C:\Users\Mayur\Documents\C# Library\HttpLib\HttpLib\obj\Debug\HttpLib.pdb
Overview
overview
3Static
static
3Diamond fo...un.bat
windows7-x64
1Diamond fo...un.bat
windows10-2004-x64
1Diamond fo...10.pyc
windows7-x64
3Diamond fo...10.pyc
windows10-2004-x64
3Diamond fo...11.pyc
windows7-x64
3Diamond fo...11.pyc
windows10-2004-x64
3Diamond fo...12.pyc
windows7-x64
3Diamond fo...12.pyc
windows10-2004-x64
3Diamond fo...a__.py
windows7-x64
3Diamond fo...a__.py
windows10-2004-x64
3Diamond fo...10.pyc
windows7-x64
3Diamond fo...10.pyc
windows10-2004-x64
3Diamond fo...11.pyc
windows7-x64
3Diamond fo...11.pyc
windows10-2004-x64
3Diamond fo...12.pyc
windows7-x64
3Diamond fo...12.pyc
windows10-2004-x64
3Diamond fo...39.pyc
windows7-x64
3Diamond fo...39.pyc
windows10-2004-x64
3Diamond fo...10.pyc
windows7-x64
3Diamond fo...10.pyc
windows10-2004-x64
3Diamond fo...11.pyc
windows7-x64
3Diamond fo...11.pyc
windows10-2004-x64
3Diamond fo...12.pyc
windows7-x64
3Diamond fo...12.pyc
windows10-2004-x64
3Diamond fo...10.pyc
windows7-x64
3Diamond fo...10.pyc
windows10-2004-x64
3Diamond fo...11.pyc
windows7-x64
3Diamond fo...11.pyc
windows10-2004-x64
3Diamond fo...12.pyc
windows7-x64
3Diamond fo...12.pyc
windows10-2004-x64
3Diamond fo...10.pyc
windows7-x64
3Diamond fo...10.pyc
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Diamond follow v2/Run.bat
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Diamond follow v2/Run.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Diamond follow v2/__json/__pycache__/json_data__.cpython-310.pyc
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Diamond follow v2/__json/__pycache__/json_data__.cpython-310.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Diamond follow v2/__json/__pycache__/json_data__.cpython-311.pyc
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Diamond follow v2/__json/__pycache__/json_data__.cpython-311.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Diamond follow v2/__json/__pycache__/json_data__.cpython-312.pyc
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Diamond follow v2/__json/__pycache__/json_data__.cpython-312.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
Diamond follow v2/__json/json_data__.py
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Diamond follow v2/__json/json_data__.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Diamond follow v2/__pycache__/utils.cpython-310.pyc
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Diamond follow v2/__pycache__/utils.cpython-310.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Diamond follow v2/__pycache__/utils.cpython-311.pyc
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
Diamond follow v2/__pycache__/utils.cpython-311.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Diamond follow v2/__pycache__/utils.cpython-312.pyc
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
Diamond follow v2/__pycache__/utils.cpython-312.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Diamond follow v2/__pycache__/utils.cpython-39.pyc
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Diamond follow v2/__pycache__/utils.cpython-39.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Diamond follow v2/__source/__pycache__/body_structure__.cpython-310.pyc
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
Diamond follow v2/__source/__pycache__/body_structure__.cpython-310.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Diamond follow v2/__source/__pycache__/body_structure__.cpython-311.pyc
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Diamond follow v2/__source/__pycache__/body_structure__.cpython-311.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Diamond follow v2/__source/__pycache__/body_structure__.cpython-312.pyc
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
Diamond follow v2/__source/__pycache__/body_structure__.cpython-312.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Diamond follow v2/__source/__pycache__/constants__.cpython-310.pyc
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
Diamond follow v2/__source/__pycache__/constants__.cpython-310.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Diamond follow v2/__source/__pycache__/constants__.cpython-311.pyc
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Diamond follow v2/__source/__pycache__/constants__.cpython-311.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Diamond follow v2/__source/__pycache__/constants__.cpython-312.pyc
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Diamond follow v2/__source/__pycache__/constants__.cpython-312.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
Diamond follow v2/__source/__pycache__/crypto_base__.cpython-310.pyc
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
Diamond follow v2/__source/__pycache__/crypto_base__.cpython-310.pyc
Resource
win10v2004-20240802-en
General
-
Target
sigma.rar
-
Size
34.6MB
-
MD5
f16def1c737c3314cac6b92f8fb6429e
-
SHA1
071bcb2b4197e9bd9d84dc6538b14cf29dda9943
-
SHA256
26784ed85b868f66d42fea69640f404a80c6b24a9a461e475340dafbf3c28431
-
SHA512
d2344197d40dd4df17bf6b61f60043017b5926fea19b0e38a01ddb96c9ea824c13c2870ca5f1b056a2f0bd468c52b56577ebf02d38e237ed84c6bafada7a4d9e
-
SSDEEP
786432:JVPwnoYNafWG2ynvKDXDJH4OYB6Ingj4S0lYGKVFU/8V3OeJf6FF:JVwnZN+F2yn05YB6IGtDUUV3JZiF
Malware Config
Signatures
-
Detects Pyinstaller 2 IoCs
resource yara_rule static1/unpack001/Diamond follow v2/data/Microsoft Token Checker.exe pyinstaller static1/unpack001/Diamond follow v2/data/conv.exe pyinstaller -
Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/Diamond follow v2/data/#1tokens.exe unpack001/Diamond follow v2/data/Convertor/HttpLib.dll unpack001/Diamond follow v2/data/Convertor/Xbox account creator.exe unpack001/Diamond follow v2/data/Microsoft Token Checker.exe unpack001/Diamond follow v2/data/conv.exe unpack001/Diamond follow v2/nircmd.exe
Files
-
sigma.rar.rar
Password: 123
-
Diamond follow v2/Run.bat
-
Diamond follow v2/__json/__pycache__/json_data__.cpython-310.pyc
-
Diamond follow v2/__json/__pycache__/json_data__.cpython-311.pyc
-
Diamond follow v2/__json/__pycache__/json_data__.cpython-312.pyc
-
Diamond follow v2/__json/json_data__.py
-
Diamond follow v2/__json/owner_or_admins.json
-
Diamond follow v2/__json/settings.json
-
Diamond follow v2/__json/users.json
-
Diamond follow v2/__pycache__/utils.cpython-310.pyc
-
Diamond follow v2/__pycache__/utils.cpython-311.pyc
-
Diamond follow v2/__pycache__/utils.cpython-312.pyc
-
Diamond follow v2/__pycache__/utils.cpython-39.pyc
-
Diamond follow v2/__source/__pycache__/body_structure__.cpython-310.pyc
-
Diamond follow v2/__source/__pycache__/body_structure__.cpython-311.pyc
-
Diamond follow v2/__source/__pycache__/body_structure__.cpython-312.pyc
-
Diamond follow v2/__source/__pycache__/constants__.cpython-310.pyc
-
Diamond follow v2/__source/__pycache__/constants__.cpython-311.pyc
-
Diamond follow v2/__source/__pycache__/constants__.cpython-312.pyc
-
Diamond follow v2/__source/__pycache__/crypto_base__.cpython-310.pyc
-
Diamond follow v2/__source/__pycache__/crypto_base__.cpython-311.pyc
-
Diamond follow v2/__source/__pycache__/crypto_base__.cpython-312.pyc
-
Diamond follow v2/__source/__pycache__/device_auth_structure__.cpython-310.pyc
-
