Downloads+12.6.24.rar
- SHA256 66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2
Overview
overview
9Static
static
7Downloads ...v2.exe
windows7-x64
9Downloads ...v2.exe
windows10-2004-x64
9Downloads ...S2.exe
windows7-x64
1Downloads ...S2.exe
windows10-2004-x64
1Downloads ...ir.exe
windows7-x64
1Downloads ...ir.exe
windows10-2004-x64
8Downloads ...er.exe
windows7-x64
9Downloads ...er.exe
windows10-2004-x64
9Downloads ...or.exe
windows7-x64
9Downloads ...or.exe
windows10-2004-x64
9Downloads ...q1.exe
windows7-x64
5Downloads ...q1.exe
windows10-2004-x64
5Downloads ...ix.bat
windows7-x64
1Downloads ...ix.bat
windows10-2004-x64
1Downloads ...ix.bat
windows7-x64
9Downloads ...ix.bat
windows10-2004-x64
9Downloads ...ix.bat
windows7-x64
1Downloads ...ix.bat
windows10-2004-x64
1Downloads ...b1.exe
windows7-x64
5Downloads ...b1.exe
windows10-2004-x64
5Downloads ...ix.bat
windows7-x64
9Downloads ...ix.bat
windows10-2004-x64
9Behavioral task
behavioral1
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Blocker v2.exe
Resource
win7-20240705-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Blocker v2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral3
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/CS2.exe
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/CS2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Loud Chair.exe
Resource
win7-20240704-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Loud Chair.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral7
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Perm Woofer.exe
Resource
win7-20240729-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral8
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Perm Woofer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral9
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Privacy Protector.exe
Resource
win7-20240705-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Privacy Protector.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral11
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/Byr723V3Cq1.exe
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/Byr723V3Cq1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/bsod fix.bat
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/bsod fix.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/w11 fix.bat
Resource
win7-20240705-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral16
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/w11 fix.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral17
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/bsod fix.bat
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/bsod fix.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/nRi28Wtqb1.exe
Resource
win7-20240729-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/nRi28Wtqb1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/w11 fix.bat
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral22
Sample
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/w11 fix.bat
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target Downloads+12.6.24.rar
- Size 80.7MB
- Sample240811-3bewdaybpc
- SHA256 66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2
- MD5 6581ff2dd9ee474331780c2112500d6a
- SHA1 a164068608d9c2b32e07a0534617716c49629230
- SHA512 a9aa014dfaab0f60b69e6ec8b7d9a466d5f976543507727257cf3b09c4fc202e7ff9cba9cc46a284cb891cdb49d95a226f27d7f64cf5d4f84b9e1e9cce91968a
- SSDEEP 1572864:qRZgqlQF1RtT241GjCmpieL4IK7iilrrtAycBAHyw+GCzYhXKs5l44jm4/usyXQ7:qQfT241GjCmp/GxRURqdKWmOHwq
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Downloads 12.6.24/Downloads 12.6.24/Downloads/Privacy Protector.exe themida - Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/Downloads 12.6.24/Downloads 12.6.24/Downloads/Blocker v2.exe unpack001/Downloads 12.6.24/Downloads 12.6.24/Downloads/CS2.exe unpack001/Downloads 12.6.24/Downloads 12.6.24/Downloads/Loud Chair.exe unpack001/Downloads 12.6.24/Downloads 12.6.24/Downloads/Perm Woofer.exe unpack001/Downloads 12.6.24/Downloads 12.6.24/Downloads/Privacy Protector.exe unpack001/Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/Byr723V3Cq1.exe unpack001/Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/nRi28Wtqb1.exe
