3cc334756703d4e1fd679b1b2c748aa50ab1357872b1c7bb2922ae87685d2c2e520924733b6
SSDEEP 384:YD1XOpsU7pp2iGpHqdILs8jtK+jytRFLyoau13WGfiD9biwhTHnUtWMBN6Ks5CUd:YTEILs8jtK+HTthf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.3/it/System.Text.RegularExpressions.xml

SHA256 7fc6bb35237f31c01499779b1a9850b8b65ebd4848ff986043ab936ff96b9e25
MD5 30e053980f1553190a5688a3b6610b05
SHA1 ea16890ad7095e056f528e9cf596ef0d0977df8e
SHA512 a45f95100ef8285c4af8837ae1ab06c83a619f9075263ca27fd158a3533cbf107a39c8f541d2de8b9b7f2e9c6f84a4922e4a40517734708d6357b744c00f62d2
SSDEEP 1536:yIvZh+e2+7n+tKpnSStS/VBSObSKOYnvntvNbn+Lt+JtnSltSP:yIvn+e2+7n+tKpnSStS/VBSObSKOYnv3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.3/ja/System.Text.RegularExpressions.xml

SHA256 c0265fddc8e591e529d852f5daaa9f4c9729c15de0e4f1f1b69b629c0663e8ce
MD5 8d032dc93b087b95583a5b1c93e4923b
SHA1 ee1a9dbfdb4b130f0569ef1c499bf8ce252101f5
SHA512 dccd0967d27948a7cd758f2c4b93ad5911350ad8ae34375d992f264201771d47140fc6411f64476d7fb219f5f5d4019818698629b2398706ad3e2af635372743
SSDEEP 384:YCyw+yyLKyWz4x4Sf3yeIzmOKxbqwpWfh367hO6gpc36yO6g1q3Af4IgFGzRgBWB:Yo+TGoD3yk/OfuB9eLh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.3/ko/System.Text.RegularExpressions.xml

SHA256 0ace8f4924ca8c77a5a2788da3b9852599e2bea6dd21a3ee3ffc2da64381a9d7
MD5 8ce43b61c5c9c64ad93d08ae5069acb9
SHA1 28dd5d7c8c09abd656977244f891aae96cbb5306
SHA512 308ee484f42aa1eb1e1fd6dc2c431cf4dc70eb34702f90d812f1357fdd19756b374a0369ce573865892100edddd62dc0823089428ed0ace69a627431e85abf37
SSDEEP 1536:YY8nxmAXH7OmpWfXcdzd7dEdcdqlr+jl8Liq:YY8nxmAXH7OmpWfsdzd7dEdcdpq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.3/ru/System.Text.RegularExpressions.xml

SHA256 dff18d92e829e24d933cbbf507610f5470a4694ef15b2918e237280493da521d
MD5 acb7dfd8a0b06b93ef1266efbe660dc2
SHA1 e4e0842b6b594e6a1b9baccd0a529008ffb12024
SHA512 3eab1f86a1c812e07f5ae2da5cf975f376819e14f73607b9ffcdedffefb6824da0ae6e83b0464fac2b3d24304616ac4b2a8cf98390c7c12165c3592825941e83
SSDEEP 768:YxMQEVFN9g/DFfQNL6VOROtXoV1EWeVFAVr99BBVxDCkaSkV9hzm1m7VWwc1DyXF:gMQEVFbg/5fQR6JXonEWeLAlX8wm7h1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.3/zh-hans/System.Text.RegularExpressions.xml

SHA256 d1073497cde4860567c589cb88ea4e99bff7e597643ee9fc305c06103d2624be
MD5 ff918c56871c7abf8953509f2e8489ed
SHA1 91b1b34bd9ae2b102feeab3a09526659d139cd16
SHA512 e4c7e0822e3dd1b93df8269cd93f7c5c39589fb29b85368f3942b619053d1b3607cd89a3653f16d36bc4e2355171bb83d68d011319812ad10b9618fa19cbae28
SSDEEP 768:Y7KyFk2H0/9JPPPKKT8YO76cqjrpNdymv0rna:yuW0zPKKT8YvcqjrpNdymcTa
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.3/zh-hant/System.Text.RegularExpressions.xml

SHA256 e608fed3c455e1a6a427c6e4cb54e89aa31525a71c218b9d44f9dd812fd986bf
MD5 2688ce7450a769cd6150457754211d3e
SHA1 be7b5c2ff8e5fe4ad2762fee26fb650fe88b9171
SHA512 a0cae875f650ec760c65c7b319cca275ba7caf24e73dbbe0ab30fd5f27104b7134170f03a5bde2ed601fe292270901b8ca8de4f127ce793a23932d19c2e04b4f
SSDEEP 384:YqciUivZYDQ/e8fpwJ+4gHc7Hflyesf+HhO/Xlvzy9aCgFvw6ip1YFeJxsFyJZY4:YikGlz9CeWvBCFxKlYV7D7xI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.6/System.Text.RegularExpressions.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 865f01a2705864339ab06e819f8fc87f735fc9dacd9daa87fb5573b905728036
MD5 4965df7e2c00973d28a067b03225c255
SHA1 8bfade7944df6727b0a41085cb7e1951b82e72c2
SHA512 83699b04c638b9f42cc733592b3c353a5ff3a016809cee939ae33f1e5afd8aece9e5814c364fc57006b829bf3d84fc35fe35a0a6bec83225009b2ba53d0576d6
SSDEEP 384:+s/oM76HAJWGxjFv6RU26NXoQUzUWCzWQaCIcPA0GftpBj8gERHRN734lp/mQdGg:+rc6HAlmU5I0RiigEBA4Rw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

ec:02:02:90:0d:d4:9d:38:36:5e:62:30:d1:54:ca:ae:90:a0:5f:8f:ef:94:56:b3:3f:8f:43:52:5a:79:d9:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

e1:99:66:b7:d1:8f:3e:93:11:d9:bf:b6:aa:ac:b5:0b:24:3e:a6:0e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

17350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Text.RegularExpressions\4.1.0.0\System.Text.RegularExpressions.pdb

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.6/System.Text.RegularExpressions.xml

SHA256 27e9a1fb2c4f67dad6ac90fba0292a9200f09aa58a57271a67cc3f72624066a9
MD5 5c71f5a4ffd6d82d73fea14b6291ea93
SHA1 bb5936dc9b7041751b16e050365b08f83ae333a2
SHA512 cd199e242ec03803f858e86208685c17f08c32ee041c114e9ebbf5c01b641e69f2940ef29cf3e13ca87ab439c41c4ec5fa03d8624099da71c6a04caa5ba4699d
SSDEEP 384:YEPsoKTKUPImPe/81aOd+JWt9vmYgtUvp0GZtmb0VISg2QJvlk:Y4soK+IIOr+JWt9vmFSsvlk
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.6/de/System.Text.RegularExpressions.xml

SHA256 33ad3dc7e7ce87f893fa86380a945c40afe4050b866a73c6456a09897a23b3fc
MD5 de891d0220b47eb8e7d3641b0fe849be
SHA1 52d9df04e7b78d38b836439358a1033590487311
SHA512 b21e4b4f939be6396b098c2ed49484261b70e9c8f30fddd5a5ab08bf5e855aecc0a30e71a7bc0dd828ed36792607bd0fb3d0cd07d125285f20a1f43686408ea3
SSDEEP 768:YCZ+Nt9IO8+5C9+9+ARO785HOTFYpEW1HUrEDsVwa7c:FYDy+5Cbf8AKjHUrEDsVw7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.6/es/System.Text.RegularExpressions.xml

SHA256 ab27211860d03a619133468bbcb6438339d8e0aa3533c936095492b34dbf35aa
MD5 ea030c1243245d3160886e5811b138fb
SHA1 4a78d04d68a8e3b115f7ec9e48c987920d824dac
SHA512 a1c9f30cef7e1872fd4290ef5167e7ede659621b9712891aa6dc6368bb312f646881a7ddb7d25e59c073a3c42f846993675e4c4b11f4332a6a6d91737c945643
SSDEEP 768:YquDZga45WE2/zczvpzvrthlQEp7iFKsosWoHXfqK:keBtKtWoHXfqK
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.6/fr/System.Text.RegularExpressions.xml

SHA256 469c8ad0ba720725f0e16a6439a6508d8d6eb13ff712230af5416a4c5a7cf505
MD5 23e57b296e90d9439e2d3bbad054f78b
SHA1 618738c8527f778c94af38f7f7a5c011ad3f2ab6
SHA512 4295b8a172a91f7acd2f0a181db0b2f7d4559e4a26e548d557e6e3cc334756703d4e1fd679b1b2c748aa50ab1357872b1c7bb2922ae87685d2c2e520924733b6
SSDEEP 384:YD1XOpsU7pp2iGpHqdILs8jtK+jytRFLyoau13WGfiD9biwhTHnUtWMBN6Ks5CUd:YTEILs8jtK+HTthf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.6/it/System.Text.RegularExpressions.xml

SHA256 7fc6bb35237f31c01499779b1a9850b8b65ebd4848ff986043ab936ff96b9e25
MD5 30e053980f1553190a5688a3b6610b05
SHA1 ea16890ad7095e056f528e9cf596ef0d0977df8e
SHA512 a45f95100ef8285c4af8837ae1ab06c83a619f9075263ca27fd158a3533cbf107a39c8f541d2de8b9b7f2e9c6f84a4922e4a40517734708d6357b744c00f62d2
SSDEEP 1536:yIvZh+e2+7n+tKpnSStS/VBSObSKOYnvntvNbn+Lt+JtnSltSP:yIvn+e2+7n+tKpnSStS/VBSObSKOYnv3
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.6/ja/System.Text.RegularExpressions.xml

SHA256 c0265fddc8e591e529d852f5daaa9f4c9729c15de0e4f1f1b69b629c0663e8ce
MD5 8d032dc93b087b95583a5b1c93e4923b
SHA1 ee1a9dbfdb4b130f0569ef1c499bf8ce252101f5
SHA512 dccd0967d27948a7cd758f2c4b93ad5911350ad8ae34375d992f264201771d47140fc6411f64476d7fb219f5f5d4019818698629b2398706ad3e2af635372743
SSDEEP 384:YCyw+yyLKyWz4x4Sf3yeIzmOKxbqwpWfh367hO6gpc36yO6g1q3Af4IgFGzRgBWB:Yo+TGoD3yk/OfuB9eLh
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.6/ko/System.Text.RegularExpressions.xml

SHA256 0ace8f4924ca8c77a5a2788da3b9852599e2bea6dd21a3ee3ffc2da64381a9d7
MD5 8ce43b61c5c9c64ad93d08ae5069acb9
SHA1 28dd5d7c8c09abd656977244f891aae96cbb5306
SHA512 308ee484f42aa1eb1e1fd6dc2c431cf4dc70eb34702f90d812f1357fdd19756b374a0369ce573865892100edddd62dc0823089428ed0ace69a627431e85abf37
SSDEEP 1536:YY8nxmAXH7OmpWfXcdzd7dEdcdqlr+jl8Liq:YY8nxmAXH7OmpWfsdzd7dEdcdpq
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.6/ru/System.Text.RegularExpressions.xml

SHA256 dff18d92e829e24d933cbbf507610f5470a4694ef15b2918e237280493da521d
MD5 acb7dfd8a0b06b93ef1266efbe660dc2
SHA1 e4e0842b6b594e6a1b9baccd0a529008ffb12024
SHA512 3eab1f86a1c812e07f5ae2da5cf975f376819e14f73607b9ffcdedffefb6824da0ae6e83b0464fac2b3d24304616ac4b2a8cf98390c7c12165c3592825941e83
SSDEEP 768:YxMQEVFN9g/DFfQNL6VOROtXoV1EWeVFAVr99BBVxDCkaSkV9hzm1m7VWwc1DyXF:gMQEVFbg/5fQR6JXonEWeLAlX8wm7h1
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.6/zh-hans/System.Text.RegularExpressions.xml

SHA256 d1073497cde4860567c589cb88ea4e99bff7e597643ee9fc305c06103d2624be
MD5 ff918c56871c7abf8953509f2e8489ed
SHA1 91b1b34bd9ae2b102feeab3a09526659d139cd16
SHA512 e4c7e0822e3dd1b93df8269cd93f7c5c39589fb29b85368f3942b619053d1b3607cd89a3653f16d36bc4e2355171bb83d68d011319812ad10b9618fa19cbae28
SSDEEP 768:Y7KyFk2H0/9JPPPKKT8YO76cqjrpNdymv0rna:yuW0zPKKT8YvcqjrpNdymcTa
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Text.RegularExpressions.4.3.0/ref/netstandard1.6/zh-hant/System.Text.RegularExpressions.xml

SHA256 e608fed3c455e1a6a427c6e4cb54e89aa31525a71c218b9d44f9dd812fd986bf
MD5 2688ce7450a769cd6150457754211d3e
SHA1 be7b5c2ff8e5fe4ad2762fee26fb650fe88b9171
SHA512 a0cae875f650ec760c65c7b319cca275ba7caf24e73dbbe0ab30fd5f27104b7134170f03a5bde2ed601fe292270901b8ca8de4f127ce793a23932d19c2e04b4f
SSDEEP 384:YqciUivZYDQ/e8fpwJ+4gHc7Hflyesf+HhO/Xlvzy9aCgFvw6ip1YFeJxsFyJZY4:YikGlz9CeWvBCFxKlYV7D7xI
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/.signature.p7s

SHA256 6f14833bab77b48ba9d54d41a17cd1042e13ed1dbc81905a63413ee69c32a46a
MD5 f2739d4b3b1f81bbee773b14cbc72401
SHA1 fde772959b2c462e9ef59d7a0d90a3ff5d3c212b
SHA512 c4e1b423a3b77f981e7e0856f64d08da2b856c1fa649f153fe18fc873bdfe8360595d9c2d780a98d79b34f0e8fc44026a05060b4ccc1f6b6a1c39a84c2e7d8ff
SSDEEP 192:xdK7x0KDWpHhXZCVzV07Vr/y9DH0JOqNG8Fp28Wh8nD7p:jQvDGGVpp9oJNNzFwhhiXp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/System.Threading.4.3.0.nupkg

SHA256 643437751e29cd5c266aa060e2169c65a55e9d0ff7c8017fb95ec15d95e38967
MD5 a58c1186c38064fecf456298c6a62fb4
SHA1 5d94d36ebc3bc88698e400841581afadf9125143
SHA512 97a2751bdce69faaf9c54f834a9fd5c60c7a786faa52f420769828dbc9b5804c1f3721ba1ea945ea1d844835d909810f9e782c9a44d0faaecccb230c4cd95a88
SSDEEP 6144:izUc4iv4i/iUd6s7WcFluHEmp/rFY9Stn8w8FFXUO6B79cFGuAjmp/rF8tI8wD9p:dc4Q4Z06crVmInt6MoZmBE6G7Vmr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Threading.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/lib/netcore50/System.Threading.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d43446514536b456ae15ec2a772c3e7be776fe38b4e31db0bd1a5916bbf884a5
MD5 a920e8891b75253f4a81a275191a29aa
SHA1 e706450038f0fbd62bdcdae9543e9c1a6618cd97
SHA512 4d87620b4659c1006f4480d0c9581eeffe1eb93b42810136cbbd59c15124ac8dfda0bc188d8f478186e1cbfa0ce746c72ae0cc62cd9ef58fadd8b138d9a295fa
SSDEEP 768:UeWea/PF3bs5WxHpKVIVE211rd8owvehfZnYDr5BMrsRoixwEBxow:J+tI5+Js21TB1zsRo0wEB6w
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

ca:38:63:ec:5a:70:f3:6c:f5:8c:44:45:32:1f:2e:11:db:7b:d7:84:59:b0:f3:15:d7:33:3f:0f:fa:2a:31:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

73:71:31:95:98:c1:d4:a6:f9:79:4f:41:de:ac:84:8c:8f:62:2c:16

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

38378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Threading\System.Threading.pdb

LegionStealer V1 SRC/packages/System.Threading.4.3.0/lib/netstandard1.3/System.Threading.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d43446514536b456ae15ec2a772c3e7be776fe38b4e31db0bd1a5916bbf884a5
MD5 a920e8891b75253f4a81a275191a29aa
SHA1 e706450038f0fbd62bdcdae9543e9c1a6618cd97
SHA512 4d87620b4659c1006f4480d0c9581eeffe1eb93b42810136cbbd59c15124ac8dfda0bc188d8f478186e1cbfa0ce746c72ae0cc62cd9ef58fadd8b138d9a295fa
SSDEEP 768:UeWea/PF3bs5WxHpKVIVE211rd8owvehfZnYDr5BMrsRoixwEBxow:J+tI5+Js21TB1zsRo0wEB6w
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

ca:38:63:ec:5a:70:f3:6c:f5:8c:44:45:32:1f:2e:11:db:7b:d7:84:59:b0:f3:15:d7:33:3f:0f:fa:2a:31:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

73:71:31:95:98:c1:d4:a6:f9:79:4f:41:de:ac:84:8c:8f:62:2c:16

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

38378

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Threading\System.Threading.pdb

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netcore50/System.Threading.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 68f0142c192545e1d038045a9585d0a16e02b3ad49efbfe4835bd8c7712f3dd5
MD5 b937795577f5d41e805efe00dc87ec6e
SHA1 e387a7fa4c73635a435ad3b29660a8f1ca2c4e90
SHA512 7db22d03c6fa0479b39269de77ca84eb7905a933bf6159810e976c5dc6c47a18f495bb46d9ef56be21c721da271bd8b5f130e4fa26e1e298ba4273daa65ad281
SSDEEP 384:Lq7ajQzrI7YVF1NqDMvuOqTW9XE7uiA4lKWMNWdMIA0GftpBjf9ERHRN7BlgsCu:aY0uyuEXvqiTEBUo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

36:fa:36:07:61:4e:a8:ce:f2:93:b0:cb:58:b7:f9:db:29:e4:f5:ca:97:82:5d:1a:9f:43:1a:f8:ab:30:b9:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

5d:5e:6f:ef:43:27:6e:5d:ca:47:a9:0f:80:5e:4b:66:a6:b4:9c:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

21338

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Threading\4.0.10.0\System.Threading.pdb

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netcore50/System.Threading.xml

SHA256 6b7cc2661cf1f1f1e49d8bc7229aa4caef41338260669b3b0ba9a4ec8859a18d
MD5 12ccef7836ca2af98a205614fd75a95a
SHA1 45d93f9005f49659c978d15066eca59dc0452f9f
SHA512 3ec5853057e976eb6d724119f913e502488ceb9ea75d287e76f7b5299a5ac4ad27d11080b2e57ead860b536497c6c9c90ec64947b924b6f073edd9b74b9243ab
SSDEEP 768:Y0QJSyeFcei0eK979em97vB+8MzBtcJyuQ0Pn0PtCeTLmA/7k/yzBWXzBtvYH3/0:meFcei0dImV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netcore50/de/System.Threading.xml

SHA256 1d18d895d7bd20a363b8c71ed3474db2eea2906e90d2b35ff3a13f4a3c9e86e8
MD5 fb5207bce1e64e7e8105a0a6fbb313d1
SHA1 a0cc3fdb3199d73d9f13f455ae150695fd49cba2
SHA512 7a07ad3622b2a622b480b5cf7aa8740f58ab7fc1a2032d8bbdfcda572ffb304b33d6df2f5650c7de650358954da0517b51a3ac6a04d40d7a1070ada7d0407067
SSDEEP 6144:rwUGr6pAY3AY3AYMKg01quAYGA3zgzgEgNg0jGgHgF4p4rWT/YrYMV9P/pMem:cr6pAY3AY3AYMKg01quAYGA3zgzgEgN5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netcore50/es/System.Threading.xml

SHA256 d9c0f7f29d5df8bc08680a2a526dbf8d57e74e5e58177f63673b21d70569febc
MD5 e618f9af7a2429beb449ca88a093d714
SHA1 7a68923b01cb1ca839430dff4262d22a2dd056e4
SHA512 8b7b66b33e933e362ffb83f149121a89575634d74f110c6b4410e70ae572a35e321a6ea64436403b1f80b6237bebd72ab24a165e6257c568d2d33a75eb2930b3
SSDEEP 1536:wQu83RfCLCw1wsRwsbLoLdLOdzqhPO8kKqWNVqBXzeHhaRXlgqkQDN2u2+SqxqGn:wQz+KHm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netcore50/fr/System.Threading.xml

SHA256 cb1adeb8e552c8d2a34c8bc14ac7d25bddc0ecb054546cfd0963205771019e7d
MD5 17a0684dd5ae5ac42fed3aada09e6c3a
SHA1 853918bb5e55d3f6c6fc5fe0562818a38751fb56
SHA512 6ef768da6977b0c0f76a7a088bee78d08363c66583340cefdd4d50a96be66ca4222142e6b2e62cc3a695a2360e4bad3d6d9f64b8ea61ba7c9e5127d2e9a0986d
SSDEEP 1536:O+NYIUmbUgAHu2DqpmdFH1kYieuQrdIbsE3QqT2:phf2Dq0i3QqC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netcore50/it/System.Threading.xml

SHA256 d71f7d8ceb8939481e93a506427267c470287eb3153dd3d6fedbed2cc94d9c10
MD5 eb988743aad63294dc618c42e86502b0
SHA1 83406f4fa5df56513fc3d8fe995ee984540fb582
SHA512 4a7ca6ea4acd0d70dc812d78e6a846dcfb5e615e696321a4f662a5a4a3f3e2f35249a6e487e7ba03b0e39e08c352a9358ec22d7560d354ebec75a4cebec840fd
SSDEEP 6144:kBPcHOYd0m1wG3UC3/HD93y83a6LHvLXs6V2N3b3IvmGcG8yaRbaRG7YB/1+v+3q:k
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netcore50/ja/System.Threading.xml

