NY TOOLS (1).zip
- SHA256 7a0fc390552b21b671a9f87934ab161bab03e08cef9383c24e66300894f14ec5
Password
bHQ3wJn5l9KQW8tTbh8ZOA
Overview
overview
9Static
static
3NY TOOLS/B...er.exe
windows7-x64
NY TOOLS/B...er.exe
windows10-2004-x64
DefCon/DefCon.rar
windows7-x64
3DefCon/DefCon.rar
windows10-2004-x64
3DefCon/Def...gs.vbs
windows7-x64
1DefCon/Def...gs.vbs
windows10-2004-x64
1DefCon/ReadMe.txt
windows7-x64
1DefCon/ReadMe.txt
windows10-2004-x64
1UNLOCKER V2.exe
windows7-x64
5UNLOCKER V2.exe
windows10-2004-x64
5bsod fix.bat
windows7-x64
1bsod fix.bat
windows10-2004-x64
1w11 fix.bat
windows7-x64
9w11 fix.bat
windows10-2004-x64
9UNLOCK ALL.exe
windows7-x64
9UNLOCK ALL.exe
windows10-2004-x64
9bsod fix.bat
windows7-x64
1bsod fix.bat
windows10-2004-x64
1w11 fix.bat
windows7-x64
9w11 fix.bat
windows10-2004-x64
9VIP-CHAIR.exe
windows7-x64
5VIP-CHAIR.exe
windows10-2004-x64
5bsod fix.bat
windows7-x64
1bsod fix.bat
windows10-2004-x64
1w11 fix.bat
windows7-x64
9w11 fix.bat
windows10-2004-x64
9Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NY TOOLS/BLOCKER&WOOFER/Loader.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
NY TOOLS/BLOCKER&WOOFER/Loader.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
DefCon/DefCon.rar
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
DefCon/DefCon.rar
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
DefCon/Defender_Settings.vbs
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
DefCon/Defender_Settings.vbs
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
DefCon/ReadMe.txt
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
DefCon/ReadMe.txt
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
UNLOCKER V2.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
UNLOCKER V2.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
bsod fix.bat
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
bsod fix.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
w11 fix.bat
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
w11 fix.bat
Resource
win10v2004-20240426-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral15
Sample
UNLOCK ALL.exe
Resource
win7-20240508-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral16
Sample
UNLOCK ALL.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral17
Sample
bsod fix.bat
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
bsod fix.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
w11 fix.bat
Resource
win7-20240215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral20
Sample
w11 fix.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral21
