ms_by_np hackvshack.net.rar
- SHA256 34c034c2a5aa79afe6f518fb9faa53b815e26ff9a3e73d2838e5a58581129605
Password
hvh.net
Overview
overview
8Static
static
3ms_by_np/CRACK.bat
windows10-2004-x64
8ms_by_np/CRACK.bat
windows11-ltsc_2024-x64
8ms_by_np/M...dr.dll
windows10-2004-x64
5ms_by_np/M...dr.dll
windows11-ltsc_2024-x64
5ms_by_np/M...ame.js
windows10-2004-x64
3ms_by_np/M...ame.js
windows11-ltsc_2024-x64
3ms_by_np/m...se.dll
windows10-2004-x64
1ms_by_np/m...se.dll
windows11-ltsc_2024-x64
1ms_by_np/m...ct.exe
windows10-2004-x64
7ms_by_np/m...ct.exe
windows11-ltsc_2024-x64
7ms_by_np/m...ct.exe
windows10-2004-x64
7ms_by_np/m...ct.exe
windows11-ltsc_2024-x64
7ms_by_np/m...er.exe
windows10-2004-x64
7ms_by_np/m...er.exe
windows11-ltsc_2024-x64
7ms_by_np/r...ct.bat
windows10-2004-x64
3ms_by_np/r...ct.bat
windows11-ltsc_2024-x64
3ms_by_np/s...14.pyc
windows10-2004-x64
3ms_by_np/s...14.pyc
windows11-ltsc_2024-x64
3ms_by_np/s...ect.py
windows10-2004-x64
3ms_by_np/s...ect.py
windows11-ltsc_2024-x64
3ms_by_np/s...ver.py
windows10-2004-x64
3ms_by_np/s...ver.py
windows11-ltsc_2024-x64
3Behavioral task
behavioral1
Sample
ms_by_np/CRACK.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
ms_by_np/CRACK.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
Behavioral task
behavioral3
Sample
ms_by_np/MemeSense/bin/win64/xldr.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
ms_by_np/MemeSense/bin/win64/xldr.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
ms_by_np/MemeSense/cs2/vpks/game.js
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
ms_by_np/MemeSense/cs2/vpks/game.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
ms_by_np/memesense.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
ms_by_np/memesense.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
ms_by_np/ms_inject.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
ms_by_np/ms_inject.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
ms_by_np/ms_inject.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
ms_by_np/ms_inject.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
ms_by_np/ms_server.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
ms_by_np/ms_server.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
ms_by_np/remove_redirect.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
ms_by_np/remove_redirect.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral17
Sample
ms_by_np/src/__pycache__/inject.cpython-314.pyc
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
ms_by_np/src/__pycache__/inject.cpython-314.pyc
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
ms_by_np/src/inject.py
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral20
Sample
ms_by_np/src/inject.py
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral21
Sample
ms_by_np/src/localserver.py
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
ms_by_np/src/localserver.py