File Explorer
-
Downloads+12.6.24.rar.rar 80.7MB
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Blocker v2.exe.exe 12.4MB
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/CS2.exe.exe 7.1MB
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Loud Chair.exe.exe 18.9MB
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Perm Woofer.exe.exe 28.1MB
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Privacy Protector.exe.exe 8.6MB
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/Byr723V3Cq1.exe.exe 5.6MB
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/bsod fix.bat415B
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/instructions.txt1KB
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/w11 fix.bat507B
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/bsod fix.bat415B
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/instructions.txt1KB
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/nRi28Wtqb1.exe.exe 5.6MB
-
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/w11 fix.bat507B
Downloads 12.6.24/Downloads 12.6.24/Downloads/Blocker v2.exe
- SHA256 deae15597f320e6c3b7b655947a6ef9459027790d452f5e1f2559b15ce50a2df
- MD5 a9c090dde54cb5f996b3e15da5fe3b08
- SHA1 e799961d2a957c2b84dc6ff32e73c5cabe45a395
- SHA512 21e1a2d4e14399ecf3e5d085d0017b756ba8821708c8d5601c718fea356af1b701e60d2d61d8cdaabd7e962975d5bf230e6d421ac1e620556e3d8c605e1f87d8
- SSDEEP 393216:6Pyeiimo7NiqXDCzcQ9Lnp/4ygyeF53i4F2CucQOuons:T9imoMMS1/pgyeFNiS2CEp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
19710040
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
383KB
Virtual Size
664KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
93KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
16KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Windows
Size
Virtual Size
15.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
9.1MB
Virtual Size
9.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=207, id=261, version=30795,
count=17, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=103, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=7, id=253, version=33030,
count=18, id=260, version=33030,
count=18, id=259, version=33030,
count=96, id=261, version=33030,
count=26, id=257, version=30795,
count=3, id=123, version=2207,
count=327, id=1, productName=Unmarked objects,
count=13, id=261, version=33133,
count=1, id=255, version=33133,
count=1, id=258, version=33133,
Downloads 12.6.24/Downloads 12.6.24/Downloads/CS2.exe
- IMPHASH 43c468490c6400ee7bdc2746202b8558
- SHA256 3b618def9c8d4fd1cb3a4b8553f83c1ecc01be8720d82764ae7f5678570c9ddc
- MD5 6be8621375d6d268f679d4740d334a8c
- SHA1 b042e6719c564384342d42028a3abf5e7ab994d3
- SHA512 6e6aaf63bd11a3efa11a0f5797dc34a75da1d6258c432df34fba0f29732edb89a78274bcbabdfbbdd055c6361458b960d86b4181ce3e08a0af3e384a4ce99cee
- SSDEEP 196608:EgAnvZibpOQnBkJqjBkRWZrKz0Ilzo+2Ugc/NWdy41Ko9haDHMpCHMhW6E:2vQbiQjBSWZGZO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5293688
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\BACKUP\Sources\trix\Console_systemlocker\ConsoleApplication1\x64\Release\ConsoleApplication1.pdb
secureenginesdk64
ord151
ord551
version
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
kernel32
DeleteCriticalSection
GetModuleHandleW
ResumeThread
CreateProcessA
GetThreadContext
GetProcAddress
VirtualAlloc
GetModuleFileNameA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateFileW
DeviceIoControl
GetCurrentProcessId
GetVersionExA
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
WriteProcessMemory
VirtualAllocEx
GetTickCount64
GlobalMemoryStatusEx
Sleep
CloseHandle
GetTempPathA
GetStdHandle
HeapAlloc
GetLastError
DecodePointer
lstrlenA
SetConsoleTitleA
SetConsoleTextAttribute
WritePrivateProfileStringA
GetPrivateProfileStringA
VirtualFree
LoadLibraryA
SetThreadContext
IsProcessorFeaturePresent
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableW
LocalFree
FormatMessageA
GetLocaleInfoEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
EncodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
IsDebuggerPresent