SHA256 64fe7b5ad865f386737b88b56e4ebe3b4a7ee493fbe3f403e90981d8cf43530b
MD5 437fd6ab9b693f944fb3695b674db017
SHA1 2d6b46721aaae1a13095fa00ef012d2f38b868e9
SHA512 39c08587b86a40715103073ca0cc61ebb498063ac87da049e3155444cfa49696cb381b3527b2b3cce7d7d43e0ef8153303ba565dcd99e1aaca71def684aa9070
SSDEEP 768:YGUpBPiTMMMlU5M6FDgoed/gcDOOcDndDjiVIXU0yU0OkrQ1HDeO/QMxl228MxOx:BU+IxlU5MCic8PBO/NE2BfDkP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netcore50/ko/System.Threading.xml

SHA256 89f7b5bbcc1d71f3ff9fb8ed0af066c6f007992936c73780cbffcc6b189f50c4
MD5 722b736cf5df0ca1c1fa1ee53bd01bb8
SHA1 375b5e1772ba14e12855f0847e98c29d3c58237e
SHA512 b0021521b409042452ce2cf97f78b7197a722f459456614fdea628565f2027b918a894b09688932777e1a0e1dffd3c24a17dc76c7b6429203ee3a62bbf71c480
SSDEEP 3072:ifpWEx9tFHExw33GdT9RtVbVqmB8iZYAUAdxKJKJrW5OFt4HTy6:ifp33D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netcore50/ru/System.Threading.xml

SHA256 42cc5e38f811469e4f7d11d64ca77a9550524410bb408595ab345eda7b267174
MD5 ee942d1d052bbd1013124fe0d48b0cc7
SHA1 b0d5eb881937599d0bdac6c211c3ef21d6103123
SHA512 3d6ecc4afea321ef0625b29ad73cc82d3a3e66dfbc1623813c0176b6fa01e05b110992e8425173f6923ad4dc0e2706130776caf3107cf938155e990d4258dca2
SSDEEP 6144:x9ZmQCMfCM0CMKCMWCMvCMWgGsKP+r3C4jCympHiCqDRWMghvAT2uZ4z:x9ZmQCMfCM0CMKCMWCMvCMWgGsKP+r34
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netcore50/zh-hans/System.Threading.xml

SHA256 d037823f729b263b83f4f5676e0297a266054ed3be9ab58880138028fc1ad9ba
MD5 2bda2ec60ac8a7e02ae7c451b542f6fe
SHA1 cfacf42f449db49633517ea7cce8bc683ff16421
SHA512 b651f06bae42739c84198fd9816897925dbdcf0d2f79a81f6f67dd3eff44d5bd271cd47f1e250f2c0c1fe4fa03e43ecc95e888adb086fdfb73dc51aec843f938
SSDEEP 1536:U8r33SD46RAykc9yN8o/B9/qHyccxlocdkpi4EsdbcF0j04:TLBej7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netcore50/zh-hant/System.Threading.xml

SHA256 1a4ca9e1303a09c72a9ef906a81daa225c6a3fc9ffcda40e41003c7b023677f0
MD5 4df6b3049ca1bdf2811d7aabef007caa
SHA1 faa236a7d49e07c08b926faf6a4457f613dde9ae
SHA512 a3210f78d6c75ce3715c6975867f505af7d53f0072e2e013c0350427942bc03dd450a3f515a54d756ba7c5e44cc457074faff9df5f0d0e907abdafd9fbeb8602
SSDEEP 3072:7dHjecaZ46vw27TZUwjMeh8YqwWdYZnphDVNRv3WhCxS5ro6YbEGZxQL:7dHjeoeh8YqwWdYZnphDVNRv3WhCxS59
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.0/System.Threading.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a12ccaf289ca3a5cecf2e8821eabab26f2913c3e09fee35da1a426182e980c6d
MD5 e47b9a68048b8a477e1b7754042c5984
SHA1 8127083b176f58dba27ad3cd6659a60217afbf95
SHA512 f8b3317a786b862b84ccfaecd177c174bbb5ec789e04bcf791e301fffc603e5b0598a038050907ca4c5e4d95a769cfcf488ced6d6975ac43a14ff02d5d3075cf
SSDEEP 384:4If4RzWWg5zHp3duHg3UXfBIkYKOjk0W2NW31ae00GftpBj/uODHRN78Qvl15n5:4HRqWg5zHp3dKvBnGJeasi1ZD8Qz15
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

12:31:49:cf:51:6f:76:32:df:27:57:fc:14:a1:f8:49:c7:23:9e:15:64:16:9e:75:60:be:70:98:c2:9b:55:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

49:14:9d:17:74:cc:c5:92:24:06:51:d0:49:e7:c5:52:dd:0f:01:14

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:159C-A3F7-2570,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:13:36:00:00:00:00:00:1a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2011 - Oct 25, 2012

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

22254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.0/System.Threading.xml

SHA256 6b7cc2661cf1f1f1e49d8bc7229aa4caef41338260669b3b0ba9a4ec8859a18d
MD5 12ccef7836ca2af98a205614fd75a95a
SHA1 45d93f9005f49659c978d15066eca59dc0452f9f
SHA512 3ec5853057e976eb6d724119f913e502488ceb9ea75d287e76f7b5299a5ac4ad27d11080b2e57ead860b536497c6c9c90ec64947b924b6f073edd9b74b9243ab
SSDEEP 768:Y0QJSyeFcei0eK979em97vB+8MzBtcJyuQ0Pn0PtCeTLmA/7k/yzBWXzBtvYH3/0:meFcei0dImV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.0/de/System.Threading.xml

SHA256 1d18d895d7bd20a363b8c71ed3474db2eea2906e90d2b35ff3a13f4a3c9e86e8
MD5 fb5207bce1e64e7e8105a0a6fbb313d1
SHA1 a0cc3fdb3199d73d9f13f455ae150695fd49cba2
SHA512 7a07ad3622b2a622b480b5cf7aa8740f58ab7fc1a2032d8bbdfcda572ffb304b33d6df2f5650c7de650358954da0517b51a3ac6a04d40d7a1070ada7d0407067
SSDEEP 6144:rwUGr6pAY3AY3AYMKg01quAYGA3zgzgEgNg0jGgHgF4p4rWT/YrYMV9P/pMem:cr6pAY3AY3AYMKg01quAYGA3zgzgEgN5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.0/es/System.Threading.xml

SHA256 d9c0f7f29d5df8bc08680a2a526dbf8d57e74e5e58177f63673b21d70569febc
MD5 e618f9af7a2429beb449ca88a093d714
SHA1 7a68923b01cb1ca839430dff4262d22a2dd056e4
SHA512 8b7b66b33e933e362ffb83f149121a89575634d74f110c6b4410e70ae572a35e321a6ea64436403b1f80b6237bebd72ab24a165e6257c568d2d33a75eb2930b3
SSDEEP 1536:wQu83RfCLCw1wsRwsbLoLdLOdzqhPO8kKqWNVqBXzeHhaRXlgqkQDN2u2+SqxqGn:wQz+KHm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.0/fr/System.Threading.xml

SHA256 cb1adeb8e552c8d2a34c8bc14ac7d25bddc0ecb054546cfd0963205771019e7d
MD5 17a0684dd5ae5ac42fed3aada09e6c3a
SHA1 853918bb5e55d3f6c6fc5fe0562818a38751fb56
SHA512 6ef768da6977b0c0f76a7a088bee78d08363c66583340cefdd4d50a96be66ca4222142e6b2e62cc3a695a2360e4bad3d6d9f64b8ea61ba7c9e5127d2e9a0986d
SSDEEP 1536:O+NYIUmbUgAHu2DqpmdFH1kYieuQrdIbsE3QqT2:phf2Dq0i3QqC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.0/it/System.Threading.xml

SHA256 d71f7d8ceb8939481e93a506427267c470287eb3153dd3d6fedbed2cc94d9c10
MD5 eb988743aad63294dc618c42e86502b0
SHA1 83406f4fa5df56513fc3d8fe995ee984540fb582
SHA512 4a7ca6ea4acd0d70dc812d78e6a846dcfb5e615e696321a4f662a5a4a3f3e2f35249a6e487e7ba03b0e39e08c352a9358ec22d7560d354ebec75a4cebec840fd
SSDEEP 6144:kBPcHOYd0m1wG3UC3/HD93y83a6LHvLXs6V2N3b3IvmGcG8yaRbaRG7YB/1+v+3q:k
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.0/ja/System.Threading.xml

SHA256 64fe7b5ad865f386737b88b56e4ebe3b4a7ee493fbe3f403e90981d8cf43530b
MD5 437fd6ab9b693f944fb3695b674db017
SHA1 2d6b46721aaae1a13095fa00ef012d2f38b868e9
SHA512 39c08587b86a40715103073ca0cc61ebb498063ac87da049e3155444cfa49696cb381b3527b2b3cce7d7d43e0ef8153303ba565dcd99e1aaca71def684aa9070
SSDEEP 768:YGUpBPiTMMMlU5M6FDgoed/gcDOOcDndDjiVIXU0yU0OkrQ1HDeO/QMxl228MxOx:BU+IxlU5MCic8PBO/NE2BfDkP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.0/ko/System.Threading.xml

SHA256 89f7b5bbcc1d71f3ff9fb8ed0af066c6f007992936c73780cbffcc6b189f50c4
MD5 722b736cf5df0ca1c1fa1ee53bd01bb8
SHA1 375b5e1772ba14e12855f0847e98c29d3c58237e
SHA512 b0021521b409042452ce2cf97f78b7197a722f459456614fdea628565f2027b918a894b09688932777e1a0e1dffd3c24a17dc76c7b6429203ee3a62bbf71c480
SSDEEP 3072:ifpWEx9tFHExw33GdT9RtVbVqmB8iZYAUAdxKJKJrW5OFt4HTy6:ifp33D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.0/ru/System.Threading.xml

SHA256 42cc5e38f811469e4f7d11d64ca77a9550524410bb408595ab345eda7b267174
MD5 ee942d1d052bbd1013124fe0d48b0cc7
SHA1 b0d5eb881937599d0bdac6c211c3ef21d6103123
SHA512 3d6ecc4afea321ef0625b29ad73cc82d3a3e66dfbc1623813c0176b6fa01e05b110992e8425173f6923ad4dc0e2706130776caf3107cf938155e990d4258dca2
SSDEEP 6144:x9ZmQCMfCM0CMKCMWCMvCMWgGsKP+r3C4jCympHiCqDRWMghvAT2uZ4z:x9ZmQCMfCM0CMKCMWCMvCMWgGsKP+r34
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.0/zh-hans/System.Threading.xml

SHA256 d037823f729b263b83f4f5676e0297a266054ed3be9ab58880138028fc1ad9ba
MD5 2bda2ec60ac8a7e02ae7c451b542f6fe
SHA1 cfacf42f449db49633517ea7cce8bc683ff16421
SHA512 b651f06bae42739c84198fd9816897925dbdcf0d2f79a81f6f67dd3eff44d5bd271cd47f1e250f2c0c1fe4fa03e43ecc95e888adb086fdfb73dc51aec843f938
SSDEEP 1536:U8r33SD46RAykc9yN8o/B9/qHyccxlocdkpi4EsdbcF0j04:TLBej7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.0/zh-hant/System.Threading.xml

SHA256 1a4ca9e1303a09c72a9ef906a81daa225c6a3fc9ffcda40e41003c7b023677f0
MD5 4df6b3049ca1bdf2811d7aabef007caa
SHA1 faa236a7d49e07c08b926faf6a4457f613dde9ae
SHA512 a3210f78d6c75ce3715c6975867f505af7d53f0072e2e013c0350427942bc03dd450a3f515a54d756ba7c5e44cc457074faff9df5f0d0e907abdafd9fbeb8602
SSDEEP 3072:7dHjecaZ46vw27TZUwjMeh8YqwWdYZnphDVNRv3WhCxS5ro6YbEGZxQL:7dHjeoeh8YqwWdYZnphDVNRv3WhCxS59
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.3/System.Threading.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 68f0142c192545e1d038045a9585d0a16e02b3ad49efbfe4835bd8c7712f3dd5
MD5 b937795577f5d41e805efe00dc87ec6e
SHA1 e387a7fa4c73635a435ad3b29660a8f1ca2c4e90
SHA512 7db22d03c6fa0479b39269de77ca84eb7905a933bf6159810e976c5dc6c47a18f495bb46d9ef56be21c721da271bd8b5f130e4fa26e1e298ba4273daa65ad281
SSDEEP 384:Lq7ajQzrI7YVF1NqDMvuOqTW9XE7uiA4lKWMNWdMIA0GftpBjf9ERHRN7BlgsCu:aY0uyuEXvqiTEBUo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

36:fa:36:07:61:4e:a8:ce:f2:93:b0:cb:58:b7:f9:db:29:e4:f5:ca:97:82:5d:1a:9f:43:1a:f8:ab:30:b9:da

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

5d:5e:6f:ef:43:27:6e:5d:ca:47:a9:0f:80:5e:4b:66:a6:b4:9c:78

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9c:ee:fe:14:55:a9:5d:35:50:00:00:00:00:00:9c

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

21338

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Threading\4.0.10.0\System.Threading.pdb

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.3/System.Threading.xml

SHA256 6b7cc2661cf1f1f1e49d8bc7229aa4caef41338260669b3b0ba9a4ec8859a18d
MD5 12ccef7836ca2af98a205614fd75a95a
SHA1 45d93f9005f49659c978d15066eca59dc0452f9f
SHA512 3ec5853057e976eb6d724119f913e502488ceb9ea75d287e76f7b5299a5ac4ad27d11080b2e57ead860b536497c6c9c90ec64947b924b6f073edd9b74b9243ab
SSDEEP 768:Y0QJSyeFcei0eK979em97vB+8MzBtcJyuQ0Pn0PtCeTLmA/7k/yzBWXzBtvYH3/0:meFcei0dImV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.3/de/System.Threading.xml

SHA256 1d18d895d7bd20a363b8c71ed3474db2eea2906e90d2b35ff3a13f4a3c9e86e8
MD5 fb5207bce1e64e7e8105a0a6fbb313d1
SHA1 a0cc3fdb3199d73d9f13f455ae150695fd49cba2
SHA512 7a07ad3622b2a622b480b5cf7aa8740f58ab7fc1a2032d8bbdfcda572ffb304b33d6df2f5650c7de650358954da0517b51a3ac6a04d40d7a1070ada7d0407067
SSDEEP 6144:rwUGr6pAY3AY3AYMKg01quAYGA3zgzgEgNg0jGgHgF4p4rWT/YrYMV9P/pMem:cr6pAY3AY3AYMKg01quAYGA3zgzgEgN5
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.3/es/System.Threading.xml

SHA256 d9c0f7f29d5df8bc08680a2a526dbf8d57e74e5e58177f63673b21d70569febc
MD5 e618f9af7a2429beb449ca88a093d714
SHA1 7a68923b01cb1ca839430dff4262d22a2dd056e4
SHA512 8b7b66b33e933e362ffb83f149121a89575634d74f110c6b4410e70ae572a35e321a6ea64436403b1f80b6237bebd72ab24a165e6257c568d2d33a75eb2930b3
SSDEEP 1536:wQu83RfCLCw1wsRwsbLoLdLOdzqhPO8kKqWNVqBXzeHhaRXlgqkQDN2u2+SqxqGn:wQz+KHm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.3/fr/System.Threading.xml

SHA256 cb1adeb8e552c8d2a34c8bc14ac7d25bddc0ecb054546cfd0963205771019e7d
MD5 17a0684dd5ae5ac42fed3aada09e6c3a
SHA1 853918bb5e55d3f6c6fc5fe0562818a38751fb56
SHA512 6ef768da6977b0c0f76a7a088bee78d08363c66583340cefdd4d50a96be66ca4222142e6b2e62cc3a695a2360e4bad3d6d9f64b8ea61ba7c9e5127d2e9a0986d
SSDEEP 1536:O+NYIUmbUgAHu2DqpmdFH1kYieuQrdIbsE3QqT2:phf2Dq0i3QqC
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.3/it/System.Threading.xml

SHA256 d71f7d8ceb8939481e93a506427267c470287eb3153dd3d6fedbed2cc94d9c10
MD5 eb988743aad63294dc618c42e86502b0
SHA1 83406f4fa5df56513fc3d8fe995ee984540fb582
SHA512 4a7ca6ea4acd0d70dc812d78e6a846dcfb5e615e696321a4f662a5a4a3f3e2f35249a6e487e7ba03b0e39e08c352a9358ec22d7560d354ebec75a4cebec840fd
SSDEEP 6144:kBPcHOYd0m1wG3UC3/HD93y83a6LHvLXs6V2N3b3IvmGcG8yaRbaRG7YB/1+v+3q:k
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.3/ja/System.Threading.xml

SHA256 64fe7b5ad865f386737b88b56e4ebe3b4a7ee493fbe3f403e90981d8cf43530b
MD5 437fd6ab9b693f944fb3695b674db017
SHA1 2d6b46721aaae1a13095fa00ef012d2f38b868e9
SHA512 39c08587b86a40715103073ca0cc61ebb498063ac87da049e3155444cfa49696cb381b3527b2b3cce7d7d43e0ef8153303ba565dcd99e1aaca71def684aa9070
SSDEEP 768:YGUpBPiTMMMlU5M6FDgoed/gcDOOcDndDjiVIXU0yU0OkrQ1HDeO/QMxl228MxOx:BU+IxlU5MCic8PBO/NE2BfDkP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.3/ko/System.Threading.xml

SHA256 89f7b5bbcc1d71f3ff9fb8ed0af066c6f007992936c73780cbffcc6b189f50c4
MD5 722b736cf5df0ca1c1fa1ee53bd01bb8
SHA1 375b5e1772ba14e12855f0847e98c29d3c58237e
SHA512 b0021521b409042452ce2cf97f78b7197a722f459456614fdea628565f2027b918a894b09688932777e1a0e1dffd3c24a17dc76c7b6429203ee3a62bbf71c480
SSDEEP 3072:ifpWEx9tFHExw33GdT9RtVbVqmB8iZYAUAdxKJKJrW5OFt4HTy6:ifp33D
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.3/ru/System.Threading.xml

SHA256 42cc5e38f811469e4f7d11d64ca77a9550524410bb408595ab345eda7b267174
MD5 ee942d1d052bbd1013124fe0d48b0cc7
SHA1 b0d5eb881937599d0bdac6c211c3ef21d6103123
SHA512 3d6ecc4afea321ef0625b29ad73cc82d3a3e66dfbc1623813c0176b6fa01e05b110992e8425173f6923ad4dc0e2706130776caf3107cf938155e990d4258dca2
SSDEEP 6144:x9ZmQCMfCM0CMKCMWCMvCMWgGsKP+r3C4jCympHiCqDRWMghvAT2uZ4z:x9ZmQCMfCM0CMKCMWCMvCMWgGsKP+r34
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.3/zh-hans/System.Threading.xml

SHA256 d037823f729b263b83f4f5676e0297a266054ed3be9ab58880138028fc1ad9ba
MD5 2bda2ec60ac8a7e02ae7c451b542f6fe
SHA1 cfacf42f449db49633517ea7cce8bc683ff16421
SHA512 b651f06bae42739c84198fd9816897925dbdcf0d2f79a81f6f67dd3eff44d5bd271cd47f1e250f2c0c1fe4fa03e43ecc95e888adb086fdfb73dc51aec843f938
SSDEEP 1536:U8r33SD46RAykc9yN8o/B9/qHyccxlocdkpi4EsdbcF0j04:TLBej7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/ref/netstandard1.3/zh-hant/System.Threading.xml

SHA256 1a4ca9e1303a09c72a9ef906a81daa225c6a3fc9ffcda40e41003c7b023677f0
MD5 4df6b3049ca1bdf2811d7aabef007caa
SHA1 faa236a7d49e07c08b926faf6a4457f613dde9ae
SHA512 a3210f78d6c75ce3715c6975867f505af7d53f0072e2e013c0350427942bc03dd450a3f515a54d756ba7c5e44cc457074faff9df5f0d0e907abdafd9fbeb8602
SSDEEP 3072:7dHjecaZ46vw27TZUwjMeh8YqwWdYZnphDVNRv3WhCxS5ro6YbEGZxQL:7dHjeoeh8YqwWdYZnphDVNRv3WhCxS59
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.4.3.0/runtimes/aot/lib/netcore50/System.Threading.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e76a3094f0acde4890ee61ea9ed7a605e06f4d7382545c2318e76eb7a91de27f
MD5 c34e222fe47fbdf1033e566eee4b8ee6
SHA1 9c07e2eb35b9fc5ceafe3e4823415aaef4fec99d
SHA512 c23283e1975f29789dd1b6750d7a34ae415ff02003f025b870b748ce17577e047258b8a0129efc7135ade3cd49f8c34756b5b66a0bbf1bf3233fdf850b94dc93
SSDEEP 384:IKLxW4WFseuWUNWPWXNWJvT1Nq0GftpBjhqPERHRN7EldBopPI:I2jx81vicEBwoq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

61:2b:55:e0:39:a3:30:61:6b:19:77:97:b8:f2:30:1b:15:4f:63:22:fc:88:4d:f4:da:ce:57:20:65:03:9c:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

