UNBAN[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

UNBAN.zip
Size

10.8MB
MD5

9118e15ddd8994c57511bafb158170bb
SHA1

9d2c9a974fe1e5fa5e95de1aedba012d2c4b7c28
SHA256

b3b27d164c8acad4ed5d3c0a188f09763240cbf0d916ddf139cf36cb1c2c2981
SHA512

cceb1e97bef3624727427abd639777aa6cb28ba98cc43dc0204b10992167e34e0bdf599ce59414d8b22d79bdbb57f4c31559fe209a0ce943594dcbb35b232118
SSDEEP

196608:wRW2ar4X/MP0tvORZzFV/qQbt4Dg7GXzsuj/t5L4RXaHMh3hscJj2KOmkTz6N5w:IW2c4X/MeORZFXyc5ujrLcaH6hscJj2X

Score

10^/10

vmprotect themida pyinstaller

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
static1/unpack001/UNBAN/UTILS/3/1/DevManView.exe	Nirsoft

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/UNBAN/cleaner/Simple apple cleaner ( best if you dont have deep traces ).exe	themida

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/UNBAN/UTILS/1/KernelMapper.exe	vmprotect

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/UNBAN/serialChecker.exe	pyinstaller

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/UNBAN/UTILS/1/Run Me.exe
unpack001/UNBAN/UTILS/1/Test Perm Spoof.exe
unpack001/UNBAN/cleaner/Simple apple cleaner ( best if you dont have deep traces ).exe
unpack001/UNBAN/serialChecker.exe

Files

UNBAN.zip
.zip
UNBAN/Test.bat
UNBAN/UTILS/1/KernelMapper.exe
.exe windows:6 windows x64 arch:x64

ea1e0cf1f5ea982ff2181b84e3e9ef79

Code Sign

a7:5f:24:b1:7f:ae:1a:87:ec:14:59:be:25:7a:3b:6c
Certificate

Issuer

CN=EasyAntiCheat Oy,O=Certigo US.

Not Before

27/10/2021, 04:00

Not After

29/11/2024, 04:59

Subject

CN=EasyAntiCheat Oy,O=Certigo US.

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c4:33:42:1e:c0:f0:cf:63:d0:24:46:15:36:0d:66:ce:e9:1a:09:66
Signer

Actual PE Digest

c4:33:42:1e:c0:f0:cf:63:d0:24:46:15:36:0d:66:ce:e9:1a:09:66

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetVersionExA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

