�F��=j����@�>�4+��ج������;aG����iC�A�a� �)@���Ň�1�i���A �5mx����u�"�ov�p�u�l��G�4�u$5�b_�'�d������%E j���CJK��J@:�������OCO��\>�kk�۽>��6�ݮd�w��}���Jx���n%5� �A�*z[ 7We>T������h3_y˾�g'�s5�����s�A��[�CT� 5�ĉ����S�Y~�d3�Z0ӫ����o�e�5�cE$��{�U��y�*�_�F����B9`��5_@Š`��ć�뚙od� ��66��Q/��w���8]&�-�^�e�<P�C,��f��N��ϲq���*FN�^M���UR�|���6@2��t:�)����'n����o�NA�>��4��h3�;<��>/�(�p� n��������H����s��T�T� յ���@�y�3���:���T2�f"���>�Mnneq8*$�����%q`ǣ�&x�9ɤ]Q�d%08���/�NO��fNIm�DH6 V�"�n��xzE������bcK|_{��>�PZ�4}��$>%e�=S r�?�h&1�]�� �P� *o\�y�J��2�*�8��r��3{�U���+� ��27��Ԭ���1b�cͩ��~˯it3�s"�q+Y!��y�az�jse1k"X��?f)~�C�#?��WY�������W۶${�a�z>{���h-7���删q�m�-(ݴ�$Mo�>��D��rR�jh�EDʪ�&f[���BnnjD��C�����1E�� � m|z��e�W���|�݈s�;�R%���V��Z�埁�3�����T����Lb�.�?�MK��t��kEdXU!D�Je�xD�<�g�B�L���D4�K��~G��`s&�"QM��iȅ2r�@d�|T��WsQ� ���!&�9�;�e�-��UU�;�[��P��"�ML5<:_���LjI���F�8V�݁�x �J��͟���_������p5]9��ZރޞfpM��=S�:VD��0تX��MZwF��!��T����i���Ev6+���;QoRL��P|���S���a��$|�,5��4_?T-oB���k�����qo~P⾢H�4��J7wgf���V���ZC2�5��KE�S�m��~-��Ve������:C �w�#\�%���=�Cj%:����W�S�'�y�x=lM��gHŋT�������O��k��?"Úɶ�:/��m�%.��qc�kG~6{.]+A�2[O8��O��S�<ỽ��Y��֦NY����g�͕�Pf)�Py�������J!�ĥ7���{�P-��8��0�7ǵ*�z�鐫LxխPB��j�*l*#�f�h�&�Ov��%�����!Đ��*3��˫�ւ=0O�|�n�_��U�p!�tĴ��ݷ�9��r�稶�V�@��!�q�B��yg{(��vI)e�2��#G��^��{,��˿fA2�ⱌ,`h���WG'�a �����������a�7G�U�W�_H�1> v�>���xX��~��h��*(���9@��f-��h�}� ��� �)���ĭ��q�/֪��Yj����S5�_����T�����&FP�a/� o2�� �~V���r�z]t��# �X�&"��<��������b�=҇b*6T����$��Q�ш��OM��i�-W�W��ؑ��i��*8X��v�8'�ٛ1`�L�k_7�s'.�y�=y�o�Ż�w��y�F ��<`�i���8�_~���ٞ�y0��)<��������b�˞ba��:�O�cm^m���˭�`*Tn��[�z�bڭ_W_��D��d�R���ӯy`����@wR5�tk�| ���@���o�f�!)4��/]̆<�F(�V���_�ww�>^�]r(��ǃ�����k�lτY!����z�t�����k�}�{1�\��6�GpT��F�*���������a��dF�Mj�(��(��Fsv���r2��i�I���7�<��ÚN@�eL�Z�����᧵!�Oa �e�'d�^������(����n�~#�U��3�9`3ζ���Z���9.��Ӿ��d������[<��t7�b��'$hn��s�Q�UF�c�ۅ(���R{m���g��M�%{d��l6���F~.#���CT&�>���@i�Xêt�D���p���Ѐ}8��<���t����a� �(�=�Co�����R�i�`Q�UӰ�.��ޯe-���4�4���O��#�==?.M�U@u��L���g�c[�Kq�T��3��?]˰}<���TX���d�h`z���}��k���8�Z�%~iP;�(ky� w�8�l�I�PE���;��B�n$L�)72�Ӳ���0������d]-��'��J��dJҳ_/[ϊl����P�H�D��l}��K����c���:�JU��r�J҄��h��s|�z/��NPcM$%��i ��(�������j��dg��`�r;�Aa]�L���DK�[|Ю;�/��cV�|�c~}J����h��� ,�Y6p,��X#l��ܰH����BE*A����Fz<��W$�4s��,(�q����/��&��c��t`+�A�C�ѵ]'���� {�D̅��H��TS��Y9�&&X %�a�_BA�8��<��W����1<S�ޢX�-[x���G���� �'3�!�h�3MU�ylU��h�"Ǜ���4��ܔ��C��J��/��|�d�C�τre�6d;m��Ryq��jFL���'�99>L~�hP�jкA�L9k���FD?lQE�V,b��X�(Ɉ��|��6I6,�x9�Ng��A[9 = �6��'=d'h����_ g)��� �����#X�F����Y�g��*�e�s+s`1t�t���tQ�n���Ȋ���,-ѵ�KjT+�qɅ���n=�гV��<R�E���5-*� �X2���f��O5Fa����5��!��+I�^��d�������-�����A����y��51�%!���������Z��D��,���Ő�5����k��!
Overview
overview
9Static
static
3NY TOOLS/B...er.exe
windows7-x64