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target ms_by_np hackvshack.net.rar
- Size 32.9MB
- Sample261006-wv3m8ast5l
- SHA256 34c034c2a5aa79afe6f518fb9faa53b815e26ff9a3e73d2838e5a58581129605
- MD5 ec3bdb68eae29c2ef9948dc4dbd18f10
- SHA1 60d0a65d3cdb9f5c3cb7c9b7d3e77f27ed3742b8
- SHA512 e1753231091b20d23be78f4d40f8cf72f36b1b85e436a2da0deb01ce5087eeeb2c8321eb8f982431f2297d5bd24516c570fcfd498a1dc2eced95f6794a0a4706
- SSDEEP 786432:Jx2JYtxbX9FN1bL3cOx0FMmxiuaIxje4qqlSF/ctAU3lKO1:Jx2JYtV9poFxJaIde4NVKo
- TLSH T1D27733D7ADFC518CAD6D9261F8CAC1CB5DD7A501623371686AC7C3209D8783BBF82528
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Detects Pyinstaller 3 IoCs
resource yara_rule static1/unpack001/ms_by_np/ms_inject.exe pyinstaller static1/unpack001/ms_by_np/ms_inject.exe.bak pyinstaller static1/unpack001/ms_by_np/ms_server.exe pyinstaller - Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/ms_by_np/MemeSense/bin/win64/xldr.dll unpack001/ms_by_np/memesense.dll unpack001/ms_by_np/ms_inject.exe unpack001/ms_by_np/ms_inject.exe.bak unpack001/ms_by_np/ms_server.exe
File Explorer
-
ms_by_np hackvshack.net.rar.rar 32.9MB
-
ms_by_np/CRACK.bat.bat 1KB
-
ms_by_np/MemeSense/.gitattributes66B
-
ms_by_np/MemeSense/bin/win64/xldr.dll.dll 6.2MB
-
ms_by_np/MemeSense/cs2/iccache.bin594KB
-
ms_by_np/MemeSense/cs2/localizations/english.bin10KB
-
ms_by_np/MemeSense/cs2/localizations/russian.bin14KB
-
ms_by_np/MemeSense/cs2/localizations/schinese.bin10KB
-
ms_by_np/MemeSense/cs2/vpks/game.vpk.js 336KB
-
ms_by_np/MemeSense/fonts/esp-icons.ttf75KB
-
ms_by_np/MemeSense/fonts/gui-icons.ttf19KB
-
ms_by_np/MemeSense/fonts/pixel7.ttf25KB
-
ms_by_np/memesense.dll.dll 3.0MB
-
ms_by_np/ms_inject.exe.exe 9.0MB
-
inject.pyc22KB
-
ms_by_np/ms_inject.exe.bak.exe 9.0MB
-
inject.pyc20KB
-
ms_by_np/ms_server.exe.exe 7.9MB
-
localserver.pyc3KB
-
ms_by_np/remove_redirect.bat.bat 346B
-
ms_by_np/src/__pycache__/inject.cpython-314.pyc23KB
-
ms_by_np/src/inject.py12KB
-
ms_by_np/src/localserver.py.py .js 1KB
ms_by_np/CRACK.bat
- SHA256 85a6dac3e8832ac3ff9d870894088201d68ea879fc670fc6d2a60f2247ffaedc
- MD5 5f4b2bb70209c4aab78336e894fc50bc
- SHA1 00e7fdfbb952f925dd338fb1d55e54acc6eb5538
- SHA512 0b17aa73e4bfb97ba0d22b0ded87d4e9bf4d7b5ab07cfa670520b37810c532b960dc4f9ccbdaca70c722cf15f1a73c714ee1d0a4d10a6223e2c1a98f5d96259b
- TLSH T188311E5B311C0C66999AC2928C923251B68EC25F51182CCD74CFD1B82FAB7C46AFD0C6
- MD5 SHA1 SHA512 TLSH
ms_by_np/MemeSense/.gitattributes
- SHA256 1a1dbe176bc233b499d35a57db7513f2941c99ab9759f177830c9149be99005b
- MD5 05bdb783ee6514c8c072e47680af8ff7
- SHA1 ba3dfe345280bdcc5e817bb02cf49b8b8d8e1c4c
- SHA512 9e820d6126d62c0b89e380c69685f6668b2f131283f57e524f59492fa6df22844dda1b90d244d4a1f8aea78a84e65d47b1a878168c4e41001459a947ef275ffe
- TLSH T1EFA022028C0233CCA0C8B3022088E0800338838E2000800A00880C0822C3022C0A2F30
- MD5 SHA1 SHA512 TLSH
ms_by_np/MemeSense/bin/win64/xldr.dll
- IMPHASH be39109ed18c8fe7e8ae456c95a462b1