shell32

ShellExecuteA

user32

DefWindowProcA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

advapi32

ControlService

wtsapi32

WTSSendMessageW

Exports

Exports

�"��=a��s��,j��*ж��7��-҉��@+_��fn�BLV��[�p�t�h��"4-��F�H��}��+�Ĵ0��6�� V��3��SM��Q��m�﹨�q�Us�w��W��\��\��(�ݡ�( i%e��m�͙v�qY��Ny�8OG��P(:=��$�]��E��j�C��8Y��⦔;�$2T��[��ʯ��K��)��M��K��|*�)� �u{�{��%/�6yG}Y��Y��؞[��3^L�R ��+_�]f�U2�,'�x�� (_�9��,�To�� %Gc� u?�,��yW��<'�Ѯ��9R�S�O�S��Ę��ED4��ǯь�˒��^��c�$D��B�g)��gqNo"��46�2��V�X�ĥ��&��g��1��<��E��V�}XA�vP�6��HІkBz$V�$��:��1��;� �(6�'OB��Cr��R�d�4��h�[��;a�۱�p"`�(̞h�s�,kwc�]_9hȚNz i�[+��7��^�{ں�I)��k�,��OD.Oe0�S��??&r�C/��Zs��^R�n�`�y��w��t�*�BGV�Y��fŮ��SV��j�a+�:a��*��A��Mї8"�=/�U�:8;�e3BUO<�?��F�؆0�$�� ;�&B[��OY��yb��W��1V�^��Պ��3�UP��a|��GhH��Q�FS7��}޺�m�)�r�?�z��S�� f@��|�l��x�?i��ş�4Yٓ��]��L��Jp�8�j[��cR!�ޚA��j��\+�;�� S ��ml��Y1�q��y�#�X�?��_\U��o��E��溼j�J(f�� d�?��5"s# c ��Zr��| �R�x�t��?�t�Z?��3)��zen�� `u��wO�^�A�<��6�EFZ�Ha.[2#淵�*�/f8c#l˶\y�1��o��z�� 8AWB܁q�!�[4�=��Bi0#��2?�6��t$��p��j,��5�$��p��qݞv�s��hRM�H�!k�K,kVsȱ�D%�� X`�sL��f��m!}�è_��f��݃�w(uc� �;�i!j��i d?��6ʶ"}��p�H!��$c�~%! �6l �=�g*��~Z%�1�X��Lv@6�L�:��N8�p�ldԆ� Z�{d`�K6}|�Gs��0t� �}��d{c^�~n��s�4M]ĚĚѮB9iY�_[�ނp�{=�P.(�[r��i��$Gh��o�`��r?6a'!n5z��H�aa��]o�*��D��?�ބ!̏LBr.Vк��s��_��D�!5��O��̼��k8��<&��f��Eo��tO�$�N��h`ƒ<�b�m��:�]��G�PD��ʙ\��"��j;D�C�t>�J5sCf��O��gJ�#f��e��I"t��Z�Q�f:�K�0M�� $�U ^��]�� ~��<��W��4М�虏�p��{�$��pxnY�vs��IA�N�9�7�Y�\E"n%,i�P��&&�vp�9-hX�t)��MȔ�Ƹ'7�(\�vR�޵��/f�0��f>��C��-ރ��C��?��Y "$@�B�N�e��I ��lrH*�< +��^K��r�R�|Tх��"�-t��.ҠĲԣ$�٨Mcs��N�97��8e��Ӥ��m""��~��0'��,�4�&�kJ�A>�� ũ �r�#+�ٶ�&�Q��# �U�Zb�-�Y�A��,I�9��*�:�\��>��[b��֦��0}&�B�%&�D��32`��0q�:~��Y��u��N�@O��qc�R�T�Z�o ��C��qeٳ?QI/DX��G1��8G��[��6��z�#�N�I)H��R��aF0c��i��4�X��TD�Q��+��h�� Ga��4Ib�!q�vE(Ah<�R*�~�@9AV��D�/�� Ev��밒#� �H��ᨛ��`�&� >bQ?��2vZ��7�Я��B�sDr�ٍ ��d~�-&�v^��:��x}�A�l��3��"w��r'Ŭp:q�(�s�K��-{f�xw��~Us!�� B�Fǘ��[.^1�7��c�[<kD6��HT��Q�mׇ�&�:N�ЮZ��ʔp��F��O��,j��m(�2��Ҡ(y�c�$7]»� ۡ��4�p�I1�J0��)`��S 5b"�?�s24�E�4��䗖��<��)�沺��w��U��:j�^i�W|��3�V'e:�܉��|��rB蚖#9�0��m�3Y��G(�|D �&��m� U��Ԯ�s��K�0}��$�3+%h#�d�:��eADի��Jd�Y��/�xh��m!r��78m��,�(W��[Y;b��OP��b��xx{|�[��AG��}�ꌚ�-�26K[Ut��9�L_z��`��}�B��v��Ŀ7�t�6��m$��q�;��l�)�wI�s�2�?��B��}ګ29xʮ��n��:��YS�jC��w�7��u��e>��S�4e*?X��3|K�9[�M@�FiC�\W�hN%��sOr-m�n6e��]l|W��X��Eb4��M��fJ#�G�7 d��.�y��f9��A�0H�[�|7x��/��/F .��՗l�tRv�� |�%��K/H+��dK"��z�O��N�

Sections

.text
Size: - Virtual size: 239KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UNBAN/UTILS/1/Run Me.exe
.exe windows:6 windows x64 arch:x64

08755f1c09cd6042e818084b464b05c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Sassy\Desktop\ConsoleApplication1\x64\Release\ConsoleApplication1.pdb