62:82:db:71:f9:52:b7:35:5c:26:c3:c1:28:27:70:bc:47:9f:af:60

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Threading/netcore50aot\System.Threading.pdb

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/.signature.p7s

SHA256 2af2f4d96e0f6e56baa50d477b16ed0120bd58071a16462349f91129327c2638
MD5 e2b9779cfcf48149301c855c8e36494d
SHA1 5b8f4ea1d1249291d385a902fe400d7b9f4bf21a
SHA512 4738c5c3618b5d2bee2d62534015f3b77306dfff9fb7db45699b97bb5a2557e38bb487332f0d24bf8410ec589dbbbb598c4020959fb5b534b1b479ab08a349c8
SSDEEP 192:3di7x0KDWpHhXZCVzV07VrXE8pLGDH0JOqsmVgz28WhBqzk:NovDGGVpYE8lGoJN77hhak
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/System.Threading.Tasks.4.3.0.nupkg

SHA256 679ad77c9d445e9dc6df620a646899ea4a0c8d1bb49fc0b5346af0a5d21e9f8c
MD5 222568210533bf57d3112abcfbcdcbe9
SHA1 b467be2f9c92017fef3a6b98fed3bc65ddbb7c72
SHA512 7d488ff82cb20a3b3cef6380f2dae5ea9f7baa66bf75ad711aade1e3301b25993ccf2694e33c847ea5b9bdb90ff34c46fcd8a6ba7d6f95605ba0c124ed7c5d13
SSDEEP 24576:worbMSyeIiveCoYNHD6lUyeIhbpveCHbNy4yeIZEw:nzIiv1oKHtIh1v1H9IZZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netcore50/System.Threading.Tasks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c813264af7c94974ebab5db138c29b66e76d9d10176f712a2cb910c5adbfdafa
MD5 6d3a830500e673a68d8fc767bb4cd178
SHA1 5b68b4c12a262d524cb3fdddeacf5bb53bf02a1c
SHA512 4f34e3e5df8c2a2ad8e00d8b157c1a1b7c44cce711dc25b1baf5ee69e6cd5ef8dadd46177b034728879908c76d8c52aebcba138b608666859fadae2461293b2a
SSDEEP 384:zoDL1FL1jiUIgVbT6TSaMXLPfQhjrQyqB46gyHN3SWsMlGIKFsn6xrR+n8hS0TBh:zofhU4b8vQy046RsvpuL6dikQXEB/r
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

af:00:2f:94:f6:bc:11:93:04:ba:16:5d:35:3a:58:41:f1:88:15:8e:a7:bc:48:3c:bf:0a:f9:34:1e:dc:45:2b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

c0:1f:19:f2:37:5f:6b:65:8f:6a:78:bc:85:72:5b:05:a8:c8:e7:52

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

32582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Threading.Tasks\4.0.10.0\System.Threading.Tasks.pdb

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netcore50/System.Threading.Tasks.xml

SHA256 d4ba72db859e3576f072f5912f0efa893b6405f97fcfb64676a35718a2c46897
MD5 ba523fb67ccd3b7fb38b5c695ec90cc6
SHA1 81ed4ad019118fd24ee1e24a65c35c0afda24133
SHA512 61e7760bc5d322815f76f242915a8b2cf3a7f9d6622a2c2a5fc03afa579d48ca85c89a2dd81f288bda0f7926fdae74027972d26cfdc24bca60030dafb558e277
SSDEEP 3072:u5xCPwF15HInyH/BY3DeHUSgmQxBMQ7UaZj7C4OzAHGemg19:uDsuEHGemgn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netcore50/de/System.Threading.Tasks.xml

SHA256 d7c8bdb12d0c7ae70d5984ece354f4954d5f6023e314dd61aa1b50b434c473c3
MD5 40d0c9ae96bdae03225b9dce91c495db
SHA1 304f6a628d1fcf2b17abf9b2a715292c53682485
SHA512 66080c2eb0e3363bcdce518e57d41d156536c456ade1b35cfd78eec096333ecf2cdf64db81b67cb3941773cec002922dd31967d65837c3ba77b3ded0f9a685a5
SSDEEP 3072:FoPtMErHvHaHYyoGQtmZShqw891ZZDdwAE16PWx8x39Pha8sQ635B8aouFXktQZT:FoPg6saC635D9ktQaC41e3Yi8C
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netcore50/es/System.Threading.Tasks.xml

SHA256 5215b494036447d39b6718f3d9402215e0a83d4afe0c194393a4bc4409ca5560
MD5 270b67e5dba293fcf16741d818f2efbd
SHA1 663c992a06d612492793231499d0fc91ef7baede
SHA512 b07db84947cbda02d5710abcbece3f12f04859b577a22add52341dd13d1c5c10bddcb287474ac99e45a2c311a202b9460473d2b5984d1768f9031391008f1e6b
SSDEEP 3072:wqj4sWn1TYLH1gFSyGAXsV5VrNjbBbxq7pM/qqHt:wqjU7pM/qqHt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netcore50/fr/System.Threading.Tasks.xml

SHA256 0689d619ae0c25b8131bfcb84a67770e2d1dc88c1f447c291061104b58225fca
MD5 8aac0474a14b367198a00967f0ba1305
SHA1 f3b02c9b374dcd5c420e114263a0bb0629a0b62b
SHA512 6a83b637aaf763d816e99c87b035fd99294211cbce8433080c9ccfa967abf916c252f9a40177fc01838ac61ad7ddf1f490c2377d2505eb2c77148fcd5c43d48c
SSDEEP 3072:+P6Y849fF8GYxICLFb6RxgLLacCX9WJfz1efHKjwb+dUSgPv5ufnLOnZ2+dZ6zJ:+P6FEb5ufnaZ2+dZ69
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netcore50/it/System.Threading.Tasks.xml

SHA256 612d97af7ae68afd40e03526c88c80ed8ebf274be6915eef6e3ec18dc74791ab
MD5 240314ac57329b1ce53152926ec9e064
SHA1 1a0042a8e461f55314fb7680a17d7da7b4036bb8
SHA512 c870f220f8b50691c9c7024144eeb71a074c42f493ef97cfb247559ce1c42a4eadbcba3ee20a755473dbf5597ec05dd5e8314363e445b320a87f45b8a551ce0d
SSDEEP 6144:pRIwknewYFCKC6C9CihVp2A8OPuCB6yDiPI2CA7Jcx3Q3B3fIMpBE7oj/wLdoeo0:jBS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netcore50/ja/System.Threading.Tasks.xml

SHA256 f456990a2fdf1cd651a761949c31bd035fd0dd920394367ea47fba7eb53b7b11
MD5 4af07feb873989391e0178f98421cd05
SHA1 32885fd67131d9379ff30bac1b2e8da74874f45f
SHA512 23b1be93a1ed63ccb82f9fe575e264a85648c8750ed2ebdff6f373da96255f7847cfe8b5ce36263c1a65da7d9ce2911ffe6948b731289857cdab860174a31dc8
SSDEEP 3072:NLMAyOxR08u3Lw4LDF4YRmmNM4rXKD9bwNnlikv9rEiyJ:NLMfrv9rEis
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netcore50/ko/System.Threading.Tasks.xml

SHA256 d29224b3224a4748dfc36cb495782bf05b2153cbb9b6c99a3d21b15d4ab6b882
MD5 73b5b999e22f2830cdbc1b431346f982
SHA1 ca0faca531864f32eecd579cd01d860d71592245
SHA512 0920bb27e391d4b8537dfd0cc2a9b8c09683c18d57fbab45ecbf0be8efb1831a50fb37c5020a0c22694a8e8ddf6299a05e0137846be4f0f4bb8071d0b987b3f5
SSDEEP 6144:dWHFm2+mFUmYGVz0l/1SXxmAd8xSQlTXD98LMqYIBJFYMCMhlbJrHpiJ:dWtBMIBQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netcore50/ru/System.Threading.Tasks.xml

SHA256 413e44b8b4096cd36f72b852de0ffe91ffb79493b33a3ce35288502c371e6ebe
MD5 dd3b5e0d0e704c45179dea2d50a786b1
SHA1 a239abcd47335eb8f253a78dfd800d6513463850
SHA512 95cc6133a8a988b28c32f9a4f188ab4a567faba749c6f6d5b9bfb5b835cff497173e0787098e2bf6e6e26d70173e365067273d322b0ed014e7e08e7670499b93
SSDEEP 3072:FdZktZnZ+n4SY1eSlLSxN7JJN5mMkfjrXQsxXSpIYWGnY7sZ5W1adaFd0tU81P:FdZoSp/Y7sZ5W1adaFd0tUwP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netcore50/zh-hans/System.Threading.Tasks.xml

SHA256 c1fdececd31eefcc55df144d3ac45d1f9ce23ba7449243aa9bb587368a366d36
MD5 f0a9486ed16266b410e6ec2ad6ffada8
SHA1 0b899db637b9e1541d1b07a40ae1e5e00cdf8c70
SHA512 72c5131041f2b017e2a3392dea0d3b4f482af51876a6c0f359060dc37163357f17e3308b24bfcf521932107ddab70a28998310a9143f7b170e2b2d69e3a157e1
SSDEEP 3072:uQs1VNsBTrdrGpgjNLRspsg65kiGMeRgIMDmzD2Q0lvAuWI2eUxvDrE22E1VHfIi:Fs1I96LHxd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netcore50/zh-hant/System.Threading.Tasks.xml

SHA256 1af340fcbec865ed511adfd833b54698b81ada4958e70c1554d74aaf30fb937f
MD5 99c539c0efd2f9b92019f6a2b103c898
SHA1 44f0dfae1e16cfbf00ff778f50485b3e8b5c4bf2
SHA512 a67f974bd6e84225ad10881fbbb18fa6d52b863d0380a7973f08a786f58c4b0b18a852d08067426ae319a926552b3edff876203f7b1d9ba067f4aa86214bb057
SSDEEP 3072:B7L2mpvrx6KrhY9/ile+ScctiybQ+IB8Sog5sLvJJOliwaS3naDsyad73l:B7LZkvJJOlikl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.0/System.Threading.Tasks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8b97c1294614b625f22a95abf0dd757ebd06dbde3bc60221a28043ead6b1fe3d
MD5 8706b39bdc035366f38957c286dea5e8
SHA1 5026ad149c082a8a8a6fe466d8c06a90514e3cb7
SHA512 7d52790f4388db4aadf510d410d189ab2d66e807b499094e09d5a028daaec1b100dc661eb37b9a5c96c9cff1237785b3d46751e14d74fdc9b704b079e2fe7acb
SSDEEP 768:hc42sjdeXPMLYF33tqphXW0x3FsRlEefVNBVlDd8tBt+uEpXkiLDhhBjS:PTjdeXPMLYF33tqphXW0x3FsRlEefVNS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a8:7e:fc:ba:93:b0:57:b0:12:9c:a3:2c:c1:21:02:50:9f:e1:eb:3c:f7:ff:23:b5:60:6a:7c:38:90:70:57:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

c1:05:2c:29:5f:23:ce:47:11:d1:3d:c4:0a:5c:d5:0c:42:20:51:fd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:02:92:4a:00:00:00:00:00:20

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 9, 2012 - Apr 9, 2013

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

33886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.0/System.Threading.Tasks.xml

SHA256 d4ba72db859e3576f072f5912f0efa893b6405f97fcfb64676a35718a2c46897
MD5 ba523fb67ccd3b7fb38b5c695ec90cc6
SHA1 81ed4ad019118fd24ee1e24a65c35c0afda24133
SHA512 61e7760bc5d322815f76f242915a8b2cf3a7f9d6622a2c2a5fc03afa579d48ca85c89a2dd81f288bda0f7926fdae74027972d26cfdc24bca60030dafb558e277
SSDEEP 3072:u5xCPwF15HInyH/BY3DeHUSgmQxBMQ7UaZj7C4OzAHGemg19:uDsuEHGemgn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.0/de/System.Threading.Tasks.xml

SHA256 d7c8bdb12d0c7ae70d5984ece354f4954d5f6023e314dd61aa1b50b434c473c3
MD5 40d0c9ae96bdae03225b9dce91c495db
SHA1 304f6a628d1fcf2b17abf9b2a715292c53682485
SHA512 66080c2eb0e3363bcdce518e57d41d156536c456ade1b35cfd78eec096333ecf2cdf64db81b67cb3941773cec002922dd31967d65837c3ba77b3ded0f9a685a5
SSDEEP 3072:FoPtMErHvHaHYyoGQtmZShqw891ZZDdwAE16PWx8x39Pha8sQ635B8aouFXktQZT:FoPg6saC635D9ktQaC41e3Yi8C
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.0/es/System.Threading.Tasks.xml

SHA256 5215b494036447d39b6718f3d9402215e0a83d4afe0c194393a4bc4409ca5560
MD5 270b67e5dba293fcf16741d818f2efbd
SHA1 663c992a06d612492793231499d0fc91ef7baede
SHA512 b07db84947cbda02d5710abcbece3f12f04859b577a22add52341dd13d1c5c10bddcb287474ac99e45a2c311a202b9460473d2b5984d1768f9031391008f1e6b
SSDEEP 3072:wqj4sWn1TYLH1gFSyGAXsV5VrNjbBbxq7pM/qqHt:wqjU7pM/qqHt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.0/fr/System.Threading.Tasks.xml

SHA256 0689d619ae0c25b8131bfcb84a67770e2d1dc88c1f447c291061104b58225fca
MD5 8aac0474a14b367198a00967f0ba1305
SHA1 f3b02c9b374dcd5c420e114263a0bb0629a0b62b
SHA512 6a83b637aaf763d816e99c87b035fd99294211cbce8433080c9ccfa967abf916c252f9a40177fc01838ac61ad7ddf1f490c2377d2505eb2c77148fcd5c43d48c
SSDEEP 3072:+P6Y849fF8GYxICLFb6RxgLLacCX9WJfz1efHKjwb+dUSgPv5ufnLOnZ2+dZ6zJ:+P6FEb5ufnaZ2+dZ69
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.0/it/System.Threading.Tasks.xml

SHA256 612d97af7ae68afd40e03526c88c80ed8ebf274be6915eef6e3ec18dc74791ab
MD5 240314ac57329b1ce53152926ec9e064
SHA1 1a0042a8e461f55314fb7680a17d7da7b4036bb8
SHA512 c870f220f8b50691c9c7024144eeb71a074c42f493ef97cfb247559ce1c42a4eadbcba3ee20a755473dbf5597ec05dd5e8314363e445b320a87f45b8a551ce0d
SSDEEP 6144:pRIwknewYFCKC6C9CihVp2A8OPuCB6yDiPI2CA7Jcx3Q3B3fIMpBE7oj/wLdoeo0:jBS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.0/ja/System.Threading.Tasks.xml

SHA256 f456990a2fdf1cd651a761949c31bd035fd0dd920394367ea47fba7eb53b7b11
MD5 4af07feb873989391e0178f98421cd05
SHA1 32885fd67131d9379ff30bac1b2e8da74874f45f
SHA512 23b1be93a1ed63ccb82f9fe575e264a85648c8750ed2ebdff6f373da96255f7847cfe8b5ce36263c1a65da7d9ce2911ffe6948b731289857cdab860174a31dc8
SSDEEP 3072:NLMAyOxR08u3Lw4LDF4YRmmNM4rXKD9bwNnlikv9rEiyJ:NLMfrv9rEis
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.0/ko/System.Threading.Tasks.xml

SHA256 d29224b3224a4748dfc36cb495782bf05b2153cbb9b6c99a3d21b15d4ab6b882
MD5 73b5b999e22f2830cdbc1b431346f982
SHA1 ca0faca531864f32eecd579cd01d860d71592245
SHA512 0920bb27e391d4b8537dfd0cc2a9b8c09683c18d57fbab45ecbf0be8efb1831a50fb37c5020a0c22694a8e8ddf6299a05e0137846be4f0f4bb8071d0b987b3f5
SSDEEP 6144:dWHFm2+mFUmYGVz0l/1SXxmAd8xSQlTXD98LMqYIBJFYMCMhlbJrHpiJ:dWtBMIBQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.0/ru/System.Threading.Tasks.xml

SHA256 413e44b8b4096cd36f72b852de0ffe91ffb79493b33a3ce35288502c371e6ebe
MD5 dd3b5e0d0e704c45179dea2d50a786b1
SHA1 a239abcd47335eb8f253a78dfd800d6513463850
SHA512 95cc6133a8a988b28c32f9a4f188ab4a567faba749c6f6d5b9bfb5b835cff497173e0787098e2bf6e6e26d70173e365067273d322b0ed014e7e08e7670499b93
SSDEEP 3072:FdZktZnZ+n4SY1eSlLSxN7JJN5mMkfjrXQsxXSpIYWGnY7sZ5W1adaFd0tU81P:FdZoSp/Y7sZ5W1adaFd0tUwP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.0/zh-hans/System.Threading.Tasks.xml

SHA256 c1fdececd31eefcc55df144d3ac45d1f9ce23ba7449243aa9bb587368a366d36
MD5 f0a9486ed16266b410e6ec2ad6ffada8
SHA1 0b899db637b9e1541d1b07a40ae1e5e00cdf8c70
SHA512 72c5131041f2b017e2a3392dea0d3b4f482af51876a6c0f359060dc37163357f17e3308b24bfcf521932107ddab70a28998310a9143f7b170e2b2d69e3a157e1
SSDEEP 3072:uQs1VNsBTrdrGpgjNLRspsg65kiGMeRgIMDmzD2Q0lvAuWI2eUxvDrE22E1VHfIi:Fs1I96LHxd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.0/zh-hant/System.Threading.Tasks.xml

SHA256 1af340fcbec865ed511adfd833b54698b81ada4958e70c1554d74aaf30fb937f
MD5 99c539c0efd2f9b92019f6a2b103c898
SHA1 44f0dfae1e16cfbf00ff778f50485b3e8b5c4bf2
SHA512 a67f974bd6e84225ad10881fbbb18fa6d52b863d0380a7973f08a786f58c4b0b18a852d08067426ae319a926552b3edff876203f7b1d9ba067f4aa86214bb057
SSDEEP 3072:B7L2mpvrx6KrhY9/ile+ScctiybQ+IB8Sog5sLvJJOliwaS3naDsyad73l:B7LZkvJJOlikl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.3/System.Threading.Tasks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c813264af7c94974ebab5db138c29b66e76d9d10176f712a2cb910c5adbfdafa
MD5 6d3a830500e673a68d8fc767bb4cd178
SHA1 5b68b4c12a262d524cb3fdddeacf5bb53bf02a1c
SHA512 4f34e3e5df8c2a2ad8e00d8b157c1a1b7c44cce711dc25b1baf5ee69e6cd5ef8dadd46177b034728879908c76d8c52aebcba138b608666859fadae2461293b2a
SSDEEP 384:zoDL1FL1jiUIgVbT6TSaMXLPfQhjrQyqB46gyHN3SWsMlGIKFsn6xrR+n8hS0TBh:zofhU4b8vQy046RsvpuL6dikQXEB/r
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

af:00:2f:94:f6:bc:11:93:04:ba:16:5d:35:3a:58:41:f1:88:15:8e:a7:bc:48:3c:bf:0a:f9:34:1e:dc:45:2b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

c0:1f:19:f2:37:5f:6b:65:8f:6a:78:bc:85:72:5b:05:a8:c8:e7:52

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:98FD-C61E-E641,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:99:aa:c5:81:9f:8c:a2:7d:8a:00:00:00:00:00:99

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

32582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Threading.Tasks\4.0.10.0\System.Threading.Tasks.pdb

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.3/System.Threading.Tasks.xml

SHA256 d4ba72db859e3576f072f5912f0efa893b6405f97fcfb64676a35718a2c46897
MD5 ba523fb67ccd3b7fb38b5c695ec90cc6
SHA1 81ed4ad019118fd24ee1e24a65c35c0afda24133
SHA512 61e7760bc5d322815f76f242915a8b2cf3a7f9d6622a2c2a5fc03afa579d48ca85c89a2dd81f288bda0f7926fdae74027972d26cfdc24bca60030dafb558e277
SSDEEP 3072:u5xCPwF15HInyH/BY3DeHUSgmQxBMQ7UaZj7C4OzAHGemg19:uDsuEHGemgn
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.3/de/System.Threading.Tasks.xml

SHA256 d7c8bdb12d0c7ae70d5984ece354f4954d5f6023e314dd61aa1b50b434c473c3
MD5 40d0c9ae96bdae03225b9dce91c495db
SHA1 304f6a628d1fcf2b17abf9b2a715292c53682485
SHA512 66080c2eb0e3363bcdce518e57d41d156536c456ade1b35cfd78eec096333ecf2cdf64db81b67cb3941773cec002922dd31967d65837c3ba77b3ded0f9a685a5
SSDEEP 3072:FoPtMErHvHaHYyoGQtmZShqw891ZZDdwAE16PWx8x39Pha8sQ635B8aouFXktQZT:FoPg6saC635D9ktQaC41e3Yi8C
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.3/es/System.Threading.Tasks.xml

SHA256 5215b494036447d39b6718f3d9402215e0a83d4afe0c194393a4bc4409ca5560
MD5 270b67e5dba293fcf16741d818f2efbd
SHA1 663c992a06d612492793231499d0fc91ef7baede
SHA512 b07db84947cbda02d5710abcbece3f12f04859b577a22add52341dd13d1c5c10bddcb287474ac99e45a2c311a202b9460473d2b5984d1768f9031391008f1e6b
SSDEEP 3072:wqj4sWn1TYLH1gFSyGAXsV5VrNjbBbxq7pM/qqHt:wqjU7pM/qqHt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.3/fr/System.Threading.Tasks.xml

