C:\Users\Maoao\Downloads\Files\Trump\x64\Release\Trump Private.pdb
Overview
overview
5Static
static
3locust_is_goated.7z
windows7-x64
3locust_is_goated.7z
windows10-1703-x64
3locust_is_goated.7z
windows10-2004-x64
3Trump Temp...mp.exe
windows10-2004-x64
5Trump Temp...mp.exe
windows10-1703-x64
5Trump Temp...mp.exe
windows10-2004-x64
5Trump Temp...s.1337
windows10-2004-x64
3Trump Temp...s.1337
windows10-1703-x64
3Trump Temp...s.1337
windows10-2004-x64
3trump priv...ce.exe
windows10-1703-x64
1trump priv...ce.exe
windows10-1703-x64
1trump priv...ce.exe
windows10-2004-x64
1trump priv...s.1337
windows10-1703-x64
3trump priv...s.1337
windows10-1703-x64
3trump priv...s.1337
windows10-2004-x64
3trump priv...ui.ini
windows10-2004-x64
1trump priv...ui.ini
windows10-1703-x64
1trump priv...ui.ini
windows10-2004-x64
1trump slot...ce.exe
windows10-1703-x64
1trump slot...ce.exe
windows10-1703-x64
1trump slot...ce.exe
windows10-2004-x64
1trump slot...s.1337
windows10-2004-x64
3trump slot...s.1337
windows10-1703-x64
3trump slot...s.1337
windows10-2004-x64
3trump slot...ui.ini
windows10-1703-x64
1trump slot...ui.ini
windows10-1703-x64
1trump slot...ui.ini
windows10-2004-x64
1trump slot...k.1337
windows7-x64
3trump slot...k.1337
windows10-1703-x64
3trump slot...k.1337
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
locust_is_goated.7z
Resource
win7-20240221-de
Behavioral task
behavioral2
Sample
locust_is_goated.7z
Resource
win10-20240404-de
Behavioral task
behavioral3
Sample
locust_is_goated.7z
Resource
win10v2004-20240412-de
Behavioral task
behavioral4
Sample
Trump Temp/Trump_Temp.exe
Resource
win10v2004-20240412-de
Behavioral task
behavioral5
Sample
Trump Temp/Trump_Temp.exe
Resource
win10-20240404-de
Behavioral task
behavioral6
Sample
Trump Temp/Trump_Temp.exe
Resource
win10v2004-20240412-de
Behavioral task
behavioral7
Sample
Trump Temp/crackedbylocusts.1337
Resource
win10v2004-20240412-de
Behavioral task
behavioral8
Sample
Trump Temp/crackedbylocusts.1337
Resource
win10-20240404-de
Behavioral task
behavioral9
Sample
Trump Temp/crackedbylocusts.1337
Resource
win10v2004-20240412-de
Behavioral task
behavioral10
Sample
trump private/BonjourService.exe
Resource
win10-20240404-de
Behavioral task
behavioral11
Sample
trump private/BonjourService.exe
Resource
win10-20240404-de
Behavioral task
behavioral12
Sample
trump private/BonjourService.exe
Resource
win10v2004-20240412-de
Behavioral task
behavioral13
Sample
trump private/crackedbylocusts.1337
Resource
win10-20240404-de
Behavioral task
behavioral14
Sample
trump private/crackedbylocusts.1337
Resource
win10-20240404-de
Behavioral task
behavioral15
Sample
trump private/crackedbylocusts.1337
Resource
win10v2004-20240226-de
Behavioral task
behavioral16
Sample
trump private/imgui.ini
Resource
win10v2004-20240412-de
Behavioral task
behavioral17
Sample
trump private/imgui.ini
Resource
win10-20240404-de
Behavioral task
behavioral18
Sample
trump private/imgui.ini
Resource
win10v2004-20240412-de
Behavioral task
behavioral19
Sample
trump slotted/BonjourService.exe
Resource
win10-20240404-de
Behavioral task
behavioral20
Sample
trump slotted/BonjourService.exe
Resource
win10-20240404-de
Behavioral task
behavioral21
Sample
trump slotted/BonjourService.exe
Resource
win10v2004-20240226-de
Behavioral task
behavioral22
Sample
trump slotted/crackedbylocusts.1337
Resource
win10v2004-20240412-de
Behavioral task
behavioral23
Sample
trump slotted/crackedbylocusts.1337
Resource
win10-20240404-de
Behavioral task
behavioral24
Sample
trump slotted/crackedbylocusts.1337
Resource
win10v2004-20240412-de
Behavioral task
behavioral25
Sample
trump slotted/imgui.ini
Resource
win10-20240404-de
Behavioral task
behavioral26
Sample
trump slotted/imgui.ini
Resource
win10-20240404-de
Behavioral task
behavioral27
Sample
trump slotted/imgui.ini
Resource
win10v2004-20240412-de
Behavioral task
behavioral28
Sample
trump slotted/try this if that doesnt work.1337
Resource
win7-20231129-de
Behavioral task
behavioral29
Sample
