Escape The Backrooms @VaultHaven.zip
- SHA256 0a1f8905298f0dedfd308d72b42a472a16e6567f8caec78044cd4f8cca92128e
Overview
overview
8Static
static
3Last Comma...mer.py
windows10-2004-x64
3Last Comma...mer.py
windows11-ltsc_2024-x64
3UUU3021/Mo...ls.dll
windows10-2004-x64
1UUU3021/Mo...ls.dll
windows11-ltsc_2024-x64
8UUU3021/ModernWpf.dll
windows10-2004-x64
1UUU3021/ModernWpf.dll
windows11-ltsc_2024-x64
8UUU3021/Sy...le.dll
windows10-2004-x64
1UUU3021/Sy...le.dll
windows11-ltsc_2024-x64
1UUU3021/To...ns.dll
windows10-2004-x64
1UUU3021/To...ns.dll
windows11-ltsc_2024-x64
1UUU3021/Un...er.dll
windows10-2004-x64
1UUU3021/Un...er.dll
windows11-ltsc_2024-x64
1UUU3021/UuuClient.exe
windows10-2004-x64
1UUU3021/UuuClient.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Last Command Spammer.py
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
900 seconds
Behavioral task
behavioral2
Sample
Last Command Spammer.py
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
3 signatures
900 seconds
Behavioral task
behavioral3
Sample
UUU3021/ModernWpf.Controls.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
UUU3021/ModernWpf.Controls.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral5
Sample
UUU3021/ModernWpf.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
UUU3021/ModernWpf.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral7
Sample
UUU3021/System.ValueTuple.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
UUU3021/System.ValueTuple.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
UUU3021/ToastNotifications.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
UUU3021/ToastNotifications.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
UUU3021/UniversalUE4Unlocker.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
900 seconds
Behavioral task
behavioral12
Sample
UUU3021/UniversalUE4Unlocker.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
2 signatures
900 seconds
Behavioral task
behavioral13
Sample
UUU3021/UuuClient.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
900 seconds
Behavioral task
behavioral14
Sample
UUU3021/UuuClient.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
1 signatures
900 seconds
General
- Target Escape The Backrooms @VaultHaven.zip
- Size 1.2MB
- Sample260628-acd19aes5s
- SHA256 0a1f8905298f0dedfd308d72b42a472a16e6567f8caec78044cd4f8cca92128e
- MD5 3142f9b39ea236892fc4a835506d53f0
- SHA1 3695e9b833101f3236586f968cfcc589651946b5
- SHA512 ff8e70bc16dc84a6e43b3f7673b220435181a8ba11c1881d18acf080e702bdbf6ea5983a8b6c6144fd2275494290681398e2049febe54364d2ae86b09bd90ed9
- SSDEEP 24576:t5DAHLx45DCoyhoVqWYUcPWmg40L61s597BJE0DPfeTXe:tyrxlNhoVq9Hb1s5BB3DP2TXe
- TLSH T11C4533072F0386E0CADDD8B2AB315C9CA17E567B36E4736061CEBE5A2DC2B120D5945B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/UUU3021/ModernWpf.Controls.dll unpack001/UUU3021/ModernWpf.dll unpack001/UUU3021/ToastNotifications.dll unpack001/UUU3021/UniversalUE4Unlocker.dll unpack001/UUU3021/UuuClient.exe
File Explorer
-
Escape The Backrooms @VaultHaven.zip.zip 1.2MB
-
Escape The Backrooms.ct.bat .xml 1.5MB
-
Last Command Spammer.py1KB
-
[email protected]37KB
-
README.txt328B
-
UUU3021/ESCAPE THE BACKROOMS IITEMS ECT ECT.txt2KB
-
UUU3021/ModernWpf.Controls.dll.dll 373KB
-
UUU3021/ModernWpf.dll.dll 985KB
-
UUU3021/Readme.txt4KB
-
UUU3021/System.ValueTuple.dll.dll 77KB
-
UUU3021/ToastNotifications.dll.dll 107KB
-
UUU3021/UniversalUE4Unlocker.dll.dll 1.1MB
-
UUU3021/UniversalUE4Unlocker.dll.log5KB
-
UUU3021/UuuClient.exe.exe 446KB
-
UUU3021/UuuClient.exe.config.xml 614B
-
UUU3021/UuuClientSettings.ini1KB
-
requirements.txt6B
Escape The Backrooms.ct
- SHA256 e4074fe412110f0a81423447c121de1fc05370258ff490d441a320edc4a755de
- MD5 6a99f05fcfdc363d1321ccd907a2baa8
- SHA1 1d85bea61dbdf0ab984339f7aaaf76946ed5c090
- SHA512 9f3adfa02321a3a9e00bff5cf09133f2342e613688ef5890d8bb6a58783b28ff81940a937b2787579b8ab652d73d8694809f77200cf86bd8de3aeaeefcb79662
- SSDEEP 6144:iG5m1s6QVO+dVO+Nw/KBZgVO+ZG5m1s6QVO+dVO+NWM/KBZpVO+wG5m1L6QVO+d2:xF4KcIvxS
- TLSH T1E46512471A06993BA1FF51159F086805FC34734B12D5E245B8ADA2B31FEAACEDC6F350
- MD5 SHA1 SHA512 SSDEEP TLSH
Last Command Spammer.py
- SHA256 c311fbccdf02c16b9e406fb5a256d84c984097cf201847b3f6c52d276992a532
- MD5 62ccf88ec97145587a390258639f1f6b
- SHA1 7568a304ca1f2c1429dee039006e3b6fea8e1b10
- SHA512 cb8bf7fdbf2f0e14d1ca8debf780f6a7366b0abeecfa63923e45d02bd7097cf7932e731ad8085063033421502fe7cd3ccbe6043d7e46db4d19ff7efdeff39314
- TLSH T1693102173C2E25799AFA491FE201D175CF00516B8A68148BF89CBD993FB0569026B179
- MD5 SHA1 SHA512 TLSH
- SHA256 9ee9e283b6e1e52ec2a00ac9185699f4ad60aa07c1380829e923ae0d4af213cb
- MD5 e984042cf8ef2429c21d99e0f1142e6b
- SHA1 cf891a4510d3ea7db1691e8f990f1348ae2454a0
- SHA512 829b214e40c702831f96db19cd5a04d3b0872c57723d7fa906ddfe6b57f3d6609b8750734856ca504f01b48a09b95bd84dd4c32d83a96f1f4fa853444d3b06a8
- SSDEEP 384:+zyh93fSj4aunHJSU/9MPHD/fXxrhUlCVVbyogprgBk5WOS3cpg:+z+Z3/C1
- TLSH T1B203FEC1A3616FA5E1D40E3A2CC9343385042DDCD8B4160ABBF3E79765EA221577A27F
- MD5 SHA1 SHA512 SSDEEP TLSH
README.txt
- SHA256 d8382769c7f84553ee7d12f15eb21503c367051e5ec8c11d95d7185968d4df7f
- MD5 bf8eaff152017b320698a46b1c41041f
- SHA1 9e46263759856380693e42005264e6b4745b678a
- SHA512 e2ea41ec733933b41ceb520f0d30f5a6ebe773d7af1c220656c30ea37e8a8e58aa15538152e97d6c48626c7629e2740956f08c796c01638bdaeb8a7b8514158b
- TLSH T1AEE0265B97828533322525459EC435E30B29201A3B56A898A04A900452E2A33476FEDD
- MD5 SHA1 SHA512 TLSH
UUU3021/ESCAPE THE BACKROOMS IITEMS ECT ECT.txt
- SHA256 71f7f5ab7f5bd96633e3c3e479824bb6817494cc248d5c40d1bdd373e8d51a16
- MD5 8bf2cdafadf463a3b149865f352cb67d
- SHA1 d95f8fe7d8a1cd85bc5bfd44cc052956ac2f57a8
- SHA512 0e1abb0c52012e4901e3bf2b9070512c9aa4a96fd9aa371bb9286dea17cad61848bbc8d79f6c7d0e4f9e6b518ec91466aa5f445ca6357cdb17333698730d56a0
- TLSH T13C519A6423FB5782EACF30FD23F389D600D195048B22F462B9F5191BB57A5420EB85CD
- MD5 SHA1 SHA512 TLSH
UUU3021/ModernWpf.Controls.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3456dad94463e71e1ee300219871172439a49c9cf9ff3f67109aeb755b5c35e1
- MD5 d79d1ee499d420144f9f8a2327d7ec0d
- SHA1 6829f3fd12dceb1f5ed82d5f6f91f9723506451d
- SHA512 04c967408a948cdda989e3914084d15769b1a15b01c185f07282a1e863598d67b3efeabc9ffaefa4f01b8078db07948a00ba4bc5e80e2e70c8f4deebdb422397
- SSDEEP 6144:5pbkqF2YeqPqlaiWlnAMZmN0W+9is5ZoK6Lg+L8gigMUumgSH4b:0qF2YeqilEnAMZ26gigOmgSH
- TLSH T17C847CA433BC0535CAAF577990755414DBB5A88323EADB1D26D66FEC0CCBB024B112BB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
388202
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\me\source\repos\ModernWpf\ModernWpf.Controls\obj\Release\net45\ModernWpf.Controls.pdb
mscoree
_CorDllMain
Name
.text
Size
371KB
Virtual Size
371KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
880B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UUU3021/ModernWpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9c5f0b80fd4b47c4d6ee4b17558c234fa1bfc3a3dea05260ac9a41a9dbbba9d7
- MD5 85b01ab1a579c52563f7ca8b750658ff
- SHA1 963e7d7c734203828c4e2c5569eea0d895c1c17d
- SHA512 8492378286d23d4fba816ca38e13ff007aadea522555f9dd03d900d4d5cf29243e6ecba50bcc6967cc158c060d92ca91f166e5634267684409e3869538820509
- SSDEEP 12288:QSv4w7pPaAXYqD9J/ohIrksBi7cNfak15I37TLO4aI37:QSBlC7qDL2PsBi7cNfaks37/O4z37
- TLSH T12725297073A08A74D3A35A7F6668FC146A35B8656351C60B36CE3F3A88C61510B7BF63
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1014378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\me\source\repos\ModernWpf\ModernWpf\obj\Release\net45\ModernWpf.pdb
mscoree
_CorDllMain
Name
.text
Size
983KB
Virtual Size
982KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UUU3021/Readme.txt
- SHA256 c1423fdd68be3740890fd1ade4105d9dd9010ca06d1e9610d0b4663811d362c0
- MD5 c0a3026e53da8f2151bc08d273e6f5f9
- SHA1 9317b876e8761c8a7072104fedb9a628590c06c6
- SHA512 e6d18e3bb38c49499a5f6cedd4eb405371fc73140a987922698763008be371772da0d0d0690c9ccfca823fbef274e75dfda149bbfe0409e33321b5b93f17aa7b
- SSDEEP 96:JaxZlADFeAajYcyVaT/klJFM+MUkn9R0tZmefDSV25AGT5z3Jb7bLTQ:qOeURVaT/Iz8AtZmefDSVtGT5z3JbP3Q
- TLSH T19991942F9E05533304E29262824EBBE8EB22856E573695B13078C03D7225B3AD37F4D2
- MD5 SHA1 SHA512 SSDEEP TLSH
UUU3021/System.ValueTuple.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d6fb0dcfee1490a8168117ed1b55758f11db38475417b3668d19f89dcb55cbdd
- MD5 99cec77dbee0ab10b9fc4d52a1d414be
- SHA1 c83d024e80c36b663458d478dfdb067336e2d616
- SHA512 988b0ff9ede87fe7538b2e0cdd684962965b4fc2a4f0fc92726248f249cacb7c5674f3978d2d7cbed68991c71e0b0339d6edda57384097a4da8efd7d77b43cd9
- SSDEEP 1536:h784YWac+abptsy5VyYc/9n1RcGxzeeUVn9KyQgHo0JuresehaA1VUF:h7N1r9KGI04CCAP
- TLSH T1D173E82C23583653C73E843318A699C7AFB8D30BD74657BB7DDAE5E818D2374A302664
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
50:0b:9b:f8:2d:1f:dc:2c:85:5f:8d:44:8e:f0:06:34:42:5d:c4:9a:fc:6f:51:5e:c7:96:0d:06:3c:1b:20:16
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
PE Signature issue
Digest
e0:5a:d1:da:4b:60:60:fb:28:f2:b5:1c:59:6c:d7:66:96:16:eb:e0
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
May 15, 2018
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:C3B0-0F6A-4111,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c2:a0:09:c5:37:76:e9:f6:cd:00:00:00:00:00:c2
Issuer
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Subject
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Issuer
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:33:26:1a:00:00:00:00:00:31
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 31, 2010 - Aug 31, 2020
Subject
CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:16:68:34:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Apr 3, 2007 - Apr 3, 2021
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 11, 2017 - Aug 11, 2018
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:09:81:2a:00:00:00:00:00:02
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Jul 1, 2010 - Jul 1, 2025
Subject
CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:F6FF-2DA7-BB75,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:a5:48:17:72:27:f9:70:be:63:00:00:00:00:00:a5
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 7, 2016 - Sep 7, 2018
Minor OS version
0
Major OS version
4
Entry point
68586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\A\_work\39\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.ValueTuple\netstandard1.0\System.ValueTuple.pdb
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UUU3021/ToastNotifications.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ed1297117c8dba2b3880246721af5b74c6ae16d745bea176adbeefc1ee75f2fb
- MD5 ce4c69d4ba73105bf8eff333ff8d265b
- SHA1 28549362058bce91dcad5a13993f4f4b26f17530
- SHA512 adc3c6f4d6a70814eb665039f2ee8387522475ed90017d72a37a0a381bdd3d5dbfd2a5cf26afa01f53d0bc312ca568ebdb7d245cdb21f0808d021a92b450b624
- SSDEEP 768:ar7hqeNzclb+af/wFGfdpOOJWOQE9/TBLW/Uwm:ar7hqeNzclR/CWpKsRBLW/E
- TLSH T160B3E78523B65DE1C9663FFEEB4DC2500B299F80D4C99741777838284E7A61FCD122AE
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
82930
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Mannelig\Dev\Projects\NET\WpfToastNotifications\Src\ToastNotifications\obj\Release\ToastNotifications.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UUU3021/UniversalUE4Unlocker.dll
- IMPHASH 8e64f436d8a41193b070d2d4ab3ef189
- SHA256 fbe25869c37522651cd1f0dde264a0c3cb035fd70200b55028501b0986f19519
- MD5 0192098d333ee0456668a94ff75dd866
- SHA1 519b9f6af3bb7430c9672ec390ac46ef73a1aafa
- SHA512 9b0b0baa5e6ef5a998d29cd76c0cacf540ca6aaa60902d6d4ea58283a0ad53023069e3692943f297a962047a93594845f0d1b04ccb63b8de5abca3fbd02a1d31
- SSDEEP 12288:5PMZsCVf6cXFRwTEhBzWJtMmi2q9MxQ5RZr4EuFww560Vu7pPJh4vRy+aEFX+ecY:lMZ/NJdYd+ecxq1xD0ps8VuYdeICycs
- TLSH T135358D1A729841B8E17BE17CCA974A46E6B2740603259BCF07E447BE1F277F11A7E360
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
386332
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\frans.SD\Documents\GitHub\UE4Tools\ConsoleUnlockers\Universal\bin\x64\Release\UniversalUE4Unlocker.pdb
xinput9_1_0
XInputGetState
XInputSetState
kernel32
FreeConsole
AllocConsole
AttachConsole
GetCurrentProcessId
SetConsoleTextAttribute
GetStdHandle
WriteProcessMemory
OpenProcess
GetLastError
InitializeCriticalSectionAndSpinCount
SetThreadPriority
DisableThreadLibraryCalls
CreateThread
CreateFileW
WriteFile
CreateNamedPipeW
ConnectNamedPipe
ReadFile
Sleep
WriteConsoleW
GetModuleFileNameA
K32EnumProcessModulesEx
K32GetModuleInformation
CloseHandle
GetModuleHandleW
GetModuleFileNameW
FormatMessageA
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetConsoleCtrlHandler
OutputDebugStringW
LocalFree
AreFileApisANSI
ReadConsoleW
GetConsoleMode
GetConsoleCP
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentProcess
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualProtect
GetProcAddress
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualQuery
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
SetEndOfFile
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SetFileTime
GetTempPathW
RtlUnwind
DeviceIoControl
CreateDirectoryExW
CopyFileW
MoveFileExW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
MultiByteToWideChar
WideCharToMultiByte
EncodePointer
DecodePointer
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
LCMapStringEx
GetLocaleInfoEx
CompareStringEx
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCurrentThread
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetFileSizeEx
GetTimeZoneInformation
FlushFileBuffers
user32
GetWindow
GetRawInputData
ScreenToClient
RegisterRawInputDevices
IsWindowVisible
GetClassNameW
GetWindowThreadProcessId
EnumWindows
GetKeyState
GetForegroundWindow
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
oleaut32
SysFreeString
SysAllocString
CreateErrorInfo
VariantClear
GetErrorInfo
VariantChangeType
SetErrorInfo
VariantInit
Name
.text
Size
840KB
Virtual Size
839KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
181KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=26715,
count=18, id=260, version=26715,
count=177, id=261, version=26715,
count=14, id=260, version=30034,
count=10, id=259, version=30034,
count=83, id=261, version=30034,
count=4, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,
count=11, id=257, version=26715,
count=171, id=1, productName=Unmarked objects,
count=22, id=265, version=30133,
count=1, id=259, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
UUU3021/UniversalUE4Unlocker.dll.log
- SHA256 cefb6f16b73e9c3696f0ed2d21f6c2528c88f74d61549dd5170db81162cd18d8
- MD5 ad4c25121714a3f93c3eb7049273c1ff
- SHA1 95d3b3d82ac6c608d0b435b0eb36fa7c16233324
- SHA512 51c8d3856f6051a80114144a0cb43f383888b2c6e404a56cb9cec10b1f3b1b011f65adfb4892926e13da7c0247af62ff120dbb8d5e6b72249114484ba7000f02
- SSDEEP 48:pRehWIfp32GsTidQQRySU89nk2JCa882LKlWhauxGxqxtGwsMALiW9n:2hWC2ZcJCc2LNh+oMwspn
- TLSH T138C18F1566E2718F75E3366B19403FE5C86DB36B0954028FF883F3CA15FA06E8B0A755
- MD5 SHA1 SHA512 SSDEEP TLSH
UUU3021/UuuClient.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 22431a11497a177fcb5aa362c7a7a7eb21e1c9a27015233f750a24abcbb730cf
- MD5 f27ece59b091a854a1a1d94eff3f27ae
- SHA1 e5b0260fafccf5c46cd066d70e2f608a39036b88
- SHA512 c06be34e69f9fdc92cb4c98d3c60cd022f779f7fb155fb4f26eb96df50b0433bf8e25d904427f68ce334ef1076053c336753aba5cefac2273673c5187369d646
- SSDEEP 3072:4r7fUiujm4LRk2sdVCx42LNtu2ykNARuyuY4YrMR2nR1kwGZPWMaQiDr:mRIUjCxE9kNAcyRMPRZ+hD
- TLSH T13CA4615ABF380612C56B87BE51E02947CFA65FC12F7AE54975053CB887333862602F9B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
179170
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\frans.SD\Documents\GitHub\UE4Tools\ConsoleUnlockers\Universal\Client\obj\Release\UuuClient.pdb
mscoree
_CorExeMain
Name
.text
Size
167KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
278KB
Virtual Size
278KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
UUU3021/UuuClient.exe.config
- SHA256 8841b21c5fcfb1a27a40d928dca98c6fcae3528202e4834dd9431fb80397f649
- MD5 8c33c8af4d492ea3816643ee506e6774
- SHA1 d1d78c4b4a45cc8549cb79134fac79bcba1f304e
- SHA512 64245aa007c400ce37c39a2defa9cd174bb588e6a1971fcdd2e14ae3f87ee6024df2ac421b11ae2d07067ebe8535086341538d5c59e5e2b7b17ab196380ec696
- TLSH T1FEF0A2082E04EF7759328A2B68625650DFB92C9E743520E8F46F62162F1500D59033C1
- MD5 SHA1 SHA512 TLSH
UUU3021/UuuClientSettings.ini
- SHA256 eeb351d45ae8178a93bf4c9e75f4e323462b9dc5f64f3171baa590d4e99c3908
- MD5 f7959ccc26a8267ff3691017f690b8a0
- SHA1 e4d09ae28b3863a8fec0618fd3ba03118fbd7ad3
- SHA512 212d57d2f5126de27a008699653e9be1e98c5a4c33522395cbe4adf83e9cb0a8ce29be71832cb43c9512d199935c93d9363e306f23983d71f4e65ef871e5c4b0
- TLSH T1D82179CAECA012242AB50E5DDC78A14217D82927980F183DF6865A3FBB5C9957CBAC1D
- MD5 SHA1 SHA512 TLSH
requirements.txt
- SHA256 95f940720592c11124cc513073b5b53585afeddcba4e0cc2221b70a0e138cbcd
- MD5 8261e0283b81403ddeb57fb0d5bfe43b
- SHA1 72f75cc3fd6e329f954c25cde3f501826057459f
- SHA512 8d05454b256a97606c293c2b5c9c4202dba230add4fa16967a8ca90115c22c86cb60ad8b8b1818b8089ca936bb063726e437aef3de0c4e6e8b60e9f1bbb7a0fe
- MD5 SHA1 SHA512