GetStartupInfoW
GetCurrentThreadId
InitializeSListHead
SleepEx
VerSetConditionMask
GetSystemDirectoryA
GetModuleHandleA
VerifyVersionInfoA
GetTickCount
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
FreeLibrary
SetLastError
CreateFileA
GetFileSizeEx
OutputDebugStringW
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetModuleFileNameW
WriteFile
GetCommandLineA
GetCommandLineW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetFilePointerEx
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
DeleteFileW
SetStdHandle
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemTimeAsFileTime
GetModuleHandleA
CreateEventA
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
GetCurrentThreadId
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
WriteProcessMemory
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetProcessAffinityMask
SetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
Sleep
LoadLibraryA
FreeLibrary
GetTickCount
SystemTimeToFileTime
FileTimeToSystemTime
GlobalFree
LocalAlloc
LocalFree
GetProcAddress
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetModuleHandleW
LoadResource
MultiByteToWideChar
FindResourceExW
FindResourceExA
WideCharToMultiByte
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
CreateFileW
LoadLibraryW
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
HeapReAlloc
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DecodePointer
HeapAlloc
RtlUnwindEx
LCMapStringW
GetStringTypeW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
HeapSize
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
FindWindowA
CharUpperBuffW
advapi32
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
StartServiceA
QueryServiceConfigA
OpenServiceA
OpenSCManagerA
EnumServicesStatusA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
OpenEventLogA
CloseEventLog
ClearEventLogA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
ntdll
NtRaiseHardError
RtlAdjustPrivilege
RtlVirtualUnwind
NtQuerySystemInformation
RtlCaptureContext
RtlLookupFunctionEntry
wininet
InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle
ws2_32
closesocket
WSAGetLastError
htonl
send
recv
gethostname
ioctlsocket
listen
accept
sendto
connect
recvfrom
freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
bind
socket
__WSAFDIsSet
select
WSASetLastError
ntohl
normaliz
IdnToAscii
wldap32
ord45
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord217
ord143
crypt32
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateChain
CryptQueryObject
CertFreeCertificateContext
CryptStringToBinaryA
CertAddCertificateContextToStore
CertGetNameStringA
�%6(���&� uy�f��?�C����3�`�ZW3x�{Y��;�_�}��X��N��e����ɳ&]��Sq'Lj���n0o�L��ã�� Tc���c���{F�5
�h����B� X対C���aްRx�!F��*P�}E��h0)��\�.�]v�ī��m�I���r��E �`�GկQ�\��Ay�ӓ�/�G�{���e)b@�E��S��M��>9mg�*;����chkͰ6��� �?�[t�,F�jd����� �2�b#�bu` d��'�ۛ���u��c�/�v�0?�<9]#s!q�?�-C3�����|"���|��srK�A]��J��v�q*~��x�wf���j�oB�:'�֎Q5�/z�T�3;#P� �H�=� ���Zk���ϊ���}W.)�E�,'�!�3�=�:� qJۘu&~�� z��zב'Ů�:�kP��%���#�̅��<㗇Ø,w�� U)��Y맹�n�u��t\,���=�9���ς��"���L/���U�Fc���7h��B ����Û�.��;ʩp�=D�QD�+G� J�g�m�
�bכ����$��'x1ǰZ,�
W>!"�B3v\u��m��hEdW��D�t�0�� y�-C<��<ȡ���H,5�A�y ���ԵLA<�����'�$W�=a� \f�wf�+ i�m7��.7����P�Y�p����u*� X� ��4� (2P�<��t2Q��� .UUq�׀����a O���0��z���=�zT�w2� 3 Y�$`S-�*Ud ���}]]���� _�� ��Ќ�����ŀ����H�SP�-(κ)[�� ��@��ح��8◈JS��m�lf� �t%T�����e�Q.�W�w�n�( � �
� .'uUE����]l �� ]^��2 ��QE����t'�:p�s� ?u3���HS��OjP �P�Vc~i��[�B�J� FjN�#:J� �͡�@�&�0�q� zm����H����L�82غȎP�|3H%�n����p���SԨ�|�0~-̵�N�����V�t �^�7Z �bu�� ����&x 1�A��7nߣ@X�����>ݛ��� �N*"������^R[�Qj���8�\8mK��e��5C��� ��2R������HD��Nn� xbYW_tR���z_��a����O�x�D�o)a�K��~��Wp�����
7a��
� #
�N���"b��|2��_�$c >��Bn{Ϛ��h5��2H�w ��n�Fr`l�փp������hΗ�y��ִtuu
q����}���?�(��0h-��۸�50����Z]u�F �( �� _ ���
XmtX��:�*U ����s��w������½p�53����% � �5�� >�R�-�f�އn��ώ��� o�0��ݘ�*�2����i.hP\�r n����K� ��Ĩ�8%j��T�� Y���5_7�7:�-�}1 ͚0\��6���\�a
V��v�J͗���Q��3߮�I����Yr����=A4V�B���~h\��V/��b� ��̀��W?"2Ӻ��%O.4��,qu*r�yE]ٰ�P���_Ep��t[i�����ܫ���E{���� ��0XdU��Q�KK%%p�J
������)�i�6$� !e����RL����I�SA\;�(�t���i�E ˱�+��!���\�t� .�S�Ů5�F���a��g�j� X���I?�J���e0�Q��mi���vA�Yw�����p �N�����1����p
