simpleunlocker_release.zip
- SHA256 9768bf823d8f801913705dca9032b83b6912061c3a7b4bb7f47c9f225651d78f
Overview
overview
3Static
static
3simpleunlo...SU.exe
windows10-2004-x64
1simpleunlo...SU.exe
windows11-ltsc_2024-x64
1simpleunlo...DI.dll
windows10-2004-x64
1simpleunlo...DI.dll
windows11-ltsc_2024-x64
1simpleunlo...or.exe
windows10-2004-x64
3simpleunlo...or.exe
windows11-ltsc_2024-x64
3simpleunlo...ok.dll
windows10-2004-x64
1simpleunlo...ok.dll
windows11-ltsc_2024-x64
1simpleunlo...32.dll
windows10-2004-x64
3simpleunlo...32.dll
windows11-ltsc_2024-x64
3simpleunlo...vc.exe
windows10-2004-x64
3simpleunlo...vc.exe
windows11-ltsc_2024-x64
3simpleunlo...64.dll
windows10-2004-x64
1simpleunlo...64.dll
windows11-ltsc_2024-x64
1simpleunlo...vc.exe
windows10-2004-x64
1simpleunlo...vc.exe
windows11-ltsc_2024-x64
1simpleunlo...32.dll
windows10-2004-x64
3simpleunlo...32.dll
windows11-ltsc_2024-x64
3simpleunlo...64.dll
windows10-2004-x64
1simpleunlo...64.dll
windows11-ltsc_2024-x64
1simpleunlo...er.exe
windows10-2004-x64
3simpleunlo...er.exe
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
simpleunlocker_release/SU.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
simpleunlocker_release/SU.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
simpleunlocker_release/bin/AntiGDI.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
simpleunlocker_release/bin/AntiGDI.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
simpleunlocker_release/bin/AntiGDI_Injector.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
simpleunlocker_release/bin/AntiGDI_Injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
simpleunlocker_release/bin/EasyHook.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
simpleunlocker_release/bin/EasyHook.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
simpleunlocker_release/bin/EasyHook32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
simpleunlocker_release/bin/EasyHook32.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
simpleunlocker_release/bin/EasyHook32Svc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
simpleunlocker_release/bin/EasyHook32Svc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
simpleunlocker_release/bin/EasyHook64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
simpleunlocker_release/bin/EasyHook64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
simpleunlocker_release/bin/EasyHook64Svc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
simpleunlocker_release/bin/EasyHook64Svc.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
simpleunlocker_release/bin/EasyLoad32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
simpleunlocker_release/bin/EasyLoad32.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
simpleunlocker_release/bin/EasyLoad64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
simpleunlocker_release/bin/EasyLoad64.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
simpleunlocker_release/bin/su_updater.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
simpleunlocker_release/bin/su_updater.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target simpleunlocker_release.zip
- Size 943KB
- Sample260713-e2b1eaby6m
- SHA256 9768bf823d8f801913705dca9032b83b6912061c3a7b4bb7f47c9f225651d78f
- MD5 53983ab653bbef58fcbe634f67d04850
- SHA1 682bbf531b12d036d6a9133792b5df5b9b1073b7
- SHA512 cfb35e06693d35dcfb64f85e5f9a55579e0229eed627cc3b5bdd61ae08932cf0cf16c358721d2cbaab1cac481b22da55ab7dfef24d8f7530ab83f9dc0cfb2c43