Imports

msvcp140

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
__current_exception
__C_specific_handler
__std_terminate
__std_exception_copy
__std_exception_destroy
memcpy
memset
_CxxThrowException
memmove

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
_register_thread_local_exe_atexit_callback
system
_invalid_parameter_noinfo_noreturn
_c_exit
_exit
_cexit
__p___argv
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
__p___argc
_set_app_type
_seh_filter_exe
terminate
exit

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_callnewh
free
_set_new_mode
malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

RtlCaptureContext
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetSystemTimeAsFileTime

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UNBAN/UTILS/1/Test Perm Spoof.exe
.exe windows:6 windows x64 arch:x64

397657181a170cedf5596488efef5ae5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Sassy\Desktop\ConsoleApplication1\x64\Release\ConsoleApplication1.pdb

Imports

kernel32

FreeConsole
GetConsoleWindow
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlCaptureContext

user32

MessageBoxW
ShowWindow

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler
__current_exception
__std_exception_destroy
memcpy
_CxxThrowException
__current_exception_context
memmove
memset
__std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
__p___argv
terminate
_c_exit
exit
system
_initterm_e
_cexit
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_initterm
_get_initial_narrow_environment
_configure_narrow_argv
__p___argc
_set_app_type
_seh_filter_exe
_exit
_initialize_narrow_environment

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
_callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UNBAN/UTILS/1/amifldrv64.sys
.sys windows:6 windows x64 arch:x64

363922cc73591e60f2af113182414230

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:f4:3c:81:c1:eb:27:87:6e:e1:ae:fe:aa:5a:0f:5d
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/06/2014, 00:00

Not After

30/08/2017, 12:00

Subject

SERIALNUMBER=780491,CN=American Megatrends\, Inc.,O=American Megatrends\, Inc.,POSTALCODE=30093,STREET=5555 Oakbrook Parkway Suite 200,L=Norcross,ST=Georgia,C=US,1.3.6.1.4.1.311.60.2.1.2=#130747656f72676961,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe
Signer

Actual PE Digest

6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\amibios\utility\amiflashdriver\flashdriverwin64\Release\amd64\amifldrv64.pdb

Imports

ntoskrnl.exe

ZwMapViewOfSection
RtlInitUnicodeString
ZwUnmapViewOfSection
ZwClose
ObReferenceObjectByHandle
ZwOpenSection
MmUnmapLockedPages
MmMapLockedPages
MmFreeContiguousMemory
MmBuildMdlForNonPagedPool
IoFreeMdl
MmGetPhysicalAddress
MmMapIoSpace
PsGetVersion
MmIsAddressValid
IoAllocateMdl
MmAllocateContiguousMemory
DbgPrint
IoDeleteSymbolicLink
IoDeleteDevice
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx
MmMapLockedPagesSpecifyCache
MmUnmapIoSpace

hal

HalTranslateBusAddress

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 1010B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UNBAN/UTILS/2/Run Me.bat
.bat .vbs
UNBAN/UTILS/2/Volumeid64.exe
.exe windows:5 windows x64 arch:x64

735aed1002ee8ff1be0e1dee668e8b0d

Code Sign

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

30/03/2016, 19:21

Not After

30/06/2017, 19:21

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

65:97:9c:4b:c0:56:29:3c:65:68:1d:c8:51:cc:90:6a:97:43:fe:d9:91:a6:db:5c:b9:5c:47:8e:bf:73:7b:f7
Signer

Actual PE Digest

65:97:9c:4b:c0:56:29:3c:65:68:1d:c8:51:cc:90:6a:97:43:fe:d9:91:a6:db:5c:b9:5c:47:8e:bf:73:7b:f7

Digest Algorithm

sha256

PE Digest Matches

true

25:f3:81:49:d7:50:ad:69:9f:da:99:18:45:e2:bd:84:7c:66:4c:a4
Signer

Actual PE Digest

25:f3:81:49:d7:50:ad:69:9f:da:99:18:45:e2:bd:84:7c:66:4c:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

