bluewing TS.zip
- SHA256 734f289e454119f1bb31e9f4963c64e5230b51264229a1832b1707b9753f276c
Overview
overview
10Static
static
10bluewing T...er.exe
windows7-x64
10bluewing T...er.exe
windows10-2004-x64
10bluewing T...er.exe
windows7-x64
1bluewing T...er.exe
windows10-2004-x64
7bluewing T...ss.exe
windows7-x64
1bluewing T...ss.exe
windows10-2004-x64
1bluewing T...er.exe
windows7-x64
1bluewing T...er.exe
windows10-2004-x64
1bluewing TS/rust.exe
windows7-x64
1bluewing TS/rust.exe
windows10-2004-x64
6bluewing T...sp.exe
windows7-x64
5bluewing T...sp.exe
windows10-2004-x64
5bluewing T...ll.exe
windows7-x64
5bluewing T...ll.exe
windows10-2004-x64
5Behavioral task
behavioral1
Sample
bluewing TS/BlueWing Cleaner.exe
Resource
win7-20241010-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
bluewing TS/BlueWing Cleaner.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral3
Sample
bluewing TS/Loader.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
bluewing TS/Loader.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
bluewing TS/bluewing bypass.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
bluewing TS/bluewing bypass.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
bluewing TS/bluewing woofer.exe
Resource
win7-20240729-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
bluewing TS/bluewing woofer.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
bluewing TS/rust.exe
Resource
win7-20241023-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
bluewing TS/rust.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
bluewing TS/valorant esp.exe
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
bluewing TS/valorant esp.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
bluewing TS/valorant full.exe
Resource
win7-20240903-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral14
Sample
bluewing TS/valorant full.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target bluewing TS.zip
- Size 48.6MB
- Sample250221-sc4wsawks7
- SHA256 734f289e454119f1bb31e9f4963c64e5230b51264229a1832b1707b9753f276c
- MD5 cd42cddb8a7e499433cab034fb5e09c7
- SHA1 649e2c5b1715541ab8b55611abc449c68a54dad3
- SHA512 1d7b20bce5567b51f5b01f6036e9101f544b48e724f49dafd97680939f3a12523c270057077cf62cdf40bb1f8b77d403139120ce39e5f30a5d5b1e40794d5b63
- SSDEEP 1572864:pUrvw7AW9+ZGai1WeDej5RTRQISXiIT8Xvnz:pgGa7eDiRTB8iIT8X/z
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
xred
C2
-
xred.mooo.com
Attributes
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Xred family
-
resource yara_rule static1/unpack001/bluewing TS/valorant full.exe upx - Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/bluewing TS/BlueWing Cleaner.exe unpack001/bluewing TS/Loader.exe unpack001/bluewing TS/bluewing bypass.exe unpack001/bluewing TS/bluewing woofer.exe unpack001/bluewing TS/rust.exe unpack001/bluewing TS/valorant esp.exe unpack001/bluewing TS/valorant full.exe unpack002/out.upx
File Explorer
-
bluewing TS.zip.zip 48.6MB
-
bluewing TS/BlueWing Cleaner.exe.exe 1.2MB
-
bluewing TS/Loader.exe.exe 1.3MB
-
bluewing TS/bluewing bypass.exe.exe 16.8MB
-
bluewing TS/bluewing woofer.exe.exe 17.2MB
-
bluewing TS/rust.exe.exe 10.0MB
-
bluewing TS/valorant esp.exe.exe 7.5MB
-
bluewing TS/valorant full.exe.exe 910KB
-
out.upx.exe 1.9MB
bluewing TS/BlueWing Cleaner.exe
- SHA256 2fdc67ad98fe3cd9e7f1f2b7b67509b3870914aa7989cc097a99bcdf7dc6574d
- MD5 5c4c33c0e3914d6eb4471f0a7b87c8f8
- SHA1 fad32cd16ac549be1e019d3b683c005925ab1c3d
- SHA512 a5007ba3918addb9569bbbb23efafd682b9c10e4f23121b96e1ab98f8beb48ec2daebbcd04406fc36e28073496cca42d430282a0bd5f3612371e5353f7333e36
- SSDEEP 24576:3nsJ39LyjbJkQFMhmC+6GD9DF2G0bIGsRTUpCz3:3nsHyjtk2MYC5GDzh0bIGK4O
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
633728
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
615KB
Virtual Size
614KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
57B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
42KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
574KB
Virtual Size
574KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bluewing TS/Loader.exe
