Fortnite-Tools-Pack[.]zip

resource	yara_rule
sample	agile_net
static1/unpack001/Combo Editor Sexitor by Calina\TrinitySeal.dll	agile_net

resource
unpack001/AIO Giftcard Generator by Acquire\AIOgenerator by Acquire.exe
unpack001/AIO Giftcard Generator by Acquire\Qt5CoreVBox.bin
unpack001/AIO Giftcard Generator by Acquire\bin32.lib
unpack001/AIO Giftcard Generator by Acquire\core.cfg
unpack001/Combo Editor Sexitor by Calina\AlphaFS.lib
unpack001/Combo Editor Sexitor by Calina\Colorful.Console.dll
unpack001/Combo Editor Sexitor by Calina\Sexitor.exe
unpack001/Combo Editor Sexitor by Calina\TrinitySeal.dll
unpack001/Combo Editor Sexitor by Calina\WThreads.dll
unpack001/Combo Editor Sexitor by Calina\d3dcompiler_47.cfg
unpack001/Combo Editor Sexitor by Calina\strip.dll
unpack001/Fortnite Checker by Burnwood\Fortnite Checker BW.exe
unpack001/Fortnite Checker by Burnwood\bin32.bin
unpack001/Fortnite Checker by Burnwood\database32.dll
unpack001/Fortnite Checker by Burnwood\libcef.lib
unpack001/Fortnite Checker by Burnwood\xNet-Ameliorated.dll
unpack001/Fortnite Skinner Checker v1.9.1\Bunifu_UI_v1.5.3.dll
unpack001/Fortnite Skinner Checker v1.9.1\Fort Skinner.exe
unpack001/Fortnite Skinner Checker v1.9.1\bin32.cfg
unpack001/Fortnite Skinner Checker v1.9.1\libGLESV2.dll
unpack001/Fortnite Skinner Checker v1.9.1\libcef.lib
unpack001/Fortnite Skinner Checker v1.9.1\xNet.dll
unpack001/Fortnite Tracker Coded by LilToba\Colorful.Console.dll
unpack001/Fortnite Tracker Coded by LilToba\FORTNITE TRACKER.exe
unpack001/Fortnite Tracker Coded by LilToba\Leaf.xNet.dll
unpack001/Fortnite Tracker Coded by LilToba\alocal.cfg
unpack001/Fortnite Tracker Coded by LilToba\api32.lib
unpack001/Fortnite Tracker Coded by LilToba\mcl64.bin
unpack001/TCMsSkin Checker - Fortnite Tool\Bunifu_UI_v1.5.3.dll
unpack001/TCMsSkin Checker - Fortnite Tool\ElasticEmail.WebApiClient.dll
unpack001/TCMsSkin Checker - Fortnite Tool\HazardEdit.Tools.dll
unpack001/TCMsSkin Checker - Fortnite Tool\HtmlAgilityPack.dll
unpack001/TCMsSkin Checker - Fortnite Tool\MailKit.dll
unpack001/TCMsSkin Checker - Fortnite Tool\Newtonsoft.Json.dll
unpack001/TCMsSkin Checker - Fortnite Tool\TCMFortniteTool.exe
unpack001/TCMsSkin Checker - Fortnite Tool\api32.lib
unpack001/TCMsSkin Checker - Fortnite Tool\libcef.lib
unpack001/TCMsSkin Checker - Fortnite Tool\libexec.bin
unpack001/TCMsSkin Checker - Fortnite Tool\xNet.dll

Fortnite-Tools-Pack.zip

SHA256 248f1bccc6433a7c02c16d8b90caa3b7d053a6e4cc906c416cdf41a3677fe04b
MD5 b0f746d7ed3e8339b209e5ed82d064f3
SHA1 e9756f1b576d2944a763a47e054cc760e8bf8b86
SHA512 f24f8ed01f43ca38a6b8dd20f31774cec7b126aaf990cc10e6048ec8febfefecd17496a4fc52cd139d045b6521de9d1184bc9b5f063f0c9efbabfcc9f324a2e5
SSDEEP 786432:VTWulMAEjrIRNtpW21P8YdvAxVsvCACHtMG:VTOAEAP7kVsvCVD
MD5 SHA1 SHA512 SSDEEP