NY TOOLS/B...er.exe
windows10-2004-x64
DefCon/DefCon.rar
windows7-x64
3DefCon/DefCon.rar
windows10-2004-x64
3DefCon/Def...gs.vbs
windows7-x64
1DefCon/Def...gs.vbs
windows10-2004-x64
1DefCon/ReadMe.txt
windows7-x64
1DefCon/ReadMe.txt
windows10-2004-x64
1UNLOCKER V2.exe
windows7-x64
5UNLOCKER V2.exe
windows10-2004-x64
5bsod fix.bat
windows7-x64
1bsod fix.bat
windows10-2004-x64
1w11 fix.bat
windows7-x64
9w11 fix.bat
windows10-2004-x64
9UNLOCK ALL.exe
windows7-x64
9UNLOCK ALL.exe
windows10-2004-x64
9bsod fix.bat
windows7-x64
1bsod fix.bat
windows10-2004-x64
1w11 fix.bat
windows7-x64
9w11 fix.bat
windows10-2004-x64
9VIP-CHAIR.exe
windows7-x64
5VIP-CHAIR.exe
windows10-2004-x64
5bsod fix.bat
windows7-x64
1bsod fix.bat
windows10-2004-x64
1w11 fix.bat
windows7-x64
9w11 fix.bat
windows10-2004-x64
9Static task
static1
Behavioral task
behavioral1
Sample
NY TOOLS/BLOCKER&WOOFER/Loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
NY TOOLS/BLOCKER&WOOFER/Loader.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
DefCon/DefCon.rar
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
DefCon/DefCon.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
DefCon/Defender_Settings.vbs
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
DefCon/Defender_Settings.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
DefCon/ReadMe.txt
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
DefCon/ReadMe.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
UNLOCKER V2.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
UNLOCKER V2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
bsod fix.bat
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
bsod fix.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
w11 fix.bat
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
w11 fix.bat
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
UNLOCK ALL.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
UNLOCK ALL.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
bsod fix.bat
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
bsod fix.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
w11 fix.bat
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
w11 fix.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
VIP-CHAIR.exe
Resource
win7-20240419-en
Behavioral task
behavioral22
Sample
VIP-CHAIR.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
bsod fix.bat
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
bsod fix.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
w11 fix.bat
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
w11 fix.bat
Resource
win10v2004-20240426-en
General
-
Target
NY TOOLS (1).zip
-
Size
44.7MB
-
MD5
be418124d0c5f88ae1f8e38f4e637c12
-
SHA1