SHA256 0689d619ae0c25b8131bfcb84a67770e2d1dc88c1f447c291061104b58225fca
MD5 8aac0474a14b367198a00967f0ba1305
SHA1 f3b02c9b374dcd5c420e114263a0bb0629a0b62b
SHA512 6a83b637aaf763d816e99c87b035fd99294211cbce8433080c9ccfa967abf916c252f9a40177fc01838ac61ad7ddf1f490c2377d2505eb2c77148fcd5c43d48c
SSDEEP 3072:+P6Y849fF8GYxICLFb6RxgLLacCX9WJfz1efHKjwb+dUSgPv5ufnLOnZ2+dZ6zJ:+P6FEb5ufnaZ2+dZ69
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.3/it/System.Threading.Tasks.xml

SHA256 612d97af7ae68afd40e03526c88c80ed8ebf274be6915eef6e3ec18dc74791ab
MD5 240314ac57329b1ce53152926ec9e064
SHA1 1a0042a8e461f55314fb7680a17d7da7b4036bb8
SHA512 c870f220f8b50691c9c7024144eeb71a074c42f493ef97cfb247559ce1c42a4eadbcba3ee20a755473dbf5597ec05dd5e8314363e445b320a87f45b8a551ce0d
SSDEEP 6144:pRIwknewYFCKC6C9CihVp2A8OPuCB6yDiPI2CA7Jcx3Q3B3fIMpBE7oj/wLdoeo0:jBS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.3/ja/System.Threading.Tasks.xml

SHA256 f456990a2fdf1cd651a761949c31bd035fd0dd920394367ea47fba7eb53b7b11
MD5 4af07feb873989391e0178f98421cd05
SHA1 32885fd67131d9379ff30bac1b2e8da74874f45f
SHA512 23b1be93a1ed63ccb82f9fe575e264a85648c8750ed2ebdff6f373da96255f7847cfe8b5ce36263c1a65da7d9ce2911ffe6948b731289857cdab860174a31dc8
SSDEEP 3072:NLMAyOxR08u3Lw4LDF4YRmmNM4rXKD9bwNnlikv9rEiyJ:NLMfrv9rEis
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.3/ko/System.Threading.Tasks.xml

SHA256 d29224b3224a4748dfc36cb495782bf05b2153cbb9b6c99a3d21b15d4ab6b882
MD5 73b5b999e22f2830cdbc1b431346f982
SHA1 ca0faca531864f32eecd579cd01d860d71592245
SHA512 0920bb27e391d4b8537dfd0cc2a9b8c09683c18d57fbab45ecbf0be8efb1831a50fb37c5020a0c22694a8e8ddf6299a05e0137846be4f0f4bb8071d0b987b3f5
SSDEEP 6144:dWHFm2+mFUmYGVz0l/1SXxmAd8xSQlTXD98LMqYIBJFYMCMhlbJrHpiJ:dWtBMIBQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.3/ru/System.Threading.Tasks.xml

SHA256 413e44b8b4096cd36f72b852de0ffe91ffb79493b33a3ce35288502c371e6ebe
MD5 dd3b5e0d0e704c45179dea2d50a786b1
SHA1 a239abcd47335eb8f253a78dfd800d6513463850
SHA512 95cc6133a8a988b28c32f9a4f188ab4a567faba749c6f6d5b9bfb5b835cff497173e0787098e2bf6e6e26d70173e365067273d322b0ed014e7e08e7670499b93
SSDEEP 3072:FdZktZnZ+n4SY1eSlLSxN7JJN5mMkfjrXQsxXSpIYWGnY7sZ5W1adaFd0tU81P:FdZoSp/Y7sZ5W1adaFd0tUwP
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.3/zh-hans/System.Threading.Tasks.xml

SHA256 c1fdececd31eefcc55df144d3ac45d1f9ce23ba7449243aa9bb587368a366d36
MD5 f0a9486ed16266b410e6ec2ad6ffada8
SHA1 0b899db637b9e1541d1b07a40ae1e5e00cdf8c70
SHA512 72c5131041f2b017e2a3392dea0d3b4f482af51876a6c0f359060dc37163357f17e3308b24bfcf521932107ddab70a28998310a9143f7b170e2b2d69e3a157e1
SSDEEP 3072:uQs1VNsBTrdrGpgjNLRspsg65kiGMeRgIMDmzD2Q0lvAuWI2eUxvDrE22E1VHfIi:Fs1I96LHxd
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Tasks.4.3.0/ref/netstandard1.3/zh-hant/System.Threading.Tasks.xml

SHA256 1af340fcbec865ed511adfd833b54698b81ada4958e70c1554d74aaf30fb937f
MD5 99c539c0efd2f9b92019f6a2b103c898
SHA1 44f0dfae1e16cfbf00ff778f50485b3e8b5c4bf2
SHA512 a67f974bd6e84225ad10881fbbb18fa6d52b863d0380a7973f08a786f58c4b0b18a852d08067426ae319a926552b3edff876203f7b1d9ba067f4aa86214bb057
SSDEEP 3072:B7L2mpvrx6KrhY9/ile+ScctiybQ+IB8Sog5sLvJJOliwaS3naDsyad73l:B7LZkvJJOlikl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/.signature.p7s

SHA256 dba7d947cd76c602e64a2f9f0b2215930cc57303b1f8b49afede7f37f6acbd78
MD5 a7f85a9bf9c43f16881004f2e0d0c49e
SHA1 cd0bd5c08bd0e5e068150038537e83f1212f9b84
SHA512 0dcb9093772e240297c77ad5567b84f0a36bc7b1b2ff979ba3bd19d39faa0f14fe9fa8784d8b22775c61f4884ecbe4e366c3aea271ec1f75ce7f9657dc4db0de
SSDEEP 192:xdo7x0KDWpHhXZCVzV07VrVsMGDH0JOqsmVgz28WhBqxiH:j6vDGGVpBMGoJN77hhSiH
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/System.Threading.Timer.4.3.0.nupkg

SHA256 a6686c96685084fdf64d66c1ce82132d9e01a0e441a98936e4e59baeed38a7db
MD5 cb5db8cc56b09ca5e93a52524e57dce0
SHA1 7e335edcf30ee3294b79ae1af306272b2959b0c2
SHA512 d5ce8e258b7be7be268f944e21621195948106f57e6c46e69b2887c46f567760368b14e84046b4be4466ecd08ecd4cb04016a2ff7948cb4640960befc7aa1739
SSDEEP 1536:Spx6voUvMWIp9beYiNm2LxmpiNm2eIpF4WcxJEIA3hQiS:Spx6Aau96YiI2LxmpiI2euFpcxJEIFiS
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netcore50/System.Threading.Timer.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e555a2b71d6225447b7e3c30c94a9be131b19840a8a3d957c9c93c3a045a5e6c
MD5 c8c9341fff026703b5c634b7d01c81f8
SHA1 af7bf80372958b5c4b15617d1c3f52eb19b51dd2
SHA512 fd837c5fc249b36cd52de1114b2bef59f0cee927a59f33e8b6a90e2aa8140e43a726016ba3314b2bc62fc463dfd15df2fd633d05e32dd1ed6dd95546654f67e4
SSDEEP 384:e/sPpGqXXZ9MW6MWPyAA0GftpBjnEaERHRN7Olp/mQd3C:e0GxDiREaEBi0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

7d:10:1c:11:43:a9:ba:fb:9b:c7:7e:f9:03:a8:74:a1:ab:ca:b9:88:f6:39:b4:76:36:47:11:2b:a3:89:ca:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

bf:71:78:b1:f5:7a:17:3c:52:1b:3b:28:38:bb:30:3e:d8:b1:32:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Threading.Timer\4.0.0.0\System.Threading.Timer.pdb

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netcore50/System.Threading.Timer.xml

SHA256 92087ed71ee1c78c72487d56220964855d41fff1dee37652573d0ebcd4421cdb
MD5 c495017cef178d224f7a6edf5cb1d29a
SHA1 705c32ee00ce1ab53649e491442aaf6ebbf09c6d
SHA512 bd70ff50d14c59a4e3aed2fcfe0e44ca2516e8c1918b0fd8398bb13a992b011014d2636f51f0ea749976be50172b05d9d8aa275dcb3958e760d5499a9170e5fe
SSDEEP 192:Y/ywDME0p7I1IMP9pXkFdYdA2yBJykc8BjUyMq:Y/y+ME0hI1IMFpX6dYdA2yBQkc8BjUyp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netcore50/de/System.Threading.Timer.xml

SHA256 23d676e94c5970f99b2a40ddb936ba611b93bb98a609a0c84fc823b2a432641f
MD5 b076ed268d3664c5ff428f3412d601bf
SHA1 253d009ea3bb954b5d8b54a306c2cec8e4324635
SHA512 198960bd8d02374b36311a941b9682d3b61f2ff7fdc9690a7453af5d81a191e3270bfb09fb1dbe02f6a3690dd58c5b97547c66d124fc30848121022078d0024d
SSDEEP 192:Y/yNq+Mo4NcO/MuIMFdtpIZ7spr0MD2yMAsGDD8BSyFZ:Y/yXMo4NcO/1IMF/pIZ7spr0A2yMAsG2
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netcore50/es/System.Threading.Timer.xml

SHA256 57121f9afd4bca32aaa96bb6c698c8ffa7fbd114315ba02d1b9a7981f69caa80
MD5 1ac9d7cc657f547cd28665136b7ed1d6
SHA1 667ae5962052c6d6021873a5f30f756475f11515
SHA512 2979e96afcf221b3679f0d99217036ceaddc1d8a865376b88a0c4024696872543c4d322fbbf8af8be2099285ae45f11c1adee703b2381a365db7ebb809d9cd57
SSDEEP 192:Y/y5MJ8CyRQIMIbJbpp3Rlj7Rt2y9qcYt8BxEMq:Y/y5MGCyRQIMQbp/lj7Rt2yccYt8BxEl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netcore50/fr/System.Threading.Timer.xml

SHA256 cd0f7221eb743d0dea260aaca686047c4517a25c5d8220fe347552fc0db73a18
MD5 14da538934a1b84e2c04ac23113a4da1
SHA1 c27f39a5fa4b51da1d509937f35a167e425153ec
SHA512 0d83c747c2095c01bc7d590441288a4e5651f256cb4a1267f764df8b83d99d753052bea85ac6712d7072f6417433ad1eda83d2e7ea9859111cd665f3b28b90f9
SSDEEP 192:Y/yAMgaSkIMapnH/l3lZ2yVuPG8BtUjkg7:Y/yAMgaSkIMapnfl3lZ2y4PG8BtUYg7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netcore50/it/System.Threading.Timer.xml

SHA256 5aae79740f8d51bb2ba46f0db79134f1d7cae37c208beb78c8d8a76aa356e5ee
MD5 185572cf439a954363f2ce492007b076
SHA1 f3c31f410edc710700e23f5ca34adc6000df82b5
SHA512 8c9fe9b00ed31f24b73207adba6555d4c577efcc4cda0d97a1f5275d3b73a1e62b74e7b3ee831e951e92848e9ac7dd33e9201a2a8075c79af5532f5179b7f063
SSDEEP 192:Y/ykMdFuyJNIIMGuy0pLcDcl2yHWR88B8UtUa3:Y/ykMdFuyJNIIMGuy0pLcDcl2yHWR88l
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netcore50/ja/System.Threading.Timer.xml

SHA256 e3f43cca3ad690b0ab575d9cf13a9e956d8ececcab6e8303ece01d877fd9fa50
MD5 dba64f17e7fc73d875d7012c925e64ba
SHA1 9ad5c7c63a931236d4d21eb407dc4c13b1c3a4c3
SHA512 1e65e851269bee501c43e2d78201e843361e1c291bd3497c6e040bce009675ee830e8041f3d0918ae4c16be5154175849f6800b4d7da45d01c87b12e2da6bb8c
SSDEEP 96:Y/y9WqMA79afs8ShIM8+hqGvK2IpirrwugWLHqtf8ArmE2y3rwugSrqLjArW68BQ:Y/yBMoaEJhIMjIpYCBaE2y7vr8BKAiTr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netcore50/ko/System.Threading.Timer.xml

SHA256 8e15425ca492ade92ba738279e2bc27f49e5f6a42c2fb06513c6938e067140ab
MD5 4edd85860946405ab43b47824d23ba7c
SHA1 934f5c3c377b8e943f94ee0f8e9c83f1dfdb72a6
SHA512 c8b152f53319309e20e9235ed601d817663a561e61b94eaf4981d390ed533d5d57dbfa1e94452e70bc68fd7ea3b861b6b0e6d8241f5d9d494626850149917970
SSDEEP 192:Y/ymdrMX5QqkeFWiIMiQP8Pp39fR0Rk9yfjiWv2yP9fR0vfjj8BKIi5HA:Y/yGMXSqkeFWiIMZP8Pp39fqRk9yf2Wj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netcore50/ru/System.Threading.Timer.xml

SHA256 a50bd22cc95d1822f587e234c8252d3a0afc4016886d6221f2dbd662cc930d10
MD5 2e6dd07822106c3d458e1eae866c1807
SHA1 1770a7f1700711c3006ac95fae67720774809c91
SHA512 b433b66da878382a085c9eddafa5d2afb654e18af8353aa4d61e0c1052ccc87377ef15f944185b45ef94d0d7f04c35fba15d6fdff35d4c17ab75dd3c279ecdb7
SSDEEP 192:Y/y8dMG1+4+MYbIMpXYcpl5nN5MY22yDwlDY28B2UfjEiN:Y/y8dMO+zMYbIMBYcpl5N5MY22yDIDYZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netcore50/zh-hans/System.Threading.Timer.xml

SHA256 d48de6c634eb8426a06ae07075a7372808385624951b2adeaf6666ddbb99681e
MD5 eb0d9d1ade16e05dafc148776f52fe06
SHA1 f7b83f4acb1713fc82b83c645504f8da37000312
SHA512 b908eb5adc7615e616ebab866623c1d7d2b1cd0e638bc6f51325c75036347ae1d90e6777846d0690c5af88e32ed5af6c2152c3640e755e01d05ae1da06f0f8ae
SSDEEP 192:Y/yn3Mv+6LbNorIMawbpbiGr5SG2y2SBl+8BrZgMtRE:Y/y3Mv+6LxorIMakpbDr5SG2yvL+8Brs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netcore50/zh-hant/System.Threading.Timer.xml

SHA256 07b8b9346392a1d9d5be85678eca140a037d8da9b00209dcfbd98db5bc3a9a42
MD5 adb1a4e1e66f7858de65b301d2dba2a3
SHA1 99adc81f0f2e68a87c9cccfbf9ac826ac37a7adf
SHA512 d6f815958c7c086b492fb6aaf4c1d727caebed6a23b04ed659e11966f522c6839446494f9ba019cc840a626a5a13e566ce290bf4eba9a8d4c9bc500bc3418049
SSDEEP 192:Y/yLuM8yJ9jIMFp+La2Ov9+2ys/30l8Bl3nb:Y/ySM8yJZIMFpF2Ov82y20l8Bl3nb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netstandard1.2/System.Threading.Timer.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e555a2b71d6225447b7e3c30c94a9be131b19840a8a3d957c9c93c3a045a5e6c
MD5 c8c9341fff026703b5c634b7d01c81f8
SHA1 af7bf80372958b5c4b15617d1c3f52eb19b51dd2
SHA512 fd837c5fc249b36cd52de1114b2bef59f0cee927a59f33e8b6a90e2aa8140e43a726016ba3314b2bc62fc463dfd15df2fd633d05e32dd1ed6dd95546654f67e4
SSDEEP 384:e/sPpGqXXZ9MW6MWPyAA0GftpBjnEaERHRN7Olp/mQd3C:e0GxDiREaEBi0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

7d:10:1c:11:43:a9:ba:fb:9b:c7:7e:f9:03:a8:74:a1:ab:ca:b9:88:f6:39:b4:76:36:47:11:2b:a3:89:ca:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

bf:71:78:b1:f5:7a:17:3c:52:1b:3b:28:38:bb:30:3e:d8:b1:32:00

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11146

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Threading.Timer\4.0.0.0\System.Threading.Timer.pdb

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netstandard1.2/System.Threading.Timer.xml

SHA256 92087ed71ee1c78c72487d56220964855d41fff1dee37652573d0ebcd4421cdb
MD5 c495017cef178d224f7a6edf5cb1d29a
SHA1 705c32ee00ce1ab53649e491442aaf6ebbf09c6d
SHA512 bd70ff50d14c59a4e3aed2fcfe0e44ca2516e8c1918b0fd8398bb13a992b011014d2636f51f0ea749976be50172b05d9d8aa275dcb3958e760d5499a9170e5fe
SSDEEP 192:Y/ywDME0p7I1IMP9pXkFdYdA2yBJykc8BjUyMq:Y/y+ME0hI1IMFpX6dYdA2yBQkc8BjUyp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netstandard1.2/de/System.Threading.Timer.xml

SHA256 23d676e94c5970f99b2a40ddb936ba611b93bb98a609a0c84fc823b2a432641f
MD5 b076ed268d3664c5ff428f3412d601bf
SHA1 253d009ea3bb954b5d8b54a306c2cec8e4324635
SHA512 198960bd8d02374b36311a941b9682d3b61f2ff7fdc9690a7453af5d81a191e3270bfb09fb1dbe02f6a3690dd58c5b97547c66d124fc30848121022078d0024d
SSDEEP 192:Y/yNq+Mo4NcO/MuIMFdtpIZ7spr0MD2yMAsGDD8BSyFZ:Y/yXMo4NcO/1IMF/pIZ7spr0A2yMAsG2
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netstandard1.2/es/System.Threading.Timer.xml

SHA256 57121f9afd4bca32aaa96bb6c698c8ffa7fbd114315ba02d1b9a7981f69caa80
MD5 1ac9d7cc657f547cd28665136b7ed1d6
SHA1 667ae5962052c6d6021873a5f30f756475f11515
SHA512 2979e96afcf221b3679f0d99217036ceaddc1d8a865376b88a0c4024696872543c4d322fbbf8af8be2099285ae45f11c1adee703b2381a365db7ebb809d9cd57
SSDEEP 192:Y/y5MJ8CyRQIMIbJbpp3Rlj7Rt2y9qcYt8BxEMq:Y/y5MGCyRQIMQbp/lj7Rt2yccYt8BxEl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netstandard1.2/fr/System.Threading.Timer.xml

SHA256 cd0f7221eb743d0dea260aaca686047c4517a25c5d8220fe347552fc0db73a18
MD5 14da538934a1b84e2c04ac23113a4da1
SHA1 c27f39a5fa4b51da1d509937f35a167e425153ec
SHA512 0d83c747c2095c01bc7d590441288a4e5651f256cb4a1267f764df8b83d99d753052bea85ac6712d7072f6417433ad1eda83d2e7ea9859111cd665f3b28b90f9
SSDEEP 192:Y/yAMgaSkIMapnH/l3lZ2yVuPG8BtUjkg7:Y/yAMgaSkIMapnfl3lZ2y4PG8BtUYg7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netstandard1.2/it/System.Threading.Timer.xml

SHA256 5aae79740f8d51bb2ba46f0db79134f1d7cae37c208beb78c8d8a76aa356e5ee
MD5 185572cf439a954363f2ce492007b076
SHA1 f3c31f410edc710700e23f5ca34adc6000df82b5
SHA512 8c9fe9b00ed31f24b73207adba6555d4c577efcc4cda0d97a1f5275d3b73a1e62b74e7b3ee831e951e92848e9ac7dd33e9201a2a8075c79af5532f5179b7f063
SSDEEP 192:Y/ykMdFuyJNIIMGuy0pLcDcl2yHWR88B8UtUa3:Y/ykMdFuyJNIIMGuy0pLcDcl2yHWR88l
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netstandard1.2/ja/System.Threading.Timer.xml

SHA256 e3f43cca3ad690b0ab575d9cf13a9e956d8ececcab6e8303ece01d877fd9fa50
MD5 dba64f17e7fc73d875d7012c925e64ba
SHA1 9ad5c7c63a931236d4d21eb407dc4c13b1c3a4c3
SHA512 1e65e851269bee501c43e2d78201e843361e1c291bd3497c6e040bce009675ee830e8041f3d0918ae4c16be5154175849f6800b4d7da45d01c87b12e2da6bb8c
SSDEEP 96:Y/y9WqMA79afs8ShIM8+hqGvK2IpirrwugWLHqtf8ArmE2y3rwugSrqLjArW68BQ:Y/yBMoaEJhIMjIpYCBaE2y7vr8BKAiTr
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netstandard1.2/ko/System.Threading.Timer.xml

SHA256 8e15425ca492ade92ba738279e2bc27f49e5f6a42c2fb06513c6938e067140ab
MD5 4edd85860946405ab43b47824d23ba7c
SHA1 934f5c3c377b8e943f94ee0f8e9c83f1dfdb72a6
SHA512 c8b152f53319309e20e9235ed601d817663a561e61b94eaf4981d390ed533d5d57dbfa1e94452e70bc68fd7ea3b861b6b0e6d8241f5d9d494626850149917970
SSDEEP 192:Y/ymdrMX5QqkeFWiIMiQP8Pp39fR0Rk9yfjiWv2yP9fR0vfjj8BKIi5HA:Y/yGMXSqkeFWiIMZP8Pp39fqRk9yf2Wj
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netstandard1.2/ru/System.Threading.Timer.xml