T��r��H|{��Tdxi��:�~�D
�~���~@$Z0������FS��䀚Q�-W�tΌ��5���F0|���Jg-�f%�Rt?�������p����tH����,�G�-
@m�l�� 3O"5�����t/l����-���:�5�l\��iC[)1d�g�Y>� ���
��Dž�' Z���㎤k� #6 �\�����vve���Y9 �Y
������ ?�(�
�zB~b+x�Qi�2��{�-&��#G��,��A���2�Ҋ^�]w�y�sIx��P�
ȁ�DO��)�K:�LwӨ��j��o�'x��6ۼ5����ך�+����@_յ��+݅P���ξEYg]�����*м':�L�A1�Ϫ�n b� dS �Q��*D�<� �,�@G4� �&�,�a�R�m"�V�8H�6��$k�ϓ��Lu����Ǵ��y/��I�0��B�>k�0�y�Wrg�X"ZR�����u�-�� O(jk@d�{e��'Q E�K¸�A ����h����Ҡ�ru�9�<�-FĻ�ݡ�� ��V�#�xLb eM�]h��Q�@���*CC��t+��.��ͭn"����. J"P=�w�9�%��Q��lO���ԑ�~�F�B���gS����ve�rh�⸍�N
$���R��^@Q} b�پ�Y� �2Cs���џ�q$�nH�Z�����e�]G��bl!Օp�˖�g���*>~�71�~/�i b�l��KVDY��Kk)������3c�i�TV�Gb����\�/�w����3��8*��[��YB���j<��T#b2�w���-��wq� |
C�� ����%H
dQI^��+Q]��m�3�y��2Bֺ
�c&do+ ?�mNW�A�� aE����`^G���c:�H�M�/��X��pS�A��_��h:;=�7�JnbB&�1Nx�6�6��UqNH슏�5�g��V3���| �*�����ƿ�Ьx�E�r� T�U���f��W)gd�j� .�cv
� ��p}�[�1g��}���8����ɤ$��E�:O�_Y-?���Y��n�����:�d�TG6m��aEg�>V���O��~����b�K7��U��{��dϒ�$���h�
V���o+�e��m������7���,�W�xK2+�åoIL#E�{#��e���z��,�d��*���f��û��E+����")Q2��I"L1����~7p!*xVj����~� �i"tu��/�β$�2 ��D#��Oݬ�H�ɕ���Q�X�mZ̝^�x��A�} ut �
.����C �um���*�= �{�����'+� ��Z7n�6/'5 4�=|��=Qn� �z ob��Ϯ88��
��Z.'7�
Name
.text
Size
608KB
Virtual Size
607KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
200KB
Virtual Size
199KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rnP
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.?dv
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.S-X
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=204, id=261, version=30795,
count=17, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=103, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=7, id=253, version=33218,
count=18, id=260, version=33218,
count=18, id=259, version=33218,
count=93, id=261, version=33218,
count=22, id=257, version=30795,
count=3, id=123, version=2207,
count=291, id=1, productName=Unmarked objects,
count=10, id=261, version=33523,
count=1, id=255, version=33523,
count=1, id=258, version=33523,
Downloads 12.6.24/Downloads 12.6.24/Downloads/Loud Chair.exe
- IMPHASH 511b52afdc22b2d90c4cfb3f02c744e1
- SHA256 320d56906b73e07663ae65f53e6ee1008042e3ecdd640f34d60e48c035fa7eb5
- MD5 e85d8cd73a221953c10c6ae719c4daae
- SHA1 a78ad50dd874b8a159c1300035927ffae558930f
- SHA512 10c36ff7963159f6b76e80105aefefef3d6a075ad6d9d9a79397ce4f24f9f2f8deed59033543b0722614340ac9a9524c466509c609458b0160d826bc8e77fcd2
- SSDEEP 393216:Infyt2vkj2gwfhbjlZDnJAKqnPg69iG4C7NH:tt2Q2XtRtnmVFJp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
28046719
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
shlwapi
PathFileExistsW
iphlpapi
GetIpForwardTable
gdiplus
GdipSaveImageToStream
kernel32
GetVersion
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
GetWindow
gdi32
DeleteDC
advapi32
RegSetValueExW
shell32
SHGetFolderPathW
ole32
CLSIDFromString
ntdll
RtlLookupFunctionEntry
ws2_32
ntohl
dbghelp
SymSetOptions
crypt32
CertOpenStore
bcrypt
BCryptGenRandom
Name
.text
Size
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
462KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.(0l
Size
Virtual Size
11.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.^M&
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.Wy1
Size
18.9MB
Virtual Size
18.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Downloads 12.6.24/Downloads 12.6.24/Downloads/Perm Woofer.exe
- SHA256 33db059ad0344af99a91e5dc4645b4ed21f6476301dbcdd9b7938fa9f5b240fa
- MD5 6d580b009bd7e0c1d5d2e1da54191743
- SHA1 4e3568f77dfb112c6a30c9f04fece99b0a219153
- SHA512 2e7b119a035295da2a1c666f6b4d1c2de1cc2aaf2392dc4c4f76bb4edef74022902b50b539aa26a0c035c7f4d87442dc498236a37ea50e5a7408af355bad0325
- SSDEEP 786432:DEpTc844UEVZOh3yWhcs8sCir3G9uyRpwn3uY4dws:4S8WlinvU3yu+E3p7s
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
353KB
Virtual Size
611KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
90KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16.6MB
Virtual Size
18.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
16KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
YES
Size
Virtual Size
16.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
11.0MB
Virtual Size