Sample
VIP-CHAIR.exe
Resource
win7-20240419-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
VIP-CHAIR.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
bsod fix.bat
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
bsod fix.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
w11 fix.bat
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral26
Sample
w11 fix.bat
Resource
win10v2004-20240426-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target NY TOOLS (1).zip
- Size 44.7MB
- Sample240611-wnnwgsware
- SHA256 7a0fc390552b21b671a9f87934ab161bab03e08cef9383c24e66300894f14ec5
- MD5 be418124d0c5f88ae1f8e38f4e637c12
- SHA1 930f93888fbef2fb9193a11c44a2eaf0374951f8
- SHA512 5428e94c71516b7e89e806f8901b2ccd112b4830a09a41a7ef145be25235321330609d30e201f68743fa9786b8b4441b8b89a0c533b2093ff970c24a0d7edb6d
- SSDEEP 786432:YyhQI0d9E15ivO8ylYLFh+C9sozoT8wukKh9fjFXdKIJwKrvoIB:jId9u5zqLFh+E3yIfjFNKIJCIB
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/NY TOOLS/BLOCKER&WOOFER/Loader.exe unpack005/UNLOCKER V2.exe unpack007/UNLOCK ALL.exe unpack009/VIP-CHAIR.exe
File Explorer
-
NY TOOLS (1).zip.zip .ps1 44.7MB
-
NY TOOLS/BLOCKER&WOOFER/Loader.exe.exe .ps1 20.9MB
-
NY TOOLS/DISABLE ANTIVIRUS/Defender_Control_v2.1.zip.zip 447KB
-
DefCon/DefCon.rar.rar 445KB
-
DefCon/Defender_Settings.vbs.vbs 313B
-
DefCon/ReadMe.txt2KB
-
DefCon/_Password.txt579B
-
NY TOOLS/UNLOCK ALL /UNLOCK ALL V2.rar.rar 5.2MB
-
UNLOCKER V2.exe.exe 5.6MB
-
bsod fix.bat415B
-
instructions.txt1KB
-
w11 fix.bat507B
-
NY TOOLS/UNLOCK ALL /UNLOCK ALL.rar.rar 13.0MB
-
UNLOCK ALL.exe.exe 13.2MB
-
bsod fix.bat415B
-
instructions.txt1KB
-
w11 fix.bat507B
-
NY TOOLS/VIP-CHAIR/VIP-CHAIR.rar.rar 5.2MB
-
VIP-CHAIR.exe.exe 5.6MB
-
bsod fix.bat415B
-
instructions.txt1KB
-
w11 fix.bat507B
NY TOOLS/BLOCKER&WOOFER/Loader.exe
- SHA256 77dc213ba8d1c31a3dcffb1195716a68ba077392f1ed0d9c9dd2c38dbb229458
- MD5 0d69a0c8a36cb686c159ef0da8e736be
- SHA1 1257ed7d6cbc48ee0e3fe927af91c33db334c03a
- SHA512 b4d8b5a780189ec245ca3270f5aae6114406ac37d5dfc453e202323fc321956b1d11b92c361787440f02295d4f6d180aa1b69b0a18959127d76106bc5f5cd575
- SSDEEP 393216:EhUhQ430ckp6baE15lkv/okhuIeOF87iaf5314kpYL8iAh2dhdzGoIfqsA:EyhQI0d9E15ivO8ylYLFh+CB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
bHQ3wJn5l9KQW8tTbh8ZOA
Minor OS version
0
Major OS version
6
Entry point
38334552
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
7.1MB
Virtual Size
15.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
87KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
17KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Windows