SHA256 a50bd22cc95d1822f587e234c8252d3a0afc4016886d6221f2dbd662cc930d10
MD5 2e6dd07822106c3d458e1eae866c1807
SHA1 1770a7f1700711c3006ac95fae67720774809c91
SHA512 b433b66da878382a085c9eddafa5d2afb654e18af8353aa4d61e0c1052ccc87377ef15f944185b45ef94d0d7f04c35fba15d6fdff35d4c17ab75dd3c279ecdb7
SSDEEP 192:Y/y8dMG1+4+MYbIMpXYcpl5nN5MY22yDwlDY28B2UfjEiN:Y/y8dMO+zMYbIMBYcpl5N5MY22yDIDYZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netstandard1.2/zh-hans/System.Threading.Timer.xml

SHA256 d48de6c634eb8426a06ae07075a7372808385624951b2adeaf6666ddbb99681e
MD5 eb0d9d1ade16e05dafc148776f52fe06
SHA1 f7b83f4acb1713fc82b83c645504f8da37000312
SHA512 b908eb5adc7615e616ebab866623c1d7d2b1cd0e638bc6f51325c75036347ae1d90e6777846d0690c5af88e32ed5af6c2152c3640e755e01d05ae1da06f0f8ae
SSDEEP 192:Y/yn3Mv+6LbNorIMawbpbiGr5SG2y2SBl+8BrZgMtRE:Y/y3Mv+6LxorIMakpbDr5SG2yvL+8Brs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Threading.Timer.4.3.0/ref/netstandard1.2/zh-hant/System.Threading.Timer.xml

SHA256 07b8b9346392a1d9d5be85678eca140a037d8da9b00209dcfbd98db5bc3a9a42
MD5 adb1a4e1e66f7858de65b301d2dba2a3
SHA1 99adc81f0f2e68a87c9cccfbf9ac826ac37a7adf
SHA512 d6f815958c7c086b492fb6aaf4c1d727caebed6a23b04ed659e11966f522c6839446494f9ba019cc840a626a5a13e566ce290bf4eba9a8d4c9bc500bc3418049
SSDEEP 192:Y/yLuM8yJ9jIMFp+La2Ov9+2ys/30l8Bl3nb:Y/ySM8yJZIMFpF2Ov82y20l8Bl3nb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/.signature.p7s

SHA256 55ef167d15ab3694d390aed342e3ad803e360805bb557f66687c78daf70fc810
MD5 f7662b4bb8ea1ed4d7b4685ff2fb83f6
SHA1 6f5b8927b1d3ef6d33bf9ded5f6856364f27c089
SHA512 84320863f7f10784134b3fea4a5aed1518131018653894626b8b39dca6cce70a789f4b605644a86d3dabebbae088579e829ba4ef5b1502313e54f40f36da895f
SSDEEP 192:8dq7x0KDWpHhXZCVzV07xrKGDH0JOqsmVgz28WhBqki:EwvDGGVpLGoJN77hhFi
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/System.Xml.ReaderWriter.4.3.0.nupkg

SHA256 410f0a814d25bb817952787e4db79c84efffcda00667831f82f5bbd829f58730
MD5 e1fa7c7625cba2840c4a19289bef1dee
SHA1 2f47cc2ccb5e7117e47703306ca21f416102b0e7
SHA512 991101497fbd39e43fc306ca280a465318868afa8db1f34bb87c266fe61f0c81a0ec34a797b236ee823bd60d1149b7592def96fe044abb511858efffe890c2e6
SSDEEP 24576:axmHsAEEHsAE3K17zIvWLUL2jhLnR+7CIaWLSLTjmLn397JIjWLqLTjGLne:THsADHsAd7gRYnY7U/mnt70XGne
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/lib/net46/System.Xml.ReaderWriter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cdd78df6e1544f04bb71cd21317fac274c5b05802a061913777cfafbf80e93c1
MD5 d08a9c2e710f47617a0f4f1413d182f1
SHA1 765c9e4d36b4f2986514c1ab24b5e5e56afff448
SHA512 6a067867a1153dee575ae860b803a73b724dc42cad430a91b090acfd0a5ef28665b018970e09034b7c3e3195f0289886d89d65d81ceb184610f3213831d79a4b
SSDEEP 384:V4ZZ7Y4YIUWVuWuIWQuWr3rq0GftpBjRudxERHRN7OktvlBPVpt:eZZMCtpi7QEBOk1J
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

61:09:c1:79:fd:ff:03:2e:64:cf:8f:64:64:74:eb:cc:c8:e7:22:94:94:dd:fa:db:bd:9f:1c:ea:02:be:03:e0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

88:e6:25:68:88:21:e9:67:3f:16:23:83:73:b0:8a:28:dc:d6:fc:aa

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Xml.ReaderWriter/net46\System.Xml.ReaderWriter.pdb

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/lib/netcore50/System.Xml.ReaderWriter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 99a4abfe96751c5edc45dca6edffb4a53ba15c1b7cb69a40bd64af56c0c01c39
MD5 03bf696171700a561629859043bbad1b
SHA1 1e048b8be4d11868ec302328825b824f475e719c
SHA512 23b7993095b0cd924b61289be9117bfcb7157ff6246d3cf3284460d7a1fed9bf1e9fa54d750923656c4c78ea6a44ab9ba7f082ad4cd2777e65537ea102a914dc
SSDEEP 12288:W7aH3rWjhHSqbt1t7pv+7izkzebfLJVKDos:W7vbt1t7pv3UefLJVqos
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

db:f0:f7:90:a6:60:0d:27:d2:73:5e:27:d2:a4:97:24:c4:96:3c:a8:b3:4f:8d:b9:fd:80:97:c2:6f:ae:35:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

7a:ad:0c:3a:da:49:c1:a9:56:de:93:41:00:ee:48:83:66:ab:89:6c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

586102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Xml.ReaderWriter\System.Xml.ReaderWriter.pdb

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/lib/netstandard1.3/System.Xml.ReaderWriter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 99a4abfe96751c5edc45dca6edffb4a53ba15c1b7cb69a40bd64af56c0c01c39
MD5 03bf696171700a561629859043bbad1b
SHA1 1e048b8be4d11868ec302328825b824f475e719c
SHA512 23b7993095b0cd924b61289be9117bfcb7157ff6246d3cf3284460d7a1fed9bf1e9fa54d750923656c4c78ea6a44ab9ba7f082ad4cd2777e65537ea102a914dc
SSDEEP 12288:W7aH3rWjhHSqbt1t7pv+7izkzebfLJVKDos:W7vbt1t7pv3UefLJVqos
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

db:f0:f7:90:a6:60:0d:27:d2:73:5e:27:d2:a4:97:24:c4:96:3c:a8:b3:4f:8d:b9:fd:80:97:c2:6f:ae:35:91

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

7a:ad:0c:3a:da:49:c1:a9:56:de:93:41:00:ee:48:83:66:ab:89:6c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:c9:64:4d:16:db:1a:7d:b3:15:00:00:00:00:00:c9

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

586102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Xml.ReaderWriter\System.Xml.ReaderWriter.pdb

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/net46/System.Xml.ReaderWriter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cdd78df6e1544f04bb71cd21317fac274c5b05802a061913777cfafbf80e93c1
MD5 d08a9c2e710f47617a0f4f1413d182f1
SHA1 765c9e4d36b4f2986514c1ab24b5e5e56afff448
SHA512 6a067867a1153dee575ae860b803a73b724dc42cad430a91b090acfd0a5ef28665b018970e09034b7c3e3195f0289886d89d65d81ceb184610f3213831d79a4b
SSDEEP 384:V4ZZ7Y4YIUWVuWuIWQuWr3rq0GftpBjRudxERHRN7OktvlBPVpt:eZZMCtpi7QEBOk1J
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

61:09:c1:79:fd:ff:03:2e:64:cf:8f:64:64:74:eb:cc:c8:e7:22:94:94:dd:fa:db:bd:9f:1c:ea:02:be:03:e0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

88:e6:25:68:88:21:e9:67:3f:16:23:83:73:b0:8a:28:dc:d6:fc:aa

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

11550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin/obj/AnyOS.AnyCPU.Release/System.Xml.ReaderWriter/net46\System.Xml.ReaderWriter.pdb

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netcore50/System.Xml.ReaderWriter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2bc5cd64388619c1edadd953462afe3546c7aca784ce86bd84febf56083d7e28
MD5 5ad5c72702ec5ec395b988886c141461
SHA1 b8534cb05e6777b612b3e8042a9c56562d3e8829
SHA512 02e0141168be480ffa8036adb7e521b6370aa4a3b62fcc1d75f9abb1da391926a6b002d4a6f6e1aa329c2ae730eaaba9d07517dcd45b8538031e5edd68a06b88
SSDEEP 768:aPT65r5xee+iiiNhuRwqOzxxI2no4iJQ4MZMh7iaS+EBsho0f:mT6deeBhuRQNdI5h7O+EBsKS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

66:d8:32:01:df:87:bf:fa:db:95:30:1a:1c:a6:ad:36:81:2c:b3:60:67:ac:34:11:1c:5b:9a:9e:99:f1:69:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

72:96:46:f1:7f:94:82:70:fa:27:49:9c:78:c8:a3:2a:70:3f:f2:2b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

28666

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\ref\System.Xml.ReaderWriter\4.1.0.0\System.Xml.ReaderWriter.pdb

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netcore50/System.Xml.ReaderWriter.xml

SHA256 d3a217859cdc6d66666d1c6ed34bbd6e633465ea85a7ee03e71409adc4d0a1a4
MD5 fdac97ec92219d18a6da68875f861898
SHA1 1654a2c042ae042cf13804502f1c8746b55e88b5
SHA512 7e982971a751906d8d9ec9a534d23302ab0a67f5094bfb22ecbc1e4d916bf6024ed86ec099daafdc93cfae61634cbe7b8b72da25d6d1032ab2abd389514d4a0b
SSDEEP 1536:MchvIo3N3FpR0giO4uW3EP3fvF8RuLu29vlQxGYgklTZ7fuhUMRBdnlU+yqTonGd:RZ3FpR0gvf8fuhUMNnlU+yqTonG7DHV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netcore50/de/System.Xml.ReaderWriter.xml

SHA256 6e34ca8dd867d5d039c613e15d2efdbf4bc10b13933a8e7806f4cc17e4c0c3ac
MD5 8f1d5b74ad0fa42cfa6a7f3f0b88cc42
SHA1 7f8d2299c0d96491fef6683e8e376adab7e8b4dd
SHA512 5d88a07c90f406a245f77ffd02216d20c5c099c8e49df2eed11473af833b629d1bfee79a942997be2b666d9ad2ab804ab654581181bd3a03967adba517d19f2a
SSDEEP 1536:ZN58vlzb9skBTZpW2bqgLEsj7erGnnbJ1Wvugmq6HwoFdj22FQoj2jmo72evor2F:ZTWJTZpyeq6HEiQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netcore50/es/System.Xml.ReaderWriter.xml

SHA256 c3b1bc468591d0381470bd2ab1f55b9426c8458a755f43d3561be6e2038be795
MD5 e04ea20714419ae5e1a5d21d83cfd3bc
SHA1 39f10cb3c5ef2dcc05f4df8adca587fb5e57a73a
SHA512 b8d7fdb412860d0003425a2a7640987cf3a1aaec46528a3ab8722ab1af09c6fe68f672aa9751ca7ed1639bc87efd41ffc5780805008fc990b8693e95c4a3086d
SSDEEP 1536:uAmURrbV3xCrtx29wNdUyXNBsfU5YP0ojIAlIFkA4fsyA5bBw2quJ1cWbdpVjN2+:2N5P4xUl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netcore50/fr/System.Xml.ReaderWriter.xml

SHA256 b7a152dbb9944c3e09c00dc8289a43968fb90acf389544f2e709eb2812afe9b3
MD5 e28fae9f457b1f0665de5cebbdc7f00e
SHA1 be86b777b7f8b261f7a69d90e763539658ea2d1e
SHA512 ed6718044012b98a8518cc4c7c32d5cb13a3664100f43ed1a5b783c7d14b24439f0377e8004afc605b03368b10267c9c2fbe237bed65088840b8249ba092828f
SSDEEP 1536:3pFzYNc2dApkcx8GPa5orO7jcWeFzP/l3OS8SASwFgD7O2UH/uCKH5byZpUVBdOG:BwZeVBdOh6w9dFFDa9DLO0pb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netcore50/it/System.Xml.ReaderWriter.xml

SHA256 11504e8eb5db30404dad9ededf5576a3a30a49e48f70903196f3445a88faffb5
MD5 2c650347da8286e29eb3f646237cb5cf
SHA1 71cc37b359d4e84a20ec5a68d7a54f76d66de3fa
SHA512 321d55ed32715974ef7ff6dc560c1c19e8d500939876b8c5d6a999ff77e4b6fd6f6774bbd949d6ea04928477ca63e63d4b426ea1b8baba8855501bdba72df1dc
SSDEEP 6144:cP4z6WL0WbbgbL9FBIBdrmbdFijdg8RXkfYoJrqb/kIcs2LZVZzFtjtj:G
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netcore50/ja/System.Xml.ReaderWriter.xml

SHA256 66c6207597ab2b413c4b846de0761a96e80576d1a560d0e0d46044716b9f7c09
MD5 b3fca8cacad3ff3ec4d89d89268afd24
SHA1 90f7ab94b5315ee2995e73a2f02f6492db4fe580
SHA512 5c7be7fb16295ee9fb4ff8f0029bc4ffeeb2508394aea0cb3101be297f115d73e18e70bc12f7bb6ee1a0006350b4734c7bbdfd597953b33894c83cd2a3d678d9
SSDEEP 768:YFblqTMknhBA3V1poU6VHuGcHjCbW7qo6kh3QQ1x5uL242jJzcszmdKDd4zRGRCH:60Akb4kLpEuL7RGRCRQdyzEAJCZK/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netcore50/ko/System.Xml.ReaderWriter.xml

SHA256 014aeca3055d18d8357f8d0b66dd6e86730f1b6e1a59d37444e3a459b9ba1a4e
MD5 e8d6e3b91bd07d3025b29320a7619363
SHA1 f4b5db44827cfbf5c2588066939b07394ba08cd7
SHA512 603c213f816094a22816ba32fe5f701dc1ffe688ec8ffac65058a8f47e8f39decbba07d96679a978c8a08d94dc4f642cb5efc9857f1364e072f6fe5fbc4c7175
SSDEEP 1536:I2/Llo32WXv2MyX4E9MlqigWL3MuGT3GKL0m4iU9TZ9XEijsWO5kvKVt7rQXGQce:v/Xev2TW4uGT3GKgniiTr0bcXLcE31n
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netcore50/ru/System.Xml.ReaderWriter.xml

SHA256 8dd53a11d758008e3beee77efff6f977741e7329a24ea5c16d85d5f141804da2
MD5 7018ea53d95b70ea81d89870991f1e90
SHA1 644a1c338b280ebdf4718ea2211b130e83e20cf3
SHA512 8c7630245c08eec7bf4939fdccdb293dd6376c5bb748304ab9d3027ceebc555b3d99dcb7e3f2a7c2bf5199e00c46ee464f4f230badf324abd06684fe7a097b8a
SSDEEP 12288:XpkrMxxy3If6G0ZssgoLXYFsA2S1ydksBe+Ym/8AzU6pO5CpUsuIjt+s6h9Hsi96:G3If6/goLXYFsA2S1ydksBe+Ym/84jpp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netcore50/zh-hans/System.Xml.ReaderWriter.xml

SHA256 22422344ac34ffa848dc7fc0f67cfedf4956bf1fde085de1770a6562701d6ff4
MD5 0786e29b34ada26c8bf189d187f8bfbf
SHA1 5f7a4f8a40dca7c04b7d09ab5be261ad26173fdb
SHA512 86104c8a2b5fbeda6316deb422cbe1488666b09c523f67b07e4f05f42557bf2369f1ef2087ce745e6b81bb3d161e63382242c62a6d1d8c18eaedc25f91eb8219
SSDEEP 6144:wq63nU+BlUHrHjfYXYi5AVUoW9oytH/5SRADU75NKA:wq63nU+BlUHrHjfYXYi5AVUoW9oytH/O
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netcore50/zh-hant/System.Xml.ReaderWriter.xml

SHA256 3b4d8c1e3550543e81ec22d370478afb17c10517b0bd67068de4e9ec22eb1daa
MD5 fca67abcec3741c397149eafda0d158b
SHA1 62f4676891d619133a0635bf54f1723f87bdb29e
SHA512 dbe8bf70aff429bc7c2f7dd702b0719f8be0243801ec5f19d2eb9963ae14e52c8d9b99615e22d8fcce84f484cd116d9568a0a616ce1e02cd7c8d9d1cefab91ce
SSDEEP 6144:lhD7ddzXxRtmWzZVqD/cGPnUjLkXnkkQkKD7HmaUs49Ug9GYlaFt:lhNdzXxRtmWzZVqD/cGPnUjynQkKPmab
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.0/System.Xml.ReaderWriter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e856284cc9c5901b69fba2326aee3442493928344f5f1c7111e4f7e24e3d4974
MD5 800106e2e98bd1299327c317b694cc88
SHA1 6cc12b13bb9e2239a9ce27405f2c7502cd92e717
SHA512 478b4353a6309d1f26e90a48410e019b9f7ec77f7cd8d8dcac53b9dc8667dbba38a2c869d823496b4a85067b7295901e1843adddbfe9bdfe613bdcc446a29b68
SSDEEP 384:6SlhuVmmo/8aQdN9hMCX+OsN8jHjcJjcgrmQXekF5qEhO3ZehmNcoKEAk2qWNuW5:/Qtvxj09rmQ7dhO3kZErmkki2DchO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

a5:32:96:e3:a2:68:fa:eb:83:62:54:0c:29:3e:da:dc:67:72:31:c8:84:83:ec:0e:2a:77:11:a4:65:c6:d8:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

dc:9a:5c:a2:8b:cb:6b:16:b9:16:92:e2:de:37:9e:b8:e1:2f:90:8a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:02:92:4a:00:00:00:00:00:20

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 9, 2012 - Apr 9, 2013

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

29486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.0/System.Xml.ReaderWriter.xml

SHA256 d3a217859cdc6d66666d1c6ed34bbd6e633465ea85a7ee03e71409adc4d0a1a4
MD5 fdac97ec92219d18a6da68875f861898
SHA1 1654a2c042ae042cf13804502f1c8746b55e88b5
SHA512 7e982971a751906d8d9ec9a534d23302ab0a67f5094bfb22ecbc1e4d916bf6024ed86ec099daafdc93cfae61634cbe7b8b72da25d6d1032ab2abd389514d4a0b
SSDEEP 1536:MchvIo3N3FpR0giO4uW3EP3fvF8RuLu29vlQxGYgklTZ7fuhUMRBdnlU+yqTonGd:RZ3FpR0gvf8fuhUMNnlU+yqTonG7DHV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.0/de/System.Xml.ReaderWriter.xml

SHA256 6e34ca8dd867d5d039c613e15d2efdbf4bc10b13933a8e7806f4cc17e4c0c3ac
MD5 8f1d5b74ad0fa42cfa6a7f3f0b88cc42
SHA1 7f8d2299c0d96491fef6683e8e376adab7e8b4dd
SHA512 5d88a07c90f406a245f77ffd02216d20c5c099c8e49df2eed11473af833b629d1bfee79a942997be2b666d9ad2ab804ab654581181bd3a03967adba517d19f2a
SSDEEP 1536:ZN58vlzb9skBTZpW2bqgLEsj7erGnnbJ1Wvugmq6HwoFdj22FQoj2jmo72evor2F:ZTWJTZpyeq6HEiQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.0/es/System.Xml.ReaderWriter.xml

SHA256 c3b1bc468591d0381470bd2ab1f55b9426c8458a755f43d3561be6e2038be795
MD5 e04ea20714419ae5e1a5d21d83cfd3bc
SHA1 39f10cb3c5ef2dcc05f4df8adca587fb5e57a73a
SHA512 b8d7fdb412860d0003425a2a7640987cf3a1aaec46528a3ab8722ab1af09c6fe68f672aa9751ca7ed1639bc87efd41ffc5780805008fc990b8693e95c4a3086d
SSDEEP 1536:uAmURrbV3xCrtx29wNdUyXNBsfU5YP0ojIAlIFkA4fsyA5bBw2quJ1cWbdpVjN2+:2N5P4xUl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.0/fr/System.Xml.ReaderWriter.xml

SHA256 b7a152dbb9944c3e09c00dc8289a43968fb90acf389544f2e709eb2812afe9b3
MD5 e28fae9f457b1f0665de5cebbdc7f00e
SHA1 be86b777b7f8b261f7a69d90e763539658ea2d1e
SHA512 ed6718044012b98a8518cc4c7c32d5cb13a3664100f43ed1a5b783c7d14b24439f0377e8004afc605b03368b10267c9c2fbe237bed65088840b8249ba092828f
SSDEEP 1536:3pFzYNc2dApkcx8GPa5orO7jcWeFzP/l3OS8SASwFgD7O2UH/uCKH5byZpUVBdOG:BwZeVBdOh6w9dFFDa9DLO0pb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.0/it/System.Xml.ReaderWriter.xml