- SHA256 1fed79b8c6c32db84f12a0600f40e9ebf001470fc009831cb65addf75a02e178
- MD5 03e7b71a7cabed7b7f19a57b481a95da
- SHA1 69a81a2026b06c9609722a6a6096b3c56253533c
- SHA512 e582be83f663be1ba9c24c2026a19c0273ce2a07fd175058e372f266b84a346bceb76fded39fb02088ee7953c4481c3c76d143320da797ab63bf5861bca2b9b3
- SSDEEP 98304:FYwlmPwWHtNuJKIrugWUYCUEBL2uu5R6Q4eUamwHBRqZIA96SDo3xGjr:/MHzY7rHWU5L2uk56LwTQ5gSUAj
- TLSH T1C05623803CD9527CF6A74A72D1491EEEFC8035C9AE7A680E6FC6039C2531D57CEC6A25
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
hvh.net
Minor OS version
0
Major OS version
6
Entry point
12511600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntdll
KiUserExceptionDispatcher
bcrypt
BCryptGenRandom
comctl32
InitCommonControlsEx
ucrtbase
_purecall
kernel32
CloseHandle
user32
ChangeWindowMessageFilterEx
Name
uoobiuak
Size
Virtual Size
134KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
blfmugqs
Size
Virtual Size
460KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
ehwzyrvu
Size
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
qabqntbz
Size
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
blpudwrg
Size
Virtual Size
145B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
ywhabqyp
Size
Virtual Size
5.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
nnncdyqw
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
qtkyubiq
Size
6.2MB
Virtual Size
6.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
bmoxixah
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ms_by_np/MemeSense/cs2/iccache.bin
- SHA256 119e2a7c50ec720a9cb5da7ee0998b6f941a57071689a0dfb1650620f8937f59
- MD5 35f5d05ba451c5965118341c4829f07a
- SHA1 385878b93f1bb3173c386c9df8a87d0d84205038
- SHA512 effdd5956681ba9411df09c0bec431d1ef0a11f2ec45373552a6eb6261ddcd9a0ac55224a07cfc74fd35c3b8a390664351f1560ff640d90d26a65e4030a4257f
- SSDEEP 12288:f0s+o5GDmUP0DnEqt7I19NmL05c1zYVW1aPf3cw3lG5HOK87S301FDdiwRo:5GWDEyynqGfUotFDdiwi
- TLSH T1A8D44B63F9DA6F8AB7C6E10883F162FC9245817031B9531AABD42748F5D94123EE72CD
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/MemeSense/cs2/localizations/english.bin
- SHA256 632b73bc0f91b7c915b67f7a902e9ad10840ee05a97b7ab3db2733faefaa142c
- MD5 29c7024ee32d7e21c5a5cb85f9faee46
- SHA1 0611c6634ef6155d6e98d8f2ccd12e915228f281
- SHA512 cf0598b4ee40f7452a4802bfbc33338037eacab4072ae602ba6672657f670a337dc339b5a93c6b233189d716141027581f60fa7dc3a3bf4164efc67a196674ad
- SSDEEP 192:rnc/Owr4yB1MRcDUtDJX5JX20MhyYGWalrrcC9pcAM6YljeyLHif:DcBB1XItDDh8hyYJerrcC9ptYljeyLHS
- TLSH T10C225AFB216D71FAF4A2F1AC56692492BB626131C3EEC1A9F36CC810C1F54140BDAB51
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/MemeSense/cs2/localizations/russian.bin
- SHA256 da4272e47b6ec1074e5a9996ece4cb05e3e88c63d64469a6e38342d5fd70edb0
- MD5 b171e8cac0f4c06b3b58839d1e9acc0a
- SHA1 c07ccf45948696539f6bc108747f306431ecf7cc