- IMPHASH a3ea0e47a09a308500bac213aa2391d7
- SHA256 ca9d3a364ab00b6758fac81dca534c85de2acfe87e6aed985d55d733e05248f8
- MD5 a31c7aeb98cb02d7db58c570a9f18e63
- SHA1 6d9cf22847ce215100f0b0150c5fc9d579061a72
- SHA512 781f0de6b2cff9c0f92a8814a05e0ead65f3f32494a3ae8051de3dd04d3c1c42bbe44e376d9a642981fdefb4043f1f2e6ec65641ad6e593f453f6152d1f67ca9
- SSDEEP 24576:foWphKZ/21+sTZq1Hr5Ne8DmnH+ZjdGqEQw1KrF+XlJDXNqP/oY75vKWn1ceF1dl:fxphKZwlsHr5Ne8DmnH+VdGqEKrF+Xl4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
516272
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetFirmwareType
InitializeCriticalSectionEx
DeleteCriticalSection
FormatMessageA
LocalFree
GetModuleFileNameA
FreeLibrary
VerifyVersionInfoW
SetFileCompletionNotificationModes
CloseThreadpoolIo
CancelThreadpoolIo
StartThreadpoolIo
CreateThreadpoolIo
GetOverlappedResult
WriteFile
ReadFile
CreateFileW
FormatMessageW
OutputDebugStringW
ExpandEnvironmentStringsA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitOnceComplete
InitOnceBeginInitialize
QueryPerformanceFrequency
QueryPerformanceCounter
VerSetConditionMask
WideCharToMultiByte
TerminateProcess
ExitProcess
GetCurrentProcess
WaitForSingleObject
GetLastError
CloseHandle
FindNextFileA
FindFirstFileA
GetLocaleInfoEx
MultiByteToWideChar
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
GetCurrentThread
Sleep
GetUserDefaultLocaleName
GetFirmwareEnvironmentVariableA
LoadLibraryA
GetProcAddress
InitializeSListHead
GetModuleHandleA
GetFileSizeEx
FindClose
user32
GetCapture
GetClipboardData
SetCapture
ReleaseCapture
GetForegroundWindow
GetKeyState
DefWindowProcA
PostQuitMessage
UnregisterClassA
IsChild
RegisterClassExA
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetClientRect
CreateWindowExA
DestroyWindow
ShowWindow
UpdateWindow
GetDesktopWindow
PeekMessageA
LoadIconA
SetCursorPos
DispatchMessageA
TranslateMessage
LoadCursorA
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
TrackMouseEvent
advapi32
RegQueryValueExA
AdjustTokenPrivileges
RegGetValueA
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA
RegCloseKey
GetUserNameW
LookupPrivilegeValueA
shell32
ShellExecuteExA
msvcp140
??Bios_base@std@@QEBA_NXZ
?setf@ios_base@std@@QEAAHHH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
?_Random_device@std@@YAIXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?uncaught_exceptions@std@@YAHXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?fail@ios_base@std@@QEBA_NXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Mtx_lock
_Mtx_unlock
_Cnd_wait
_Cnd_broadcast
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Xbad_function_call@std@@YAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??Bid@locale@std@@QEAA_KXZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEA_K@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Throw_C_error@std@@YAXH@Z
_Cnd_destroy_in_situ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?classic@locale@std@@SAAEBV12@XZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
_Cnd_init_in_situ
_Mtx_destroy_in_situ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?__ExceptionPtrCompare@@YA_NPEBX0@Z
_Mtx_init_in_situ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
concrt140
?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ
?_Release@_ReentrantBlockingLock@details@Concurrency@@QEAAXXZ
??0_ReentrantBlockingLock@details@Concurrency@@QEAA@XZ
??1_ReentrantBlockingLock@details@Concurrency@@QEAA@XZ
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
crypt32
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateContext
CryptUnprotectMemory
bcrypt
BCryptOpenAlgorithmProvider
BCryptGetProperty
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptFinishHash
winhttp
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpConnect
WinHttpQueryOption
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpWriteData
WinHttpGetDefaultProxyConfiguration
WinHttpSetStatusCallback
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryAuthSchemes
WinHttpSetCredentials
d3d11
D3D11CreateDeviceAndSwapChain
vcruntime140