SHA256 11504e8eb5db30404dad9ededf5576a3a30a49e48f70903196f3445a88faffb5
MD5 2c650347da8286e29eb3f646237cb5cf
SHA1 71cc37b359d4e84a20ec5a68d7a54f76d66de3fa
SHA512 321d55ed32715974ef7ff6dc560c1c19e8d500939876b8c5d6a999ff77e4b6fd6f6774bbd949d6ea04928477ca63e63d4b426ea1b8baba8855501bdba72df1dc
SSDEEP 6144:cP4z6WL0WbbgbL9FBIBdrmbdFijdg8RXkfYoJrqb/kIcs2LZVZzFtjtj:G
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.0/ja/System.Xml.ReaderWriter.xml

SHA256 66c6207597ab2b413c4b846de0761a96e80576d1a560d0e0d46044716b9f7c09
MD5 b3fca8cacad3ff3ec4d89d89268afd24
SHA1 90f7ab94b5315ee2995e73a2f02f6492db4fe580
SHA512 5c7be7fb16295ee9fb4ff8f0029bc4ffeeb2508394aea0cb3101be297f115d73e18e70bc12f7bb6ee1a0006350b4734c7bbdfd597953b33894c83cd2a3d678d9
SSDEEP 768:YFblqTMknhBA3V1poU6VHuGcHjCbW7qo6kh3QQ1x5uL242jJzcszmdKDd4zRGRCH:60Akb4kLpEuL7RGRCRQdyzEAJCZK/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.0/ko/System.Xml.ReaderWriter.xml

SHA256 014aeca3055d18d8357f8d0b66dd6e86730f1b6e1a59d37444e3a459b9ba1a4e
MD5 e8d6e3b91bd07d3025b29320a7619363
SHA1 f4b5db44827cfbf5c2588066939b07394ba08cd7
SHA512 603c213f816094a22816ba32fe5f701dc1ffe688ec8ffac65058a8f47e8f39decbba07d96679a978c8a08d94dc4f642cb5efc9857f1364e072f6fe5fbc4c7175
SSDEEP 1536:I2/Llo32WXv2MyX4E9MlqigWL3MuGT3GKL0m4iU9TZ9XEijsWO5kvKVt7rQXGQce:v/Xev2TW4uGT3GKgniiTr0bcXLcE31n
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.0/ru/System.Xml.ReaderWriter.xml

SHA256 8dd53a11d758008e3beee77efff6f977741e7329a24ea5c16d85d5f141804da2
MD5 7018ea53d95b70ea81d89870991f1e90
SHA1 644a1c338b280ebdf4718ea2211b130e83e20cf3
SHA512 8c7630245c08eec7bf4939fdccdb293dd6376c5bb748304ab9d3027ceebc555b3d99dcb7e3f2a7c2bf5199e00c46ee464f4f230badf324abd06684fe7a097b8a
SSDEEP 12288:XpkrMxxy3If6G0ZssgoLXYFsA2S1ydksBe+Ym/8AzU6pO5CpUsuIjt+s6h9Hsi96:G3If6/goLXYFsA2S1ydksBe+Ym/84jpp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.0/zh-hans/System.Xml.ReaderWriter.xml

SHA256 22422344ac34ffa848dc7fc0f67cfedf4956bf1fde085de1770a6562701d6ff4
MD5 0786e29b34ada26c8bf189d187f8bfbf
SHA1 5f7a4f8a40dca7c04b7d09ab5be261ad26173fdb
SHA512 86104c8a2b5fbeda6316deb422cbe1488666b09c523f67b07e4f05f42557bf2369f1ef2087ce745e6b81bb3d161e63382242c62a6d1d8c18eaedc25f91eb8219
SSDEEP 6144:wq63nU+BlUHrHjfYXYi5AVUoW9oytH/5SRADU75NKA:wq63nU+BlUHrHjfYXYi5AVUoW9oytH/O
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.0/zh-hant/System.Xml.ReaderWriter.xml

SHA256 3b4d8c1e3550543e81ec22d370478afb17c10517b0bd67068de4e9ec22eb1daa
MD5 fca67abcec3741c397149eafda0d158b
SHA1 62f4676891d619133a0635bf54f1723f87bdb29e
SHA512 dbe8bf70aff429bc7c2f7dd702b0719f8be0243801ec5f19d2eb9963ae14e52c8d9b99615e22d8fcce84f484cd116d9568a0a616ce1e02cd7c8d9d1cefab91ce
SSDEEP 6144:lhD7ddzXxRtmWzZVqD/cGPnUjLkXnkkQkKD7HmaUs49Ug9GYlaFt:lhNdzXxRtmWzZVqD/cGPnUjynQkKPmab
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.3/System.Xml.ReaderWriter.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2bc5cd64388619c1edadd953462afe3546c7aca784ce86bd84febf56083d7e28
MD5 5ad5c72702ec5ec395b988886c141461
SHA1 b8534cb05e6777b612b3e8042a9c56562d3e8829
SHA512 02e0141168be480ffa8036adb7e521b6370aa4a3b62fcc1d75f9abb1da391926a6b002d4a6f6e1aa329c2ae730eaaba9d07517dcd45b8538031e5edd68a06b88
SSDEEP 768:aPT65r5xee+iiiNhuRwqOzxxI2no4iJQ4MZMh7iaS+EBsho0f:mT6deeBhuRQNdI5h7O+EBsKS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

66:d8:32:01:df:87:bf:fa:db:95:30:1a:1c:a6:ad:36:81:2c:b3:60:67:ac:34:11:1c:5b:9a:9e:99:f1:69:09

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

72:96:46:f1:7f:94:82:70:fa:27:49:9c:78:c8:a3:2a:70:3f:f2:2b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

28666

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\ref\System.Xml.ReaderWriter\4.1.0.0\System.Xml.ReaderWriter.pdb

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.3/System.Xml.ReaderWriter.xml

SHA256 d3a217859cdc6d66666d1c6ed34bbd6e633465ea85a7ee03e71409adc4d0a1a4
MD5 fdac97ec92219d18a6da68875f861898
SHA1 1654a2c042ae042cf13804502f1c8746b55e88b5
SHA512 7e982971a751906d8d9ec9a534d23302ab0a67f5094bfb22ecbc1e4d916bf6024ed86ec099daafdc93cfae61634cbe7b8b72da25d6d1032ab2abd389514d4a0b
SSDEEP 1536:MchvIo3N3FpR0giO4uW3EP3fvF8RuLu29vlQxGYgklTZ7fuhUMRBdnlU+yqTonGd:RZ3FpR0gvf8fuhUMNnlU+yqTonG7DHV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.3/de/System.Xml.ReaderWriter.xml

SHA256 6e34ca8dd867d5d039c613e15d2efdbf4bc10b13933a8e7806f4cc17e4c0c3ac
MD5 8f1d5b74ad0fa42cfa6a7f3f0b88cc42
SHA1 7f8d2299c0d96491fef6683e8e376adab7e8b4dd
SHA512 5d88a07c90f406a245f77ffd02216d20c5c099c8e49df2eed11473af833b629d1bfee79a942997be2b666d9ad2ab804ab654581181bd3a03967adba517d19f2a
SSDEEP 1536:ZN58vlzb9skBTZpW2bqgLEsj7erGnnbJ1Wvugmq6HwoFdj22FQoj2jmo72evor2F:ZTWJTZpyeq6HEiQ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.3/es/System.Xml.ReaderWriter.xml

SHA256 c3b1bc468591d0381470bd2ab1f55b9426c8458a755f43d3561be6e2038be795
MD5 e04ea20714419ae5e1a5d21d83cfd3bc
SHA1 39f10cb3c5ef2dcc05f4df8adca587fb5e57a73a
SHA512 b8d7fdb412860d0003425a2a7640987cf3a1aaec46528a3ab8722ab1af09c6fe68f672aa9751ca7ed1639bc87efd41ffc5780805008fc990b8693e95c4a3086d
SSDEEP 1536:uAmURrbV3xCrtx29wNdUyXNBsfU5YP0ojIAlIFkA4fsyA5bBw2quJ1cWbdpVjN2+:2N5P4xUl
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.3/fr/System.Xml.ReaderWriter.xml

SHA256 b7a152dbb9944c3e09c00dc8289a43968fb90acf389544f2e709eb2812afe9b3
MD5 e28fae9f457b1f0665de5cebbdc7f00e
SHA1 be86b777b7f8b261f7a69d90e763539658ea2d1e
SHA512 ed6718044012b98a8518cc4c7c32d5cb13a3664100f43ed1a5b783c7d14b24439f0377e8004afc605b03368b10267c9c2fbe237bed65088840b8249ba092828f
SSDEEP 1536:3pFzYNc2dApkcx8GPa5orO7jcWeFzP/l3OS8SASwFgD7O2UH/uCKH5byZpUVBdOG:BwZeVBdOh6w9dFFDa9DLO0pb
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.3/it/System.Xml.ReaderWriter.xml

SHA256 11504e8eb5db30404dad9ededf5576a3a30a49e48f70903196f3445a88faffb5
MD5 2c650347da8286e29eb3f646237cb5cf
SHA1 71cc37b359d4e84a20ec5a68d7a54f76d66de3fa
SHA512 321d55ed32715974ef7ff6dc560c1c19e8d500939876b8c5d6a999ff77e4b6fd6f6774bbd949d6ea04928477ca63e63d4b426ea1b8baba8855501bdba72df1dc
SSDEEP 6144:cP4z6WL0WbbgbL9FBIBdrmbdFijdg8RXkfYoJrqb/kIcs2LZVZzFtjtj:G
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.3/ja/System.Xml.ReaderWriter.xml

SHA256 66c6207597ab2b413c4b846de0761a96e80576d1a560d0e0d46044716b9f7c09
MD5 b3fca8cacad3ff3ec4d89d89268afd24
SHA1 90f7ab94b5315ee2995e73a2f02f6492db4fe580
SHA512 5c7be7fb16295ee9fb4ff8f0029bc4ffeeb2508394aea0cb3101be297f115d73e18e70bc12f7bb6ee1a0006350b4734c7bbdfd597953b33894c83cd2a3d678d9
SSDEEP 768:YFblqTMknhBA3V1poU6VHuGcHjCbW7qo6kh3QQ1x5uL242jJzcszmdKDd4zRGRCH:60Akb4kLpEuL7RGRCRQdyzEAJCZK/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.3/ko/System.Xml.ReaderWriter.xml

SHA256 014aeca3055d18d8357f8d0b66dd6e86730f1b6e1a59d37444e3a459b9ba1a4e
MD5 e8d6e3b91bd07d3025b29320a7619363
SHA1 f4b5db44827cfbf5c2588066939b07394ba08cd7
SHA512 603c213f816094a22816ba32fe5f701dc1ffe688ec8ffac65058a8f47e8f39decbba07d96679a978c8a08d94dc4f642cb5efc9857f1364e072f6fe5fbc4c7175
SSDEEP 1536:I2/Llo32WXv2MyX4E9MlqigWL3MuGT3GKL0m4iU9TZ9XEijsWO5kvKVt7rQXGQce:v/Xev2TW4uGT3GKgniiTr0bcXLcE31n
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.3/ru/System.Xml.ReaderWriter.xml

SHA256 8dd53a11d758008e3beee77efff6f977741e7329a24ea5c16d85d5f141804da2
MD5 7018ea53d95b70ea81d89870991f1e90
SHA1 644a1c338b280ebdf4718ea2211b130e83e20cf3
SHA512 8c7630245c08eec7bf4939fdccdb293dd6376c5bb748304ab9d3027ceebc555b3d99dcb7e3f2a7c2bf5199e00c46ee464f4f230badf324abd06684fe7a097b8a
SSDEEP 12288:XpkrMxxy3If6G0ZssgoLXYFsA2S1ydksBe+Ym/8AzU6pO5CpUsuIjt+s6h9Hsi96:G3If6/goLXYFsA2S1ydksBe+Ym/84jpp
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.3/zh-hans/System.Xml.ReaderWriter.xml

SHA256 22422344ac34ffa848dc7fc0f67cfedf4956bf1fde085de1770a6562701d6ff4
MD5 0786e29b34ada26c8bf189d187f8bfbf
SHA1 5f7a4f8a40dca7c04b7d09ab5be261ad26173fdb
SHA512 86104c8a2b5fbeda6316deb422cbe1488666b09c523f67b07e4f05f42557bf2369f1ef2087ce745e6b81bb3d161e63382242c62a6d1d8c18eaedc25f91eb8219
SSDEEP 6144:wq63nU+BlUHrHjfYXYi5AVUoW9oytH/5SRADU75NKA:wq63nU+BlUHrHjfYXYi5AVUoW9oytH/O
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.ReaderWriter.4.3.0/ref/netstandard1.3/zh-hant/System.Xml.ReaderWriter.xml

SHA256 3b4d8c1e3550543e81ec22d370478afb17c10517b0bd67068de4e9ec22eb1daa
MD5 fca67abcec3741c397149eafda0d158b
SHA1 62f4676891d619133a0635bf54f1723f87bdb29e
SHA512 dbe8bf70aff429bc7c2f7dd702b0719f8be0243801ec5f19d2eb9963ae14e52c8d9b99615e22d8fcce84f484cd116d9568a0a616ce1e02cd7c8d9d1cefab91ce
SSDEEP 6144:lhD7ddzXxRtmWzZVqD/cGPnUjLkXnkkQkKD7HmaUs49Ug9GYlaFt:lhNdzXxRtmWzZVqD/cGPnUjynQkKPmab
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/.signature.p7s

SHA256 a57ff04515a1b888fb0a6262897d84a4b1e28e7a45d23d43b8126161029610a4
MD5 21fb98a655600b7f838df1cb3e30fe0f
SHA1 2dae901ed64e19437591003ab5b867620ed54d44
SHA512 eb224b7548d66ede662c85455fc48d7a0015ee0a14eac1cdfaf797aed9283df89f207fc313c8ff401aba04c25231088b4b38f5267eead5e050761d91f289bc7a
SSDEEP 192:xd47x0KDWpHhXZCVzV07VrL9DH0JOqNG8Fp28Wh8nVR:jqvDGGVpM9oJNNzFwhhi/
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/System.Xml.XDocument.4.3.0.nupkg

SHA256 ad6b5d72672e12534e4b309e85f9722b01e40d1a623a1249b3c09e4349750822
MD5 ccd8d51471458b756dc6a2d3e310ff65
SHA1 bd1fe9d50e6502770a1bd8216cb39890b1d7eb2a
SHA512 c2d9236a696daf23a29b530b9aa510fb813041685a1bb9a95845a51e61d870a0615e988b150f5be0d0896ef94b123e97f96c8a43ee815cf5b9897593986b1113
SSDEEP 12288:XM7D7tT3Rx40ls3+BkZh5Wmid5T3ge40ZrI+UkZz55/T3ZZ40nEf+ZkZI54r:XGPtbZBKh5WmO5PhUKz55/bFZKI54r
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ThirdPartyNotices.txt

SHA256 0684b2349427ee28e392ae8914645832e59731dba8a38a984f72b3fb8769c76b
MD5 c967cb8266866e70f817fee256966091
SHA1 58633a0b1cc282fa6ec4ca32d4b9327319ca31fe
SHA512 cfba61d008f30f76886b10275ff1f91c896472fab551e333a3d67ed15885c3dfe83cce7b3db603871ea2be95c7d16f975fa895495491686a7ec5f948b5873353
MD5 SHA1 SHA512

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/dotnet_library_license.txt

SHA256 f1db688d8481c91a452fabcea5060a23da9ea5088329b58c478a040e2e426297
MD5 db62529d9c74388f3885fad4b435b3f7
SHA1 a4cb8479639f7380ba6a632264e887f46fa7a561
SHA512 d1648c8de0e71f21d00b7fccc436f7b7483d4b5fbc81d498ef3e0cc6da9a8385234808e0152e38880def5e9668a38664099193d459483da644691f3f442ecfe2
SSDEEP 192:wd2g5o+eQvHeT9Nf0g+p1+e5lli5ecQSuGCQGDwKxTF5nFmN:rgneQvHINfCvlli5V1FFswKxTF5nsN
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/lib/netcore50/System.Xml.XDocument.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7010c482a9695d7e17ab5a78bc133c860f0313f100a18cd978c9769e5650b8e9
MD5 72f4bc1ce871844e8713018fb20ba1d0
SHA1 1d1d5e112388fa451d7fdff78958243713429467
SHA512 9d6e99988dd26cfe7caf44018f3d4d28099572c4e1b36272b6a2557f3115d798f67b93df6259ec7d2a3df36124006b05b02e740c7ad80613060fbf9ffa391c27
SSDEEP 1536:EreCuxU+dQPSP8Wy6EvU0/l4pSOngDUecIXlKIFVb7geUuyuEBLPBEEBdeQ:uKzP8WTEv7lTO8cUVg2QjBEEOQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

47:e9:c9:21:06:49:6b:2e:18:79:0c:c6:a0:85:d5:15:69:f3:32:7d:46:2e:e8:25:3b:bb:79:4c:cb:87:f5:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a4:8f:97:3e:4b:ac:9c:5d:63:6a:4d:07:4e:fe:1c:d8:fe:8a:cd:34

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

100774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Xml.XDocument\System.Xml.XDocument.pdb

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/lib/netstandard1.3/System.Xml.XDocument.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7010c482a9695d7e17ab5a78bc133c860f0313f100a18cd978c9769e5650b8e9
MD5 72f4bc1ce871844e8713018fb20ba1d0
SHA1 1d1d5e112388fa451d7fdff78958243713429467
SHA512 9d6e99988dd26cfe7caf44018f3d4d28099572c4e1b36272b6a2557f3115d798f67b93df6259ec7d2a3df36124006b05b02e740c7ad80613060fbf9ffa391c27
SSDEEP 1536:EreCuxU+dQPSP8Wy6EvU0/l4pSOngDUecIXlKIFVb7geUuyuEBLPBEEBdeQ:uKzP8WTEv7lTO8cUVg2QjBEEOQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

47:e9:c9:21:06:49:6b:2e:18:79:0c:c6:a0:85:d5:15:69:f3:32:7d:46:2e:e8:25:3b:bb:79:4c:cb:87:f5:f6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

a4:8f:97:3e:4b:ac:9c:5d:63:6a:4d:07:4e:fe:1c:d8:fe:8a:cd:34

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 5, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:5847-F761-4F70,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:cb:d9:52:06:53:bf:3e:2a:59:00:00:00:00:00:cb

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 7, 2016 - Sep 7, 2018

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 18, 2016 - Nov 2, 2017

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

100774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\39\s\bin\obj\AnyOS.AnyCPU.Release\System.Xml.XDocument\System.Xml.XDocument.pdb

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netcore50/System.Xml.XDocument.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dfb6b2c66229e6b20f197a87c4f9870530584f58e0c5164da0de3b04574b11ee
MD5 94b3550013c2410b0c5f6edde8c24303
SHA1 6387084d18e7f7603f303d7357ac3f4a490da383
SHA512 b2e3eb9bdecf9e1828de228ce797b6df0170de719c2309040ab565598634d8fc4979adf754915e2700b2cf0af2962658b8fd7aea0c544fbb1ea34c804541010f
SSDEEP 384:jp9CzyVUFtXMG40nLhGysBMo7K75LFhujnnqXOKsvY5Vsh6u4GWYDWryAA0GftpW:jp45ThGyb761Pki7cqEBl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

b3:ec:cc:f9:48:1d:fa:3f:f9:83:ca:d1:13:35:2d:15:fe:f9:55:3a:23:45:1d:6b:9e:ef:42:f3:41:ba:e7:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

dc:f7:c7:fc:2e:fb:d7:e1:b2:12:3a:4c:b8:b5:3a:9d:93:9a:34:85

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

24930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Xml.XDocument\4.0.10.0\System.Xml.XDocument.pdb

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netcore50/System.Xml.XDocument.xml

SHA256 9fd6843c586bebd309a60f356f677b48d9230e14e0fe3583cf3ae49e96ca0e1d
MD5 da0074c47278833302f42e3f9994e757
SHA1 4da947190eeea36bd0b7c96a9b4629a5065f983a
SHA512 8303320f423fcc628215d5bc2e0f201b03baf62755b0fac3130fffa29f41106497ab84d39e6f2523fd9f0af9c25be275d83188c613381c11f679514cd23e53d8
SSDEEP 1536:Fe0Xnq3C6VDANJAvfvXt0NB4XBVkJv3vS+eXSnBCzkC4jpYjGehoGQUOUfUBNBn3:6+xPwrs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netcore50/de/System.Xml.XDocument.xml

SHA256 6510cf3333821c91129d860e6c29b0290a919eb409a58e6046a7276fae1dc814
MD5 36afab77fd929b928fd3917fa0076d41
SHA1 ff2df9829446e137b2c7eabd0caff8b0f457707e
SHA512 8f4f23d0e9d70b6f2b9868d836007807237153113194ae89309e75c46949fef9ab8f9fbeef49bad8bcac825b61fc27da70c6e18f0614ccb34ed61559f19fec87
SSDEEP 1536:V45oZXkM1hWC8ZYoUjkFALY0XxvVYERfRQOfblLJOPVTdY4YEU3CCFNC3tSDQbOY:XYgbe49fAC7gBgu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netcore50/es/System.Xml.XDocument.xml

SHA256 839c64b679e0e30e39c22b6943163960bbc30ae4772e859a1c484226e83fe07f
MD5 fdffe96b2ac45e64ecc00d6e6067a41d
SHA1 c7161698b80cd6a787ce28cdb09dff6a7cffb874
SHA512 77b2baf6a45c2cb914d2759ecec075e37f1aa0601361c89c19bc47d3ee7d9a154120c7617faaaea7b78267edefe91b7326c0ee04f0671b2f78bbfac8a9cef33b
SSDEEP 1536:NUkS2pVGvGGgWKG6SUk8yBjwVV32NZAPCreE1XLsBDF0dOz924OkAbBLTF1:NWGwOm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netcore50/fr/System.Xml.XDocument.xml