FormatMessageA
GetDriveTypeA
CreateFileA
GetVolumeInformationA
GetVersionExA
LCMapStringW
CloseHandle
GetStringTypeW
OutputDebugStringW
SetFilePointer
DeviceIoControl
ReadFile
WriteFile
GetLastError
GetCommandLineW
GetVersion
LoadLibraryA
GetModuleHandleA
GetStdHandle
LocalFree
LocalAlloc
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA
GetFileType
ReadConsoleW
WriteConsoleW
SetFilePointerEx
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
SetStdHandle
HeapAlloc
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
GetConsoleMode
ReadConsoleInputA
SetConsoleMode
GetCommandLineA
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
RtlUnwindEx
IsDebuggerPresent
IsProcessorFeaturePresent
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThreadId
GetProcessHeap
LoadLibraryExW
CreateFileW
QueryPerformanceCounter
GetCurrentProcessId
HeapSize

user32

SendMessageA
DialogBoxIndirectParamA
EndDialog
GetDlgItem
SetWindowTextA
SetCursor
LoadCursorA
InflateRect
GetSysColorBrush

gdi32

StartPage
EndDoc
StartDocA
SetMapMode
GetDeviceCaps
EndPage

comdlg32

PrintDlgA

advapi32

RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegCreateKeyA
RegCloseKey
RegSetValueExA

version

GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeA

Sections

.text
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UNBAN/UTILS/3/1/DevManView.cfg
UNBAN/UTILS/3/1/DevManView.exe
.exe windows:4 windows x86 arch:x86

57395b1a198f2bee9d5195fd70610b18

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/09/2019, 00:00

Not After

09/09/2023, 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:7e:99:ae:53:fc:c8:b0:bb:1d:e0:d6:0b:75:e7:29:7d:85:05:ed:b5:18:31:92:6d:7f:4b:80:3a:9d:4f:3f
Signer

Actual PE Digest

71:7e:99:ae:53:fc:c8:b0:bb:1d:e0:d6:0b:75:e7:29:7d:85:05:ed:b5:18:31:92:6d:7f:4b:80:3a:9d:4f:3f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Projects\VS2005\DevManView\Release\DevManView.pdb

Imports

msvcrt

__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__p__fmode
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
__set_app_type
_controlfp
_except_handler3
__wgetmainargs
_wcslwr
strlen
qsort
towupper
free
wcscmp
modf
memcmp
_memicmp
wcstoul
_ultow
malloc
??2@YAPAXI@Z
??3@YAXPAX@Z
wcschr
_itow
wcsrchr
_wcsicmp
wcslen
memcpy
_wcsnicmp
_purecall
_wtoi
wcscpy
memset
wcscat
_snwprintf
wcsncat

comctl32

ord17
ImageList_Create
ImageList_SetImageCount
ImageList_AddMasked
CreateStatusWindowW
CreateToolbarEx
ImageList_SetOverlayImage
ImageList_ReplaceIcon

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

kernel32

Process32FirstW
GetCurrentThreadId
WinExec
EnumResourceTypesW
GetModuleHandleA
GetStartupInfoW
OpenProcess
CreateToolhelp32Snapshot
FreeLibrary
GetProcAddress
LoadLibraryExW
GetLastError
CompareFileTime
GetModuleFileNameW
SystemTimeToFileTime
LoadLibraryW
FileTimeToSystemTime
CloseHandle
ExpandEnvironmentStringsW
GetDriveTypeW
GetLogicalDrives
GetTickCount
CreateFileW
QueryDosDeviceW
DeviceIoControl
GlobalLock
SizeofResource
FormatMessageW
GetDateFormatW
GetTempFileNameW
GetVersionExW
GetFileSize
GetWindowsDirectoryW
GetModuleHandleW
FileTimeToLocalFileTime
GetTimeFormatW
GetFileAttributesW
ReadFile
LocalFree
LockResource
WriteFile
lstrcpyW
FindResourceW
lstrlenW
LoadResource
GlobalAlloc
SystemTimeToTzSpecificLocalTime
GlobalUnlock
GetSystemDirectoryW
GetTempPathW
WideCharToMultiByte
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetPrivateProfileStringW
GetStdHandle
Sleep
DeleteFileW
SetErrorMode
CreateProcessW
GetCurrentProcessId
ExitProcess
GetCurrentProcess
ReadProcessMemory
Process32NextW

