���+�7S&J ���@e���3�Go:�ٍ���P�g#R������E��YhP�� �Lĝk����G�B���xG����]��M���� �B�����b���/F!H��G��(���ε��٧qr�������`�= �&Ծ��i��Dp%'6�a�լ�WO�9&��c��, ���w�R-�W4���L�_��w�#�3��h�h����\ -��(A-�L�L��+X(��ؽ�iն?��8T粿 "$�L �;��wG`wچR�� |�.��7:?oM�W)w���c��TF�t%U�\|�+�Zg*�a�!�).�ؤ:@���;� U� w8D� "�9��������u��N�q� yjKƓ����������Bz���6�b���w|�b ��<�����/����+M��FCH��V ���&�1^�! �������b���VM=�=��1%�:��f�Ή��E%��сF��<5�M�ں� �m�� ڢ�����h�p �2��|��K6O[2�{~]h�>��|��Ԙ7@ˈ\��k.߲> � ��q����ϣB8<� � Q�>t����(1��15+��ܸ(Q3t9����cs:�/��X� G@v��v��*� _�������Ǟ�|�>c�Z���b�kI��tN�iYP�lxNe� �8���� 9�SK�yw�Xk����']? �K Tv����� [m�v�� !ס�{ZuO�ڰ�~Y�{�mc:��.<�3��d����"��[x�� �N�!r!��5��pH�����Zr����|嶼���\�yD��ûY�.E<�*;E��.K��;Ӡ�l �֡�3*���!K��;������kM�� _nݒ�͈ݾ��&p�^�M�!7U����`c=�|�E���v���c�����\�i?>s�h�(��n����VI ���nK����� 0[�I�ő *�� n\rb�RK�@�� ��������Ƴ�u�J����i=&�[��Ƅ�L���*�m\;"D���������_ ��G�Tc��}�ܔV�6�#���`�����1 q3ڸ��RS��)�����,4�f�v���~�d%K De:�(A�k4ϵ˚�������9��E>1A��hY��8� ���"~``J|�� 5F����-��JF4�� �_gN�C�,���!@ T{I͇�X�� � CQ�%�Z���;� ��q��� ߨ�-!� �&8���3�$^. �_� q,�r����i�lH��wO#|�jrg���Y��C�n���&^?+R�>�� ��)z���Z�ӥG5\#+��-s[�ǁO6�������s�zʽ ��� p�k �׃|ê�o�ыa���z���3�#���V��#ո�ͳ!<.}$�������9$�m:М?h�#7q��dL��E0]a{ހ���-1L���pIÛy6�>d��Y8�Pl/�E�v�� �f�%��>;��a �dA�?LY4u����L�ą_���NHt������z�to�� �vS h�l��_����&H��M�wdYo�vA,���Sʄ $U�B�O�Wu[GM������N0���r��&.����#�Vʗ�7��&�bW`��9���I�=6J� ��q������I7��ԍϋ��ϵT� ̟�<P�d�#� _��6���Xo��O) �VZ)Ac�Y�s�����薢@fs�����GV ���1�W�3�=G�{��nIPrN��ж � Gsf��Z�S=l�v g� ��M��x�ף+�����Zb��A ;��t�q�k�C�N ��""�4�� ʸ�^en{�E,ug�:z���$H2Q���Rb�n�SR�e�CaaZ��Q1��ݟ�����T������X���"@�,�W2���"<�0Gf"t������i~���� }��e����X� y[W�Ӭ5� M��8C�8[�m��H���]Z�H�<�0 9��Μ�⫆�c����?�G�����8{o���4ԋ�oh��fU>���ݿ���k;�\u3�;�]��8���)��#5g�!��ǟK#x�U�"1n�5_/\3��=s$�o�Ӡ�ƥ�άLϮ��i�,349j���z-�lSƌ�c����_��b�nȗ�.�ÿgL����=��%6k����a *.�pv��ћ Y��8�L>\b4G���`6� ��Sg���u��'�p�����A�������穢�=@��b�6��. 8�P�[a<�~��ۧg�^D� h���C����9���(��gM� ��+��j�$�:H.-5� �]->,�JSԻ6X�2J�-��Də�B �o6��oʽ�!�_ڠp�L�V���qgV��o���݃��V��6p�ˇ�[�Zd� ����"DTP~R��պ J~�Ⱦ��b7��p�4��|>�пT�;M�\�^j .�.m�)��C��-gX�k���q�ݷmv����~�y-i�V�@�Q�d d�c�ԌԯM������O��U��\���LeZ#�/ Խ�Ą>�GT.m�t�yT��1�`&o ���x��� �5oL�$}TK9gvŹ]�-��FS��e� ~?�>�y�]Z!m`����T������@����{�M�4�HT������U�I�q �1 �XD�����>�n��P�[i����WVr}l#�O����Pdm��T S}��v��������4��������#��� �e�pr��ّ ����Cd�_Ҋa},3��Ot�=��L�% ��ˠn��]��"w͕�cUޙF�.�}��x�S^/gw���Mg[���Vk[����Ô5f� C���z�� ����3U�;�̃qc�qt@�F��pl�$J���ń$�0��nT��� ���ASf���Z(1]Ԯ�����2���,]_�ؕ_R� �����vtI4�H�� ���kQrD���л6����������7��\�L�F0J��O��NMC#6�ɛrE^e����7����]��^�� ��ZbjRI |����W%Y���� jZ#mХnc���n����{��4�@v ��ry�GN�p�5M��< FB���4��b�W��${t9��b����{�y���髶ހ(�Tj<����v� �<�f����y%s�fUV�9�l3`} ��g��
General
-
Target
SpoofersAndAuraSlotted.zip
-
Size
134.7MB
-
MD5
d2764505f2dc05d7edeeded329b8cfab
-
SHA1
3051430026bfe48f6a9a4ba9224fec28938ffac2
-
SHA256
f387b04dd6e51fce98cbf8e3b3824d06fcffaa3f3dce68923ac466effc803ffc
-
SHA512
a89b3782bdc17fc7b627db399d7ac992401425c0f13538bf2e799038ab3292246e8142cdd135c899ee342fa2cb254e83ce72d183d887b423a4dde709c8ae6870
-
SSDEEP
3145728:tnUwK5ZLPJwT1ksao6DOZMKkrDJ7p6J9bq48aOzgTbO3k9jD5OV:kByfED+ctMJVHjDE
Malware Config
Signatures
-
resource yara_rule static1/unpack001/SpoofersAndAuraSlotted/AppleCleaner.exe themida static1/unpack001/SpoofersAndAuraSlotted/RINGSPOOFER - Copy (7).exe themida -
Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/SpoofersAndAuraSlotted/AppleCleaner.exe unpack001/SpoofersAndAuraSlotted/Aura_Injector.exe unpack001/SpoofersAndAuraSlotted/BadwareFree.exe unpack001/SpoofersAndAuraSlotted/RINGSPOOFER - Copy (7).exe unpack001/SpoofersAndAuraSlotted/Trinity Cleaner.exe
Files
-
SpoofersAndAuraSlotted.zip.zip
-
SpoofersAndAuraSlotted/AppleCleaner.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 46KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 10KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
SpoofersAndAuraSlotted/Aura_Injector.exe.exe windows:6 windows x64 arch:x64
bbf2cfb65b8a13c12cef6b08e355075f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
kernel32
DeviceIoControl
CreateFileW
CloseHandle
ReadFile
VirtualFree
GetCurrentProcess
WriteFile
VirtualAlloc
LoadLibraryExA
Sleep
GetLastError
LoadLibraryA
DeleteFileW
LoadLibraryW
GetWindowsDirectoryW
GetProcAddress
GetFileSize
FreeLibrary
IsDebuggerPresent
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
QueryPerformanceCounter
WideCharToMultiByte
WaitForSingleObjectEx
GetCurrentThreadId
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WaitForSingleObject
GetExitCodeProcess
CreateProcessW
GetFileAttributesExW
ReadConsoleW
HeapReAlloc
FindClose
RtlUnwind
user32
UnhookWindowsHookEx
FindWindowA
PostThreadMessageA
GetWindowThreadProcessId
SetWindowsHookExA
shell32
ShellExecuteW
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlImageNtHeader
Sections
.text Size: 207KB - Virtual size: 207KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 202KB - Virtual size: 209KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
SpoofersAndAuraSlotted/BadwareFree.exe.exe windows:6 windows x64 arch:x64
d32aa1ff669713b856a599a48cb39d61
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
ws2_32
getsockname
wldap32
ord27
crypt32
CertCloseStore
advapi32
CryptAcquireContextA
kernel32
ExitThread
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
CharUpperBuffW
shell32
ShellExecuteA
ole32
CoUninitialize
rpcrt4
RpcStringFreeA
iphlpapi
GetAdaptersInfo
bcrypt
BCryptGenRandom
Exports
Exports
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 791KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 868KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.>nn Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.`RL Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.{~g Size: 7.2MB - Virtual size: 7.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
SpoofersAndAuraSlotted/CheatMethod.txt
-
SpoofersAndAuraSlotted/Cloudflare_WARP_Release-x64.msi.msi
-
SpoofersAndAuraSlotted/RINGALTS.txt
-
SpoofersAndAuraSlotted/RINGSPOOFER - Copy (7).exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 3.5MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 2.9MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 38KB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 149KB - Virtual size: 258KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 40KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1024B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 16.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 10.7MB - Virtual size: 10.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
SpoofersAndAuraSlotted/Trinity Cleaner.exe.exe windows:6 windows x64 arch:x64
9e28a931454d510c8c68ce218a71016a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
D:\Back69\Ass\EAC-BE-Fortnite-Cleaner-Latest-Traces-Mac-Changer-main\x64\Release\Fortnite Cleaner.pdb
Imports
kernel32
Beep
RtlLookupFunctionEntry
GetModuleHandleW
Sleep
GetStdHandle
SetConsoleTitleA
SetConsoleTextAttribute
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
DeleteFileW
IsDebuggerPresent
RtlCaptureContext
user32
MessageBoxA
advapi32
RegOpenKeyExA
GetUserNameW
RegQueryValueExA
RegSetValueExA
msvcp140
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
memmove
memset
__std_exception_destroy
__std_exception_copy
__std_terminate
__C_specific_handler
_CxxThrowException
__current_exception_context
__current_exception
api-ms-win-crt-runtime-l1-1-0
_exit
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_c_exit
_crt_atexit
terminate
system
__p___argv
_cexit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
__p___argc
_register_onexit_function
_initialize_onexit_table
exit
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
_set_new_mode
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
_set_fmode
__stdio_common_vfprintf
__stdio_common_vsprintf
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 729KB - Virtual size: 729KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
SpoofersAndAuraSlotted/UnBanMethods.txt
-
SpoofersAndAuraSlotted/mac.bat
-
SpoofersAndAuraSlotted/test.dll.dll windows:6 windows x64 arch:x64
3a71f698cff7d8742d6672d014462008
Code Sign
14:78:1b:c8:62:e8:dc:50:3a:55:93:46:f5:dc:c5:18Certificate
IssuerCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USNot Before28/07/2015, 00:00Not After26/07/2018, 23:59SubjectCN=NVIDIA Corporation,O=NVIDIA Corporation,L=SANTA CLARA,ST=California,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/08/2022, 00:00Not After09/11/2031, 23:59SubjectCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate
IssuerCN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=USNot Before08/02/2010, 00:00Not After07/02/2020, 23:59SubjectCN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate
IssuerCN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before23/03/2022, 00:00Not After22/03/2037, 23:59SubjectCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate
IssuerCN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=USNot Before14/07/2023, 00:00Not After13/10/2034, 23:59SubjectCN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
05:c5:3d:a5:47:e2:48:97:1e:5e:af:4d:a6:03:d1:ba:fb:57:bd:fcSigner
Actual PE Digest05:c5:3d:a5:47:e2:48:97:1e:5e:af:4d:a6:03:d1:ba:fb:57:bd:fcDigest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\Moon\Desktop\Internal KL\Internal KL\Internal\x64\Release\subzero internal.pdb
Imports
kernel32
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlLookupFunctionEntry
user32
GetAsyncKeyState
MapVirtualKeyA
SendInput
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_type_info_destroy_list
memset
_CxxThrowException
__C_specific_handler
memcpy
__std_exception_copy
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
api-ms-win-crt-math-l1-1-0
round
cosf
sinf
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_cexit
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
api-ms-win-crt-heap-l1-1-0
malloc
free
_callnewh
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