930f93888fbef2fb9193a11c44a2eaf0374951f8
-
SHA256
7a0fc390552b21b671a9f87934ab161bab03e08cef9383c24e66300894f14ec5
-
SHA512
5428e94c71516b7e89e806f8901b2ccd112b4830a09a41a7ef145be25235321330609d30e201f68743fa9786b8b4441b8b89a0c533b2093ff970c24a0d7edb6d
-
SSDEEP
786432:YyhQI0d9E15ivO8ylYLFh+C9sozoT8wukKh9fjFXdKIJwKrvoIB:jId9u5zqLFh+E3yIfjFNKIJCIB
Malware Config
Signatures
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/NY TOOLS/BLOCKER&WOOFER/Loader.exe unpack005/UNLOCKER V2.exe unpack007/UNLOCK ALL.exe unpack009/VIP-CHAIR.exe
Files
-
NY TOOLS (1).zip.zip .ps1 polyglot
Password: bHQ3wJn5l9KQW8tTbh8ZOA
-
NY TOOLS/BLOCKER&WOOFER/Loader.exe.exe .ps1 windows:6 windows x64 arch:x64 polyglot
Password: bHQ3wJn5l9KQW8tTbh8ZOA
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 7.1MB - Virtual size: 15.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 87KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Windows Size: - Virtual size: 17.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 10.8MB - Virtual size: 10.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
NY TOOLS/DISABLE ANTIVIRUS/Defender_Control_v2.1.zip.zip
Password: bHQ3wJn5l9KQW8tTbh8ZOA
-
DefCon/DefCon.rar.rar
Password: bHQ3wJn5l9KQW8tTbh8ZOA
-
DefCon/Defender_Settings.vbs.vbs
-
DefCon/ReadMe.txt
-
DefCon/_Password.txt
-
NY TOOLS/UNLOCK ALL /UNLOCK ALL V2.rar.rar
Password: bHQ3wJn5l9KQW8tTbh8ZOA
-
UNLOCKER V2.exe.exe windows:6 windows x64 arch:x64
Password: bHQ3wJn5l9KQW8tTbh8ZOA
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 456KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
bsod fix.bat
-
instructions.txt
-
w11 fix.bat
-
NY TOOLS/UNLOCK ALL /UNLOCK ALL.rar.rar
Password: bHQ3wJn5l9KQW8tTbh8ZOA
-
UNLOCK ALL.exe.exe windows:6 windows x64 arch:x64
Password: bHQ3wJn5l9KQW8tTbh8ZOA
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 391KB - Virtual size: 681KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 94KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 17KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Windows Size: - Virtual size: 16.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 9.8MB - Virtual size: 9.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
bsod fix.bat
-
instructions.txt
-
w11 fix.bat
-
NY TOOLS/VIP-CHAIR/VIP-CHAIR.rar.rar
Password: bHQ3wJn5l9KQW8tTbh8ZOA
-
VIP-CHAIR.exe.exe windows:6 windows x64 arch:x64
66de54f56b9c026baa5134a68ce00c6f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?good@ios_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord33
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
ungetc
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
isupper
Exports
Exports