- SSDEEP 12288:+fitUb2odWtw/S5DRuO37SaB5In2Ftxs8oQkG7FIre4QUEysNxISYAaX//cFdR1I:+Y/2/S5DMO+25IlGjoBNSYF/UpC2/c
- TLSH T1182533CC006C360AF512A2B7A760DFC7889C70594691F79475CEF382AD75BA27325F2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack001/simpleunlocker_release/SU.exe unpack001/simpleunlocker_release/bin/AntiGDI.dll unpack001/simpleunlocker_release/bin/AntiGDI_Injector.exe unpack001/simpleunlocker_release/bin/EasyHook.dll unpack001/simpleunlocker_release/bin/EasyHook32.dll unpack001/simpleunlocker_release/bin/EasyHook32Svc.exe unpack001/simpleunlocker_release/bin/EasyHook64.dll unpack001/simpleunlocker_release/bin/EasyHook64Svc.exe unpack001/simpleunlocker_release/bin/EasyLoad32.dll unpack001/simpleunlocker_release/bin/EasyLoad64.dll unpack001/simpleunlocker_release/bin/su_updater.exe
File Explorer
-
simpleunlocker_release.zip.zip 943KB
-
simpleunlocker_release/ReadMe.txt3KB
-
simpleunlocker_release/SU.exe.exe 1.5MB
-
simpleunlocker_release/bin/AntiGDI.dll.dll 21KB
-
simpleunlocker_release/bin/AntiGDI_Injector.exe.exe 7KB
-
simpleunlocker_release/bin/EasyHook.dll.dll 51KB
-
simpleunlocker_release/bin/EasyHook32.dll.dll 262KB
-
simpleunlocker_release/bin/EasyHook32Svc.exe.exe 8KB
-
simpleunlocker_release/bin/EasyHook64.dll.dll 303KB
-
simpleunlocker_release/bin/EasyHook64Svc.exe.exe 8KB
-
simpleunlocker_release/bin/EasyLoad32.dll.dll 7KB
-
simpleunlocker_release/bin/EasyLoad64.dll.dll 7KB
-
simpleunlocker_release/bin/su_updater.exe.exe 214KB
simpleunlocker_release/ReadMe.txt
- SHA256 10a10aac162dc08c85a0dc6537785c76bd7d860c3cfb6452ed1bd925e82d7b34
- MD5 3e41bee1c2071ded6cd5f9117bd28834
- SHA1 22419b5561ab1856479bbecfbfd0e6c7b6ccaf97
- SHA512 4dbf1a278ebdff885db9ece632e311920d917b440e319db5105c93c168ae42784703b16c579112dd690d786e6ed364197c44e2e9904c7d89ff5422fb977ad870
- TLSH T15B71ABA1219A644F0502B157AC04BE0C7EEA41BF7F7B42523D6D5D3E73F21E4852D68E
- MD5 SHA1 SHA512 TLSH
simpleunlocker_release/SU.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 db1e5b4acd912fd1d999b4b42090faccb90b71d74022ec8d75bbd7512427afb5
- MD5 e46dd2a3617edc79af7f07eee8dca09b
- SHA1 3bf40c603c9e59dc970f115031284d059e0e41a5
- SHA512 85eec16e3aa27f5879c9580c9366ff624ec5fa35057e031afc3a18fddb8f080c715be976dae595d27fae783fb6e2685cd67d5084795b8749e1b7b61166a267f7
- SSDEEP 24576:gjTCY7H4ef1UU7JWhlqZV6vT89c2hYTx1:OlH4efF7pGA9c2hy
- TLSH T16C755B103FB8C91AD1AEA6F8A031355083F7BF9132F5E79EC99038A91DB9B109D95347
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1215038
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
407KB
Virtual Size
406KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
simpleunlocker_release/bin/AntiGDI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 644b699e988e3fbe6e0277659799997054f7db1ef1c8f923444ddfc87f325529
- MD5 16168fd88cf4851f75d287cc86913669
- SHA1 d32e10ad055f9d24919a2f5688490b02d9f2484a
- SHA512 9e5df9958e3f91494358c0e8a65367dd25987797f1f20c0c7238dcb33a18087fd9169096bfa8125a85d54d78da45433fe54fe6f218da4104d7dd4202cb242e53
- SSDEEP 384:uNXwPPeFjn6G8nrzffgT8qdNl2vpJSBpoGMd9Ugw62mdghajm4q5r:4wPPeFz83efLUY
- TLSH T129A2C6197BE8556ED1BA4B74AEB145101BB1FC5E4F33D31B044D803D6AA3B604EA273E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
27890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
R:\Програмирование\Мои проекты\SimpleUnlocker (c0d9d by DesConnet)\v1 (Recode)\src\AntiGDI\obj\Release\AntiGDI.pdb
mscoree
_CorDllMain
Name
.text
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
simpleunlocker_release/bin/AntiGDI_Injector.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 96c54111b24ca7936a883cd2ead040cc8451fe8d3c0ff61a78303f79eba7d20e
- MD5 9505f2e3a19ef13a437d4d403b0242df
- SHA1 237b22764c7fa387d8e9e4a97fc7467d17ea3c7f
- SHA512 589e71bbe7f93bf0578779b16d2f713155c83b5b3a36f74dc6e71e90fd57b0ee2250c7022f4c8246b617cc62198655c47bebb4df4f1dce3b383a7b85a7c2ae7e
- SSDEEP 96:N3fqtf51n8b1kK+XnhEMfmbFJ8iCvienEe5ZTBisdnFpR1TzNt:VrR4qbT8PjXZTBrdFpR11
- TLSH T1D1E1E74573E80637EDAF8B715A7202409531FB61CE63CA6E2886516F3C16F244632BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11990
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
R:\Програмирование\Мои проекты\SimpleUnlocker (c0d9d by DesConnet)\v1 (Recode)\src\AntiGDI_Injector\obj\Release\AntiGDI_Injector.pdb
mscoree
_CorExeMain
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
simpleunlocker_release/bin/EasyHook.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8267ea2acb222dad150199a6c2a3280b4b6cf8a85d7208bf0134719743d47256
- MD5 e1ac4719026481231aa7fea8b4370df3
- SHA1 a8a462f57e893ea37282a8ea6038a3f70048b9c2
- SHA512 abb1ca254f15487e4aef77bca9d01d928643c2d40131918c2515fbc50ce13a4fcb916ac7e71d6400611900189700e670f5ac4dec79f0603e086693ae0a482c68
- SSDEEP 768:GhfS0XbE5h5Efo0MisZ7b6y9YVAdB0oP4NgkC+ab0d++XyCp4fp78d:gIrEw0MjZ9YVAd6zN9Cvbq+GYpg
- TLSH T1C0333A0463CD8626E3FF4B396C731B5283F0F2426633EB5A9AD0602EA857BD54610BD7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
57810
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\easyhook\EasyHook\obj\netfx4-Release\EasyHook.pdb
mscoree
_CorDllMain
Name
.text
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
simpleunlocker_release/bin/EasyHook32.dll
- IMPHASH 0c2609288fcba4a8350c2130643a83bb
- SHA256 1469b54d8c0b8abf370c357d518b2bb68f51b7d49278e5ee2444aa2ea3180fda
- MD5 96e29840ab54b7098f7c473751a64be4
- SHA1 a0c049e48242279a3590849d9e7025d7792b7484
- SHA512 73dfa8778ec5acc9e95014cf0e4c638847815f7c050c710bef2dc3e42a63772346adc32d4adb0fa2418fc7f3c22c45ce79420d0bf4ab44389dc2c9b74f587d47
- SSDEEP 3072:9Wp8Jh5UlJhufhySRWKmAPv5E1TyEUK8IQP/HVx5rin0rYNNJ7VxKF1E:1RnPjEB0XVkx
- TLSH T113441942E7D08123F1BB067918F71A926E3FBD60A73AD68F16B1CA1C1D307D12A76752
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
9433
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\projects\easyhook\Build\netfx4-Release\x86\EasyHook32.pdb
psapi
EnumProcessModules
GetModuleInformation
kernel32
TlsFree
GetCurrentThreadId
GetSystemInfo
GetLastError
GetCurrentProcess
GetProcAddress
GetModuleFileNameA
GetFullPathNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
SetEvent
GetModuleHandleW
LoadLibraryW
GetModuleHandleA
CloseHandle
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
GetThreadContext
SetThreadContext
WaitForSingleObject
OpenProcess
Thread32First
ReadProcessMemory
Thread32Next
VirtualAllocEx
OpenThread
CreateEventW
CreateToolhelp32Snapshot
DuplicateHandle
TlsAlloc
SuspendThread
ResumeThread
TlsGetValue
CreateProcessW
CreateRemoteThread
TlsSetValue
WideCharToMultiByte
TerminateProcess
lstrlenW
SetLastError
GetExitCodeThread
Module32FirstW
WaitForMultipleObjects
Module32NextW
GetCurrentProcessId
FatalAppExitW
GetModuleFileNameW
CreateFileW
HeapAlloc
HeapFree
IsBadReadPtr
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
InterlockedExchange
GetVersionExW
VirtualQuery
SetStdHandle
OutputDebugStringW
LoadLibraryA
HeapCreate
HeapDestroy
FreeLibrary
WriteConsoleW
SetEndOfFile
WriteProcessMemory
LCMapStringW
EncodePointer
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
GetStdHandle
GetFileType
GetStartupInfoW
GetProcessHeap
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
RtlUnwind
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
HeapReAlloc
LoadLibraryExW
ReadFile
ReadConsoleW
GetStringTypeW
advapi32
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
OpenProcessToken
ole32
CoTaskMemAlloc
CoTaskMemFree
shlwapi
PathQuoteSpacesW
?GetRemoteModuleExportDirectory@@YGHPAXPAUHINSTANCE__@@PAU_IMAGE_EXPORT_DIRECTORY@@U_IMAGE_DOS_HEADER@@U_IMAGE_NT_HEADERS@@@Z
_DbgAttachDebugger@0
_DbgDetachDebugger@0
_DbgGetProcessIdByHandle@8
_DbgGetThreadIdByHandle@8
_DbgHandleToObjectName@16
_DbgIsAvailable@0
_DbgIsEnabled@0
_GacCreateContext@0
_GacInstallAssembly@16
_GacReleaseContext@4
_GacUninstallAssembly@16
_HookCompleteInjection@4
_LhBarrierBeginStackTrace@4
_LhBarrierCallStackTrace@12
_LhBarrierEndStackTrace@4
_LhBarrierGetAddressOfReturnAddress@4
_LhBarrierGetCallback@4
_LhBarrierGetCallingModule@4
_LhBarrierGetReturnAddress@4
_LhBarrierPointerToModule@8
_LhEnumModules@12
_LhGetHookBypassAddress@8
_LhInstallHook@16
_LhIsThreadIntercepted@12
_LhSetExclusiveACL@12
_LhSetGlobalExclusiveACL@8
_LhSetGlobalInclusiveACL@8
_LhSetInclusiveACL@12
_LhUninstallAllHooks@0
_LhUninstallHook@4
_LhUpdateModuleInformation@0
_LhWaitForPendingRemovals@0
_ReleaseTestFuncHookResults@8
_RhCreateAndInject@36
_RhCreateStealthRemoteThread@16
_RhGetProcessToken@8
_RhInjectLibrary@28
_RhInstallDriver@8
_RhInstallSupportDriver@0
_RhIsAdministrator@0
_RhIsX64Process@8
_RhIsX64System@0
_RhWakeUpProcess@0
_RtlCreateSuspendedProcess@20
_RtlGetLastError@0
_RtlGetLastErrorString@0
_RtlGetLastErrorStringCopy@0
_RtlInstallService@12
_TestFuncHooks@24
Name
.text
Size
109KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
60KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
78KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=225, version=20806,
count=1, id=199, version=41118,
count=48, id=225, productName=VS2013 build 21005, version=21005,
count=20, id=223, productName=VS2013 build 21005, version=21005,
count=135, id=224, productName=VS2013 build 21005, version=21005,
count=13, id=203, version=65501,
count=131, id=1, productName=Unmarked objects,
count=1, id=109, version=31008,
count=25, id=228, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
simpleunlocker_release/bin/EasyHook32Svc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 39361867b97155b16fe6f16f77b50b97b00393e16e0c23fad8d2e34adb72c8db
- MD5 62e4b079910db4c8f7435e99ec55d513
- SHA1 91006067a3527787d7087c1bd0a27a4d1ad76442
- SHA512 af3b4446aeba117c03f218b9cb8510f8f3eb0e1d78873eadec042c04387ee4aa5af93d3f66c43115a5a44d7344b192ca57c7f7415c9d88ee0117657620f8bc3e
- SSDEEP 192:/ffEkWW2wQ94LcK9xs3+ETZrOWVSvrGK88l:Xf4HH94tfs3+Elr30SK88
- TLSH T174F1E901E7EC4733DDBB1B31AC77224017B9B356D9779A2CB8C49A4B5D06A4009A2BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13274
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\projects\easyhook\EasyHookSvc\obj\x86\netfx4-Release\EasyHookSvc.pdb
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
simpleunlocker_release/bin/EasyHook64.dll
- IMPHASH 4d117d78b1518e2a9eee4e20c8ed50c7
- SHA256 14fbd6b2aa138c279dbcfe592388cbe22d6b261431dd03dedff01277668b0cc3
- MD5 0f1d903e83d1e2fa71a1f957e4a32fd2
- SHA1 e3108b67398e4a07a249e1ceb9187458af46d3ad
- SHA512 cd1b71bbd8ce95fd06e88750d4fb6e6a8f1413e983bdda8a4c61936cdb9258bcbe1acb2defac86bf56348baf2397409ec2330d96db2077cbee4d452cd393342b
- SSDEEP 3072:1y2Wd/BghT8p3/fc4CxfbEfuEs6DI4JgZdjeI2sJRVpB5Am9xWrXFYxptxC:1y21T8pvf5CfwfFX9JOdEsJGOcSp
- TLSH T1AD642917E7E00997FC63963589F30952AA7378546336D7CF0AB00219EE2F3E16A36725
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10492
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\easyhook\Build\netfx4-Release\x64\EasyHook64.pdb
psapi
EnumProcessModules
GetModuleInformation
kernel32
TlsFree
GetCurrentThreadId
VirtualFree
VirtualAlloc
GetSystemInfo
GetLastError
GetCurrentProcess
GetProcAddress
GetModuleFileNameA
LoadLibraryW
GetCurrentProcessId
GetFullPathNameW
GetEnvironmentVariableW
SetEnvironmentVariableW
SetEvent
GetModuleHandleW
GetModuleHandleA
CloseHandle
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
GetThreadContext
SetThreadContext
WaitForSingleObject
OpenProcess
Thread32First
ReadProcessMemory
Thread32Next
VirtualAllocEx
OpenThread
TlsAlloc
CreateToolhelp32Snapshot
DuplicateHandle
WriteProcessMemory
SuspendThread
ResumeThread
TlsGetValue
CreateProcessW
CreateRemoteThread
TlsSetValue
WideCharToMultiByte
TerminateProcess
lstrlenW
SetLastError
GetExitCodeThread
Module32FirstW
WaitForMultipleObjects
Module32NextW
FatalAppExitW
GetModuleFileNameW
CreateFileW
HeapAlloc
HeapFree
IsBadReadPtr
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
GetVersionExW
SetEndOfFile
LoadLibraryA
HeapCreate
HeapDestroy
FreeLibrary
CreateEventW
RtlPcToFileHeader
WriteConsoleW
SetStdHandle
OutputDebugStringW
LCMapStringW
EncodePointer
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
AreFileApisANSI
MultiByteToWideChar
RtlUnwindEx
GetStdHandle
GetFileType
GetStartupInfoW
GetProcessHeap
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
HeapReAlloc
LoadLibraryExW
ReadFile
ReadConsoleW
GetStringTypeW
advapi32
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
OpenProcessToken
ole32
CoTaskMemFree
CoTaskMemAlloc
shlwapi
PathQuoteSpacesW
?GetRemoteModuleExportDirectory@@YAHPEAXPEAUHINSTANCE__@@PEAU_IMAGE_EXPORT_DIRECTORY@@U_IMAGE_DOS_HEADER@@U_IMAGE_NT_HEADERS64@@@Z
DbgAttachDebugger
DbgDetachDebugger
DbgGetProcessIdByHandle
DbgGetThreadIdByHandle
DbgHandleToObjectName
DbgIsAvailable
DbgIsEnabled
GacCreateContext
GacInstallAssembly
GacReleaseContext
GacUninstallAssembly
HookCompleteInjection
LhBarrierBeginStackTrace
LhBarrierCallStackTrace
LhBarrierEndStackTrace
LhBarrierGetAddressOfReturnAddress
LhBarrierGetCallback
LhBarrierGetCallingModule
LhBarrierGetReturnAddress
LhBarrierPointerToModule
LhEnumModules
LhGetHookBypassAddress
LhInstallHook
LhIsThreadIntercepted
LhSetExclusiveACL
LhSetGlobalExclusiveACL
LhSetGlobalInclusiveACL
LhSetInclusiveACL
LhUninstallAllHooks
LhUninstallHook
LhUpdateModuleInformation
LhWaitForPendingRemovals
ReleaseTestFuncHookResults
RhCreateAndInject
RhCreateStealthRemoteThread
RhGetProcessToken
RhInjectLibrary
RhInstallDriver
RhInstallSupportDriver
RhIsAdministrator
RhIsX64Process
RhIsX64System
RhWakeUpProcess
RtlCreateSuspendedProcess
RtlGetLastError
RtlGetLastErrorString
RtlGetLastErrorStringCopy
RtlInstallService
TestFuncHooks
Name
.text
Size
124KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
79KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
85KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=199, version=41118,
count=51, id=225, version=20806,