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__current_exception_context
__current_exception
__C_specific_handler
_purecall
strstr
memchr
memset
__std_terminate
memmove
memcpy
memcmp
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
abort
_invalid_parameter_noinfo_noreturn
_beginthreadex
terminate
_errno
api-ms-win-crt-string-l1-1-0
strncpy
strcmp
isalpha
strcat_s
strcpy_s
isdigit
isxdigit
api-ms-win-crt-stdio-l1-1-0
ftell
__acrt_iob_func
fclose
fwrite
_get_stream_buffer_pointers
__p__commode
_set_fmode
fflush
fgetc
ferror
feof
fgetpos
fputc
fread
__stdio_common_vsscanf
__stdio_common_vsprintf
setvbuf
fseek
_wfopen
fsetpos
__stdio_common_vsprintf_s
ungetc
_fseeki64
api-ms-win-crt-heap-l1-1-0
free
_callnewh
realloc
malloc
_set_new_mode
api-ms-win-crt-convert-l1-1-0
wcstol
atoi
wcstombs_s
api-ms-win-crt-filesystem-l1-1-0
_access_s
_unlock_file
remove
_mkdir
_lock_file
api-ms-win-crt-time-l1-1-0
_time64
_localtime64
strftime
_localtime64_s
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
__setusermatherr
acosf
fmodf
sqrtf
sinf
cosf
ceilf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
765KB
Virtual Size
765KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
208KB
Virtual Size
207KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
270KB
Virtual Size
273KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=17, id=261, version=30141,
count=10, id=260, version=34321,
count=37, id=261, version=34321,
count=6, id=259, version=34321,
count=8, id=257, version=34321,
count=25, id=257, version=30795,
count=483, id=1, productName=Unmarked objects,
count=21, id=261, version=34436,
count=1, id=255, version=34436,
count=1, id=258, version=34436,
bluewing TS/bluewing bypass.exe
- IMPHASH fe9c002d651328233022258515b68108
- SHA256 fa5045f42fe977d5a35e87526544752241031a3b9e5c854a5b8d9c65cae263ec
- MD5 526f48ff5e2e6502792de77301bdabd8
- SHA1 3ace17d3fca1e01a04733da0c4a8ae014c235d7c
- SHA512 11a7ab6e098b67b2ca48290d0f428cf495ea2814b11f48751fdfd3ad72d6fa4612f09a70d350fcfed7bd1ed790f5f0d51ac8f27dc51762b6dc548ace632c00f5
- SSDEEP 393216:G6prs3Ndv3LvOqUCZbIDK/wiyXPL+JWsBmvd4bafJ6wFct:T1s3Ndv3IYbqK/whXDeWsBmqaB6wCt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
13221406
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
kernel32
GetFileAttributesExW
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
SetClipboardData
advapi32
IsValidSid
shell32
ShellExecuteA
msvcp140
?_Syserror_map@std@@YAPEBDH@Z
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertCloseStore
ws2_32
setsockopt
shlwapi
PathFindFileNameW
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-stdio-l1-1-0
ftell
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strpbrk
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
523KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fku0
Size
Virtual Size
9.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.fku1
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fku2
Size
16.8MB
Virtual Size
16.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bluewing TS/bluewing woofer.exe
- IMPHASH c77a819dd96c4bbb71c9b7ef868c2dcb
- SHA256 87774fd5d36f01751b6a7dca58ab9c7325e734b4806e73b30d037e1e7ec409f5
- MD5 e2443a82501780eab2a68b1edc94a0e4
- SHA1 4418de72270d6a5774a355477dac0aa35cee72aa
- SHA512 863e69bac7b7c9b514af881e68464415d03033443cc5124c1fcd570dce14229c21c54255bbbf9161ca83a60c5ac201ad3be626d3398906e60300295322537e25
- SSDEEP 393216:yjQmfOlxOTfcnGM8FJolxLyWPoqUFzt0ZXB/RmyW4xa0:SLODOj8gXolxLyWQJzCZX1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
29059277
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
d3dcompiler_43
D3DCompile
winhttp
WinHttpConnect
ws2_32
WSACloseEvent
crypt32
CertOpenStore
api-ms-win-crt-stdio-l1-1-0
_open
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-runtime-l1-1-0
system
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-locale-l1-1-0
___lc_locale_name_func
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-filesystem-l1-1-0
_unlink
api-ms-win-crt-environment-l1-1-0
getenv
gdi32
CreateRoundRectRgn
dwmapi
DwmExtendFrameIntoClientArea
user32