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

AIO Giftcard Generator by Acquire\AIOgenerator by Acquire.exe

IMPHASH 953ddbeaf8260a562016edb32b006967
SHA256 8dd6477fa8e19f220f167310d2961b7c2a223ed46dd883164913fcac480e8350
MD5 04142f894c394b262245746d3a9fd3ad
SHA1 368803226a985ff2faf6b02c38fa7f706df49ad1
SHA512 4324a8796baf5a701ff49c1d1361433c49042bc4a67b2708c8f4f16e6c8aa9cc62c6d0b6bd7ca66bbf855b629fb805035f05f78deae48d2baae91f7667a8c711
SSDEEP 6144:5/fUcZlwn55vjiieFHDi+DZUdHDgKhnoUlYN30AUcq7o:CK2n/NeFHDHCDno0YN30AUcq7o
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc HeapFree GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW

version

VerQueryValueW

AIO Giftcard Generator by Acquire\Qt5CoreVBox.bin

IMPHASH 374527fb65242b051c289078f8099fdd
SHA256 3ad26e1c16b6f49c6136c0c1c02c5943437349a310a6bcc5a8a0f4924a6f4ae4
MD5 26f56121184843056f1d6e6db3f9844b
SHA1 f8d6c767cab3be5e55608cc5abd30a4c383759e9
SHA512 13a0898a6780f474ab4ffe8e46ca0227f03f2c4d26daaf4b61862eb7374a65d887b96a8672f21247e7f3aac4c49cce77521dd1564983b52f8716219aff894b9d
SSDEEP 24576:2m3hIqxIdAtLA0Q9xtPUf0ZOxGI3ffWgR5vuv54Jdhx76g:2gWaW9xthIXWgR5vuv54Jdhx7n
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14356

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar ReadConsoleW ReadFile GetConsoleMode GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency LocalFree GetLocaleInfoEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeSRWLock InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent RaiseException GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW HeapValidate GetSystemInfo CreateThread ExitThread ResumeThread FreeLibraryAndExitThread ExitProcess GetStdHandle WriteFile GetCurrentThread GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler HeapReAlloc HeapSize HeapQueryInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP CreateFileW

winhttp

WinHttpReceiveResponse

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

AIO Giftcard Generator by Acquire\bin32.lib

IMPHASH 0392634acac147c03d108c2d046e7996
SHA256 58a0b8c13f085a3181fecc5d97cdfe5e35892af6b4b31d79657fc88512bb520d
MD5 b9352fa2d673bf124116ba9e5639956e
SHA1 f511f3b653fc0a7a3e49d1cc58c21c9a53fcf79b
SHA512 eea7bd7ff2023e2239b6d5a5ba96d4ecdab4217ecdd6f7403947aa09b1dd54db533bde3b8ef2256cdb720086754c716842bf98810c135b4d72f281dfe5dd48df
SSDEEP 6144:1PXVt3l07qcbU0ddapOpVXMpUvRz1Kxudx:FFt3lQbU05pm2z1KxY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

115500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

AIO Giftcard Generator by Acquire\core.cfg

IMPHASH 59e1615e45c8f3ab210e3df16d200414
SHA256 4f8f41defc38a510c0b8c37a6f6f253d1250e99770a746d0dd4d1abd5d523597
MD5 6fc1f551548e78b308b40b803eed893d
SHA1 6c39dab84699aca9b11fdfaf2faf554283bfa7f8
SHA512 1111dbc16d50cec4b4661e7f6e3ac187bab0203ef50dce1149120c247ec3e1bb7b4fd7fc1c1790ae285de6da74c2bcec4ebf4de6423ae719e4cd1004412dfd24
SSDEEP 393216:su4EJVLu58rLUUqC6euQ96MjSluRizWs07ySsuB6xahl7YwbUfIW21nKNXCcZFUe:VHSC9MkW3xahl7PW21nQIbh+N5N
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5898928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