11.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
392B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=204, id=261, version=30795,
count=1, productName=Unmarked objects (old),
count=103, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,
count=7, id=253, version=33030,
count=18, id=260, version=33030,
count=18, id=259, version=33030,
count=96, id=261, version=33030,
count=18, id=260, version=30795,
count=2, id=123, version=2207,
count=29, id=257, version=30795,
count=309, id=1, productName=Unmarked objects,
count=11, id=261, version=33133,
count=1, id=255, version=33133,
count=1, id=258, version=33133,
Downloads 12.6.24/Downloads 12.6.24/Downloads/Privacy Protector.exe
- SHA256 0890f0b89e5c5745ad4bfaf1ca6459c5b765adae9cc2d0988e9456894350b434
- MD5 fbf038e5ef2e30da99e88371531dfebc
- SHA1 b0507491cf241aa4da8b73ef513528b2a937aa2c
- SHA512 2526c6e621b64c861aa5baddd9e80d2bdd5cd7d628be115584e3f0471536ab95ef85be48ae06b5207bc70f9e6eeeb75ceebc2594ebda6b1878cbc22f8321ea84
- SSDEEP 196608:gAHP6FQVWZ0C1+eqy/rRXEChq+ZExY37lJo9aM2yf/2dI:KPqWRUChqCtLlW5X2dI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
14680152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
128KB
Virtual Size
287KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
41KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
5KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
64KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
12.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
8.4MB
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
64KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=123, version=2207,
count=10, id=260, version=33218,
count=4, id=259, version=33218,
count=39, id=261, version=33218,
count=6, id=257, version=33218,
count=2, id=260, version=32822,
count=2, id=261, version=32822,
count=24, id=257, version=30795,
count=425, id=1, productName=Unmarked objects,
count=3, id=257, version=31630,
count=3, id=261, version=28107,
count=1, id=259, version=33521,
count=10, id=265, version=33523,
count=1, id=255, version=33523,
count=1, id=151,
count=1, id=258, version=33523,
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/Byr723V3Cq1.exe
- IMPHASH 51235326a5333254d9a2e7b5ce26509f
- SHA256 f7b154b559d43433246b75a5294f260ecf11a1e03a77264b037c9d54a14315da
- MD5 05396b1d29a97b383fbd638b1f9355a9
- SHA1 34123ced194bfb10bab574555784e4bf43b97c8c
- SHA512 b4de31b07c9dea35c37ec4ec5ee7eb4d46fa6a25801238ee36e859166f7f46dd033dde0abcc8184a63209e9d69a79ced5103e2a97f1d0dd4827706ee35c503bd
- SSDEEP 98304:ETIF0v7xEkVfXhspQU9hP3P0yM5bOxetYqzxiU6WCTHXqj97sWl+0xGL:ENvqCfRsa03PZMceDMU6WcI93zx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4845697
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
{�Yk���� � _ZҼ���hbzw�{�j��R���v� u�u
x�
��[�6'�ـ MA����/:]�� �A/ ���ߴg�С^LR]�
�L8��5���@�'�� Fi�A��N��n� I�P�JP�2㙔 䯙���
L� ��A̞ͧ7�ؘ��8@�)Hnt�?��'��$��4W�8J"�K���m �g�ضOO[
녎�.y�qi���M� �h������~cV1�ȧ���ٱW��feV=��̋�k�?�J��(?���6sd�*k�e����M��a2�n�L�ѭ,}ӯ
��ԣ[����)�#1�4n�?�s��
C�_� �
D} a!R��?���.&��nFo���!_*�
� ����1س��:D�'�o����~z]$q�T �YdX�,�HS��B5�-b�K�����vO��mg�i�?�(T�~�G��4����P ��M��\�1�nq�(��$�+�C&s�V0@p?u����
ۮ:��uZid'��_E���+;K��1Q! FQL�6tg��s/�0��-��yRH�����HJc� ھOR#�� �}���t����H��
[����'��Q͏U�2�=*z�7/O�+����}\9��?��?� ����Cr��o�= u������Vk,���=x�!���0�
�o���N�v������#h\A�[��u"��*rx��P"c��
]��������сN�ݴG��K��N�e`g�T�`�m� Y���b���5���e�4��~��X~��` �L��<�Ԗw0�d:}�dh*k �d��� �E�l� ����?[�����N��O��
r
��Л� �)/![x�r7�?3���h��G��j-��r�'��֖��� ]�~��PeV�E]�`�j��5��W ���Dv�>QJ��x��Z�W �6��1��*ߡ�˄�&�W웆����F D�U����4�Ex�i ��h±�����̠��[pܕ&���BM|J,�% q���TTM�ߘ`�FAe���͐��k��sZV8 hM�S2z$:)W�;��N����J��Pe�ޮI<��K��[��=���(o<Kg� 7Z)�>Q<��[T�������ON���aI�b� ��!����� ���
�WVt��<�=.Q��i��6c�������jQ�t��
�q�ͭV�G;yA��!`��>B\�y� g���a||;.U��
ɕj����DTxO��k6
���T'L<��V~`CJ�t��A�Cd� ��j�� |�N��V��D��Rӟ� ݫ���+���#1�ʹ�q��qJb�? ZA������v*�s���O%��Y�%Fe !��j=�|h�e�G �Cd���Q|��f�fĭ���7�m���|�7>�2�$���-l�L�p>�Ż�����8��?��N�=wn�ik��wphO}9�]"���I
{؆�lG �w�9)�M��K�_�o��O� ��Gʗ������<�Yh@��36&I�|��dp�o��q3��\�y �� �Ea �Ԟ���j�8O�eƨP�sj^ �X���ݭp@4�ɠZjX��.,���=_����isV��w��)ou�+�z�9
\f �z>u }��2�@�@�=���5��+7��^�n�.