- SHA512 a144afe55bf937f900b6866a7479175f01322a164cf3ac049aabe0285f2807338b47f09e60178e406ccec10230bd92fa1bb73052a09cdb4c1eb764e308a6e5cd
- SSDEEP 192:1RVP1DDcPijAsbuCJ5qEHlgeVRtqgarf7AzJKzJNEnr9Hier2+yRD6CqSa2cNZ6V:1h5jLDxlfbogaQzJgwn0erDW6H7NZoGY
- TLSH T1BD628235505960DE5641F10BCD996A097EBB5EBE2FAB636616386C3F71F20108B3C70A
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/MemeSense/cs2/localizations/schinese.bin
- SHA256 a169483c4f5fac745d117f20b9cf6af86d01406f1130e435fb16937598f4cd06
- MD5 aa19e83e1f018cab13946f7540195c1d
- SHA1 a6975d129bc848450a0a7455c5ebce7313043ba1
- SHA512 88abadd6377ddd7ccfb4d9258e28333396aeed0c16f35f544696f3f9d438331cf9b0c8a8801325d892f0d16a98f70919deb582d55c68960b3d40c575076e2795
- SSDEEP 192:9HANI/M59wr6jx7HkC9w+fnD2Pu7YyQOH1JNaUSb6XvYpCQ0GqQEnveB/Wqf:9II2L1w+fnaPuEyVVJNu6Xws6EveQq
- TLSH T154328D97317862FA2857B58C8969809B6759E3329BD3F01BBB76DF10415C62007A2F53
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/MemeSense/cs2/vpks/game.vpk
- SHA256 455e43352863e4e4478e365e11e3cf66de60df63eb3b026bfd9e419e9ae361d1
- MD5 b5a3ee9c095fd07738b438e71987d81c
- SHA1 7ec8a38680fb6c731af57b2adbfed7f411ccae93
- SHA512 e81f01cdfb09a42b0342995e7b8e18023f52c6bfd347c1f775c16ea43295e39739e37188d364490f7e97fb9dde0b560ef682326d2aa0f8538ab5fc76093544b8
- SSDEEP 3072:SCaVS9H4QiZ3oifq6bUqd4LRoUyBCjpBPzdaYBoL74A602kJb:NaVS963ob6bXUyBCjrPzDI7430r
- TLSH T1D074185820F711A6E56B71BCA7CB4111377050032509EE78FD8DE229AF9A5ED13F2B8E
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/MemeSense/fonts/esp-icons.ttf
- SHA256 6aae8b79f861cc57ce4ed3909fabe698aa4d7500e5f5cc4f2856c7706395b3f9
- MD5 9ffc243d6605ea211d86ab35f64b5863
- SHA1 d5e778e796ddfabf8c35cd5ed3552bb37203c364
- SHA512 0e7f4e4d25668c6939dba8502e18132eee73460fb72c37e8db3dfa953ad9ad73a4e82fde65ef859d1d49dbd3e4d78f5f3a66ad6c4d0c6d087ddce5092a0e15f9
- SSDEEP 1536:9eMXjx0WMfgVd8Y4h2sw7IVdd3P5OfpgJ7iz9DsLLsHMa:9eMXjx0XIIdhhCIZm07ep
- TLSH T10673E88623FCDF8AE07169E2449205578AD5E208DF264B32FECE5EDCC1216E44D257AF
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/MemeSense/fonts/gui-icons.ttf
- SHA256 b7d26e39b4109dd3d4bfeaf93cccd10651c02da847381454df2272a3f860fe7f
- MD5 5ee79ba590b45d0bc7fdbb910264213f
- SHA1 5780354d30583c3bef4e94dae3e35176adde5e35
- SHA512 4107803f53efb3bc100ec78bff1125d63c654fe82cc726fce7f03184cb22f9d4d8c18654baaa0139ee5715519255015b32aa43b88fecf41407f0d0dbb9bdac7a
- SSDEEP 384:ZFkl9HDjnGCAZ0EgXAa/UbF/5aoBsbUm8uInKyQGUvXW9aBT:ZFklp/GCAZ0EgXuPWgm8RnKylv9aV
- TLSH T1B6922B5997D2CF8ECD2687FD5CA346A10BF0CE21D27AD56F68869C42D0389DC4EB0A49
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/MemeSense/fonts/pixel7.ttf
- SHA256 0e71338a9ae45df2ede080567cfab831627bac9a83be601521ddbace4cbed11e
- MD5 cd2242816d23dad4250f5ea159c7675c
- SHA1 de74028b5cdb4f3ddc5d5efb0a9b16111b5270fc
- SHA512 5636ff40d846a824c555b076b8ea95a24a62fce9e1abb04048d529a98d62c9961ffa9f12bbd38caa3281f33dc10900aef3095362f34309b6404ad82fd0900458