user32

SetCursor
ReleaseDC
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
GetDC
GetWindowRect
GetDlgItemInt
SetWindowPos
SendDlgItemMessageW
EndDialog
EndPaint
GetDlgItem
InvalidateRect
GetWindow
GetWindowPlacement
DrawFrameControl
SetDlgItemInt
SetWindowTextW
BeginPaint
UpdateWindow
GetClientRect
SetDlgItemTextW
GetDlgItemTextW
GetSystemMetrics
DeferWindowPos
CreateWindowExW
RegisterClassW
MessageBoxW
SetMenu
LoadAcceleratorsW
PostMessageW
DefWindowProcW
TranslateAcceleratorW
SendMessageW
SetWindowPlacement
LoadImageW
DestroyIcon
LoadIconW
SetWindowLongW
GetWindowLongW
SetFocus
GetParent
KillTimer
SetTimer
EndDeferWindowPos
BeginDeferWindowPos
OpenClipboard
MoveWindow
GetMenuStringW
GetMenuItemCount
CloseClipboard
CheckMenuItem
GetCursorPos
GetSysColor
SetClipboardData
EnableWindow
MapWindowPoints
GetMenu
GetSubMenu
EmptyClipboard
InsertMenuItemW
EnableMenuItem
GetClassNameW
GetDesktopWindow
GetWindowTextW
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DialogBoxParamW
DestroyMenu
CreateDialogParamW
DestroyWindow
EnumChildWindows
LoadStringW
GetKeyState
SetMenuItemInfoW
CreatePopupMenu
InsertMenuW
DeleteMenu
RemoveMenu
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
GetMessageW
DispatchMessageW
IsDialogMessageW
TranslateMessage
DrawTextExW
GetMonitorInfoW
MonitorFromWindow
GetWindowThreadProcessId
EnumWindows
AttachThreadInput
SetForegroundWindow

gdi32

SetBkMode
DeleteObject
GetTextExtentPoint32W
SetBkColor
SelectObject
SetTextColor
CreateFontIndirectW
GetDeviceCaps
GetStockObject

comdlg32

FindTextW
GetOpenFileNameW
GetSaveFileNameW

advapi32

QueryServiceStatus
StartServiceW
OpenServiceW
ChangeServiceConfigW
ControlService
CloseServiceHandle
OpenSCManagerW
RegLoadKeyW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetKeySecurity
RegConnectRegistryW
RegGetKeySecurity

shell32

ExtractIconExW
ShellExecuteW
SHGetFileInfoW
Shell_NotifyIconW

ole32

CoUninitialize
CoInitialize
CoCreateInstance

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UNBAN/UTILS/3/1/DeviceCleanupCmd.exe
.exe windows:5 windows x64 arch:x64

6aa5e2f8804f69cfa4766d009271c7d7

Code Sign

5b:16:02:a6:5c:10:8c:b5:47:a1:5f:08:9a:33:5c:5b
Certificate

Issuer

CN=Uwe Sieber,O=www.uwe-sieber.de,1.2.840.113549.1.9.1=#0c126d61696c407577652d7369656265722e6465

Not Before

08/09/2011, 13:43

Not After

30/12/2099, 22:00

Subject

CN=Uwe Sieber,O=www.uwe-sieber.de,1.2.840.113549.1.9.1=#0c126d61696c407577652d7369656265722e6465