B<��ks�v��Yi�]�(E[b�/4����,��Z\�D���� �������9�ڎprs��~� R��x2���&R�����;��!D]/7:͌g���+��6�؉g|x,Ѿ�ECXC�]�a�yRl$N{�9�8�����@��'>M�Y��L� ���C��s����~��$b\L3�����5�W�Tw��/a��w�k<�K�� syAv� N[1=0��h-vG V
U�v�i_c��:��
�γm�b3��-��.��zo��W 5v{}��"��pFh�aH)�`�k�lo1�-�:�B.ǍO����{������5��ۢ[s���qz_�� ���(�0�������\l63)Ch�gi*�����w1C���U�9����l�'��ۼb����{����#qwb�7%#�|Ӕ���=�g���������O��?C���$�@��ߓ���Y�N�'_�������H?'P� �MD��n��u���WIu���;m,%
S��Cϵ^*- /��F4 )�A����,7o<)| ����Y2"��dm�:0�� �q� ��@9X��� w�3��w��?'( ���k�lp:�M]���� ��d�����Nj�> ]��Y�� �ID军%�l4? � X�&W������N�̝�i<�Ḯ,D ��mCɻFwc,s~�Z�v�Փ��A!�Wfb[�1��Y�P�/�ɂ��#���ɵS8�mI��C�h�X��W�Z��;��}����z��S8_����\����O}�\�s8 �^6+�?�(���r��CH��1��zS��g��
'(�#��`a4S�
dV 8��=ݠ<K蘹 C�m�&�-���$���>�Ŷ-�S
�?D��=0��kWW��]Oz�P�I�R��RW_9��Z�t��:� ۮ��ی�)Ll��s�,̹9�6��Z^?
���C�v�����|�}���fў���m��6fOx�U!���-{0O����s�D������-c,Ni��� ɚ�X���O���@�ܚG�(���y�ëj�͂e1�Fm
��ł�o �Ag�`�����{� �]�*lD�h�lT���9dT�u��ҧ�T��i3��ΎB٢��������.�s��ꐞ�!H� �i��C���>���d�=[� �V�>���A����"�
N��-����_�K������/v�8@OG������z�'�L�}y26T�b-����s�2w���}vC ������\�˫�s��,`|�{3
W�cl�y'�iji ��հ)�#y�ː:��S )��j�%3MDR� p0K���^N��Q-T�kt��X^�̓D�V;��!���lO��i/� �(�~Fd��e���A��p���Hs~���K�u<#ȵ>N$<]��3"��5�� ��薘���8���7���w��? �D�
���{�힞(�'\l��? �����ȟgЪ�5��,-Mauur�i�H~<)a�`��ٚ0�h�k�s��yD�6{<�&��:�%
f�3^���-�>�*��f0$�
Name
.text
Size
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.lol0
Size
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.lol1
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.lol2
Size
5.6MB
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
188B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/bsod fix.bat
- SHA256 318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
- MD5 392f331dc1744fbe560a2a17d7ca838f
- SHA1 817559945e137d036f47b26696d4fab5f22572c1
- SHA512 0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
- MD5 SHA1 SHA512
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/instructions.txt
- SHA256 d3725b7407a38a44cbbed309f86aa153e37d0aa4c899d803f66ebfb0fa32e91d
- MD5 c955199f059659b2435e0a6ecf781754
- SHA1 49818da7e7b60f1c2bc3f89fd5dc46e77286008e
- SHA512 dd4e2bc6ef8d3ab17237c3705cc1673fc46444527b8ae8935635e051e62843b4b3b8c064b373fc4f82041057a32b9919abcd2b1e18e56ae64b8fec64495b8fb2
- MD5 SHA1 SHA512
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/w11 fix.bat
- SHA256 7ec1b31de3b0114c266df0b475c5c582a504c7c38f7127949df27f78a5d1c026
- MD5 6fb44052dc5a85a097feeb91d7a81712
- SHA1 29db33e6cf3286a6ba82af684ac535d42b43d257