Size
Virtual Size
17.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
10.8MB
Virtual Size
10.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=206, id=261, version=30795,
count=17, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=103, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=7, id=253, version=33218,
count=18, id=260, version=33218,
count=18, id=259, version=33218,
count=97, id=261, version=33218,
count=26, id=257, version=30795,
count=3, id=123, version=2207,
count=334, id=1, productName=Unmarked objects,
count=12, id=265, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
NY TOOLS/DISABLE ANTIVIRUS/Defender_Control_v2.1.zip
- SHA256 f0dfda80cd905ffc133668198dad0fd61460c96876df4e1f6f80e3018a4d8895
- MD5 904541d4e7a83bff5ea0418835633f34
- SHA1 b86815aa5c7881f3d2a7d8f9a1324873c80fde10
- SHA512 918200695105a049870912269bfa6f54b62e55b13e4cdcdb1d64282cbd92ef4ccb1cfd37481854c94e5daaca78ecf387b6435c9cededd210c08ff71a895b8ec1
- SSDEEP 12288:wI7rMU6047sT0LdFObmFVfAWeIJ8qZa125+BMB:1X60GsGlfeYcy
- MD5 SHA1 SHA512 SSDEEP
Password
bHQ3wJn5l9KQW8tTbh8ZOA
DefCon/DefCon.rar
- SHA256 7e7c628c578afce5abbe1ba80d0d156857949766efa787c0ed307065e14909a6
- MD5 b46af7fc448e6fc31b4ef838e0235521
- SHA1 c5ba1edefa2241c721aa1fea589a81216315bc14
- SHA512 8cbf17d8adf989d4de022493e7634186b751271aaf5922e4d77dde58136d00a60eab0753849e14537ecdb20d3683f01c9b449fd723712323240a00a22faca2a1
- SSDEEP 12288:aI7rMU6047sT0LdFObmFVfAWeIJ8qZa125+BMr:zX60GsGlfeYc+
- MD5 SHA1 SHA512 SSDEEP
Password
bHQ3wJn5l9KQW8tTbh8ZOA
DefCon/Defender_Settings.vbs
- SHA256 af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
- MD5 b0bf0a477bcca312021177572311e666
- SHA1 ea77332d7779938ae8e92ad35d6dea4f4be37a92
- SHA512 09366608f2670d2eb0e8ddcacd081a7b2d7b680c4cdd02494d08821dbdf17595b30e88f6ce0888591592e7caa422414a895846a268fd63e8243074972c9f52d8
- MD5 SHA1 SHA512
DefCon/ReadMe.txt
- SHA256 d3b0219253a58ccb394559751299bd16dba1120e02cb11571c3b6a085b1027f8
- MD5 8dbe87a9bf6342c4e2ea406fa86e76bb
- SHA1 35fe083b3f5793fe1b803d091262e4dee2cd0c4d
- SHA512 3fca076f1c6fe286bef4d211fad2643e2c2e426d75e665c1a1c8dd241689fbd3911544b90f65e0b2ab25ce0ff63fc5520684ff7c1c2fb71be9cda6359a8b1c8e
- MD5 SHA1 SHA512
DefCon/_Password.txt
- SHA256 6299487f06d99d63bc0eeb238dbd52a8cbe8b75a9d2af3ec4e99cf8fd0fe18d3
- MD5 298453d3172225457a580da98b543235
- SHA1 9d38b671bb84bbb69963aa21332450092a0c8b38
- SHA512 7d8b5cf7a9bb45217c219b9250acc81557d1bd3e49e942471e873d2d0a3bf72e222a5be0191d8b0d2af36da83fcb3a82c74c9c1d7fb002f158219947595f17ed
- MD5 SHA1 SHA512
NY TOOLS/UNLOCK ALL /UNLOCK ALL V2.rar
- SHA256 64a0047a5acdba65562aee526e5c598884fec4c6e7862bb17b8f963064e9bc8e
- MD5 3630a83a49ddd4e05e709a94088cdf0f
- SHA1 9172b7edc790c10d02f631bc76298ca84ec9616e
- SHA512 939da4e97110d85f14c2d280fa6f2245cc0d63a702425f888ff2236add283b5fb33c6ca3b45780a8f1bcdc129aac1dc41282b0b22f84d55da3cd40d893132466
- SSDEEP 98304:KwHoMutDwoUR0W2Nv/pkWNir2wztAJ3eoUpE7193VRATkD6sWOcB4G1a+qd0IMO2:/C0qW2NTir2+KdeDEDVRAYD6sikpGdO2
- MD5 SHA1 SHA512 SSDEEP
Password
bHQ3wJn5l9KQW8tTbh8ZOA
UNLOCKER V2.exe
- IMPHASH 51235326a5333254d9a2e7b5ce26509f
- SHA256 3a5576c4e7d9ed56cc295fea24ef0fa68cf4235dfefa434caa32015887e757c3
- MD5 872b0fa8c0306040f181d08c5d7a252b
- SHA1 a08cf74361c96aa4d7e4503af6563c63b95f1973
- SHA512 23d8610ac8bfcb68695b652dd8d35edcc5f17994c90966ef0cabf11489d983cc852dd8e6d36ec85c78ec6f63cb6a7b21238a6d9687494f3ef99bc7ca86a4a277
- SSDEEP 98304:GRx4heu/+/tswG+PJPigEtVTH41ZE6HqM/aZeOO4wZivrH/LXmfI1ZWQpy:GL4gy+/tbG+PJa3txT6KKaLbwZivrjdJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
bHQ3wJn5l9KQW8tTbh8ZOA
Minor OS version
0
Major OS version
6
Entry point
8056346
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
� F��=j����@�>�4+��ج������;aG����iC�A�a� �)@���Ň�1 �i���A �5mx� ���u�"�ov�p�u�l ��G�4�u$5� b_�'�d������%E j���CJK��J@:�������OCO��\>�kk�۽>��6�ݮd�w��}� �� Jx���n%5� �A�*z[ 7We>T������h3_y˾�g'�s5�� ���s�A��[�CT� 5�ĉ����S�Y~�d3�Z0ӫ����o�e�5�cE$��{�U��y�*�_�F ����B9`��5_@Š`��ć�뚙od� ��66��Q/��w���8 ]&�-�^� e�<P�C,��f��N��ϲq���*FN�^M���UR�|� ��6@2�� t:�)����'n����o�NA�>��4��h3�;<��>/�(�p� n��������H����s��T�T�
յ���@�y�3���:���T2�f"���>�Mnneq8*$� ����%q`ǣ�&x�9ɤ]Q�d%08���/�NO��fNIm�DH6
V� "�n ��xzE������bcK|_{��>�PZ�4}��$ >%e�=S
r�?�h&1�]�� �P�
*o\�y�J��2�*�8��r��3{�U���+ �
��27��Ԭ���1b�cͩ��~˯it3�s"�q+Y!��y�az�jse1k"X��?f)~�C�#?��WY�������W۶${�a�z>{���h-7���删q�m�-(ݴ�$Mo�> ��D��rR�jh�EDʪ�&f[���BnnjD��C�����1E�� � m|z��e �W�� �|�݈s�; �R%���V��Z�埁�3�����T����Lb�.�?�MK��t��kEdXU!D�Je�xD�<�g�B�L���D4�K��~G��`s&�"QM��iȅ2r�@d�|T��WsQ� ���!&�9�;�e�-��UU�;�[��P��"�ML5<:_���Lj I���F�8V�݁�x
�J��͟���_������p5]9��ZރޞfpM��=S�:VD��0تX��MZwF��!��T���� i���Ev6+���;QoRL��P|���S���a��$|�,5��4_?T-oB���k�����qo~P⾢H�4��J 7wgf���V���ZC2�5��KE�S�m��~-��Ve������:C �w�#\�%�� �=�Cj% :����W�S�'�y�x =lM��gHŋT�������O��k��?"Úɶ�:/��m�%.��qc�kG~6{.]+A�2[O8� �O��S�<ỽ��Y��֦NY����g� ͕�Pf)�Py�������J!�ĥ7���{�P-��8��0�7ǵ*�z�鐫LxխPB��j�*l*#�f�h�&� Ov��%�����!Đ��*3��˫�ւ=0O�|�n�_��U�p!�tĴ��ݷ� 9��r�稶�V�@��! �q�B��yg{(��vI)e�2��#G��^� �{,��˿fA2�ⱌ,`h���WG'�a �� ���������a�7G�U�W�_H�1> v� >���xX��~��h��*(���9@��f-��h�}�
��� �)���ĭ��q�/֪��Yj�� ��S5�_����T�����&FP�a/� o2�� �~V���r�z] t��#