- SSDEEP 384:VfvBLFj/8zVzglSHg/CxhAzxhAefWVfW0Ur2tPRGVRZ:7LFj8zVzglIAbqlPRGJ
- TLSH T115B2AE084FD72B6DF23296752A61271CB371BE5F0386178BE69D287A1CB31CA4C256D3
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/memesense.dll
- IMPHASH bb9a6031289e38fca34d9318778895a5
- SHA256 3f9ec74d56b69e327bebabf69098d0b6139916c1d5b4bcb6a424ee17b8e67950
- MD5 6b4f26ddb0a70fd3154b20de70c534c3
- SHA1 d4892750a486da0257a433cb541cc8f1473e2d20
- SHA512 1703ddeb28273a1880d7394ba3ce1a2bceb5c0b2a50e24f8652b282491a889b1662eaafca9e4545a74875d2a0fc7f09f062d4b7e842efecbeb6970902deda647
- SSDEEP 49152:k1xKKKKKKKoqIrFAW/vst/4pl9YjWdCzMJDJkjca/MT7d70NbaGWxHYwS73MI:yxKKKKKKKoq4Ot/4VYjW2/MviNaRyQI
- TLSH T1B3E5BF43E2D2147EC41EC138535FAA25FA2578889F746CE76600F6352AF1A91FD7E328
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
hvh.net
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
ntdll
KiUserExceptionDispatcher
LdrFindEntryForAddress
NtQueryPerformanceCounter
RtlAllocateHeap
RtlCreateUnicodeString
RtlDecodePointer
RtlDeleteCriticalSection
RtlEnterCriticalSection
RtlFreeHeap
RtlHashUnicodeString
RtlInitializeCriticalSection
RtlInitializeCriticalSectionAndSpinCount
RtlLeaveCriticalSection
RtlTimeToTimeFields
RtlTryEnterCriticalSection
RtlWakeAddressSingle
__chkstk
_ltoa
_strcmpi
_stricmp
_ultoa
memchr
memcmp
strcat
strcat_s
strcmp
strcpy
strcpy_s
strlen
strncpy
strstr
tolower
toupper
wcslen
ucrtbase
_purecall
msvcp_win
?_Random_device@std@@YAIXZ
?_Xlength_error@std@@YAXPEBD@Z
v8
ord682
ord1143
ord1371
ord1568
ord5001
ord5669
ord5672
ord5772
ord5774
ord6679
ord6813
ord6981
ord7798
ord7872
ord10998
ord11002
ord13153
ord13181
ord13192
ord13354
ord13355
ord15979
ord15980
ord18017
ord18045
sdl3
ord189
ord277
ord562
ord619
ord886
ord1159
libfreetype-6
ord17
ord35
ord39
ord56
ord96
ord97
ord120
ord133
ord135
ord167
ord170
ord172
tier0
ord89
ord123
ord175
ord285
ord295
ord309
ord344
ord375
ord378
ord537
ord633
ord701
ord843
ord844
ord845
ord846
ord847
ord848
ord849
ord851
ord856
ord859
ord862
ord863
ord865
ord929
ord931
ord1095
ord1231
ord1519
ord1702
ord1703
ord1705
ord1708
ord1710
ord1779
ord1807
ord1838
ord1984
ord1987
ord1989
ord1992
ord2361
ord2365
ord2367
ord2368
ord2373
ord2378
ord2385
ord2395
ord2444
ord2445
ord2450
ord2456
ord2457
ord2458
ord2471
ord2474
ord2480
ord2501
ord2540
v8_zlib
ord6
ord12
ord15
ord17
ord61
ord67
ord70
ord86
Name
.text
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
462KB
Virtual Size
461KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.CRT
Size
512B
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.brdata
Size
1024B
Virtual Size
681B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wow64
Size
512B
Virtual Size
145B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.ess0
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ms_by_np/ms_inject.exe
- IMPHASH f0d05c1dd5ba1ed096c85a04a8275fec
- SHA256 a953d2994598d6a3c39fa44ea8e8ce28f90c05b3e21e5372f7e89cf3e75e7e1a