EmptyClipboard
kernel32
GetCPInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
imm32
ImmGetContext
ole32
CoUninitialize
oleaut32
SysFreeString
advapi32
CopySid
userenv
UnloadUserProfile
iphlpapi
GetAdaptersAddresses
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
normaliz
IdnToUnicode
wldap32
ord217
rpcrt4
UuidCreate
psapi
GetModuleInformation
bcrypt
BCryptGenRandom
Name
.text
Size
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
3.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.sD{
Size
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.<8e
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rY$
Size
17.2MB
Virtual Size
17.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bluewing TS/rust.exe
- IMPHASH f776939530df6539f588849908ce3d9d
- SHA256 a5b9eeaa0be03d8a921690ab724441d4b522147df249594720ce09d995726494
- MD5 dd6d31286e7369ae5a1bf9a6105f6e4c
- SHA1 b9a3527c90563335ff808cf707ae8988a96f390b
- SHA512 275594ccc76f3bcb9b4e377cb5e6e3d5f136e185174cba8c37a71865fa522fc85c5c04d0572d20da9d15210748a7e21c824398f74bb0191fa834c200b294312c
- SSDEEP 196608:KdztxExMp99eZwnNJ6Mj9B8ZLQoEA0o828LVVKPDE1WbSh68scT:KlkxU99emnNkMj92LQov0s8LXKGWbShV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
14909632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetProcAddress
user32
FindWindowW
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
vcruntime140
memcmp
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
api-ms-win-crt-stdio-l1-1-0
_get_stream_buffer_pointers
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-string-l1-1-0
_wcsnicmp
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
wcstol
api-ms-win-crt-math-l1-1-0
atan2f
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.00cfg
Size
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.ca
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.u656b
Size
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.hex
Size
10.0MB
Virtual Size
10.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=31823,
count=3, id=259, version=31823,
count=29, id=261, version=31823,
count=6, id=257, version=31823,
count=5, id=257, version=33136,
count=138, id=1, productName=Unmarked objects,
count=2, id=260, version=31948,
count=4, id=261, version=31948,
count=1, id=255, version=31948,
count=1, id=258, version=31948,
bluewing TS/valorant esp.exe
- IMPHASH c29085b2430754c7ad7f1fc9a3e06dcb
- SHA256 a92207cdaeabf1e5837d5c78c581c2af75052f6b6c162d666cd66931879d9f8e
- MD5 90dc2034f9b34caa297d22ba110a648b
- SHA1 4aa18722f3c715107819252b14882e25faaf89d4
- SHA512 556e09218bb190ab1a2158680d44a778236768c5c5e19339f303cda2bb27acb87fa1dbc34190b5cfd4acf27fc66894c79af067e5a10ce9229933829d972ff4c0
- SSDEEP 196608:GKIg67q6GENqJ9fWiTcJhtmLY0FL53d0S/lFAezL3D5te2:v1Q9GEN17tmc0p53dTjAe/33
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7239814
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetModuleHandleA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxW
CharUpperBuffW
advapi32
InitializeAcl
shell32
ShellExecuteExW
msvcp140
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
crypt32
CertGetCertificateChain
ws2_32
setsockopt
shlwapi
PathFindFileNameW
psapi
GetModuleInformation
userenv
UnloadUserProfile
bcrypt
BCryptGenRandom
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-runtime-l1-1-0
__sys_errlist
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-convert-l1-1-0
wcstombs
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-math-l1-1-0
_fdopen
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
)0)$$!|Y����� �P�$��B�g��u���^F:�7h���=,�����c+���|�K�t��fHK��`:�]0V �u���v�B��Dd �e �������({"��/�Y�e���M��F*�)�>!4�� nL�P�GH`/���h�w ���:�Y��嬿HJ��fC���5N)l+�^�^�j�C"+F$�����ABb�6)����>os������o��|�z�.-y�>��������6L�Dh!�m�Xd��wXrK�k/ �PwPC��^L��S�k� Ƙ f��I#����t�v�����������gf΅���Fv��'����#x��>��'��J�-g�W5R��*���b�9�o�Đ6���ue���F)�vE�k_��=�f�8����W
�Ki:��~
�g��9�W}�fÙ \�D�ע�j�
�[�v��v%a�eݟU
F���T�(�� ?�i�|x^d����]��m)eCg�J�}}i�����ҕ)ټLoY��4Ҿ�չ����s����g�dri��6����������h����&Aq����Jv^���Z c+�%H���
������4� �(e����<r���L),�O��c(�U��:��+�.