Extended Key Usages

ExtKeyUsageCodeSigning

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23/10/2020, 00:00

Not After

22/01/2032, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

58:67:b5:7d:83:db:6e:07:36:99:78:ca:39:7f:ce:60:56:48:84:60
Signer

Actual PE Digest

58:67:b5:7d:83:db:6e:07:36:99:78:ca:39:7f:ce:60:56:48:84:60

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

u:\1Source\VC\DeviceCleanupCmd113\Release_x64\DeviceCleanupCmd.pdb

Imports

kernel32

lstrcatA
QueryDosDeviceW
lstrcmpiW
lstrcpyW
GetTickCount
CloseHandle
LocalFree
GetLastError
OpenProcess
GetCurrentProcess
DeleteCriticalSection
GetCurrentProcessId
GetConsoleWindow
ReadConsoleInputW
FlushConsoleInputBuffer
Sleep
GetNumberOfConsoleInputEvents
SetConsoleTextAttribute
LeaveCriticalSection
EnterCriticalSection
GetConsoleScreenBufferInfo
GetStdHandle
lstrlenA
WriteFile
GetFileType
PeekConsoleInputW
lstrcpyA
InitializeCriticalSection
GetConsoleMode
SetConsoleMode
GetConsoleOutputCP
GetACP
SetConsoleCtrlHandler
HeapAlloc
HeapFree
lstrlenW
GetCommandLineW
GetSystemDirectoryA
FreeLibrary
SetFileAttributesA
GetFileAttributesA
GetWindowsDirectoryA
GetProcAddress
ExitProcess
GetProcessHeap
lstrcatW
SetConsoleWindowInfo
SetConsoleScreenBufferSize
GetModuleFileNameW
GetModuleHandleA
GetVersionExW
SetLastError
LoadLibraryW
GetSystemDirectoryW
LoadLibraryA
SystemTimeToFileTime
GetSystemTime
LocalAlloc
RaiseException

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UNBAN/UTILS/3/1/DriveCleanup.exe
.exe windows:5 windows x64 arch:x64

53e2fdd9f0e671e26681569046be0658

Code Sign

5b:16:02:a6:5c:10:8c:b5:47:a1:5f:08:9a:33:5c:5b
Certificate

Issuer

CN=Uwe Sieber,O=www.uwe-sieber.de,1.2.840.113549.1.9.1=#0c126d61696c407577652d7369656265722e6465

Not Before

08/09/2011, 13:43

Not After

30/12/2099, 22:00

Subject

CN=Uwe Sieber,O=www.uwe-sieber.de,1.2.840.113549.1.9.1=#0c126d61696c407577652d7369656265722e6465

Extended Key Usages

ExtKeyUsageCodeSigning

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

11/05/2022, 00:00

Not After

10/08/2033, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

90:b6:1d:5f:95:2d:18:09:ab:52:d7:fa:1f:88:13:c0:74:82:aa:17
Signer

Actual PE Digest

90:b6:1d:5f:95:2d:18:09:ab:52:d7:fa:1f:88:13:c0:74:82:aa:17

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

u:\1Source\VC\DriveCleanup163\Release_x64\DriveCleanup.pdb

Imports

kernel32

FreeLibrary
SetConsoleTextAttribute
GetStdHandle
CloseHandle
GetCurrentProcess
lstrcmpW
GetModuleFileNameW
GetConsoleWindow
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
lstrlenW
LocalFree
GetLastError
Process32NextW
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
GetWindowsDirectoryW
GetTickCount
lstrcpyW
Sleep
lstrcmpiW
GetNumberOfConsoleInputEvents
FlushConsoleInputBuffer
PeekConsoleInputW
GetFileType
GetCurrentProcessId
SetConsoleMode
SetConsoleCtrlHandler
ReadConsoleInputW
HeapAlloc
HeapFree
WriteConsoleW
WriteFile
WideCharToMultiByte
GetOEMCP
GetCommandLineW
ExitProcess
GetProcessHeap
lstrlenA
lstrcatW
MultiByteToWideChar
DeviceIoControl
CreateFileW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
GetVolumeInformationW
GetDriveTypeW
GetVolumeNameForVolumeMountPointW
LocalAlloc
GetProcAddress
GetModuleHandleA
LoadLibraryA
lstrcatA
GetSystemDirectoryA
GetVersionExW
FormatMessageW
RaiseException