- MD5 bc2a40015a343eb86bbc98ecf91bb389
- SHA1 9f774fa93de17ea897a37259783fa8f21c1c4aec
- SHA512 63c99f1d10398c30954e4386261a3be433c45a7ae96388cfbc197318bb3727f1a86af2856724668f9b76c29b74d7fde5bcfe46b1dd3be11c11851b8ba656acd3
- SSDEEP 196608:KJoC+tbW897GXPHMe81SF2RPUewq97BtKZ2xHsMRqabRgFgDU:Au1wPsZg2KezxK4xHsMRqabYgw
- TLSH T17C963399D3B009EAE4779A3F5DA59062D3B1B8250760C4DF1AD0872B3F5B2EE6C39341
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
hvh.net
Minor OS version
0
Major OS version
6
Entry point
56560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
CloseHandle
GetCurrentProcess
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
GetCurrentProcessId
OpenProcess
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
HeapSize
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
Process32NextW
SetUnhandledExceptionFilter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetModuleHandleW
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
205KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=188, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=145, id=1, productName=Unmarked objects,
count=30, id=260, version=36246,
count=1, id=258, version=36246,
inject.pyc
- SHA256 a11d40ec079a40b866e0acea43950d92b54fe1eb0e3228b72aaba2b2138c6f71
- MD5 08eab037adef62f0b111b2b888224721
- SHA1 9df4a2dcb818dae8840629832e664ac71f950b83
- SHA512 2e09331f7350b424960fcbca3a1302cae00b71473ca28ccc4b1dfecf384def6759fd94f5ebefe41f1b5f47ee8b6a4f335c4a0d269dcee09bb32eba80b1deec56
- SSDEEP 192:79tsB6FKQmoxkMvI/x2Fv/BgCYu2iRMrqbKhRLAkX535b7w7otNO+Ri/GgykHyyG:kop/4iarqOhRLB35fWK2GDayy6XcG
- TLSH T160A2D6F88A909867FED9F8BA70D72542F7328189A595D703F8198D3D3F8A2AED50110C
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/ms_inject.exe.bak
- IMPHASH e3e80a143805ea18936c8f612e25d363
- SHA256 fa381021430e1aac11c8250f86744acb0d25d902f637de65995f24e72c40e8b8
- MD5 197a898d08329f5489af433494427eb6
- SHA1 07dfeb1297fe883f8c2249a5376365a9fe0f4f5d
- SHA512 960338d1f6396ba50016e27126e60521127d69cc95988c35a4f0c2d559183a5378dcaf2db7a973748723c98b66d266eeb4b7bed9af722347c808f6cae5f9fe0e
- SSDEEP 196608:JoCw4FNPtbW897GXPHMe81SF2RPUewq97BtKZ2xHsMRqabRgFgDU:JFfP1wPsZg2KezxK4xHsMRqabYgw
- TLSH T1EC9633A9D3F409EBD8A7653F5DA52093D3E1B42507A1C5DF1B90432A3FA72EE2839350
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
hvh.net
Minor OS version
0
Major OS version
6
Entry point
59248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMonitorInfoW
MonitorFromPoint
GetCursorPos
GetSystemMetrics
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
LCMapStringW
CompareStringW
VirtualProtect
GetCurrentDirectoryW
HeapAlloc
GetFileSizeEx
GetConsoleOutputCP
GetOEMCP
GetCPInfo
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
GetModuleHandleW
MulDiv
FormatMessageW
CloseHandle
GetCurrentProcess
GetModuleFileNameW
SetDllDirectoryW
GetEnvironmentStringsW
SetErrorMode
GetCurrentProcessId
OpenProcess
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
SetFilePointerEx
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateSymbolicLinkW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
GetConsoleMode
ReadConsoleW
advapi32
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
200KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=189, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=11, id=257, version=33145,
count=163, id=1, productName=Unmarked objects,
count=30, id=260, version=36246,
count=1, id=258, version=36246,
inject.pyc
- SHA256 77435f2ecaa11c6f036c18a1b19187fe07e2b5d75d7d22bfc6a4715d2cd6c7da
- MD5 6ae8c0825dbf7f811cf348a2777eef37
- SHA1 701bf07994be9167dc6d15545728b0a604b7d032
- SHA512 cab013310001b195a819560e8d288a50e034c79c9853e204ac55cd1f600c168ee2feeb383b9ca194e0bcdec76930980ec3ea1b83419a9f7e0580dc6a455eec94
- SSDEEP 192:3mOzkUKYtGywQTv/2gp52iRxr/bKhRLAkndkgb7oG3/oQNSga0MRvk2r7xctilD:6rPa/2/iXr/OhRL1kgfoGP7Sbtbr7L
- TLSH T137A2C4F8CA605427FEE9F87934EB2546F363C186A601DB03B81D8D797F8926EE94110C
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/ms_server.exe
- IMPHASH f0d05c1dd5ba1ed096c85a04a8275fec
- SHA256 54c24a4dfbd1c8e90e734252799c6d3bd52296d00ede775baad5f0695d36930c
- MD5 0c2d9efdc3773448e75988e776f5edfe
- SHA1 16d449ef0bdb1278a01479b742d30ffc1e903d01
- SHA512 08e3b4aee7c70d407ed56dbb86c12dc8dc7ff777d7990eb4d84902b35df42d0a1f2da90faf9f4e3d8b124aa2eb5a323944958a006ef394b5bc49938871e262ff
- SSDEEP 196608:AYr2eBNTwhLCxdRurHSuhHToAUPNfGU5vXvPk0ax8lLDdIOZ+:LsLCxruXhHTodRGkXNaxI/PA
- TLSH T1F38633A6A3C049F9FDB7E6388A539129D7B63C051321C5E702D48A937E275F42A39733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
hvh.net
Minor OS version
0
Major OS version
6
Entry point
56560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
GetCursorPos
ShutdownBlockReasonCreate
GetWindowThreadProcessId
SetWindowLongPtrW
GetWindowLongPtrW
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetMonitorInfoW
MonitorFromPoint
GetSystemMetrics
kernel32
GetTimeZoneInformation
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetLastError
FreeLibrary
GetProcAddress
LoadLibraryExW
FormatMessageW
CloseHandle
GetCurrentProcess
GetModuleFileNameW
SetDllDirectoryW
CreateSymbolicLinkW
SetErrorMode
GetCurrentProcessId
OpenProcess
QueryFullProcessImageNameW
CreateToolhelp32Snapshot
Process32FirstW
HeapSize
CreateDirectoryW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LocalFree
SetConsoleCtrlHandler
GetConsoleWindow
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetEndOfFile
Process32NextW
SetUnhandledExceptionFilter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetModuleHandleW
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlLookupFunctionEntry
EncodePointer
RaiseException
RtlPcToFileHeader
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
GetCurrentDirectoryW
VirtualProtect
CompareStringW
LCMapStringW
advapi32