�X�&"��<��������b �=҇b*6T����$��Q�ш��O M��i�-W�W��ؑ��i��*8X��v�8'�ٛ1`�L�k_7�s'.�y�=y�o�Ż�w��y�F
��<`�i���8�_~���ٞ� y0��)<�� ������b�˞ba��:�O�cm^m ���˭�`*Tn��[�z�b ڭ_W_��D��d�R���ӯy`����@wR5�tk�| ���@���o�f �!)4��/]̆ <�F(�V���_�ww�>^�]r(��ǃ�����k�lτY!����z�t�����k�}�{1�\��6�GpT��F�*���������a��dF�Mj�( ��(��Fsv���r2��i�I���7�<��ÚN@�eL�Z�����᧵!�Oa �e�' d�^������(����n�~#�U��3�9`3ζ���Z���9.��Ӿ��d������[<��t7�b��'$hn��s�Q�UF�c�ۅ(���R{m���g��M�%{d��l6���F~.#���CT&�>���@i�X êt�D���p���Ѐ}8�� <���t����a� �(� =�Co�����R�i�`Q�UӰ�.��ޯe-���4�4���O��#�==?.M�U@u��L���g�c[�Kq�T��3 ��?]˰}<���T X���d�h`z���}��k���8�Z �%~iP;� (ky�
w�8�l�I�PE���;��B�n$L�)72�Ӳ���0������d]-��'��J��dJҳ_/[ ϊl����P�H�D ��l}��K����c���: �J U��r�J҄ ��h��s|�z/�� NPcM$%��i
�� (�������j��dg��`�r;�Aa]�L���DK�[|Ю;�/��cV�|�c~}J����h���
,�Y6p,� �X#l��ܰH����BE*A����Fz<��W$�4s� �,(�q����/��&��c��t`+�A�C�ѵ]'���� {�D̅��H��TS��Y9�&&X
%�a�_BA�8��<� �W����1<S�ޢX�-[x���G����
�'3�!�h� 3MU�ylU��h�"Ǜ���4��ܔ��C��J��/�� |�d�C�τre�6d;m��Ryq��jFL���'�99>L~�hP�jкA�L9 k���FD?lQE�V,b�� X�( Ɉ ��|��6I6,�x9�Ng��A[9
=
�6��'=d'h�� ��_
g)��� �����#X�F����Y�g��*�e�s+s`1t�t���tQ�n���Ȋ���,-ѵ�KjT+�qɅ���n=�гV�� <R�E���5-*� �X2���f��O5Fa� ���5��!��+I�^��d� ������-�� ���A����y��51�%! ���������Z��D� �,���Ő�5����k��!
Name
.text
Size
Virtual Size
456KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.lol0
Size
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.lol1
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.lol2
Size
5.6MB
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
212B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bsod fix.bat
- SHA256 318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
- MD5 392f331dc1744fbe560a2a17d7ca838f
- SHA1 817559945e137d036f47b26696d4fab5f22572c1
- SHA512 0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
- MD5 SHA1 SHA512
instructions.txt
- SHA256 6e9d7a74bff2718b61ce3bcc538a99662c8e47958f61f2bfa1dc014c0986410e
- MD5 060030231f16c28316db957b3b8f9d76
- SHA1 db81e86a6366955ef2cdcfc8f2933d2ca73ac580
- SHA512 50ebda840758fda86956b3700034d7117d52b8ba3a37500fc89d9dffc415f20a8ebcf94ec2ab4c7c937065ca8a80ce9da41cb47a14dad3f4f6a65d30a5bf3b3a
- MD5 SHA1 SHA512
w11 fix.bat
- SHA256 7ec1b31de3b0114c266df0b475c5c582a504c7c38f7127949df27f78a5d1c026
- MD5 6fb44052dc5a85a097feeb91d7a81712
- SHA1 29db33e6cf3286a6ba82af684ac535d42b43d257
- SHA512 ee9dbcc0a7340ec6fe968ba611f0849fd1b77b88cb5deaad4c6a516a417abaf14055021e949ca04fde979364f060504c911fede81b0c492b651ea1b3f246494a
- MD5 SHA1 SHA512
NY TOOLS/UNLOCK ALL /UNLOCK ALL.rar