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UNBAN/UTILS/3/1/Run Me.bat
UNBAN/UTILS/3/2/1. Xbox hosts, fivem.bat
UNBAN/UTILS/3/2/2. Windows Cleanup.bat
UNBAN/UTILS/3/2/3. Epic games.bat
UNBAN/UTILS/3/2/4. Identifers.bat
UNBAN/UTILS/3/2/6 Spoof Mac.bat
.bat .vbs
UNBAN/UTILS/3/2/7. Run Last.bat
UNBAN/cleaner/Best Cleaner ( may break some windows features ).bat
UNBAN/cleaner/Simple apple cleaner ( best if you dont have deep traces ).exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Size: 54KB - Virtual size: 142KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 12KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: - Virtual size: 5.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
UNBAN/read me.txt
UNBAN/run.bat
UNBAN/serialChecker.exe
.exe windows:5 windows x64 arch:x64

bae3d3e8262d7ce7e9ee69cc1b630d3a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

GetWindowThreadProcessId
ShowWindow

kernel32

GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
SetDllDirectoryW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
GetCurrentProcessId
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetConsoleWindow
HeapSize
GetLastError
WriteConsoleW
SetEndOfFile
GetStartupInfoW
TlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
HeapReAlloc
GetFileAttributesExW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation

advapi32

ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorW

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
main.pyc

Sharing

General

Malware Config

Signatures

Files

ea1e0cf1f5ea982ff2181b84e3e9ef79

Code Sign

a7:5f:24:b1:7f:ae:1a:87:ec:14:59:be:25:7a:3b:6cCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

c4:33:42:1e:c0:f0:cf:63:d0:24:46:15:36:0d:66:ce:e9:1a:09:66Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shell32

user32

advapi32

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 239KB

.rdata Size: - Virtual size: 114KB

.data Size: - Virtual size: 116KB

.pdata Size: - Virtual size: 9KB

.vmp0 Size: - Virtual size: 3.5MB

.vmp1 Size: 5.4MB - Virtual size: 5.4MB

.reloc Size: 512B - Virtual size: 180B

.rsrc Size: 1KB - Virtual size: 1KB

08755f1c09cd6042e818084b464b05c9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 852B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 88B

397657181a170cedf5596488efef5ae5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

a7:5f:24:b1:7f:ae:1a:87:ec:14:59:be:25:7a:3b:6c
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

c4:33:42:1e:c0:f0:cf:63:d0:24:46:15:36:0d:66:ce:e9:1a:09:66
Signer

.text
Size: - Virtual size: 239KB

.rdata
Size: - Virtual size: 114KB

.data
Size: - Virtual size: 116KB

.pdata
Size: - Virtual size: 9KB

.vmp0
Size: - Virtual size: 3.5MB

.vmp1
Size: 5.4MB - Virtual size: 5.4MB

.reloc
Size: 512B - Virtual size: 180B

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 852B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 88B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 900B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 88B

61:20:4d:b4:00:00:00:00:00:27
Certificate

09:f4:3c:81:c1:eb:27:87:6e:e1:ae:fe:aa:5a:0f:5d
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

6a:eb:58:7e:dc:d0:12:89:ab:c8:43:16:ae:88:95:9c:23:56:63:fe
Signer

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 1024B - Virtual size: 572B

.data
Size: 512B - Virtual size: 272B

.pdata
Size: 512B - Virtual size: 192B

INIT
Size: 1024B - Virtual size: 1010B

33:00:00:00:9b:e0:74:37:cb:3d:4d:8d:2e:00:00:00:00:00:9b
Certificate

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

65:97:9c:4b:c0:56:29:3c:65:68:1d:c8:51:cc:90:6a:97:43:fe:d9:91:a6:db:5c:b9:5c:47:8e:bf:73:7b:f7
Signer

25:f3:81:49:d7:50:ad:69:9f:da:99:18:45:e2:bd:84:7c:66:4c:a4
Signer

.text
Size: 79KB - Virtual size: 79KB

.rdata
Size: 56KB - Virtual size: 55KB

.data
Size: 6KB - Virtual size: 15KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB