unlockall-release (1) (1).zip
- SHA256 00a419884bfd0a02f9e3b6c0bb72bd52cfdc61736c6385f44b208305095a661c
Overview
overview
8Static
static
3unlockall-...1).zip
windows10-2004-x64
1unlockall-...1).zip
windows11-ltsc_2024-x64
1unlockall-...DME.md
windows10-2004-x64
3unlockall-...DME.md
windows11-ltsc_2024-x64
3unlockall-...us.sys
windows10-2004-x64
3unlockall-...us.sys
windows11-ltsc_2024-x64
3unlockall-...ls.ps1
windows10-2004-x64
3unlockall-...ls.ps1
windows11-ltsc_2024-x64
3unlockall-...er.cmd
windows10-2004-x64
8unlockall-...er.cmd
windows11-ltsc_2024-x64
8unlockall-...er.exe
windows10-2004-x64
1unlockall-...er.exe
windows11-ltsc_2024-x64
1unlockall-...va.ps1
windows10-2004-x64
3unlockall-...va.ps1
windows11-ltsc_2024-x64
3unlockall-...va.ps1
windows10-2004-x64
5unlockall-...va.ps1
windows11-ltsc_2024-x64
5unlockall-...up.cmd
windows10-2004-x64
8unlockall-...up.cmd
windows11-ltsc_2024-x64
8unlockall-...er.cmd
windows10-2004-x64
3unlockall-...er.cmd
windows11-ltsc_2024-x64
3unlockall-...ll.exe
windows10-2004-x64
1unlockall-...ll.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
unlockall-release (1) (1).zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
unlockall-release (1) (1).zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
unlockall-release (1) (1)/unlockall-release/README.md
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
unlockall-release (1) (1)/unlockall-release/README.md
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
unlockall-release (1) (1)/unlockall-release/driver/lifus.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
unlockall-release (1) (1)/unlockall-release/driver/lifus.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
unlockall-release (1) (1)/unlockall-release/get-symbols.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
unlockall-release (1) (1)/unlockall-release/get-symbols.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral9
Sample
unlockall-release (1) (1)/unlockall-release/load-driver.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral10
Sample
unlockall-release (1) (1)/unlockall-release/load-driver.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral11
Sample
unlockall-release (1) (1)/unlockall-release/loader/loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
unlockall-release (1) (1)/unlockall-release/loader/loader.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
unlockall-release (1) (1)/unlockall-release/loader/safe-rva.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
unlockall-release (1) (1)/unlockall-release/loader/safe-rva.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
unlockall-release (1) (1)/unlockall-release/loader/sec-rva.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
unlockall-release (1) (1)/unlockall-release/loader/sec-rva.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral17
Sample
unlockall-release (1) (1)/unlockall-release/setup.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral18
Sample
unlockall-release (1) (1)/unlockall-release/setup.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral19
Sample
unlockall-release (1) (1)/unlockall-release/unload-driver.cmd
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
unlockall-release (1) (1)/unlockall-release/unload-driver.cmd
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
unlockall-release (1) (1)/unlockall-release/unlockall.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
unlockall-release (1) (1)/unlockall-release/unlockall.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target unlockall-release (1) (1).zip
- Size 2.7MB
- Sample261113-24xffssz2n
- SHA256 00a419884bfd0a02f9e3b6c0bb72bd52cfdc61736c6385f44b208305095a661c
- MD5 1389357ac62904b697a6db786d59fbcb
- SHA1 b3e7663b3924f9b5ca4515bba517f4ef712a5b37
- SHA512 369db56fcc04901398947534be50c637015f7cdeb7534f0a6746574c64f6cfb4eb3aa4fb76b577e8620c4b9e8cce4ad50463c18d3f2d6b1a33014acf3e32655c
- SSDEEP 49152:Gubk2ni6+xGHCq0oJEc//HeB009dRm+uYTSXzaG9lhpZUExOgnP/OgoTnfZCWcAG:GWk2ni6+8imJEws7RPpTYzaGdpOEOgnf
- TLSH T17BD5337DA971F5D6CA0C966C61FA80ABE543BB0B5EEE704563E68390331F6C4829F4C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/unlockall-release (1) (1)/unlockall-release/driver/lifus.sys unpack001/unlockall-release (1) (1)/unlockall-release/loader/loader.exe unpack001/unlockall-release (1) (1)/unlockall-release/unlockall.exe
File Explorer
-
unlockall-release (1) (1).zip.zip 2.7MB
-
unlockall-release (1) (1)/unlockall-release/README.md5KB
-
unlockall-release (1) (1)/unlockall-release/driver/lifus.sys.sys 24KB
-
unlockall-release (1) (1)/unlockall-release/get-symbols.ps1.ps1 5KB
-
unlockall-release (1) (1)/unlockall-release/load-driver.cmd.cmd .bat 4KB
-
unlockall-release (1) (1)/unlockall-release/loader/loader.exe.exe 185KB
-
unlockall-release (1) (1)/unlockall-release/loader/safe-rva.ps1.ps1 6KB
-
unlockall-release (1) (1)/unlockall-release/loader/sec-rva.ps1.ps1 5KB
-
unlockall-release (1) (1)/unlockall-release/setup.cmd.cmd .bat 1KB
-
unlockall-release (1) (1)/unlockall-release/unload-driver.cmd.cmd .bat 309B
-
unlockall-release (1) (1)/unlockall-release/unlockall.exe.exe 8.9MB
unlockall-release (1) (1)/unlockall-release/README.md
- SHA256 3bf95a210a5799cee51d5c74645e7f8d9e110cd74b6964267ffecdf16f9cd17b
- MD5 769b90e24c1fecda0b5e695f697f293a
- SHA1 0daabdc32f1cb12f18720f5eddbb0028a58be397
- SHA512 17e7974ffaa15bce3d9fee631b449fbf38abd34631cd26013d3ef00eb3caa98571925122e4c6528b805bc37bd5f50665480f8b2a00976e1ed7b591bf71d538ec
- SSDEEP 96:8FG5VOBTMJLJtyp6QNitkKalvy5q8r9KHlV5svVRpGIVzYV9+FR:8Y3OBTMJLygiiGKalvyY8xUsA+13
- TLSH T1D7B1E98E7755777348B1C262E62F3AE1F76C84194237202075AE9268E74D2BAC23BCC5
- MD5 SHA1 SHA512 SSDEEP TLSH
unlockall-release (1) (1)/unlockall-release/driver/lifus.sys
- IMPHASH 8f671e63bb19366b3c67cb71f3928c87
- SHA256 47a03a13015f7cf4099a37136feeec9dc19765052c51113a600f5fd123d2ddab
- MD5 55ec8cd41e755ab9dca118dfcf37350a
- SHA1 7b9d7b778f377570c8dd41f67b852afb4f6d08c7
- SHA512 2c2699cd32ddeff5123de01872b4aa4d129e6931b3c81cb41e2a1e0850963b85503514e4abb71640a3ea65ce1fe732741ace40baff358aefbc9ca9111cfa597f
- SSDEEP 384:NmB/dAdOskXf5RVrb0PO04cT96p4IRIw55bCxqxWWeVhO2C97:Nmod/kSG04cTgphRIw55EqxWWefI
- TLSH T1AAB24C89938918F8E6BBC67D81B602DBAAB079151312A7CF4970C5342E63FD4B736F00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
10
Major OS version
1
Entry point
36864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\levip\Downloads\unlockall-main\out\release\driver\lifus.pdb
ntoskrnl.exe
RtlInitUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
ObfDereferenceObject
ZwClose
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ObOpenObjectByPointer
ZwQueryVirtualMemory
MmCopyVirtualMemory
ZwQuerySystemInformation
ZwQueryInformationThread
PsProcessType
PsThreadType
ZwCreateKey
MmGetSystemRoutineAddress
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwQueryValueKey
RtlFreeUnicodeString
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=262, version=33145,
count=9, id=260, version=33145,
count=6, id=259, version=33145,
count=3, id=257, version=33145,
count=44, id=1, productName=Unmarked objects,
count=1, id=260, version=35229,
count=1, id=255, version=35229,
count=1, id=258, version=35229,
unlockall-release (1) (1)/unlockall-release/get-symbols.ps1
- SHA256 c83a37fa87e25f917b5c6057b5f315b53446ab9a69e66be9a1a2e32754542eba
- MD5 4952a67048273eebe32158473978deb6
- SHA1 dbc3d7bc515dff3a451c24a5234fe2dfbe67e2a7
- SHA512 9d91dbbdc85c1d1711c5c77d1939d90a34b52c50bdc629519cfecf6003f5b538d9a02dbfcc1e4b18b08daa1e6f15f4c2b08d6d8e1272ebb3d712549414970f87
- SSDEEP 96:3SrMuf1uI9oyioJT1icN7w3Ie1w3m32Wj/iLIO+S/q4P1SCv64SLGiQwSIdgSmE8:3Jg1jeyioB1iMs3nLiLx+S/r1SCvtWGF
- TLSH T11DB1A41BBCA0C76B4743113A5ACA884DBB0DA05F005D1F057C2DD1C9BFA992C8EE6AE5
- MD5 SHA1 SHA512 SSDEEP TLSH
unlockall-release (1) (1)/unlockall-release/load-driver.cmd
- SHA256 899ff9a09f82be5bbeb406fe5fefed8e0f6ce9dd79cfff4199c2c8085cf0b6e4
- MD5 ce8b93b8114b1116cbf8a59da6a1e939
- SHA1 7b0e1a45d30399f8f63f4f2b1b8fb1928136d637
- SHA512 2708325f0461a19c4624532190607281fd3b0445b779951a68a3a6201296aa3744160be11ff4fae44ac49915714b8abe93deb1c54e177c27e2958b4215db5848
- SSDEEP 96:ycPX2jdmX3GKN0g4jd4eFKJY9Rocg9taC:ycPXMS/N0zWZAoeC
- TLSH T117A1736E3E4187B254BFC923BA5B2900F32E445F063A9AD87052913DFF894AD85FC8D0
- MD5 SHA1 SHA512 SSDEEP TLSH
unlockall-release (1) (1)/unlockall-release/loader/loader.exe
- IMPHASH b267e5374a80c7be16a3014b33329798
- SHA256 8889c534fb157aec400b8e2894109f5daa532e8fc1e7020c86be94768e8f8cb5
- MD5 cdefb873eedf9afc99e67e53408ad21b
- SHA1 df79d2976e001264fbb5108b24188c566759ef0d
- SHA512 12024935d6b8c88e12562eaab9dfe7a7c84fec908a307a731022c25ceaddc08c5deb8db75746d80f418908720fe70faac54e91b2b4242312d79b72212465d549
- SSDEEP 3072:NlQkDJkZQqHq8LQ9EduXhVsgfVcnQNVnsp/ny4xO3wA1Rd:riuqHLu1hVsiOQNyxEPd
- TLSH T186046B61B3E900EDE1B79A38C9611621FAB2781117349ADF436852B9DF377C0ED39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
19600
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winhttp
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpSetOption
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
dbghelp
SymSetOptions
SymFromNameW
SymUnloadModule64
SymLoadModuleExW
SymCleanup
SymInitializeW
advapi32
OpenProcessToken
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
InitiateSystemShutdownExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
kernel32
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
WriteConsoleW
HeapSize
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
HeapReAlloc
GetEnvironmentVariableW
CreateDirectoryW
CreateFileW
DeleteFileW
GetFileAttributesW
GetFullPathNameW
WriteFile
CloseHandle
GetLastError
DeviceIoControl
Sleep
GetCurrentProcess
ExitProcess
GetSystemDirectoryW
GetWindowsDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
FindFirstFileExW
FindClose
GetStringTypeW
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
CompareStringW
LCMapStringW
GetFileType
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
SetStdHandle
ntdll
RtlPcToFileHeader
RtlUnwindEx
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
70KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=147, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=17, id=260, version=35207,
count=40, id=261, version=35207,
count=11, id=257, version=33145,
count=143, id=1, productName=Unmarked objects,
count=1, id=260, version=35229,
count=1, id=258, version=35229,
unlockall-release (1) (1)/unlockall-release/loader/safe-rva.ps1
- SHA256 5ea066ead38d9617dbc8b682c9e8679620df95f2b0f027902259af1200a25ba2
- MD5 b012e9ab8938a5ac045773e8611074e3
- SHA1 19d3a6b58db671480d43ec1aaad807fd1e660dc3
- SHA512 db624b4c272e5db8b2f4964c82eaf9bcafd0c88f1dd5d64ee733c301b14f78cb80fcbe57baf7d116bbbc91835f4d6bd794aae0dadbc6b6a60d8817005e96cd2e
- SSDEEP 192:NIeG2Nmd3hqHGK5l75IYteW+RiQP+jiQcUgy1iQEkdTxraNxY502o:NVNmd3hqHGKD7WYtZTrBo
- TLSH T12AD121183EA4D7190183D129799E810DF669B02B056CAF047DBC52D8FF4906D85BEFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
unlockall-release (1) (1)/unlockall-release/loader/sec-rva.ps1
- SHA256 8bddadb11da7e8fabd951ad197a05891da4123b4d776b7ab236eaeb4d2e79a98
- MD5 35e14e56b691ac35db6961d0500da936
- SHA1 e99625daeeff8e76bf0434a6bc3ffc3c153a1792
- SHA512 a66c4e8965665d03281936c00dc31628a4bb219c6989dba2db5bda92fb54b078603dbc1601235be9c28bdb0583716538180da58f8c9ba3caf88a2da41e106850
- SSDEEP 96:02ODB4Q6E8GUQY/df5j4YybkqlKCalHPl6g/2lQ5AYCo9sOIpBa:5ODaQ6E8G6/Ipb7KCalvlFIQ5ANoiBa
- TLSH T185C184154F23423218A1D217A6CEA1C7EB5B402717BE6920B8ED93249F47168E57CFEE
- MD5 SHA1 SHA512 SSDEEP TLSH
unlockall-release (1) (1)/unlockall-release/setup.cmd
- SHA256 783091a243b6d45b1880b0a9269c28d2b96296ff08e54b76352c82718290cf1a
- MD5 882d6f6ea9ead020060ef6cce3c2b8c9
- SHA1 21dc44b88e99c69a7e736fce427dcee3a202dd5a
- SHA512 d65fb3de58ad1021ca8911bfca101d68ce0554d4379d8a1fbb21a0cf7ad5802f4f082028c8cb4b3121ee2a78a04b387cf838fab2b45201f75644441a8c1b0d08
- TLSH T1F821331BF10D83B391A4D8155E2A6290BA18429F42151DEC785FA138BF0D7C09FFCAC0
- MD5 SHA1 SHA512 TLSH
unlockall-release (1) (1)/unlockall-release/unload-driver.cmd
- SHA256 b00e74386476981c2bd3eb18765bbf758e6564678ff51c569225dfcbdcb1ec4b
- MD5 90c595ba40a28b1fac5487691defec01
- SHA1 417e1ca1538b4d7090641ce9970d3800e0ee7d5c
- SHA512 96a5eda1984b443196e5c962c2849843f0126e6908760d0fca5f46f849517b8f9ffec9a12729b0161f7d595c3116cfcabed2cf701c85ce53429b1b72d58ecaa6
- TLSH T1F3E07D0374C966B11052D4D47E3D43B23284019F1245AED5F0576039A9908C4DFEECC5
- MD5 SHA1 SHA512 TLSH
unlockall-release (1) (1)/unlockall-release/unlockall.exe
- IMPHASH 09a11b04b83c12a78d3d693eada603d5
- SHA256 e15617351c54e56a40e315d34b095bfe9e4d539ac99318b824b85b07ff7aa4d3
- MD5 1af9fc40887c575cfb7e5e42261156fc
- SHA1 0c04c5dd8e7c433be6641f863eb1fe117f97ee5d
- SHA512 1846e90f03b61a693da6bf6730bcd237d055028b26bb4b73998c5583d775c548293c0463c90789cd9d760a3e9e71ca5d1228bb3455939d591ade38aa1bc2583e
- SSDEEP 49152:itZZUCmV64kpfDAMgM8nqlj95sYDD21ed5Uj2VPliorW4yPiaDH5YF1cXAGy5Iy2:ZONDIDk1/5T45f9ytncRrXRunP0L3j
- TLSH T121967C62659500A1E0BAC175CEDB5E03DBB2784E4331EBEB0580ED974E6FAF0AD75B10
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4295724
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\levip\Downloads\unlockall-main\out\release\unlockall.pdb
api-ms-win-core-processenvironment-l1-1-0
SetCurrentDirectoryW
GetCommandLineA
GetEnvironmentVariableW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetCurrentDirectoryW
SetStdHandle
GetStdHandle
GetEnvironmentStringsW
GetCommandLineW
api-ms-win-core-file-l1-1-0
SetFileAttributesW
GetFullPathNameW
GetFileAttributesW
DeleteFileW
SetFileInformationByHandle
FindClose
CreateFileW
GetFileType
GetFinalPathNameByHandleW
FindFirstFileW
SetFileTime
ReadFile
FindFirstFileExW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileSizeEx
GetFileInformationByHandle
WriteFile
SetFilePointerEx
SetEndOfFile
FlushFileBuffers
CreateDirectoryW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-errorhandling-l1-1-0
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-synch-l1-1-0
InitializeCriticalSectionEx
CreateEventExW
WaitForSingleObjectEx
WaitForSingleObject
ReleaseMutex
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSRWLockShared
CreateWaitableTimerExW
EnterCriticalSection
AcquireSRWLockShared
InitializeCriticalSectionAndSpinCount
SetWaitableTimer
CreateMutexW
TryAcquireSRWLockShared
LeaveCriticalSection
DeleteCriticalSection
CreateSemaphoreExW
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalFree
GlobalFree
api-ms-win-shcore-obsolete-l1-1-0
CommandLineToArgvW
api-ms-win-ntuser-sysparams-l1-1-0
GetMonitorInfoW
d3d11
D3D11CreateDevice
api-ms-win-core-synch-l1-2-0
WakeAllConditionVariable
WakeConditionVariable
Sleep
SleepConditionVariableSRW
InitOnceExecuteOnce
api-ms-win-core-sysinfo-l1-1-0
GlobalMemoryStatusEx
GetSystemTime
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
FreeLibraryAndExitThread
LoadLibraryExW
GetModuleHandleExW
SizeofResource
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadResource
LockResource
GetModuleHandleW
api-ms-win-core-libraryloader-l1-2-1
FindResourceW
LoadLibraryA
api-ms-win-core-processthreads-l1-1-1
GetCurrentProcessorNumber
OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-file-l1-2-0
GetTempPathW
api-ms-win-core-string-l1-1-0
GetStringTypeW
CompareStringEx
CompareStringW
MultiByteToWideChar
WideCharToMultiByte
bcrypt
BCryptDestroyHash
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptHashData
BCryptCloseAlgorithmProvider
api-ms-win-core-processthreads-l1-1-0
TlsFree
CreateThread
ExitThread
TlsSetValue
TlsGetValue
CreateProcessW
SwitchToThread
GetCurrentThreadId
GetExitCodeThread
ResumeThread
TlsAlloc
GetExitCodeProcess
GetCurrentThread
GetStartupInfoW
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
ExitProcess
FlushProcessWriteBuffers
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
K32GetProcessMemoryInfo
api-ms-win-core-io-l1-1-0
DeviceIoControl
api-ms-win-core-localization-l1-2-0
LCMapStringEx
IsValidLocale
GetLocaleInfoW
LCMapStringW
GetOEMCP
GetLocaleInfoEx
FormatMessageA
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesW
GetACP
FormatMessageW
IsValidCodePage
GetCPInfo
api-ms-win-core-toolhelp-l1-1-0
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
api-ms-win-core-com-l1-1-0
CoTaskMemFree
api-ms-win-core-file-l2-1-0
MoveFileExW
CreateDirectoryExW
CreateHardLinkW
CreateSymbolicLinkW
GetFileInformationByHandleEx
ReplaceFileW
crypt32
CryptStringToBinaryA
api-ms-win-core-winrt-l1-1-0
RoUninitialize
RoInitialize
RoGetActivationFactory
api-ms-win-core-job-l2-1-0
AssignProcessToJobObject
CreateJobObjectW
SetInformationJobObject
ws2_32
ntohl
accept
bind
closesocket
htonl
htons
listen
recv
select
send
setsockopt
shutdown
socket
WSAStartup
WSACleanup
iphlpapi
SetTcpEntry
GetExtendedTcpTable
api-ms-win-core-memory-l1-1-0
VirtualProtect
VirtualQueryEx
shell32
ShellExecuteW
SHGetKnownFolderPath
user32
IsWindowUnicode
SetCapture
GetKeyState
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
EmptyClipboard
GetClipboardData
SetClipboardData
DestroyWindow
IsWindow
CreateWindowExW
RegisterClassExW
ClientToScreen
PeekMessageW
DispatchMessageW
TranslateMessage
CloseClipboard
OpenClipboard
LoadCursorW
GetWindowThreadProcessId
SetWindowLongPtrW
SetWindowPos
WindowFromPoint
ClipCursor
ScreenToClient
GetCursorPos
SetCursor
GetForegroundWindow
ReleaseCapture
GetCapture
GetAsyncKeyState
IsIconic
IsWindowVisible
ShowWindow
EnumWindows
PostQuitMessage
DefWindowProcW
MonitorFromWindow
EnumDisplaySettingsW
GetClientRect
MsgWaitForMultipleObjectsEx
MessageBoxW
MessageBoxA
wsprintfA
GetDC
GetWindowLongPtrW
ReleaseDC
GetWindow
SetCursorPos
SetProcessDPIAware
UnregisterClassW
dcomp
DCompositionCreateDevice
kernel32
K32GetPerformanceInfo
imm32
ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow
ImmSetCandidateWindow
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
GlobalUnlock
api-ms-win-core-sysinfo-l1-2-0
VerSetConditionMask
GetNativeSystemInfo
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
d3dcompiler_47
D3DCompile
api-ms-win-core-file-l1-2-2
AreFileApisANSI
api-ms-win-core-file-l2-1-2
CopyFileW
api-ms-win-core-threadpool-l1-2-0
CreateThreadpoolWait
CloseThreadpoolWait
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolWait
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-interlocked-l1-1-0
InterlockedFlushSList
InitializeSListHead
InterlockedPushEntrySList
api-ms-win-core-rtlsupport-l1-1-0
RtlUnwind
RtlCaptureContext
RtlUnwindEx
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-debug-l1-1-0
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-heap-l1-1-0
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
HeapSize
api-ms-win-core-console-l1-1-0
WriteConsoleW
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
SetConsoleCtrlHandler
api-ms-win-core-fibers-l1-1-0
FlsGetValue
FlsFree
FlsAlloc
FlsSetValue
api-ms-win-core-fibers-l1-1-1
IsThreadAFiber
api-ms-win-core-datetime-l1-1-0
GetDateFormatW
GetTimeFormatW
api-ms-win-core-timezone-l1-1-0
GetTimeZoneInformation
dwmapi
DwmIsCompositionEnabled
DwmEnableBlurBehindWindow
DwmGetColorizationColor
gdi32
GetDeviceCaps
CreateRectRgn
DeleteObject
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
oleaut32
GetErrorInfo
SetErrorInfo
SysFreeString
SysStringLen
Name
.text
Size
5.1MB
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
22KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
170KB
Virtual Size
170KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
192KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=181, id=261, version=33145,
count=36, id=260, version=33145,
count=29, id=259, version=33145,
count=10, id=259, version=35207,
count=17, id=260, version=35207,
count=102, id=261, version=35207,
count=21, id=260, version=35229,
count=1, id=262, version=33145,
count=14, id=257, version=33145,
count=99, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=292, id=1, productName=Unmarked objects,
count=89, id=261, version=35229,
count=1, id=255, version=35229,
count=1, id=258, version=35229,