- SHA256 4090afdbf6ec9d8517602272c0b5eddc90b48988cf440ba68b754ed4397f75bd
- MD5 5d58cec75effbfe727afc2b22d111f23
- SHA1 656574c5a66788ed75acc691b9d8c5d831de0e3f
- SHA512 56ca77024801a90d03f2ccbff02fdbb06e74b28a81e2ae556c8be51da1abb12e5db7a44de6c9fcfcca2fceff2c2e6cdf1afb4877ac41c1f83570e979c6c30cd8
- SSDEEP 393216:iofp0xsvFn1zmiR+2UEKFLVkCcJTwF36rMK/otzgJs:3fjFXdKIJwKrvoIs
- MD5 SHA1 SHA512 SSDEEP
Password
bHQ3wJn5l9KQW8tTbh8ZOA
UNLOCK ALL.exe
- SHA256 22d3b9f8872c784da7f2fe39ae826c36e6a373f07568043aa40a234b9f73047b
- MD5 4388bf1bacc99fb238d16a3885066755
- SHA1 d7adf519cd3c188e6f9f99dc78c6e4510320beb6
- SHA512 9a3b0b7b85d99705c437b72d65b1a2fd1bb03d4fbff637225422680e0fa871ad0251e6c83dea9c866c429a9258865e439ccf976340b765882ec9cf5f0b36c7ab
- SSDEEP 393216:YKv8XedcqxSu2gI7+GXEG1FcSCQE5uYPxNDMQ+s8P:YKTrP95GXE5LQE5Jbxy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
bHQ3wJn5l9KQW8tTbh8ZOA
Minor OS version
0
Major OS version
6
Entry point
20811864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
391KB
Virtual Size
681KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
94KB
Virtual Size
208KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2.9MB
Virtual Size
2.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
17KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Windows
Size
Virtual Size
16.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
9.8MB
Virtual Size
9.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=206, id=261, version=30795,
count=17, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=103, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=7, id=253, version=33030,
count=18, id=260, version=33030,
count=18, id=259, version=33030,
count=96, id=261, version=33030,
count=26, id=257, version=30795,
count=3, id=123, version=2207,
count=327, id=1, productName=Unmarked objects,
count=13, id=261, version=33133,
count=1, id=255, version=33133,
count=1, id=258, version=33133,
bsod fix.bat
- SHA256 318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
- MD5 392f331dc1744fbe560a2a17d7ca838f
- SHA1 817559945e137d036f47b26696d4fab5f22572c1
- SHA512 0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
- MD5 SHA1 SHA512
instructions.txt
- SHA256 6e9d7a74bff2718b61ce3bcc538a99662c8e47958f61f2bfa1dc014c0986410e
- MD5 060030231f16c28316db957b3b8f9d76
- SHA1 db81e86a6366955ef2cdcfc8f2933d2ca73ac580
- SHA512 50ebda840758fda86956b3700034d7117d52b8ba3a37500fc89d9dffc415f20a8ebcf94ec2ab4c7c937065ca8a80ce9da41cb47a14dad3f4f6a65d30a5bf3b3a
- MD5 SHA1 SHA512
w11 fix.bat
- SHA256 7ec1b31de3b0114c266df0b475c5c582a504c7c38f7127949df27f78a5d1c026