trump slotted/try this if that doesnt work.1337
Resource
win10-20240404-de
Behavioral task
behavioral30
Sample
trump slotted/try this if that doesnt work.1337
Resource
win10v2004-20240226-de
General
-
Target
locust_is_goated.7z
-
Size
4.9MB
-
MD5
c1a15616f8f80c339ee2dfd33bc23884
-
SHA1
a9a984c47d3bd039eeeddd395dd30cfa5b6dc72d
-
SHA256
b9d1e1bb3a3d284b99dbd4825b967cc67f770df8ea102e3dd7914c35a3f5691f
-
SHA512
518572907ead5a48b9a9f9d197c01708e36ea1acf09906138f410e8b7cc70eddae710f8c6d28f7934057e24563fe2d136eed041a2a2aa32ec305cd5d02f0c44a
-
SSDEEP
98304:RjBXWEza/93EQ5ajDxozzQQFKSljB790PHzS2vqKmW3W2my9yQian:eAQVe9ozzQE/ljQrqP6WIyQjn
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Trump Temp/Trump_Temp.exe unpack001/trump private/BonjourService.exe unpack001/trump slotted/BonjourService.exe
Files
-
locust_is_goated.7z.7z
-
Trump Temp/Trump_Temp.exe.exe windows:6 windows x64 arch:x64
5ce78534e79460a186755a7d90f68704
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
user32
MessageBoxA
advapi32
CryptCreateHash
shell32
ShellExecuteA
msvcp140
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertGetCertificateChain
ws2_32
WSAGetLastError
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
api-ms-win-crt-runtime-l1-1-0
_crt_atexit
api-ms-win-crt-stdio-l1-1-0
fflush
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-utility-l1-1-0
qsort
Sections
.text Size: - Virtual size: 451KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
. #8 Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.<2< Size: 512B - Virtual size: 440B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.P/{ Size: 4.0MB - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 200KB - Virtual size: 199KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Trump Temp/crackedbylocusts.1337
-
trump private/BonjourService.exe.exe windows:6 windows x64 arch:x64
5117fdbf04355e6aa9dd7b29a7297392
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
QueryFullProcessImageNameW
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
GetFileSizeEx
GetLastError
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnmapViewOfFile
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
DeleteCriticalSection
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
HeapDestroy
GetTempPathW
CreateFileW
VirtualAlloc
VirtualFree
CreateEventA
GetProcessHeap
HeapAlloc
CreateFileA
WaitForMultipleObjects
DeviceIoControl
HeapFree
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
FreeLibrary
VerSetConditionMask
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
GetModuleHandleA
lstrcmpiA
MapViewOfFile
Process32Next
GetCurrentThread
CloseHandle
LoadLibraryW
GetThreadContext
GetProcAddress
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentProcess
GetModuleHandleW
CreateFileMappingW
VirtualProtect
UnhandledExceptionFilter
CreateThread
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
Process32First
GetCurrentThreadId
CreateToolhelp32Snapshot
Sleep
GetModuleFileNameA
user32
SetThreadDpiAwarenessContext
GetAsyncKeyState
MessageBoxA
DispatchMessageA
ShowWindow
MoveWindow
SetLayeredWindowAttributes
TranslateMessage
PeekMessageA
GetSystemMetrics
GetCursorPos
SetCursorPos
GetClientRect
SetCursor
GetForegroundWindow
ClientToScreen
ScreenToClient
LoadCursorA
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
FindWindowA
UpdateWindow
advapi32
CryptEncrypt
SetSecurityInfo
RegOpenKeyW
RegCreateKeyW
CopySid
ConvertSidToStringSidA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
IsValidSid
InitializeAcl
GetTokenInformation
RegDeleteTreeW
RegCloseKey
RegSetKeyValueW
OpenProcessToken
AddAccessAllowedAce
GetLengthSid
shell32
ShellExecuteA
msvcp140
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
_FExp
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Mtx_lock
_Mtx_unlock
?_Xout_of_range@std@@YAXPEBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?id@?$ctype@D@std@@2V0locale@2@A
ntdll
NtQuerySystemInformation
RtlInitUnicodeString
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord211