�V�ؾ2v�.��67{�>�[����;/I�?�<�;7��-����L���7�߶�9�1K�B��LRO�������KV���H ZI6�&W ���9������|�9�c����y^�˗ �36�M�`. ����]����gPW�T���|���k�~@�M��Ҷ�wO�DOf�JG� Po#�⿀�딋�g.*�,\�~�I��-����n3�|*�����&Ѩ ����|�m l=6~壹RY��G �s uT�-
��h ��)��6t�3�V@�s�� 4���Є�Qn�_�쿭��Ҹ� w�#J 9���E��2f!�n��-��+����Rx;�#t�ק�-cE���kl�Y�B��[ H�ʌA�
}��սe���9���ȟ����Ţ�|P��H>�/���4Z�ʹ7//P��?�ߪS@���\�������5�Z!sm��|
<)�X��bV]@�ս����SA���l���D�-�@7P��j~�u=���bk�{%�SR�����!t����p_S����i<������)v]0Ffw�A4��aS.S(i��҇��=�T��j���E����w��0%���?�ެ�]뀄h���j��P���J��mA� �-_өOst\}����Ϟb��b&kUS=^��imT���c%v�J�����V.�2��
PT �u)`v���U9&�!y���2'>h߁�%�r�w���|���
C'� y$}~�*n��
K �e/ (��sk��Hk��(�dA� �8��ST�r��� 8�ݚ� �?r�q��˓��9����=Pց�b�]��w�T�-7�<����I��G*Ս���J<B���d\<�� ������
9ԋ�MQ��!���jf�����]m< ����n�]�~�Ļnࣕ�����3���vg<~ ��V�g���\7�+���S.c�PEc��>�w� ��a]\WD�}wU�g
!�֮2~Z�m%^r(_U�����̖7Ў�����W͘��I�Of0�`4�(̋�k=z, 1ovn ����S}��@��f�s]� Sn���\Vną�c\�� d�ŝŨp�_�T屡h�k���Ῥ�e�3�4I�
X��S���X�)�ڽL7�\�����`� �%;l�ٷ����w� s���M�j{�U�1}ۏ�=��N? �'VX�Ͷ��f��� \�H`Tx)26�a��v��.T̏Fۉ$R�C�����z�B�7�l�Ú t'h��ȯĜ�1r�-(Zj{������EB�g�����Q��ˌ-
��#�����цi�JT��|��x�� ����,��Gm~�� `�l�=z�����T�*���ΰ75� gM�GRg��[��ѭ:��[��I�oC� �ujL�Qf��1<�m�KR����-3�];�7v[��V=�����U�nBg��;@a��X6�(�Z}7��k�*)��Rg
��|�����&sDUX3�JT��Ôx#TY1����͘^���^��2[�#շ gn���Pw ���W��B1~g ��3��sxG���c�Ɲ/��j�����7O1���R� ����:�cw1���A=z�6�.!'��,tzj��� �UvC���Zە|�wN��
, ��7�Fq�a���s+T�7���\.�gW�w�@��!����O0.(�8�8�KE�E�s��,ڭ��7���������Ltَ�]k�_������_�-�d
�t�7KQ+ (���w�7&I�"l���LP����l�(�aIXg (��?�����}扡B������1*�Y�q�P�
�菾�.@u!4y���8��R�I��@�;� ����^�{<%C���+C>�P,O��},)�{�<T��[mx�9�-
����A)u�:�ڂj=cȦ��]&<��2#3��p�LIp� �n^��ņNhڴv� MN�/ P�� ��Yn���
G���� ���A���#���4�r Kb���8/��$l��u�k��O�07����D[,(��S����p�<ӻ��+V�=Sz��z,ff���|o��51���#_Hca��ܵ1M�;@��X\���zo�Yzp���b���q���gF�`���#n>�}\ ��V$�V"rL]!J��Ry�!��}��{��U� �]ձ� J>mU,����f��琼@�����qm��ݩ,{- �;~T�{!�D'7�U=��7�O��"���-�ާ�u��7�ȯ�}^xUP7��)Ϩ!�
���F������aD"���a��Np�g�A���Ϙ�@A9�eϮ>?ә�Ho���W��*
G���c+��\r����9���TQ��} x��p�D�!_��ܭ�o
�Q ��7��� ���i͡����RDo�g�ɍ��u�M�G,� J��ˢ�S�گ��#�,�� ��<� B��^`���yFb:�8�S����3ߣ�&��U�� S�3��$MW�� ���� ���"���Ƥ_�c��j�T+=H^a���C�lޤV��P ������q˕�/��p
j ���0b�h��
Name
.text
Size
Virtual Size
723KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Tysvmp10
Size
Virtual Size
5.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Tysvmp11