SHA256 682aa5c055cbe2679cfb54669fd442cc606466ab352e9256bd1960928497d8dc
MD5 9643e3203bc9f792c7d33b7e2c520c86
SHA1 9ddf67622fa02cef1252693062015628bc29e1c7
SHA512 c66a7014e6fdb5fca2bcc91be906c2e7f8794bab2df0d9320b77eeb7358c3ebef5478090a6daa6400edfbe07fc7db505bc8fdcef77ba2d5abfb540b5369d7ec4
SSDEEP 1536:WihGPW7gZcUXAuvwkd2YJ/cISjuiybiUarErTH3RoYeoC9:oWoZTrThe7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netcore50/it/System.Xml.XDocument.xml

SHA256 b67c206bbaddca1cfb14088d6776f7ec1b97afdea6b75498aa09e382cb2ee696
MD5 723f01ab33d7355d4c2503fdb0f710c8
SHA1 41b993028d24030eeb2758ca4b51660fff8c993e
SHA512 83adb34151a992c70eba4bff6f753ee20026d0823caec3f8e02afdea5f0a7516dc1f96166b10b13b3d7d9baf6d57ec125427a1fe24d73d351e517c3717274184
SSDEEP 768:YkEX6ircxyYhcYSe7VowqMslzdQG2+I/DubGnjO/zyrqzhfNzX17HFuuHj342/sX:nEsslzdQiIKzh5X17HFuuHj3LEDf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netcore50/ja/System.Xml.XDocument.xml

SHA256 10d7a49742818403b9f441692eb5b5511e85ce4b88415f4597ca02a9a35ecf28
MD5 8c820aaa48408a171d9cb904650ff76b
SHA1 a7b8668eda8dbf6304cc10f2e3a1c83972a9c749
SHA512 86b6113592b19fcb5ed448a6d66766f25329496ecc6b3b7bb55e9c6f72b30906acb65fae39fa07c3e83b941fb3fab43500c834917ce2c71310b6846f76bfd1de
SSDEEP 768:YhXBU8n0mR1ViSW7Wbr6hT6DFSElKxKQif09:0XBU3m1dW7W3696DFSElKxKo
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netcore50/ko/System.Xml.XDocument.xml

SHA256 898c1f169d8c0bfe9b4219c84de18c7272b210cedd540c9bd2b7d0f16d35c510
MD5 7f83d8d5bcff3a5338882c60c1de1ec7
SHA1 e9f32de03d40dd62e48d50948e6df6ebf7b031ca
SHA512 754934a844dadf3d920ceea4ec54097fb8507134fc3602c16fc104837969b9a9f1d0fcac31e6d92972b84908ada9271cdba7417f5b8963b73d4b61b3dc031dd5
SSDEEP 3072:AMh67rJRM/W8uh8cw8NJR8i/lohqwVJRVB/N8heu8uh8Irpht1QJRr/E86h8ga8I:AMh67rJRM/W8uh8cw8NJR8i/lohqwVJt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netcore50/ru/System.Xml.XDocument.xml

SHA256 3e9da418c6704070cd9c44688bc131f96158d1d9873fc9da391bf034ad88089b
MD5 ced8069c5668a2673597c23d85480845
SHA1 662a961393670b43cfdb8c0456242af7b678e176
SHA512 b8e5f854f26423624a52545f8256108bb914b506eb45a08cbd75359a0ae2187e11e32a52da00d9cd79845181aa0ed96f70141e573ff91356777dc59d7f24a6ae
SSDEEP 1536:6AKzE+of8CHENhorRh9pb0O8ZPuogFj9hi:ezE+of8CworRh9pb58ZPujhi
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netcore50/zh-hans/System.Xml.XDocument.xml

SHA256 e5202aa78ef345dd490096fb34d442ef2d22435cca4002c2b7acea3b1e04aee9
MD5 9b0ba4f219ac844d1d4dc220ca32317a
SHA1 a70872b390b90891ccc2f335b44449a97302cb9a
SHA512 ae0aa2d7735ddd7639e5923977ba1355099b1776f976901a6d2f5318e9b71ae3581d5f7b31bb9422273f471978a621d0836b17ba04f796e2ae4e4d0eed0245d2
SSDEEP 1536:DroY5gsThrtyGR/rQns1eJPhS7LXSRRxhp6eT68AbWXOn8fTLpGWvicthqNWkBRs:hRBsGW0oXfjp6E
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netcore50/zh-hant/System.Xml.XDocument.xml

SHA256 8e951f2ffee8e443f8bf930617df65acda35df61e47804d79be37c096a11ed40
MD5 4e2dbe04b8436bc40074a3924b98cd23
SHA1 0f580adcff514416ce31876f98cded4343ab7644
SHA512 4272adf91b894da9f3afe47d238a4dfe3249f85ee374d1ad0da5fe9075153325edce10b084cf0b64b4a29a48e784601418bc538842a65233617676531f1b8c6b
SSDEEP 1536:eqrM6OCxEOcF4NSfU0fqnSjSTd7YdGBmI1m/SOqv9I8uW5SNpfKs4FgAAlrKtJIV:eqrM6OhI1m/vG28uW5S97
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.0/System.Xml.XDocument.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8e5905c713d5f0966407cc780a692ce207416136849640e7f51451ebbd23a548
MD5 ee7ca3d328740e0826cca606f173837d
SHA1 31a7ef8d220e545d0817697b9dfa1c771e60373d
SHA512 6fcae217251800c7b2967ff6f61bb6c5f195bde72ea7de25bd3056daecc2d514f62daf7372580ba51da84348682cbecae141f16b058df4cc42aea32bfd4a9014
SSDEEP 768:cbfrNlILFTHu4OeWXJg99OIki62pvD8O6:4fplI5ju4OeWC9MhSZD8O6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

be:36:18:08:9a:11:2c:dc:7f:9f:ff:6c:13:a8:81:62:ac:65:07:f5:01:c1:51:54:09:3c:56:20:96:b5:4d:a6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

b4:ce:bc:0f:dc:ab:9f:07:0b:c8:fd:98:26:ae:5a:80:22:a1:d9:05

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:19:cc:93:00:01:00:00:00:66

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2011 - Jan 10, 2013

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:02:92:4a:00:00:00:00:00:20

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 9, 2012 - Apr 9, 2013

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:34:12:00:00:00:00:00:03

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2012 - Aug 14, 2013

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

25742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.0/System.Xml.XDocument.xml

SHA256 9fd6843c586bebd309a60f356f677b48d9230e14e0fe3583cf3ae49e96ca0e1d
MD5 da0074c47278833302f42e3f9994e757
SHA1 4da947190eeea36bd0b7c96a9b4629a5065f983a
SHA512 8303320f423fcc628215d5bc2e0f201b03baf62755b0fac3130fffa29f41106497ab84d39e6f2523fd9f0af9c25be275d83188c613381c11f679514cd23e53d8
SSDEEP 1536:Fe0Xnq3C6VDANJAvfvXt0NB4XBVkJv3vS+eXSnBCzkC4jpYjGehoGQUOUfUBNBn3:6+xPwrs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.0/de/System.Xml.XDocument.xml

SHA256 6510cf3333821c91129d860e6c29b0290a919eb409a58e6046a7276fae1dc814
MD5 36afab77fd929b928fd3917fa0076d41
SHA1 ff2df9829446e137b2c7eabd0caff8b0f457707e
SHA512 8f4f23d0e9d70b6f2b9868d836007807237153113194ae89309e75c46949fef9ab8f9fbeef49bad8bcac825b61fc27da70c6e18f0614ccb34ed61559f19fec87
SSDEEP 1536:V45oZXkM1hWC8ZYoUjkFALY0XxvVYERfRQOfblLJOPVTdY4YEU3CCFNC3tSDQbOY:XYgbe49fAC7gBgu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.0/es/System.Xml.XDocument.xml

SHA256 839c64b679e0e30e39c22b6943163960bbc30ae4772e859a1c484226e83fe07f
MD5 fdffe96b2ac45e64ecc00d6e6067a41d
SHA1 c7161698b80cd6a787ce28cdb09dff6a7cffb874
SHA512 77b2baf6a45c2cb914d2759ecec075e37f1aa0601361c89c19bc47d3ee7d9a154120c7617faaaea7b78267edefe91b7326c0ee04f0671b2f78bbfac8a9cef33b
SSDEEP 1536:NUkS2pVGvGGgWKG6SUk8yBjwVV32NZAPCreE1XLsBDF0dOz924OkAbBLTF1:NWGwOm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.0/fr/System.Xml.XDocument.xml

SHA256 682aa5c055cbe2679cfb54669fd442cc606466ab352e9256bd1960928497d8dc
MD5 9643e3203bc9f792c7d33b7e2c520c86
SHA1 9ddf67622fa02cef1252693062015628bc29e1c7
SHA512 c66a7014e6fdb5fca2bcc91be906c2e7f8794bab2df0d9320b77eeb7358c3ebef5478090a6daa6400edfbe07fc7db505bc8fdcef77ba2d5abfb540b5369d7ec4
SSDEEP 1536:WihGPW7gZcUXAuvwkd2YJ/cISjuiybiUarErTH3RoYeoC9:oWoZTrThe7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.0/it/System.Xml.XDocument.xml

SHA256 b67c206bbaddca1cfb14088d6776f7ec1b97afdea6b75498aa09e382cb2ee696
MD5 723f01ab33d7355d4c2503fdb0f710c8
SHA1 41b993028d24030eeb2758ca4b51660fff8c993e
SHA512 83adb34151a992c70eba4bff6f753ee20026d0823caec3f8e02afdea5f0a7516dc1f96166b10b13b3d7d9baf6d57ec125427a1fe24d73d351e517c3717274184
SSDEEP 768:YkEX6ircxyYhcYSe7VowqMslzdQG2+I/DubGnjO/zyrqzhfNzX17HFuuHj342/sX:nEsslzdQiIKzh5X17HFuuHj3LEDf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.0/ja/System.Xml.XDocument.xml

SHA256 10d7a49742818403b9f441692eb5b5511e85ce4b88415f4597ca02a9a35ecf28
MD5 8c820aaa48408a171d9cb904650ff76b
SHA1 a7b8668eda8dbf6304cc10f2e3a1c83972a9c749
SHA512 86b6113592b19fcb5ed448a6d66766f25329496ecc6b3b7bb55e9c6f72b30906acb65fae39fa07c3e83b941fb3fab43500c834917ce2c71310b6846f76bfd1de
SSDEEP 768:YhXBU8n0mR1ViSW7Wbr6hT6DFSElKxKQif09:0XBU3m1dW7W3696DFSElKxKo
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.0/ko/System.Xml.XDocument.xml

SHA256 898c1f169d8c0bfe9b4219c84de18c7272b210cedd540c9bd2b7d0f16d35c510
MD5 7f83d8d5bcff3a5338882c60c1de1ec7
SHA1 e9f32de03d40dd62e48d50948e6df6ebf7b031ca
SHA512 754934a844dadf3d920ceea4ec54097fb8507134fc3602c16fc104837969b9a9f1d0fcac31e6d92972b84908ada9271cdba7417f5b8963b73d4b61b3dc031dd5
SSDEEP 3072:AMh67rJRM/W8uh8cw8NJR8i/lohqwVJRVB/N8heu8uh8Irpht1QJRr/E86h8ga8I:AMh67rJRM/W8uh8cw8NJR8i/lohqwVJt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.0/ru/System.Xml.XDocument.xml

SHA256 3e9da418c6704070cd9c44688bc131f96158d1d9873fc9da391bf034ad88089b
MD5 ced8069c5668a2673597c23d85480845
SHA1 662a961393670b43cfdb8c0456242af7b678e176
SHA512 b8e5f854f26423624a52545f8256108bb914b506eb45a08cbd75359a0ae2187e11e32a52da00d9cd79845181aa0ed96f70141e573ff91356777dc59d7f24a6ae
SSDEEP 1536:6AKzE+of8CHENhorRh9pb0O8ZPuogFj9hi:ezE+of8CworRh9pb58ZPujhi
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.0/zh-hans/System.Xml.XDocument.xml

SHA256 e5202aa78ef345dd490096fb34d442ef2d22435cca4002c2b7acea3b1e04aee9
MD5 9b0ba4f219ac844d1d4dc220ca32317a
SHA1 a70872b390b90891ccc2f335b44449a97302cb9a
SHA512 ae0aa2d7735ddd7639e5923977ba1355099b1776f976901a6d2f5318e9b71ae3581d5f7b31bb9422273f471978a621d0836b17ba04f796e2ae4e4d0eed0245d2
SSDEEP 1536:DroY5gsThrtyGR/rQns1eJPhS7LXSRRxhp6eT68AbWXOn8fTLpGWvicthqNWkBRs:hRBsGW0oXfjp6E
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.0/zh-hant/System.Xml.XDocument.xml

SHA256 8e951f2ffee8e443f8bf930617df65acda35df61e47804d79be37c096a11ed40
MD5 4e2dbe04b8436bc40074a3924b98cd23
SHA1 0f580adcff514416ce31876f98cded4343ab7644
SHA512 4272adf91b894da9f3afe47d238a4dfe3249f85ee374d1ad0da5fe9075153325edce10b084cf0b64b4a29a48e784601418bc538842a65233617676531f1b8c6b
SSDEEP 1536:eqrM6OCxEOcF4NSfU0fqnSjSTd7YdGBmI1m/SOqv9I8uW5SNpfKs4FgAAlrKtJIV:eqrM6OhI1m/vG28uW5S97
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.3/System.Xml.XDocument.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dfb6b2c66229e6b20f197a87c4f9870530584f58e0c5164da0de3b04574b11ee
MD5 94b3550013c2410b0c5f6edde8c24303
SHA1 6387084d18e7f7603f303d7357ac3f4a490da383
SHA512 b2e3eb9bdecf9e1828de228ce797b6df0170de719c2309040ab565598634d8fc4979adf754915e2700b2cf0af2962658b8fd7aea0c544fbb1ea34c804541010f
SSDEEP 384:jp9CzyVUFtXMG40nLhGysBMo7K75LFhujnnqXOKsvY5Vsh6u4GWYDWryAA0GftpW:jp45ThGyb761Pki7cqEBl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

b3:ec:cc:f9:48:1d:fa:3f:f9:83:ca:d1:13:35:2d:15:fe:f9:55:3a:23:45:1d:6b:9e:ef:42:f3:41:ba:e7:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 29, 2024

PE Signature issue

Digest

dc:f7:c7:fc:2e:fb:d7:e1:b2:12:3a:4c:b8:b5:3a:9d:93:9a:34:85

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2016

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Minor OS version

0

Major OS version

4

Entry point

24930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\A\_work\21\s\bin\obj\ref\System.Xml.XDocument\4.0.10.0\System.Xml.XDocument.pdb

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.3/System.Xml.XDocument.xml

SHA256 9fd6843c586bebd309a60f356f677b48d9230e14e0fe3583cf3ae49e96ca0e1d
MD5 da0074c47278833302f42e3f9994e757
SHA1 4da947190eeea36bd0b7c96a9b4629a5065f983a
SHA512 8303320f423fcc628215d5bc2e0f201b03baf62755b0fac3130fffa29f41106497ab84d39e6f2523fd9f0af9c25be275d83188c613381c11f679514cd23e53d8
SSDEEP 1536:Fe0Xnq3C6VDANJAvfvXt0NB4XBVkJv3vS+eXSnBCzkC4jpYjGehoGQUOUfUBNBn3:6+xPwrs
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.3/de/System.Xml.XDocument.xml

SHA256 6510cf3333821c91129d860e6c29b0290a919eb409a58e6046a7276fae1dc814
MD5 36afab77fd929b928fd3917fa0076d41
SHA1 ff2df9829446e137b2c7eabd0caff8b0f457707e
SHA512 8f4f23d0e9d70b6f2b9868d836007807237153113194ae89309e75c46949fef9ab8f9fbeef49bad8bcac825b61fc27da70c6e18f0614ccb34ed61559f19fec87
SSDEEP 1536:V45oZXkM1hWC8ZYoUjkFALY0XxvVYERfRQOfblLJOPVTdY4YEU3CCFNC3tSDQbOY:XYgbe49fAC7gBgu
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.3/es/System.Xml.XDocument.xml

SHA256 839c64b679e0e30e39c22b6943163960bbc30ae4772e859a1c484226e83fe07f
MD5 fdffe96b2ac45e64ecc00d6e6067a41d
SHA1 c7161698b80cd6a787ce28cdb09dff6a7cffb874
SHA512 77b2baf6a45c2cb914d2759ecec075e37f1aa0601361c89c19bc47d3ee7d9a154120c7617faaaea7b78267edefe91b7326c0ee04f0671b2f78bbfac8a9cef33b
SSDEEP 1536:NUkS2pVGvGGgWKG6SUk8yBjwVV32NZAPCreE1XLsBDF0dOz924OkAbBLTF1:NWGwOm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.3/fr/System.Xml.XDocument.xml

SHA256 682aa5c055cbe2679cfb54669fd442cc606466ab352e9256bd1960928497d8dc
MD5 9643e3203bc9f792c7d33b7e2c520c86
SHA1 9ddf67622fa02cef1252693062015628bc29e1c7
SHA512 c66a7014e6fdb5fca2bcc91be906c2e7f8794bab2df0d9320b77eeb7358c3ebef5478090a6daa6400edfbe07fc7db505bc8fdcef77ba2d5abfb540b5369d7ec4
SSDEEP 1536:WihGPW7gZcUXAuvwkd2YJ/cISjuiybiUarErTH3RoYeoC9:oWoZTrThe7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.3/it/System.Xml.XDocument.xml

SHA256 b67c206bbaddca1cfb14088d6776f7ec1b97afdea6b75498aa09e382cb2ee696
MD5 723f01ab33d7355d4c2503fdb0f710c8
SHA1 41b993028d24030eeb2758ca4b51660fff8c993e
SHA512 83adb34151a992c70eba4bff6f753ee20026d0823caec3f8e02afdea5f0a7516dc1f96166b10b13b3d7d9baf6d57ec125427a1fe24d73d351e517c3717274184
SSDEEP 768:YkEX6ircxyYhcYSe7VowqMslzdQG2+I/DubGnjO/zyrqzhfNzX17HFuuHj342/sX:nEsslzdQiIKzh5X17HFuuHj3LEDf
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.3/ja/System.Xml.XDocument.xml

SHA256 10d7a49742818403b9f441692eb5b5511e85ce4b88415f4597ca02a9a35ecf28
MD5 8c820aaa48408a171d9cb904650ff76b
SHA1 a7b8668eda8dbf6304cc10f2e3a1c83972a9c749
SHA512 86b6113592b19fcb5ed448a6d66766f25329496ecc6b3b7bb55e9c6f72b30906acb65fae39fa07c3e83b941fb3fab43500c834917ce2c71310b6846f76bfd1de
SSDEEP 768:YhXBU8n0mR1ViSW7Wbr6hT6DFSElKxKQif09:0XBU3m1dW7W3696DFSElKxKo
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.3/ko/System.Xml.XDocument.xml

SHA256 898c1f169d8c0bfe9b4219c84de18c7272b210cedd540c9bd2b7d0f16d35c510
MD5 7f83d8d5bcff3a5338882c60c1de1ec7
SHA1 e9f32de03d40dd62e48d50948e6df6ebf7b031ca
SHA512 754934a844dadf3d920ceea4ec54097fb8507134fc3602c16fc104837969b9a9f1d0fcac31e6d92972b84908ada9271cdba7417f5b8963b73d4b61b3dc031dd5
SSDEEP 3072:AMh67rJRM/W8uh8cw8NJR8i/lohqwVJRVB/N8heu8uh8Irpht1QJRr/E86h8ga8I:AMh67rJRM/W8uh8cw8NJR8i/lohqwVJt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.3/ru/System.Xml.XDocument.xml

SHA256 3e9da418c6704070cd9c44688bc131f96158d1d9873fc9da391bf034ad88089b
MD5 ced8069c5668a2673597c23d85480845
SHA1 662a961393670b43cfdb8c0456242af7b678e176
SHA512 b8e5f854f26423624a52545f8256108bb914b506eb45a08cbd75359a0ae2187e11e32a52da00d9cd79845181aa0ed96f70141e573ff91356777dc59d7f24a6ae
SSDEEP 1536:6AKzE+of8CHENhorRh9pb0O8ZPuogFj9hi:ezE+of8CworRh9pb58ZPujhi
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.3/zh-hans/System.Xml.XDocument.xml

SHA256 e5202aa78ef345dd490096fb34d442ef2d22435cca4002c2b7acea3b1e04aee9
MD5 9b0ba4f219ac844d1d4dc220ca32317a
SHA1 a70872b390b90891ccc2f335b44449a97302cb9a
SHA512 ae0aa2d7735ddd7639e5923977ba1355099b1776f976901a6d2f5318e9b71ae3581d5f7b31bb9422273f471978a621d0836b17ba04f796e2ae4e4d0eed0245d2
SSDEEP 1536:DroY5gsThrtyGR/rQns1eJPhS7LXSRRxhp6eT68AbWXOn8fTLpGWvicthqNWkBRs:hRBsGW0oXfjp6E
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/System.Xml.XDocument.4.3.0/ref/netstandard1.3/zh-hant/System.Xml.XDocument.xml