ord60
ord45
ord50
ord46
ord217
ord143
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord301
ord200
ord41
ord30
crypt32
CertFreeCertificateChainEngine
CertGetCertificateChain
CertOpenStore
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChain
ws2_32
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
htonl
ioctlsocket
listen
closesocket
recv
send
WSAGetLastError
__WSAFDIsSet
bind
select
connect
getpeername
getaddrinfo
freeaddrinfo
ntohl
gethostname
recvfrom
sendto
getsockname
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__std_exception_copy
strstr
strchr
__C_specific_handler
__std_terminate
_CxxThrowException
memchr
memcmp
memcpy
memmove
__std_exception_destroy
wcsstr
memset
strrchr
__current_exception
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_beginthreadex
terminate
abort
_errno
system
strerror
__sys_nerr
_invalid_parameter_noinfo
_resetstkoflw
_initialize_onexit_table
_getpid
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
calloc
realloc
malloc
free
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vsprintf
_lseeki64
__p__commode
_read
ftell
__acrt_iob_func
fflush
feof
fputs
fopen
fclose
fseek
fgetc
_open
_close
_popen
_pclose
fgets
__stdio_common_vfprintf
fwrite
_wfopen
fread
__stdio_common_vsscanf
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
_write
fputc
api-ms-win-crt-convert-l1-1-0
strtol
atof
strtoul
strtod
strtoull
strtoll
atoi
api-ms-win-crt-math-l1-1-0
_dsign
logf
pow
powf
roundf
sin
acosf
asin
atan2
atan2f
ceilf
tanf
cos
sqrtf
_dclass
scalbnf
copysignf
ldexp
_fdsign
ilogbf
cosf
exp
fmodf
sinf
sqrt
__setusermatherr
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-string-l1-1-0
isupper
strncmp
strpbrk
strcmp
_stricmp
tolower
strncpy
_strdup
strspn
strcspn
api-ms-win-crt-filesystem-l1-1-0
_wremove
_unlink
remove
_access
_stat64
_lock_file
_unlock_file
_fstat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
localeconv
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
Exports
Exports
interception_create_context
interception_destroy_context
interception_get_filter
interception_get_hardware_id
interception_get_precedence
interception_is_invalid
interception_is_keyboard
interception_is_mouse
interception_receive
interception_send
interception_set_filter
interception_set_precedence
interception_wait
interception_wait_with_timeout
Sections
.text Size: 927KB - Virtual size: 927KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 209KB - Virtual size: 208KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
trump private/crackedbylocusts.1337
-
trump private/imgui.ini
-
trump slotted/BonjourService.exe.exe windows:6 windows x64 arch:x64
5117fdbf04355e6aa9dd7b29a7297392
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\Maoao\Downloads\Files\Trump\x64\Release\Trump Slotted.pdb
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
QueryFullProcessImageNameW
SetLastError
FormatMessageA
LocalFree
EnterCriticalSection
LeaveCriticalSection
SleepEx
GetSystemDirectoryA
VerifyVersionInfoA
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
GetFileSizeEx
GetLastError
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnmapViewOfFile
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
DeleteCriticalSection
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
HeapDestroy
GetTempPathW
CreateFileW
VirtualAlloc
VirtualFree
CreateEventA
GetProcessHeap
HeapAlloc
CreateFileA
WaitForMultipleObjects
DeviceIoControl
HeapFree
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
FreeLibrary
VerSetConditionMask
QueryPerformanceFrequency
LoadLibraryA
MultiByteToWideChar
GetModuleHandleA
lstrcmpiA
MapViewOfFile
Process32Next
GetCurrentThread
CloseHandle
LoadLibraryW
GetThreadContext
GetProcAddress
GetCurrentProcessId
QueryPerformanceCounter
GetCurrentProcess
GetModuleHandleW
CreateFileMappingW
VirtualProtect
UnhandledExceptionFilter
CreateThread
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
Process32First
GetCurrentThreadId
CreateToolhelp32Snapshot
Sleep
GetModuleFileNameA
user32
SetThreadDpiAwarenessContext
GetAsyncKeyState
MessageBoxA
DispatchMessageA
ShowWindow
MoveWindow
SetLayeredWindowAttributes
TranslateMessage
PeekMessageA
GetSystemMetrics
GetCursorPos
SetCursorPos
GetClientRect
SetCursor
GetForegroundWindow
ClientToScreen
ScreenToClient
LoadCursorA
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
FindWindowA
UpdateWindow
advapi32
CryptEncrypt
SetSecurityInfo
RegOpenKeyW
RegCreateKeyW
CopySid
ConvertSidToStringSidA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptGenRandom
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
IsValidSid
InitializeAcl
GetTokenInformation
RegDeleteTreeW
RegCloseKey
RegSetKeyValueW
OpenProcessToken
AddAccessAllowedAce
GetLengthSid
shell32
ShellExecuteA
msvcp140
_Query_perf_frequency
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_sleep
_Query_perf_counter
_Xtime_get_ticks
_FExp
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Mtx_lock
_Mtx_unlock
?_Xout_of_range@std@@YAXPEBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?uncaught_exception@std@@YA_NXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Mtx_init_in_situ
_Mtx_destroy_in_situ
?id@?$ctype@D@std@@2V0locale@2@A
ntdll
NtQuerySystemInformation
RtlInitUnicodeString
dwmapi
DwmExtendFrameIntoClientArea
imm32
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord211
ord60
ord45
ord50
ord46
ord217
ord143
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord301
ord200
ord41
ord30
crypt32
CertFreeCertificateChainEngine
CertGetCertificateChain
CertOpenStore
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChain
ws2_32
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
accept
htonl
ioctlsocket
listen
closesocket
recv
send
WSAGetLastError
__WSAFDIsSet
bind
select
connect
getpeername
getaddrinfo
freeaddrinfo
ntohl
gethostname
recvfrom
sendto
getsockname
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__std_exception_copy
strstr
strchr
__C_specific_handler
__std_terminate
_CxxThrowException
memchr
memcmp
memcpy
memmove
__std_exception_destroy
wcsstr
memset
strrchr
__current_exception
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_beginthreadex
terminate
abort
_errno
system
strerror
__sys_nerr
_invalid_parameter_noinfo
_resetstkoflw
_initialize_onexit_table
_getpid
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
calloc
realloc
malloc
free
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__stdio_common_vsprintf
_lseeki64
__p__commode
_read
ftell
__acrt_iob_func
fflush
feof
fputs
fopen
fclose
fseek
fgetc
_open
_close
_popen
_pclose
fgets
__stdio_common_vfprintf
fwrite
_wfopen
fread
__stdio_common_vsscanf
_get_stream_buffer_pointers
_fseeki64
fsetpos
ungetc
setvbuf
fgetpos
_write
fputc
api-ms-win-crt-convert-l1-1-0
strtol
atof
strtoul
strtod
strtoull
strtoll
atoi
api-ms-win-crt-math-l1-1-0
_dsign
logf
pow
powf
roundf
sin
acosf
asin
atan2
atan2f
ceilf
tanf
cos
sqrtf
_dclass
scalbnf
copysignf
ldexp
_fdsign
ilogbf
cosf
exp
fmodf
sinf
sqrt
__setusermatherr
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-string-l1-1-0
isupper
strncmp
strpbrk
strcmp
_stricmp
tolower
strncpy
_strdup
strspn
strcspn
api-ms-win-crt-filesystem-l1-1-0
_wremove
_unlink
remove
_access
_stat64
_lock_file
_unlock_file
_fstat64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
___lc_codepage_func
localeconv
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
Exports
Exports
interception_create_context
interception_destroy_context
interception_get_filter
interception_get_hardware_id
interception_get_precedence
interception_is_invalid
interception_is_keyboard
interception_is_mouse
interception_receive
interception_send
interception_set_filter
interception_set_precedence
interception_wait
interception_wait_with_timeout
Sections
.text Size: 942KB - Virtual size: 942KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 210KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
trump slotted/crackedbylocusts.1337
-
trump slotted/imgui.ini
-
trump slotted/try this if that doesnt work.1337