- SHA512 ee9dbcc0a7340ec6fe968ba611f0849fd1b77b88cb5deaad4c6a516a417abaf14055021e949ca04fde979364f060504c911fede81b0c492b651ea1b3f246494a
- MD5 SHA1 SHA512
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/bsod fix.bat
- SHA256 318ae14fd3712848ed06c109d36a9df600964e1d827581f980c121d52a7b5df5
- MD5 392f331dc1744fbe560a2a17d7ca838f
- SHA1 817559945e137d036f47b26696d4fab5f22572c1
- SHA512 0b1023402d8bf343cdee0e1e643209a65879dca4a7e22862b28ba08dea2d1a72ff651ab757ce32ad11add2aad61b44f36a64d1c754bdbe1ea740c44c2857c0dd
- MD5 SHA1 SHA512
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/instructions.txt
- SHA256 6e9d7a74bff2718b61ce3bcc538a99662c8e47958f61f2bfa1dc014c0986410e
- MD5 060030231f16c28316db957b3b8f9d76
- SHA1 db81e86a6366955ef2cdcfc8f2933d2ca73ac580
- SHA512 50ebda840758fda86956b3700034d7117d52b8ba3a37500fc89d9dffc415f20a8ebcf94ec2ab4c7c937065ca8a80ce9da41cb47a14dad3f4f6a65d30a5bf3b3a
- MD5 SHA1 SHA512
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/nRi28Wtqb1.exe
- IMPHASH 51235326a5333254d9a2e7b5ce26509f
- SHA256 3a5576c4e7d9ed56cc295fea24ef0fa68cf4235dfefa434caa32015887e757c3
- MD5 872b0fa8c0306040f181d08c5d7a252b
- SHA1 a08cf74361c96aa4d7e4503af6563c63b95f1973
- SHA512 23d8610ac8bfcb68695b652dd8d35edcc5f17994c90966ef0cabf11489d983cc852dd8e6d36ec85c78ec6f63cb6a7b21238a6d9687494f3ef99bc7ca86a4a277
- SSDEEP 98304:GRx4heu/+/tswG+PJPigEtVTH41ZE6HqM/aZeOO4wZivrH/LXmfI1ZWQpy:GL4gy+/tbG+PJa3txT6KKaLbwZivrjdJ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8056346
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
� F��=j����@�>�4+��ج������;aG����iC�A�a� �)@���Ň�1 �i���A �5mx� ���u�"�ov�p�u�l ��G�4�u$5� b_�'�d������%E j���CJK��J@:�������OCO��\>�kk�۽>��6�ݮd�w��}� �� Jx���n%5� �A�*z[ 7We>T������h3_y˾�g'�s5�� ���s�A��[�CT� 5�ĉ����S�Y~�d3�Z0ӫ����o�e�5�cE$��{�U��y�*�_�F ����B9`��5_@Š`��ć�뚙od� ��66��Q/��w���8 ]&�-�^� e�<P�C,��f��N��ϲq���*FN�^M���UR�|� ��6@2�� t:�)����'n����o�NA�>��4��h3�;<��>/�(�p� n��������H����s��T�T�
յ���@�y�3���:���T2�f"���>�Mnneq8*$� ����%q`ǣ�&x�9ɤ]Q�d%08���/�NO��fNIm�DH6
V� "�n ��xzE������bcK|_{��>�PZ�4}��$ >%e�=S
r�?�h&1�]�� �P�
*o\�y�J��2�*�8��r��3{�U���+ �
��27��Ԭ���1b�cͩ��~˯it3�s"�q+Y!��y�az�jse1k"X��?f)~�C�#?��WY�������W۶${�a�z>{���h-7���删q�m�-(ݴ�$Mo�> ��D��rR�jh�EDʪ�&f[���BnnjD��C�����1E�� � m|z��e �W�� �|�݈s�; �R%���V��Z�埁�3�����T����Lb�.�?�MK��t��kEdXU!D�Je�xD�<�g�B�L���D4�K��~G��`s&�"QM��iȅ2r�@d�|T��WsQ� ���!&�9�;�e�-��UU�;�[��P��"�ML5<:_���Lj I���F�8V�݁�x