Diamond follow v2/__source/__pycache__/device_auth_structure__.cpython-311.pyc
-
Diamond follow v2/__source/__pycache__/device_auth_structure__.cpython-312.pyc
-
Diamond follow v2/__source/__pycache__/managers__.cpython-310.pyc
-
Diamond follow v2/__source/__pycache__/managers__.cpython-311.pyc
-
Diamond follow v2/__source/__pycache__/managers__.cpython-312.pyc
-
Diamond follow v2/__source/__pycache__/party_command__.cpython-310.pyc
-
Diamond follow v2/__source/__pycache__/party_command__.cpython-311.pyc
-
Diamond follow v2/__source/__pycache__/party_command__.cpython-312.pyc
-
Diamond follow v2/__source/__pycache__/party_structure__.cpython-310.pyc
-
Diamond follow v2/__source/__pycache__/party_structure__.cpython-311.pyc
-
Diamond follow v2/__source/__pycache__/party_structure__.cpython-312.pyc
-
Diamond follow v2/__source/__pycache__/remove_and_add__.cpython-310.pyc
-
Diamond follow v2/__source/__pycache__/remove_and_add__.cpython-311.pyc
-
Diamond follow v2/__source/__pycache__/remove_and_add__.cpython-312.pyc
-
Diamond follow v2/__source/__pycache__/session__.cpython-310.pyc
-
Diamond follow v2/__source/__pycache__/session__.cpython-311.pyc
-
Diamond follow v2/__source/__pycache__/session__.cpython-312.pyc
-
Diamond follow v2/__source/body_structure__.py
-
Diamond follow v2/__source/constants__.py
-
Diamond follow v2/__source/crypto_base__.py
-
Diamond follow v2/__source/device_auth_structure__.py
-
Diamond follow v2/__source/managers__.py
-
Diamond follow v2/__source/party_command__.py
-
Diamond follow v2/__source/party_structure__.py
-
Diamond follow v2/__source/remove_and_add__.py
-
Diamond follow v2/__source/session__.py
-
Diamond follow v2/cogs/Add Owner.py
-
Diamond follow v2/cogs/Invite.py
-
Diamond follow v2/cogs/Message everyone.py
-
Diamond follow v2/cogs/Nuke.py
-
Diamond follow v2/cogs/Profile Information.py
-
Diamond follow v2/cogs/Remove Owner.py
-
Diamond follow v2/cogs/State.py
-
Diamond follow v2/cogs/Token_Handling.py
-
Diamond follow v2/cogs/__pycache__/Add Owner.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/Check subscription lengths.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/Invite.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/Message everyone.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/Message.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/Nuke.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/Owner.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/Profile Information.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/Remove Owner.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/State.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/Token Check.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/Token_Handling.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/authenticate.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/authenticate.cpython-311.pyc
-
Diamond follow v2/cogs/__pycache__/authenticate.cpython-312.pyc
-
Diamond follow v2/cogs/__pycache__/authenticate.cpython-39.pyc
-
Diamond follow v2/cogs/__pycache__/blacklist.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/blacklist.cpython-311.pyc
-
Diamond follow v2/cogs/__pycache__/blacklist.cpython-312.pyc
-
Diamond follow v2/cogs/__pycache__/check.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/check.cpython-311.pyc
-
Diamond follow v2/cogs/__pycache__/check.cpython-312.pyc
-
Diamond follow v2/cogs/__pycache__/check.cpython-39.pyc
-
Diamond follow v2/cogs/__pycache__/disable.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/disable.cpython-311.pyc
-
Diamond follow v2/cogs/__pycache__/disable.cpython-312.pyc
-