ǫON�m�b��Vk"�Ree"��������F�2'�܇�L�HÚbcN���������*��'����GFG��Y4'忡X�d-n��!9(m���ˉ��l#�l-}l#�P���1�g ������hJ��� J��b���Fl��-n��ЎI�b������h���5�vQy��<����M�YB�<���;8��?��=Ι��4�� �\�ڦ���fp�A�-���]�_p��W�'��n9l�̀z�}"P�]�f���F_�m��������x%����K`\�����i'W��B�- ��\�y����0�J��0�n\�B��ٶ� ��q=��4��ɨ��\��X�э{a�=hs�@�j+��V�O�MFu�q#�1�a���M�o� #n����#�����8@��7a�D�6h��ƶ�ڭx˹���H�Z��]�;�o��)�bx�3��vi'�����G~,�#�ã!3�/�>�ٮ���9�l�+�`J2�iN���/�o�IJ��6��L¬�����0g8Q̂���qH ��vc מې:�n�ƪ3i⿰�ɪ�v@�x�^�U��=g�/s�ݏ���<vATh�28Oֲo�=8��I)��F%"r�~�32����p5����%����m��N�����?0��[���RGGPy���К�f��e �(<���~G"aXN$��w�f�`4&{ٱpOI!�R��f�`��b�e��U�/)��m�pʋ��@1�Fn;L� ��l]�J��ٯy1�:�r����ؕLP���(g�����ڹ������)�`�7�#>�0e@y~�%N&ٜ��D?�鎃GX�A�b�7#���'Ԗ7�*��h~H�Skxui��ӕ# �MJ���Q�W<E�}ZS�b=(d�RETE�`[�b��aQ;���O ��r,bg�x"款O��>b�]c�����E^���%����N���S�}�Ը�V �����:��)�WVA.�F�F���m�Rs{j�QT,q�l�D&[L+����R=��v�%��7G��#�[%V��g��~�z�l��=��4X�"���D4Ѕ����Hk�819�;�$lL���{� ~��3����!LꜼ���)k唸�OBDɆa���ǀ�uF�G�'��]��"bxIi7C}Ó�Ai#H+�4�_�E+�4j�s�]N����4��!>�tx�/�,wݶ����o�8T`���H�C5|�GEC� �6�����IʘrD���q w��)c�2ǃ�?��{���"�����E��ݕt �R�v��\��M�뇟�A:5�46z�%&H�^^�����.ݳ�g7��2����5ALa�g��@\ݷ���vz}dC��ܔ�D���O��4�h�hT���w�L�8� ���]�fh�nY����� ���i�+�"|f��f��1!�>G=:�gu��!�h%� �*�p��`���]��5��2��ݫjB�F����e�}u��<WÒ9Z} ó�s�r�u�� ���dk��a� �c��>��=�߸�_- ��f_�J�{��Ƹ��c��;�_��+W�;�ۚ�4x���(����9T�ȋ��ָ'U;�ԓ`����q����,S/�C�3kr�t�g��k�)�Wnx^Ŝ5r«_HC��b���轵��ދ4C�U������������4���Q����@�N�!<5Q�7� ��ᅗ�=�8R,�-� F� )�"��`���jy�����R (ίf���9o<HQ�f}�d��=OGnE����^�����KC�E�㔫JXe�h�sҕ?�Fj��m;�$�g�{p�<,�=_/��ʳ�=3�t�� ��y#�}JW��ː��aRy��P��C������>��V�Ǜ�� �ۦ��{����+�V�/wSE��^�=�p iX�q(\ߺr®GS��I� �� 4Sx[^��/D��HRK�rx[�~�H�mYi�W� �*�(������t0 z~��>\ʅb���ߦ��!az8�o��0����*��jQ�m��ϭb�DI|�V� #��Aʇ)�dU֩]��G��Z������kB`]���J�J�SE@#,���i��iA�D��ƍ�"� LŤ�Q~�P)'��h}`�����:�QU�H*���),�����q�D* ����|����W��H �%1��lfƿ?�u�B�P�G�(��,i[ڐ&��L/P�����bF���ѭ��$�|�w?������|���{�t�O_�с표�2��81��I�������ߎ ���$u7�*#�.ᖋ/>R ����)��,�Ͽ�65�'��R�oY=!"م72�R���x�nd.�s�[�����v����o�3TG�N�;��Cp E���e8��7s��+��T#�|)��@��<�f*�P��u��w�m};�^ d�з�&�.���y8�f�w�������O����7�#k�I������������ b!��}N.ZamV�;��͙= ��?������tA��'��]ƥ�� ��;��̂�L����B&2����P��%K�����+�L��#5�d�Q�^]�Q� �{! ��* ���h����C}˴f�O�y0���M"��A<߬�퇎(��&a������?����*�{������S�ҏYZ�P鰂V���R���?.����Gn���[�qt����K7F��0@A��~א`�r�.N��\O�7j�y�.���������D���������|�>��=É�7�-�F���M��I�X��[���hfoʠ�=��X�L��nUJj>���"ŸW��g>��X�]�ɢ�F�9Zʀ|j��qg6�=~A��[���"��7�����,FS����(���aD��&QQ`�]0���� &����<wk�L��p����U��eä������7��� {�'�r.Y%��ܳ���i��1���g@Dj R8�]���,�wX5.�[��#������H�#�Q5J�0��G!x����C�5��U�2W~������RT��2���Υ���F��I^N���l��X��d:Q���O;x�|�'Ρ�h�E��������e�(fnW ��{�
Sections
.text Size: - Virtual size: 462KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
bsod fix.bat
-
instructions.txt
-
w11 fix.bat