�J��͟���_������p5]9��ZރޞfpM��=S�:VD��0تX��MZwF��!��T���� i���Ev6+���;QoRL��P|���S���a��$|�,5��4_?T-oB���k�����qo~P⾢H�4��J 7wgf���V���ZC2�5��KE�S�m��~-��Ve������:C �w�#\�%�� �=�Cj% :����W�S�'�y�x =lM��gHŋT�������O��k��?"Úɶ�:/��m�%.��qc�kG~6{.]+A�2[O8� �O��S�<ỽ��Y��֦NY����g� ͕�Pf)�Py�������J!�ĥ7���{�P-��8��0�7ǵ*�z�鐫LxխPB��j�*l*#�f�h�&� Ov��%�����!Đ��*3��˫�ւ=0O�|�n�_��U�p!�tĴ��ݷ� 9��r�稶�V�@��! �q�B��yg{(��vI)e�2��#G��^� �{,��˿fA2�ⱌ,`h���WG'�a �� ���������a�7G�U�W�_H�1> v� >���xX��~��h��*(���9@��f-��h�}�
��� �)���ĭ��q�/֪��Yj�� ��S5�_����T�����&FP�a/� o2�� �~V���r�z] t��#
�X�&"��<��������b �=҇b*6T����$��Q�ш��O M��i�-W�W��ؑ��i��*8X��v�8'�ٛ1`�L�k_7�s'.�y�=y�o�Ż�w��y�F
��<`�i���8�_~���ٞ� y0��)<�� ������b�˞ba��:�O�cm^m ���˭�`*Tn��[�z�b ڭ_W_��D��d�R���ӯy`����@wR5�tk�| ���@���o�f �!)4��/]̆ <�F(�V���_�ww�>^�]r(��ǃ�����k�lτY!����z�t�����k�}�{1�\��6�GpT��F�*���������a��dF�Mj�( ��(��Fsv���r2��i�I���7�<��ÚN@�eL�Z�����᧵!�Oa �e�' d�^������(����n�~#�U��3�9`3ζ���Z���9.��Ӿ��d������[<��t7�b��'$hn��s�Q�UF�c�ۅ(���R{m���g��M�%{d��l6���F~.#���CT&�>���@i�X êt�D���p���Ѐ}8�� <���t����a� �(� =�Co�����R�i�`Q�UӰ�.��ޯe-���4�4���O��#�==?.M�U@u��L���g�c[�Kq�T��3 ��?]˰}<���T X���d�h`z���}��k���8�Z �%~iP;� (ky�
w�8�l�I�PE���;��B�n$L�)72�Ӳ���0������d]-��'��J��dJҳ_/[ ϊl����P�H�D ��l}��K����c���: �J U��r�J҄ ��h��s|�z/�� NPcM$%��i
�� (�������j��dg��`�r;�Aa]�L���DK�[|Ю;�/��cV�|�c~}J����h���
,�Y6p,� �X#l��ܰH����BE*A����Fz<��W$�4s� �,(�q����/��&��c��t`+�A�C�ѵ]'���� {�D̅��H��TS��Y9�&&X
%�a�_BA�8��<� �W����1<S�ޢX�-[x���G����
�'3�!�h� 3MU�ylU��h�"Ǜ���4��ܔ��C��J��/�� |�d�C�τre�6d;m��Ryq��jFL���'�99>L~�hP�jкA�L9 k���FD?lQE�V,b�� X�( Ɉ ��|��6I6,�x9�Ng��A[9
=
�6��'=d'h�� ��_
g)��� �����#X�F����Y�g��*�e�s+s`1t�t���tQ�n���Ȋ���,-ѵ�KjT+�qɅ���n=�гV�� <R�E���5-*� �X2���f��O5Fa� ���5��!��+I�^��d� ������-�� ���A����y��51�%! ���������Z��D� �,���Ő�5����k��!
Name
.text
Size
Virtual Size
456KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.lol0
Size
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.lol1
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.lol2
Size
5.6MB
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
212B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Downloads 12.6.24/Downloads 12.6.24/Downloads/Unlock All/w11 fix.bat
- SHA256 7ec1b31de3b0114c266df0b475c5c582a504c7c38f7127949df27f78a5d1c026
- MD5 6fb44052dc5a85a097feeb91d7a81712
- SHA1 29db33e6cf3286a6ba82af684ac535d42b43d257
- SHA512 ee9dbcc0a7340ec6fe968ba611f0849fd1b77b88cb5deaad4c6a516a417abaf14055021e949ca04fde979364f060504c911fede81b0c492b651ea1b3f246494a
- MD5 SHA1 SHA512