Diamond follow v2/cogs/__pycache__/disable.cpython-39.pyc
-
Diamond follow v2/cogs/__pycache__/follow.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/follow.cpython-311.pyc
-
Diamond follow v2/cogs/__pycache__/follow.cpython-312.pyc
-
Diamond follow v2/cogs/__pycache__/follow.cpython-39.pyc
-
Diamond follow v2/cogs/__pycache__/message.cpython-311.pyc
-
Diamond follow v2/cogs/__pycache__/message.cpython-312.pyc
-
Diamond follow v2/cogs/__pycache__/message.cpython-39.pyc
-
Diamond follow v2/cogs/__pycache__/party.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/party.cpython-311.pyc
-
Diamond follow v2/cogs/__pycache__/party.cpython-312.pyc
-
Diamond follow v2/cogs/__pycache__/party.cpython-39.pyc
-
Diamond follow v2/cogs/__pycache__/reload.cpython-39.pyc
-
Diamond follow v2/cogs/__pycache__/unauthenticate.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/unauthenticate.cpython-311.pyc
-
Diamond follow v2/cogs/__pycache__/unauthenticate.cpython-312.pyc
-
Diamond follow v2/cogs/__pycache__/unauthenticate.cpython-39.pyc
-
Diamond follow v2/cogs/__pycache__/upload.cpython-310.pyc
-
Diamond follow v2/cogs/__pycache__/upload.cpython-311.pyc
-
Diamond follow v2/cogs/__pycache__/upload.cpython-312.pyc
-
Diamond follow v2/cogs/__pycache__/upload.cpython-39.pyc
-
Diamond follow v2/cogs/__pycache__/xuid.cpython-310.pyc
-
Diamond follow v2/cogs/authenticate.py
-
Diamond follow v2/cogs/blacklist.py
-
Diamond follow v2/cogs/check.py
-
Diamond follow v2/cogs/follow.py
-
Diamond follow v2/cogs/modules/Follow orig.py
-
Diamond follow v2/cogs/modules/check.py
-
Diamond follow v2/cogs/modules/follow v2.py
-
Diamond follow v2/cogs/modules/follow.py
-
Diamond follow v2/cogs/modules/follow1.py
-
Diamond follow v2/cogs/modules/follow3.py
-
Diamond follow v2/cogs/unauthenticate.py
-
Diamond follow v2/data/#1tokens.exe.exe windows:6 windows x64 arch:x64
Password: 123
4f2f006e2ecf7172ad368f8289dc96c1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 297KB - Virtual size: 666KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: 512B - Virtual size: 168B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
/4 Size: 512B - Virtual size: 297B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/19 Size: 459KB - Virtual size: 459KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/32 Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/46 Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/65 Size: 923KB - Virtual size: 923KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/78 Size: 593KB - Virtual size: 593KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
/90 Size: 179KB - Virtual size: 178KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 46KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 357KB - Virtual size: 356KB
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Diamond follow v2/data/Accounts.txt
-
Diamond follow v2/data/Convertor/Account creator.config.xml
-
Diamond follow v2/data/Convertor/Created.txt
-
Diamond follow v2/data/Convertor/HttpLib.dll.dll windows:4 windows x86 arch:x86
Password: 123
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Diamond follow v2/data/Convertor/Xbox account creator.exe.exe windows:4 windows x86 arch:x86
Password: 123
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\harry\Documents\Visual Studio 2022\Projects\Account Creators\XBDC Creator\XBDC Creator\obj\Debug\XBDC Creator.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Diamond follow v2/data/FailedAccounts.txt
-
Diamond follow v2/data/Microsoft Token Checker.exe.exe windows:6 windows x64 arch:x64
Password: 123
ba2fe82dbe3fc8bdddc26ef88c3ef15a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
GetWindowThreadProcessId
ShowWindow
kernel32
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
WaitForSingleObject
FormatMessageW
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
GetLastError
WriteConsoleW
SetEndOfFile
Sleep
EnterCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableW
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Sections
.text Size: 169KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 424KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Token validation.pyc
-
Diamond follow v2/data/Token validation.py
-
Diamond follow v2/data/api_keys.txt
-
Diamond follow v2/data/colors.txt
-
Diamond follow v2/data/config.json
-
Diamond follow v2/data/conv.exe.exe windows:5 windows x64 arch:x64
Password: 123
5bc16b5845145eb0edb88983820691b1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
user32
GetWindowThreadProcessId
ShowWindow
kernel32
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
FormatMessageW
Sleep
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
GetLastError
WriteConsoleW
SetEndOfFile
WaitForSingleObject
LeaveCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableW
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Sections
.text Size: 168KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 424KB - Virtual size: 423KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
conv.pyc
-
Diamond follow v2/data/conv.py
-
Diamond follow v2/data/owners.json
-
Diamond follow v2/data/tokens.txt
-
Diamond follow v2/data/users.json
-
Diamond follow v2/follow.py
-
Diamond follow v2/kill.bat
-
Diamond follow v2/main.py
-
Diamond follow v2/modules/utils.py
-
Diamond follow v2/nircmd.exe.exe windows:4 windows x64 arch:x64
Password: 123
633684595a5911dabe231a798d532fcd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
c:\Projects\VS2005\NirCmd\x64\release\NirCmd.pdb
Imports
winmm
mixerClose
mixerOpen
mciSendStringA
mixerGetLineInfoA
mixerGetControlDetailsA
mixerGetLineControlsA
mixerSetControlDetails
waveOutGetVolume
waveOutGetNumDevs
waveOutGetDevCapsA
waveOutSetVolume
msvcrt
_initterm
__getmainargs
_acmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
__dllonexit
__setusermatherr
_strlwr
atof
puts
_mbsicmp
_snprintf
_strnicmp
strtol
atoi
_stricmp
strcmp
_commode
_fmode
__set_app_type
_itoa
strtoul
strchr
strcpy
_memicmp
memcmp
strrchr
wcslen
malloc
wcscpy
free
wcscmp
wcsrchr
_wcsicmp
memcpy
strlen
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
memset
_strcmpi
sprintf
strcat
kernel32
DeleteFileA
WinExec
LocalFileTimeToFileTime
GetStdHandle
CreateProcessA
SetComputerNameA
GetEnvironmentVariableA
DeviceIoControl
WritePrivateProfileStringA
GetCurrentProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentThreadId
GetStartupInfoA
Beep
GetSystemTime
SetProcessAffinityMask
ReadProcessMemory
SetConsoleTextAttribute
GetSystemDirectoryA
OutputDebugStringA
WaitForSingleObject
SetPriorityClass
Sleep
OpenProcess
LocalFree
GetWindowsDirectoryA
CopyFileA
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalAlloc
CloseHandle
GlobalSize
GlobalLock
GlobalUnlock
SystemTimeToFileTime
MultiByteToWideChar
GetFileAttributesA
ReadFile
GetModuleFileNameA
GetTimeFormatA
FindNextFileA
LoadLibraryExA
FormatMessageA
SetFileTime
GetDateFormatA
CreateDirectoryA
GetFileTime
WriteFile
FindFirstFileA
GetLastError
GetVersionExA
CreateFileA
GetFileSize
SetFileAttributesA
WideCharToMultiByte
FindClose
SetFilePointer
user32
IsWindowEnabled
GetMessageA
TrackPopupMenu
TranslateMessage
DispatchMessageA
GetWindowTextA
KillTimer
GetParent
FindWindowA
SendInput
ShowWindow
AttachThreadInput
PostQuitMessage
GetForegroundWindow
SendMessageTimeoutA
SystemParametersInfoA
GetActiveWindow
GetSystemMetrics
IsWindowVisible
SetTimer
SetWindowPos
DestroyIcon
PostMessageA
ExitWindowsEx
InvalidateRect
SetCursorPos
MessageBeep
GetWindowThreadProcessId
SetDlgItemTextA
GetSysColorBrush
ChildWindowFromPoint
DialogBoxParamA
LoadCursorA
SetCursor
EndDialog
SendMessageA
GetDlgItem
SetWindowTextA
MessageBoxA
GetDlgItemTextA
CreateWindowExA
GetWindowTextLengthA
GetClipboardFormatNameA
EmptyClipboard
RegisterClipboardFormatA
SetClipboardData
CloseClipboard
OpenClipboard
GetWindowLongA
SetWindowLongA
ReleaseDC
GetDC
GetClipboardData
SetForegroundWindow
EnableWindow
MapWindowPoints
GetWindowPlacement
GetCursorPos
GetWindowRect
MoveWindow
SetFocus
GetClassNameA
SetWindowPlacement
GetMonitorInfoA
EnumWindows
EnumDisplaySettingsA
GetDesktopWindow
EnumDisplayMonitors
EnumDisplayDevicesA
EnumChildWindows
RegisterClassA
ChangeDisplaySettingsA
DefWindowProcA
gdi32
CreateCompatibleBitmap
DeleteDC
BitBlt
CreateCompatibleDC
GetDeviceCaps
SelectObject
CreateDIBitmap
GetObjectA
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
advapi32
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
shell32
ExtractIconExA
SHFileOperationA
ShellExecuteExA
SHChangeNotify
ShellExecuteA
Shell_NotifyIconA
ole32
OleGetClipboard
ReleaseStgMedium
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
PropVariantClear
Sections
.text Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Diamond follow v2/party.py
-
Diamond follow v2/utils.py
-
Multi-Selfbot/config.json
-
Multi-Selfbot/main.py
-
Multi-Selfbot/rotate.json
-
Party Spammer/__data/tokens.txt
-
Party Spammer/__json/__pycache__/json_data__.cpython-310.pyc
-
Party Spammer/__json/__pycache__/json_data__.cpython-311.pyc
-
Party Spammer/__json/__pycache__/json_data__.cpython-312.pyc
-
Party Spammer/__json/json_data__.py
-
Party Spammer/__json/owner_or_admins.json
-
Party Spammer/__json/settings.json
-
Party Spammer/__json/users.json
-
Party Spammer/__source/__pycache__/body_structure__.cpython-310.pyc
-
Party Spammer/__source/__pycache__/body_structure__.cpython-311.pyc
-
Party Spammer/__source/__pycache__/body_structure__.cpython-312.pyc
-
Party Spammer/__source/__pycache__/constants__.cpython-310.pyc
-
Party Spammer/__source/__pycache__/constants__.cpython-311.pyc
-
Party Spammer/__source/__pycache__/constants__.cpython-312.pyc
-
Party Spammer/__source/__pycache__/crypto_base__.cpython-310.pyc
-
Party Spammer/__source/__pycache__/crypto_base__.cpython-311.pyc
-
Party Spammer/__source/__pycache__/crypto_base__.cpython-312.pyc
-
Party Spammer/__source/__pycache__/device_auth_structure__.cpython-310.pyc
-
Party Spammer/__source/__pycache__/device_auth_structure__.cpython-311.pyc
-
Party Spammer/__source/__pycache__/device_auth_structure__.cpython-312.pyc
-
Party Spammer/__source/__pycache__/managers__.cpython-310.pyc
-
Party Spammer/__source/__pycache__/managers__.cpython-311.pyc
-
Party Spammer/__source/__pycache__/managers__.cpython-312.pyc
-
Party Spammer/__source/__pycache__/party_command__.cpython-310.pyc
-
Party Spammer/__source/__pycache__/party_command__.cpython-311.pyc
-
Party Spammer/__source/__pycache__/party_command__.cpython-312.pyc
-
Party Spammer/__source/__pycache__/party_structure__.cpython-310.pyc
-
Party Spammer/__source/__pycache__/party_structure__.cpython-311.pyc
-
Party Spammer/__source/__pycache__/party_structure__.cpython-312.pyc
-
Party Spammer/__source/__pycache__/remove_and_add__.cpython-310.pyc
-
Party Spammer/__source/__pycache__/remove_and_add__.cpython-311.pyc
-
Party Spammer/__source/__pycache__/remove_and_add__.cpython-312.pyc
-