- MD5 6fb44052dc5a85a097feeb91d7a81712
- SHA1 29db33e6cf3286a6ba82af684ac535d42b43d257
- SHA512 ee9dbcc0a7340ec6fe968ba611f0849fd1b77b88cb5deaad4c6a516a417abaf14055021e949ca04fde979364f060504c911fede81b0c492b651ea1b3f246494a
- MD5 SHA1 SHA512
NY TOOLS/VIP-CHAIR/VIP-CHAIR.rar
- SHA256 28f11cf5fa5248e188c52a7377dcbff8e6ec8e9528a9e8211f5d5a183035f02d
- MD5 d68b10d49700fb884b573f7b9704f4ef
- SHA1 e4b59fa533dae68c21292b5d5f35760de96fc1ad
- SHA512 ae7bb38f4fab73f5b7a9a418bd0bf33d794eb191f176ba123e2d05978ec1ccc27b52c26cd5f301972c72602ee8bcaf1e39a7962c6e0120c724b45171aee23f63
- SSDEEP 98304:PpNKuf40W6Vp2GalkV0Df9NEgG/Ujf8hB5eZUI0L+L770XsTvffo9sixZn:RNKuOdiVQRmUohBRC7tTPysCB
- MD5 SHA1 SHA512 SSDEEP
Password
bHQ3wJn5l9KQW8tTbh8ZOA
VIP-CHAIR.exe
- IMPHASH 66de54f56b9c026baa5134a68ce00c6f
- SHA256 358e6a243ff184b5d0770e8c442a2a883257e925e66e2cb8c42e137d19059953
- MD5 1456d19f6e07ae3374e5c296f205a7e5
- SHA1 21391320b8f27e7f8bbf9f25c0e97f58a82f5c28
- SHA512 0ccdbeeae6f05ebc8fae56b241e9ab9a090d5c3c771bcb9a6415c09f1217f02aa2e2465e4deb833c8a5d16139fb69e172d77c7c0dbf7ef25e217bc84a7319ba4
- SSDEEP 98304:l5Po/g9kQoDuhk2M2uHSwfdnX/aqeAZnOIBggY5smGbirNFUM5p3KS:/o/EkJCduywkVAZnOIY5sJaAW3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5475058
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
isupper
ǫON�m�b��Vk" �Ree"��������F�2'�܇�L�HÚbcN��� � �����*��'����GFG��Y4'忡X�d-n��!9(m���ˉ��l#�l-}l#�P���1�g ������hJ��� J��b���Fl��-n��ЎI�b�� ����h���5�vQy��<����M�YB�<���;8��?��=Ι��4��
� \�ڦ���fp�A�-���]�_p��W�'��n9 l�̀z�}"P�]�f ���F_�m��������x%����K`\�����i'W��B�-
��\�y����0�J��0�n\�B�� ٶ� ��q=��4��ɨ��\��X� э{a�=hs�@�j+��V�O�MFu�q#�1�a���M�o� #n����#�����8@��7a�D�6h��ƶ�ڭx˹���H�Z��]�;�o��)�bx�3��vi'�����G~,�#�ã !3�/�>�ٮ���9�l�+�`J2�iN ���/�o�IJ��6��L¬�����0g8Q̂���qH ��vc
מې:�n�ƪ3i⿰�ɪ�v@�x�^� U��=g�/s�ݏ���<vATh �28Oֲo�= 8��I)��F%"r�~�32����p5����%����m��N�����?0��[���RGGPy��� К�f��e
�(<���~G"aXN$��w�f�`4&{ٱpOI!�R��f�`��b�e� �U�/)��m�pʋ��@1�Fn;L� ��l]�J��ٯy1�:�r� ���ؕLP���(g�����ڹ������)�`�7�#>�0e@y~�%N&ٜ��D?�鎃GX�A�b�7#���'Ԗ7�*��h~H �Skxui��ӕ# �MJ��� Q�W<E�}ZS�b=(d �RETE�` [�b��aQ;���O
��r,bg�x"款O��>b �]c�����E^���%����N��� S�}�Ը�V
�����:��)�WVA.�F�F���m�Rs{j�QT,q�l �D&[L+����R=��v�%��7G��#�[%V��g��~�z�l��=��4X�"���D4Ѕ����Hk�819�;�$lL� ��{�
~��3����!LꜼ���)k唸�OBDɆa���ǀ�uF�G�'��]��"bxIi7C}Ó�Ai#H+�4�_�E+�4j�s�]N� ���4��!>�tx�/�,wݶ����o�8T`���H�C5|�GEC�
�6�����IʘrD���q w��)c�2ǃ�?��{���"�����E��ݕt
�R�v�� \��M�뇟�A:5�46z�%&H�^ ^�����.ݳ�g7��2����5ALa�g��@\ݷ���vz}dC��ܔ�D���O��4�h�hT���w�L�8�
���]�fh�nY�����
���i�+�"|f��f��1!�>G=:�gu��!�h%� �*�p��`���]��5��2��ݫjB�F����e� }u��<WÒ9Z} ó�s�r�u�� ���dk�� a� �c��>��=�߸�_-