SHA256 8e951f2ffee8e443f8bf930617df65acda35df61e47804d79be37c096a11ed40
MD5 4e2dbe04b8436bc40074a3924b98cd23
SHA1 0f580adcff514416ce31876f98cded4343ab7644
SHA512 4272adf91b894da9f3afe47d238a4dfe3249f85ee374d1ad0da5fe9075153325edce10b084cf0b64b4a29a48e784601418bc538842a65233617676531f1b8c6b
SSDEEP 1536:eqrM6OCxEOcF4NSfU0fqnSjSTd7YdGBmI1m/SOqv9I8uW5SNpfKs4FgAAlrKtJIV:eqrM6OhI1m/vG28uW5S97
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/.signature.p7s

SHA256 2cd26e8a34eeee86d3b5c377db3c363b17f416a66b1655d587f8e8baa2ed695c
MD5 a8299d7c8e1c3dc34ffda7710ec67d80
SHA1 572b2c37f4b9674c84e81830138efe1299a24714
SHA512 a5d83a2cf6b3093b2639a631a119fdd13ff33b863aa5b61e966a1d9b3c617bd0f0324d5c56011aaac234c80552617f391b077d3ecc38dfced29e5536c6936048
SSDEEP 192:Idq7x0KDWpHhXZCVzV07Vr/QJGDH0JOqsmVgz28WhBq4qZ:QwvDGGVpWQJGoJN77hhhqZ
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/Vestris.ResourceLib.2.1.0.nupkg

SHA256 885e9796dba8e1625eba8c7bd8b79b2938bed87c2f40d01a0b8a900da26ff9e1
MD5 38ec739a7110f159c76cd30c34021d2c
SHA1 ac5ccc9235d42c0680fcb6059bd3ff2ab76b54fa
SHA512 dfc6eb39a02be530aed676efb9ed163cf41986eee01c621ed0323b0b6c1df11344f4197ba065c62bd0d9d8506a7bcda710be5f946d0fadefee469e9418947010
SSDEEP 6144:1U/SObMJTfHHdCcYJIA0fHH6xqEYeGfHH9WL1eKjfHHA+k5O+fHHzX:KaAMJTfHotJ+fHIqBfHcL1PfHg+kNfH7
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net20/Vestris.ResourceLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dc6af989ddff80d4cdc6ec56ed649b1461a2c2e436d162e110fb215a04a9f23a
MD5 10602d512e9b336da3ba79477ae3eaf4
SHA1 07e6acda3f233f640614c3ef03af4a127dab2091
SHA512 423f1559efa953f66d74d6415589dc1f84b380dd0c8c29436f37b2c7cd7f1dcd4fed5cbfd436a9a3359ea8f1c2191db8a8009d89dc38ce23674e5b2643516b6e
SSDEEP 1536:zSHviIDAqoPf5lYvBE7+IXIKr/3RxOcVVG3vKZYgmC8ITPzw3fowk6drYMOHaJId:zSHvPDAqoPf5lYvBE7+IXXr/hxOcVVGE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82898

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\resourcelib\Source\ResourceLib\obj\Release\net20\Vestris.ResourceLib.pdb

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net20/Vestris.ResourceLib.xml

SHA256 d243a0b107c44e654a53bf7941a9ade0dab6476b36eaf0fbe990cf99036bd12e
MD5 a0152babc033f3c62eadb7c4baa75cab
SHA1 b6317dbee83e6f2c5f3eafd21c8ca0bc16f29227
SHA512 f8c9f9c5c27ceff7894edd21c2bfa58a3066c2fb2ff35ee5c99df77e9dd553e427761c9882426b7e3de76697967652957c2a36ff321d1e33d4b5279f6a840fb8
SSDEEP 3072:uuaOKJ1AAlTNKLNWs/+Y4Y4d8yUa/jvGF:ux1AAlTgLNqljvGF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net35/Vestris.ResourceLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6d4df46db20da580ca269ae94bbecb93ae1162da1c6b4cbc86850185f8ae156c
MD5 6ceb6c2788498c18d43deff634a7cbe4
SHA1 bf13d97c49552fa35b0fc5550f4dd3442cf9fe7a
SHA512 8573376f7a93e116773e0cfc186b6b79c834537e2d2c2c32512f1edf684dc1bb7a71b23be074eabceaabe54025c74e877fd46ffd6fa4806e82cf418b89a2673e
SSDEEP 1536:4SHviIDAqoPf5lYvBE7+IXIKr/3RxOcVVG3vKZYgmC8ITPzw3fowk6drYMOHaJIp:4SHvPDAqoPf5lYvBE7+IXXr/hxOcVVGE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82898

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\resourcelib\Source\ResourceLib\obj\Release\net35\Vestris.ResourceLib.pdb

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net35/Vestris.ResourceLib.xml

SHA256 d243a0b107c44e654a53bf7941a9ade0dab6476b36eaf0fbe990cf99036bd12e
MD5 a0152babc033f3c62eadb7c4baa75cab
SHA1 b6317dbee83e6f2c5f3eafd21c8ca0bc16f29227
SHA512 f8c9f9c5c27ceff7894edd21c2bfa58a3066c2fb2ff35ee5c99df77e9dd553e427761c9882426b7e3de76697967652957c2a36ff321d1e33d4b5279f6a840fb8
SSDEEP 3072:uuaOKJ1AAlTNKLNWs/+Y4Y4d8yUa/jvGF:ux1AAlTgLNqljvGF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net40/Vestris.ResourceLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d571df8d154118bbbfd16fffb1a4ad642ad854a98ccfb712097633b522ce7aca
MD5 d39f7ef14893f4d0e909a9ef67d91d7e
SHA1 dfd7519871580b605366a513377db0549bcd5eee
SHA512 f15f759ef12970afb8aa46550d5e3491ec771b69c861da3be4a32cb6a6d93eb78b52aa595758277918358961ff99e5ec4fa5f411fe86ca7f87af0fc1a8923b1e
SSDEEP 1536:Vx+rDv49EAcd4OGZzUDInJMtIxexanrP:jwD/AczGZkInJrxecL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

83042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\resourcelib\Source\ResourceLib\obj\Release\net40\Vestris.ResourceLib.pdb

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net40/Vestris.ResourceLib.xml

SHA256 d243a0b107c44e654a53bf7941a9ade0dab6476b36eaf0fbe990cf99036bd12e
MD5 a0152babc033f3c62eadb7c4baa75cab
SHA1 b6317dbee83e6f2c5f3eafd21c8ca0bc16f29227
SHA512 f8c9f9c5c27ceff7894edd21c2bfa58a3066c2fb2ff35ee5c99df77e9dd553e427761c9882426b7e3de76697967652957c2a36ff321d1e33d4b5279f6a840fb8
SSDEEP 3072:uuaOKJ1AAlTNKLNWs/+Y4Y4d8yUa/jvGF:ux1AAlTgLNqljvGF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net45/Vestris.ResourceLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
MD5 944ce5123c94c66a50376e7b37e3a6a6
SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

83158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/net45/Vestris.ResourceLib.xml

SHA256 d243a0b107c44e654a53bf7941a9ade0dab6476b36eaf0fbe990cf99036bd12e
MD5 a0152babc033f3c62eadb7c4baa75cab
SHA1 b6317dbee83e6f2c5f3eafd21c8ca0bc16f29227
SHA512 f8c9f9c5c27ceff7894edd21c2bfa58a3066c2fb2ff35ee5c99df77e9dd553e427761c9882426b7e3de76697967652957c2a36ff321d1e33d4b5279f6a840fb8
SSDEEP 3072:uuaOKJ1AAlTNKLNWs/+Y4Y4d8yUa/jvGF:ux1AAlTgLNqljvGF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/netstandard2.0/Vestris.ResourceLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3c66c5f9ae42cde424565791e81b3a87513120ecf580bc49fccdf64053a8b4ef
MD5 ed32af6dfa6d4c5736dce095d086f2d2
SHA1 c588b909fc4162f4aefe6cb268879c9d3499d721
SHA512 b351e3e5bc3edc0d0a38767120f77526825130f075b939fe89c9792ca2ef5261ab19fee9b32fa7829b0ea73b8f4d9399477e5942e185a41642830843a6f67896
SSDEEP 1536:kM6t6KDa6D0uiyVU+W34hvIAZdS34fIDMthneoh+fLs:kdtV0uvU+iR3WIDUnei9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

83150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\resourcelib\Source\ResourceLib\obj\Release\netstandard2.0\Vestris.ResourceLib.pdb

LegionStealer V1 SRC/packages/Vestris.ResourceLib.2.1.0/lib/netstandard2.0/Vestris.ResourceLib.xml

SHA256 d243a0b107c44e654a53bf7941a9ade0dab6476b36eaf0fbe990cf99036bd12e
MD5 a0152babc033f3c62eadb7c4baa75cab
SHA1 b6317dbee83e6f2c5f3eafd21c8ca0bc16f29227
SHA512 f8c9f9c5c27ceff7894edd21c2bfa58a3066c2fb2ff35ee5c99df77e9dd553e427761c9882426b7e3de76697967652957c2a36ff321d1e33d4b5279f6a840fb8
SSDEEP 3072:uuaOKJ1AAlTNKLNWs/+Y4Y4d8yUa/jvGF:ux1AAlTgLNqljvGF
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/jose-jwt.4.1.0/.signature.p7s

SHA256 11fea98786e153c7c8743fdbc3fe491c16428b26dc9110d12cee92681a56fbb7
MD5 df114484e8fc090ba41d97b7493e50eb
SHA1 5f180695f8436223ec8074d155fdbadf35e72f3b
SHA512 5831618d4e40d3c175eca7abec8c8fcdbd2ad1ef528cf226b7c187a41034b72096652753a1785acf7cac201a65595b2808485c1446e19d5f498239a26a45dfa4
SSDEEP 192:TdP7x0KDWpHiX1x3iyHS7x02Nyby2sE9jBF2+noPOJB3vglvt:JNvDG6wyH4JNyb8E9VFDPxvIV
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/jose-jwt.4.1.0/jose-jwt.4.1.0.nupkg

SHA256 0176378bf2373bc468cf612c7156da69f57559d4c56d7e31c360d5a54a224307
MD5 bd7cd308fca509709f39e6d3f7b0c5ff
SHA1 d2c9e294c03e012958471f59d6aa227caffc2c05
SHA512 777a131853accf1188cb6eb49eaf6dac4f20d99c6bce28750edc90cb7934e315d788ab95207559eee7f243335611a0454e830faa2ac4fbdd803b4386fe225766
SSDEEP 3072:JTwj7xWwd6+py9WD4+hxnZqRgyyy1oQJYHlBTl7i4akZ23J9LgqvEzHTF0l2uBsf:JTwXQuu9ib4ToWYHfQ4NZGKvTF0Eu6f
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/packages/jose-jwt.4.1.0/lib/net40/jose-jwt.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4cbe341978fa1c80b4591631ad5c4c2973c4cc5dcdd346c1b936d40788956c47
MD5 43f24038a436cb3092234515a0f71186
SHA1 68d9ba0c70f9d7f3a8df5bf9245f288ce2367f5f
SHA512 8556df195014d227e965c51aae4d2dbe3f87dc8d00b0baffbb351f6c6c10efcc7a195306ccc4ae3cad41818c610165f15a7ee7f0c8d577d71aa83cae33c7db3c
SSDEEP 1536:jLLF4mtztDQYdwo4oYEQcI0AikAI0mZ+3uqW4T2CseRPRBzRlLX/oo1259P5D3+C:jLuCtDBg4T2CseRPhlLvoo12jPl3+dvs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

86178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\jose-jwt\jose-jwt\obj\Release\net40\jose-jwt.pdb

LegionStealer V1 SRC/packages/jose-jwt.4.1.0/lib/net461/jose-jwt.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e3a0f864cebbaaadd16f2efe290e5a0c025d0f041e245287c16158e2043935e3
MD5 780e3bf5190c0648fa1f415f4563975a
SHA1 f598d71b9256dd30032e0ae0cf0703c12214c40e
SHA512 e03b713dff38df5cc74394d32cdb15a3ebf57996654fae049f8a1b2a3cb997429262a6a22ec815b75fa2654275294d76ee760240988e51f716a1c58ec0377786
SSDEEP 1536:4oTHe4mg8OlstIh0ggPzrBXR+pya+p259P5x3+7J+yTDQ:4o1QISggnBXha+p2jPz3+7J+yg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

87534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\jose-jwt\jose-jwt\obj\Release\net461\jose-jwt.pdb

LegionStealer V1 SRC/packages/jose-jwt.4.1.0/lib/net472/jose-jwt.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a02b713b6a99cb0b3f85e9f389275bf904eee8be848b2a8c41507c64b264133a
MD5 3932710fd1cfc829efaee90f08e74208
SHA1 105d65bfbc12e8e9c27d6dde9484bc85e7a7f77e
SHA512 0ecb5a5b1ab5308f6c48428e244639f8d5f9a4514f9822a92f29798b1b3e7a0d60922c93543e637abd22613643feeb18cc17cdc9e906a06bc649971e678c0715
SSDEEP 1536:OglH/sWHgmHzzCr51o+ZpKEusq5RIH+qh7D259P5h3+F1AAy/Dc:OgyN1nK86Q7D2jPn3+F1AAyg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

88526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\jose-jwt\jose-jwt\obj\Release\net472\jose-jwt.pdb

LegionStealer V1 SRC/packages/jose-jwt.4.1.0/lib/netstandard1.4/jose-jwt.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ae98c83ec631c34431dfaf99e17f92e98a25aebd9869212b6a5652bd47c61f6a
MD5 816b1444a6df072083f8e1604505524a
SHA1 94d40b6d09b77b2d99606cec3137013be9c3d672
SHA512 51f01efb8435e0d2c66363830ef0f97b4eaa995effd9d8ef72e23d23ad97ab439e8c0212d68bf12e1f3d624ba9fff2dc253fd20b0f3e1365b78619e956bf4966
SSDEEP 1536:i3mU+MYgiiXWtGum7ECLvGysEhx259P5n3+mT1l:i3yL071vr5hx2jPF3+mT1l
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

87070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\jose-jwt\jose-jwt\obj\Release\netstandard1.4\jose-jwt.pdb

LegionStealer V1 SRC/packages/jose-jwt.4.1.0/lib/netstandard2.1/jose-jwt.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 396bfe2338b7b41ca2ff56af6664f6905c90b1990d285c926f7333f982f047b3
MD5 aa559c3f62c824522df1f6b61870d2f5
SHA1 5f8942e363539d797b8dec73a8f80f53518b20e7
SHA512 a9fd6bcb0d537880c32df1c8c3e3663220b8bdf22b01e3a240b1c2ff0408ffbe73e1e038532a15210325e59c693b159d7aea4ca1b3e834ab9d894a073de0dfde
SSDEEP 1536:IVGtNbMxKiyKupUmv0MB5Vna5DCbSl/xRx259P5/3+87O8ANMJ1:1tNrxK7rIQlJP2jPx3+xMz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

86450

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\jose-jwt\jose-jwt\obj\Release\netstandard2.1\jose-jwt.pdb

LegionStealer V1 SRC/sendweb.cs

SHA256 0c5013eafb7534eea4ed73caed8af509bbeb85ae3f6e84e8c2694697022d97e8
MD5 50e90dbe2f106d8af7759ec4b094c989
SHA1 eb21960cbede992fc65cd7d501631bde53887ac1
SHA512 0d5a544281103b4819ad70f34f0bdee7bb2188e74f4481e46f5df5c61a0e83fa22ca67016a4d65aba9278b041f50c4c981dbd4c22788e18e296d3f3fe0eb1203
MD5 SHA1 SHA512

LegionStealer V1 SRC/setter.Designer.cs

SHA256 70f1c0460473ff8c3aedd43d13c370d22f477daae09d4c1d67842f9c9b1c69b9
MD5 dc0d8b476742a4177e4ec2580d8e6065
SHA1 ab9259aff8167f931db707d4ecc763495ca57275
SHA512 ec26b417718eee97e33dc3931e63f550a832a28875400560f6c77bd1bf4e489e711061f694508959dccdeb1c2a2fa048cfddd45d34dda04a0834193cfe5f2bbb
SSDEEP 384:fwTJSxXFV3DIl6ILfx5094KDB4OJ94ku6ls94neG394MrBlDpJJr/vu8Eam311dH:4TzYtzysGlZsTm
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/setter.cs

SHA256 0eb8a8d05231b0f209aa1a3000d22c936c784760efd9cf25892b12de9c0bc602
MD5 7b2bb3ffe87c0c7b2a1ca4682b157f41
SHA1 925bab133f8bd4a28d4cb9e2f85fb887b0e1b81c
SHA512 8359ebc0c2ba5bea55d4b577c42c89151d7bbb254e393553f37f2d0d6694d2ae7d370bbb45472b33eacebf379d6f16497d30fe120e2b70f70d3aeefdba8f8ce9
SSDEEP 192:4KGyRgzwNGE3NbbuZgZ7c7JBX6g4QGYPsUs5:4KGigshbI4Tt
MD5 SHA1 SHA512 SSDEEP

LegionStealer V1 SRC/setter.resx

SHA256 ff93b70eaf7793495882fd361928221e9b210db7b038bae41288a46046de8965
MD5 3141fb5ab28f3760a4a411475c84f4cd
SHA1 65970e4708b23ef7b07bc4039c8c37c5b5f23d7b
SHA512 ded63c6acece56e9a9ab867cd44e665d929de8364e5a38c81217ee8b956894db594b4cd148bca2fcf6eb4dce04468d0de7253bc5882f8ccdcd72e34bee4b597d
SSDEEP 3072:Kj2AMNJ5XRQIInevatNhJjS3uatNhJjVatNhJjAMwL7pjUoC2PPDdfu:KnMNiHNtxe3FtxQtx0BC2XB2
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

LegionStealerV1 Source Code.zip

LegionStealer V1 SRC/App.config

LegionStealer V1 SRC/Builder.cs

LegionStealer V1 SRC/Common.cs

LegionStealer V1 SRC/Exploits.Designer.cs

LegionStealer V1 SRC/Exploits.cs

LegionStealer V1 SRC/Exploits.resx

LegionStealer V1 SRC/FakeMessageBox.cs

LegionStealer V1 SRC/FodyWeavers.xml

LegionStealer V1 SRC/FodyWeavers.xsd

LegionStealer V1 SRC/Form1.Designer.cs

LegionStealer V1 SRC/Form1.cs

LegionStealer V1 SRC/Form1.resx

LegionStealer V1 SRC/General.Designer.cs

LegionStealer V1 SRC/General.cs

LegionStealer V1 SRC/General.resx

LegionStealer V1 SRC/Main.cs

LegionStealer V1 SRC/Main.designer.cs

LegionStealer V1 SRC/Main.resx

LegionStealer V1 SRC/NewBuilder.cs

LegionStealer V1 SRC/NewRenamer.cs

LegionStealer V1 SRC/NewSettings.cs

LegionStealer V1 SRC/Program.cs

LegionStealer V1 SRC/Properties/AssemblyInfo.cs

LegionStealer V1 SRC/Properties/Resources.Designer.cs

LegionStealer V1 SRC/Properties/Resources.resx

LegionStealer V1 SRC/Properties/Settings.Designer.cs

LegionStealer V1 SRC/Properties/Settings.settings

LegionStealer V1 SRC/Set.cs

LegionStealer V1 SRC/Sver.Designer.cs

LegionStealer V1 SRC/Sver.cs

LegionStealer V1 SRC/Sver.resx

LegionStealer V1 SRC/asamlby.Designer.cs

LegionStealer V1 SRC/asamlby.cs

LegionStealer V1 SRC/asamlby.resx

LegionStealer V1 SRC/bin/Debug/My_Stealer_l3gion/My_Stealer_l3gion.rar

legion.stub

mscoree

dotnet

legionstealer.exe

mscoree

dotnet

LegionStealer V1 SRC/bin/Debug/My_Stealer_l3gion/legionstealer.exe

mscoree

dotnet

LegionStealer V1 SRC/bin/Debug/System.Diagnostics.DiagnosticSource.xml

LegionStealer V1 SRC/bin/Debug/Vestris.ResourceLib.xml

LegionStealer V1 SRC/bin/Debug/legionstealer.exe

mscoree

dotnet

LegionStealer V1 SRC/bin/Debug/legionstealer.exe.config

LegionStealer V1 SRC/bin/Debug/legionstealer.pdb

LegionStealer V1 SRC/bin/Debug/legionstealer.rar

LegionStealer V1 SRC/bin/Debug/setupstub.exe

mscoree

dotnet

LegionStealer V1 SRC/bin/Interop.IWshRuntimeLibrary.dll

mscoree

dotnet

LegionStealer V1 SRC/bin/Interop.IWshRuntimeLibrary.zip

Interop.IWshRuntimeLibrary.dll

mscoree

dotnet

dllme.txt

LegionStealer V1 SRC/bin/Release/CODE.txt

LegionStealer V1 SRC/bin/Release/System.Diagnostics.DiagnosticSource.xml

LegionStealer V1 SRC/bin/Release/Vestris.ResourceLib.xml

LegionStealer V1 SRC/bin/Release/legionstealer.exe

mscoree

dotnet

LegionStealer V1 SRC/bin/Release/legionstealer.exe.config

LegionStealer V1 SRC/bin/Release/legionstealer.pdb

LegionStealer V1 SRC/bin/Release/legionstealer_Secure/legionstealer.exe

mscoree

dotnet