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Tysvmp12
Size
7.5MB
Virtual Size
7.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
bluewing TS/valorant full.exe
- SHA256 54abc7b31f3167221eb186cf5a1ab9dc7b4945e9da4a241b46b7fbeb932fe3c7
- MD5 a4589be07699d55f1e84de98fb8e14dc
- SHA1 409e3df648fcd2bd70d5569ba9e39faa4b6eefb3
- SHA512 313d34b55a8ffe68c208b800f77610b1cd2740f1b56939d1b95b8793b7c643da767237649c5534ea9eb39bd60e2776c2542fb38326bd817d728d8984b8fdcda6
- SSDEEP 24576:lKg+vBX4JpuCUX0Qpuvgdx/y5RL90q+wRw:z+Zupu/kqFdxENAwRw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2008768
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
907KB
Virtual Size
908KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=253, version=34321,
count=4, id=259, version=34321,
count=10, id=260, version=34321,
count=38, id=261, version=34321,
count=6, id=257, version=34321,
count=43, id=260, version=33523,
count=129, id=260, version=32535,
count=2, id=261, version=32535,
count=25, id=257, version=33138,
count=463, id=1, productName=Unmarked objects,
count=1, id=265, version=34435,
count=1, id=255, version=34435,
count=1, id=151,
count=1, id=258, version=34435,
out.upx
- SHA256 48ed0ce286fc3956896c0992a89ab6143e835f08c359c80a0f42831665745bbe
- MD5 6f2f4af0a0f5574b2a12cf6a9a0277c7
- SHA1 283b940c36353aaed68ad8122877324968b8bb62
- SHA512 39ccacecf7ec20ace9c8b424753cd1ca3ad89f21622194b423d311159dabe7f76385dff2200840f27e1d2cf77e3472e834f966559710b7ff62aa693bccc54596
- SSDEEP 49152:zpLMVj+9U4pZ8mAG1yOtpZmJuLch+qgK3NOyLF5vOXLXO87PZD:zpKDmAG1yOtpZmJuLc8rKtF5vOb+8J
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
732144
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
724KB
Virtual Size
723KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
195KB
Virtual Size
194KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
972KB
Virtual Size
971KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=253, version=34321,
count=4, id=259, version=34321,
count=10, id=260, version=34321,
count=38, id=261, version=34321,
count=6, id=257, version=34321,
count=43, id=260, version=33523,
count=129, id=260, version=32535,
count=2, id=261, version=32535,
count=25, id=257, version=33138,
count=463, id=1, productName=Unmarked objects,
count=1, id=265, version=34435,
count=1, id=255, version=34435,
count=1, id=151,
count=1, id=258, version=34435,