Party Spammer/__source/__pycache__/session__.cpython-310.pyc
-
Party Spammer/__source/__pycache__/session__.cpython-311.pyc
-
Party Spammer/__source/__pycache__/session__.cpython-312.pyc
-
Party Spammer/__source/body_structure__.py
-
Party Spammer/__source/constants__.py
-
Party Spammer/__source/crypto_base__.py
-
Party Spammer/__source/device_auth_structure__.py
-
Party Spammer/__source/managers__.py
-
Party Spammer/__source/party_command__.py
-
Party Spammer/__source/party_structure__.py
-
Party Spammer/__source/remove_and_add__.py
-
Party Spammer/__source/session__.py
-
Party Spammer/main.py
-
Tonganoxie Esports auth bot/config.json
-
Tonganoxie Esports auth bot/emails.txt
-
Tonganoxie Esports auth bot/links.json
-
Tonganoxie Esports auth bot/main.py
-
Tonganoxie Esports auth bot/used.txt
-
message spammer/data__/__tokens.txt
-
message spammer/json__/__pycache__/__init__.cpython-310.pyc
-
message spammer/json__/__pycache__/json_files__.cpython-310.pyc
-
message spammer/json__/__pycache__/json_files__.cpython-311.pyc
-
message spammer/json__/__pycache__/json_files__.cpython-312.pyc
-
message spammer/json__/json_files__.py
-
message spammer/json__/owner_or_admins.json
-
message spammer/json__/settings.json
-
message spammer/json__/users.json
-
message spammer/main.py
-
message spammer/source__/__pycache__/comboing__.cpython-310.pyc
-
message spammer/source__/__pycache__/constants__.cpython-310.pyc
-
message spammer/source__/__pycache__/constants__.cpython-311.pyc
-
message spammer/source__/__pycache__/constants__.cpython-312.pyc
-
message spammer/source__/__pycache__/crypto_base__.cpython-310.pyc
-
message spammer/source__/__pycache__/crypto_base__.cpython-311.pyc
-
message spammer/source__/__pycache__/crypto_base__.cpython-312.pyc
-
message spammer/source__/__pycache__/device_auth_structure__.cpython-310.pyc
-
message spammer/source__/__pycache__/device_auth_structure__.cpython-311.pyc
-
message spammer/source__/__pycache__/device_auth_structure__.cpython-312.pyc
-
message spammer/source__/__pycache__/embed__.cpython-310.pyc
-
message spammer/source__/__pycache__/managers__.cpython-310.pyc
-
message spammer/source__/__pycache__/managers__.cpython-311.pyc
-
message spammer/source__/__pycache__/managers__.cpython-312.pyc
-
message spammer/source__/__pycache__/message__.cpython-310.pyc
-
message spammer/source__/__pycache__/message__.cpython-311.pyc
-
message spammer/source__/__pycache__/message__.cpython-312.pyc
-
message spammer/source__/__pycache__/profile__.cpython-310.pyc
-
message spammer/source__/__pycache__/profile_structure__.cpython-310.pyc
-
message spammer/source__/__pycache__/remove_and_add__.cpython-310.pyc
-
message spammer/source__/__pycache__/remove_and_add__.cpython-311.pyc
-
message spammer/source__/__pycache__/remove_and_add__.cpython-312.pyc
-
message spammer/source__/__pycache__/reserve__.cpython-310.pyc
-
message spammer/source__/__pycache__/session__.cpython-310.pyc
-
message spammer/source__/__pycache__/session__.cpython-311.pyc
-
message spammer/source__/__pycache__/session__.cpython-312.pyc
-
message spammer/source__/__pycache__/session__.cpython-37.pyc
-
message spammer/source__/__pycache__/xuid__.cpython-310.pyc
-
message spammer/source__/__pycache__/xuid_structure__.cpython-310.pyc
-
message spammer/source__/constants__.py
-
message spammer/source__/crypto_base__.py
-
message spammer/source__/device_auth_structure__.py
-
message spammer/source__/managers__.py
-
message spammer/source__/message__.py
-
message spammer/source__/modules/remove_and_add__.py
-
message spammer/source__/remove_and_add__.py
-
message spammer/source__/session__.py