count=127, id=224, version=20806,
count=11, id=223, version=20806,
count=13, id=203, version=65501,
count=135, id=1, productName=Unmarked objects,
count=1, id=109, version=31008,
count=25, id=228, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=220, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=219, productName=VS2013 build 21005, version=21005,
count=1, id=151,
count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,
simpleunlocker_release/bin/EasyHook64Svc.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 76ae3da1149711aabeda64195e87b1049a58dee6e625ae0688db4596b516c684
- MD5 8352ad23d90fc8d982fe0fb4ce03ca77
- SHA1 ac9d8565f20410118f8d4348469ec22cbb885a24
- SHA512 cea2a4e697bf096af7cad0491e8bff9252baca8eb177c7145be741bde1fb8892b4ecc9dfa08e73ecbb1e055a6ef3fb161d5affcb6f4498060c9213cd73b37722
- SSDEEP 192:lffEkWW2wQ94LcK9xs3+ETZrO2VSvVgGMs8l:Vf4HH94tfs3+Elr703Ms8
- TLSH T1BFF1E701E7AC4733DDBF5B30AC7322401779B356DA739A2CA8C1954B5D07A440AE2BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13274
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\projects\easyhook\EasyHookSvc\obj\netfx4-Release\EasyHookSvc.pdb
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
simpleunlocker_release/bin/EasyLoad32.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ad26b4df8a73ebdbc526a6940c7a286965fdf4d4b2be72d10bb73e7c88f55e68
- MD5 8dcecd41d98bb951f9e6a2a24c1aa4e1
- SHA1 f958af6a15aff9750ffe740e59a654b16abb815d
- SHA512 b27f25b0f59df2f6c579f934fe04a5e1f538602d46c77095e82eab9949df945aac80cae49f2a137fb1e6b525803822171b19e5a345928d9e613872ec973dcd1f
- SSDEEP 96:eN52ct6LHl1jSybgq0k7uVwR12aY4g0ohzrkKfyx6Pi:62ct6LHlpSyb/aGL2xMGz9RPi
- TLSH T1E8F1D602E3E94A36D8BB8B3ED83392414774F302AE23C61B8DD8660ACC963446F71375
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Close
Load
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
95B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
simpleunlocker_release/bin/EasyLoad64.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 960c791d60da56641cea12f4ae5c764e28ccbfb736854a8efd5065152064c52d
- MD5 bfae38591215e8c2161795219a57135c
- SHA1 c5366a86cf70a6dfb5d197618b7b2ca53a42578c
- SHA512 7e6aa1a6b65792d8c2bc31aad53cb2b2db520adeb3efbb9f2dc4efb63254ad20d3c9700c40ebd36ecf4b63435512ab4c24e87560e0761d86965c893e512be8fc
- SSDEEP 96:DL/Sct6LHl1zCybgq0k7uVwR12aYbx10ohzrkKfySzKX:DL/Sct6LHlZCyb/aGL2xl6Gz9hKX
- TLSH T167F1C702E7E94A75C87B4B3DD833A2414774F7129E23C61B8DC8550ACC963486F71371
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
12382
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Close
Load
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
103B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
simpleunlocker_release/bin/su_updater.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 19ad20c7f4b426d1ef6db5dff33a5e570e2efbe7d5f5938cee09b76754a80614
- MD5 4273a495e9cac52adf54d133b86bd236
- SHA1 c38e51b78bc768cf06b34d6a72323b08a3416f34
- SHA512 a3ec6146442369d8eba25fe0ca9e4daff42268631dd3b7aed6ed30f71d925c8167481481315344f21caefa9903bd697840059b27cc2abe345c286c740f9e978d
- SSDEEP 3072:7H221f6gNVnSt36cWK0PWIcbmsW6mON1bbmHA6cu2TpUaMsieI/KQ73WmmcSCSL3:7H22BVnStKcWZuisW8bmg+ZaMKaW
- TLSH T1B5245B1417DC8A9BF1FF5BB9E0B02191C3B1B412B97EDB4EAC8561EE1917381E9017A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
210974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
208KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