��f_�J�{��Ƹ��c��;�_��+W�;�ۚ�4x���(����9T�ȋ� �ָ' U;�ԓ`����q����,S /�C�3kr�t�g��k�)�Wnx^Ŝ5r«_HC��b���轵��ދ4C�U �������� ����4���Q����@�N�! <5Q�7�
��ᅗ �=� 8R,�-�
F� )�"��`���jy�����R
(ίf���9o<HQ�f}�d��=OGnE����^�����KC�E�㔫JXe�h�sҕ?�Fj��m;�$ �g�{p�<,�=_/��ʳ�=3�t�� ��y#�}JW��ː��aRy��P��C������ >��V�Ǜ�� �ۦ��{��� �+�V�/wSE��^�=� p
iX�q(\ߺr®GS��I� �� 4Sx [^��/D��HRK�rx[�~�H�mYi�W�
�*�(������t0
z~��>\ʅb���ߦ��!az8�o��0����*��jQ�m��ϭb�DI|�V� #��Aʇ)� dU֩]��G��Z������kB`]���J�J�SE@#,���i��iA�D��ƍ�"� LŤ�Q~�P)' ��h}`�����:�QU�H*���),�����q�D* ����|����W��H �%1��l fƿ ?�u�B�P�G�(��,i [ڐ&��L/P�����bF���ѭ��$�|�w?������|���{�t�O_�с표� 2��81��I�������ߎ
���$u7�*#�.ᖋ/>R ����)��,� Ͽ�65�'��R�oY=!"م72�R���x�n d.�s� [�����v����o�3TG�N�;��Cp
E���e8�� 7s��+��T#�|)��@��<�f*�P��u��w�m}; �^
d�з�&�.���y8�f�w�������O����7�#k�I������������ b!��}N.Za mV�;��͙=
��?������tA��'��]ƥ�� ��;��̂�L����B&2 ����P��%K�����+�L��#5�d�Q�^]�Q�
�{!
��*
���h����C}˴f�O�y0���M"��A<߬�퇎(��&a������?� ���*�{������ S�ҏYZ�P鰂V���R�� �?.����Gn���[�qt����K7F��0@A��~א`�r�.N ��\O�7j�y �.���������D���������|�>��=É�7�-�F���M��I�X� �[���hfoʠ�=��X�L��nUJj>���"ŸW��g>��X�]�ɢ�F�9Zʀ|j��qg6�=~A��[���"��7�����,FS�� � �(���aD��&QQ`�]0����
&����<wk�L��p����U��e�����7� ��
{�'�r.Y%��ܳ���i��1���g@Dj R8�]���,�wX5.�[��#������H�#�Q5J�0��G!x����C�5��U�2W~������RT��2���Υ���F� �I^N���l��X��d:Q���O;x�|�'Ρ�h�E� �������e�(fnW ��{�
Name
.text
Size
Virtual Size
462KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.lol0
Size
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.lol1
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.lol2
Size
5.6MB
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bsod fix.bat
- SHA256 318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
- MD5 392f331dc1744fbe560a2a17d7ca838f
- SHA1 817559945e137d036f47b26696d4fab5f22572c1
- SHA512 0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
- MD5 SHA1 SHA512
instructions.txt
- SHA256 d3725b7407a38a44cbbed309f86aa153e37d0aa4c899d803f66ebfb0fa32e91d
- MD5 c955199f059659b2435e0a6ecf781754
- SHA1 49818da7e7b60f1c2bc3f89fd5dc46e77286008e
- SHA512 dd4e2bc6ef8d3ab17237c3705cc1673fc46444527b8ae8935635e051e62843b4b3b8c064b373fc4f82041057a32b9919abcd2b1e18e56ae64b8fec64495b8fb2
- MD5 SHA1 SHA512
w11 fix.bat
- SHA256 7ec1b31de3b0114c266df0b475c5c582a504c7c38f7127949df27f78a5d1c026
- MD5 6fb44052dc5a85a097feeb91d7a81712
- SHA1 29db33e6cf3286a6ba82af684ac535d42b43d257
- SHA512 ee9dbcc0a7340ec6fe968ba611f0849fd1b77b88cb5deaad4c6a516a417abaf14055021e949ca04fde979364f060504c911fede81b0c492b651ea1b3f246494a
- MD5 SHA1 SHA512