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
Name
.text
Size
205KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
60KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=188, id=261, version=33145,
count=12, id=260, version=33145,
count=11, id=259, version=33145,
count=3, id=253, version=35721,
count=9, id=259, version=35721,
count=17, id=260, version=35721,
count=39, id=261, version=35721,
count=7, id=257, version=33145,
count=145, id=1, productName=Unmarked objects,
count=30, id=260, version=36246,
count=1, id=258, version=36246,
localserver.pyc
- SHA256 5f20bc8f09c04d570f632b60d2768994376b92c3880e934a6ef05f74271f22cd
- MD5 e92b90c5ebc785a7cee941757947d70d
- SHA1 a749727c32be9cd2b8a04582d539efafc1c82707
- SHA512 0f6a3087cd928d49b940f59942d51783c16326b896a73775fd1d25d965a22ed123dc6223c7f63a84998ed1d3a19998f7e23795e8619853915b5005216603c1ad
- TLSH T14C718A45BB52C0F7FC5855B168141B4DE353E6B16A0CD3E78315A1789C5B1AAFC5070D
- MD5 SHA1 SHA512 TLSH
ms_by_np/remove_redirect.bat
- SHA256 ab5ffd668507ab0770bd249556776fa1e53f6e03fa03bf29a5306f93d60e0348
- MD5 688da05b95698cf12b90769ccda1ac07
- SHA1 af8158fc842ca9945cb328fd5450d4d3366b8e14
- SHA512 83580905d6b5794e93ee5cf6742470f0b9583132d7b25d910cb4daa1b6d25e905e0c69543277d4c70f9cfdd1dce771fdb102eb5d0eff5fd8a948263ff0f979d3
- TLSH T186E0C003358F3C2B485896C554E24342AFCCC2CB002D68CDE0E862522D80BC4CBC5886
- MD5 SHA1 SHA512 TLSH
ms_by_np/src/__pycache__/inject.cpython-314.pyc
- SHA256 00b9c24e18700a6dc9693058ff7c9e8f3c835a69472b7aa802508dbe6352e650
- MD5 b5ca338eb226ea3286a0d9f237fef966
- SHA1 0231773383c208cff766d62fbd7ddbd85f5742ec
- SHA512 f4a38d4820266635f2502654d4dca43013c77658e8a6b107c8ff6b918e2b008a4bcffcf5690d3368b54c3938186b0fcbbaf6748ac6ca95fda089c2ce35e48404
- SSDEEP 384:bx5Rt/V8iWroOhRLIMLmtx/f1MzkTcayycD+Bc/:Ftt8iWjRL+3f1TgycP
- TLSH T163B2D5F8CAA05877FED9F87A74DA2546F3338085A585DB03F85C8D3A7F8A26AD54110C
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/src/inject.py
- SHA256 aa5ae2aa483b9f35041127167b2373bfe551e3b449f29aa1545cd0a63390b734
- MD5 453fe341388f3c7d8bc1b1606d276992
- SHA1 1e1d8c7887ab718343a8bd4f0dfe83c97427fa3c
- SHA512 151ffe64b1e8af532f105a0e4c2006c71187b6f5aff3ce808e6f0a6c7ab9b3beefd9848784809023ef8405931ea90fa6ddd7925fc6d275e29db7eba8a9792b69
- SSDEEP 192:k7Qb+fBy6gIZEgyngDx2XgOHAjl4H++ZiqLUrcXoelb0EvRI5HIT0qm3026oPERf:k77KnuAXNp3vRIRezdJAUL
- TLSH T17652D6491A6C9150D793548ACA178C497E49B8171A381E343F5D8AB3BF2E43DE7B0BF8
- MD5 SHA1 SHA512 SSDEEP TLSH
ms_by_np/src/localserver.py
- SHA256 810143fceb1c025b2dcba84cee61e928f8321ae0da4061d56ef568cc9aaa9282
- MD5 e8cfbe8a00b2223284c19948525c46bd
- SHA1 572586e23d7b9309e00898900ee8d85e7abf56db
- SHA512 c92f73e918f7cb8f4d7622aefe6d08c2f7afa08b27c0d6e9ec154e0869eade97503f8fda277c243ed0ff00493f98f086053b7c8d30e158618b6c1b98a7017870
- TLSH T17531AA99CD6942A3D7A3867D166BC1405357B873168981B8BBCCE7803FC61B8E0F56AC
- MD5 SHA1 SHA512 TLSH