MultiByteToWideChar GetTickCount QueryPerformanceFrequency QueryPerformanceCounter GetModuleHandleW FlushInstructionCache RtlLookupFunctionEntry RtlDeleteFunctionTable InterlockedPushEntrySList InterlockedFlushSList InitializeSListHead GetTickCount64 DuplicateHandle QueueUserAPC WaitForSingleObjectEx SetThreadPriority GetThreadPriority ResumeThread GetCurrentThreadId Sleep TlsAlloc GetCurrentThread CreateThread WaitForMultipleObjectsEx SignalObjectAndWait RtlCaptureContext SetThreadStackGuarantee VirtualQuery GetStdHandle WideCharToMultiByte GetConsoleOutputCP MapViewOfFileEx UnmapViewOfFile GetStringTypeExW SetEvent GetCurrentProcessorNumber GlobalMemoryStatusEx CreateIoCompletionPort PostQueuedCompletionStatus SleepEx GetQueuedCompletionStatus InterlockedPopEntrySList GetCurrentProcessorNumberEx ExitProcess CreateMemoryResourceNotification GetProcessAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx GetLargePageMinimum VirtualUnlock GetLogicalProcessorInformation SetThreadGroupAffinity SetThreadAffinityMask IsProcessInJob QueryInformationJobObject K32GetProcessMemoryInfo VirtualAlloc VirtualFree VirtualProtect SwitchToThread CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer GetFileSize GetEnvironmentVariableW SetEnvironmentVariableW CreateEventW ResetEvent CreateSemaphoreExW ReleaseSemaphore CreateMutexW ReleaseMutex GetThreadContext SuspendThread SetThreadContext GetEnabledXStateFeatures InitializeContext SetXStateFeaturesMask RtlInstallFunctionTableCallback GetSystemDefaultLCID GetUserDefaultLCID RtlUnwind LoadLibraryExW HeapAlloc HeapFree GetProcessHeap HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW FormatMessageW OutputDebugStringA GetACP LCMapStringEx LocalFree VerSetConditionMask VerifyVersionInfoW FindClose GetModuleFileNameW FindNextFileW QueryThreadCycleTime VirtualAllocExNuma GetNumaProcessorNodeEx GetNumaHighestNodeNumber GetLogicalProcessorInformationEx GetThreadGroupAffinity GetSystemTimes GetSystemTimeAsFileTime CreateFileMappingW CreateProcessW GetCPInfo CreateFileW GetFileAttributesExW GetTempPathW GetCurrentDirectoryW FindFirstFileExW GetFullPathNameW OpenProcess LoadLibraryExA OpenEventW ExitThread HeapReAlloc CreateNamedPipeA WaitForMultipleObjects DisconnectNamedPipe CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers MapViewOfFile GetActiveProcessorGroupCount GetSystemTime SetConsoleCtrlHandler GetLocaleInfoEx GetUserDefaultLocaleName RtlAddFunctionTable CreateDirectoryW RemoveDirectoryW GetFileSizeEx LoadLibraryA IsWow64Process InitializeCriticalSectionAndSpinCount AddVectoredExceptionHandler SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCurrentProcessId RaiseFailFastException FreeLibrary RaiseException WaitForSingleObject TlsSetValue TlsGetValue GetSystemInfo IsDebuggerPresent LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection WriteFile GetProcessTimes GetCommandLineW ReadFile SetFilePointer GetProcAddress GetModuleHandleExW SetErrorMode CloseHandle GetCurrentProcess FlushProcessWriteBuffers SetLastError GetLastError OutputDebugStringW RtlRestoreContext DebugBreak DecodePointer GetStringTypeW RtlVirtualUnwind IsProcessorFeaturePresent RtlUnwindEx EncodePointer TlsFree RtlPcToFileHeader InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetExitCodeThread CreateFileMappingA

advapi32

RegGetValueW SetKernelObjectSecurity GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation DeregisterEventSource ReportEventW RegisterEventSourceW RegQueryValueExW RegOpenKeyExW RegCloseKey EventRegister AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW SetThreadToken RevertToSelf OpenThreadToken EventWriteTransfer EventWrite

ole32

CoTaskMemAlloc CoTaskMemFree CoWaitForMultipleHandles IIDFromString CLSIDFromProgID CoGetMarshalSizeMax CoMarshalInterface CoCreateGuid CoGetObjectContext CoRegisterInitializeSpy CoGetContextToken CoGetClassObject CoCreateFreeThreadedMarshaler CreateStreamOnHGlobal StringFromGUID2 CoInitializeEx CoUninitialize CoUnmarshalInterface CoRevokeInitializeSpy CoReleaseMarshalData

oleaut32

SafeArrayAllocData SafeArrayGetElemsize SysStringByteLen SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement LoadRegTypeLi CreateErrorInfo SafeArrayAllocDescriptorEx VarCyFromDec VariantInit VariantClear SafeArraySetRecordInfo VariantChangeType SafeArrayGetVartype LoadTypeLibEx QueryPathOfRegTypeLi SafeArrayDestroy SafeArrayGetLBound SafeArrayGetDim SysAllocStringLen SysStringLen SysAllocString SetErrorInfo GetErrorInfo SysFreeString VariantChangeTypeEx GetRecordInfoFromTypeInfo

user32

MessageBoxW LoadStringW

version

VerQueryValueW GetFileVersionInfoExW GetFileVersionInfoSizeExW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

strncmp wcsncmp iswupper towlower isalpha isdigit wcstok_s strnlen iswascii towupper wcscat_s strcspn wcscpy_s _stricmp strlen isupper strcmp _wcsnicmp _wcsdup wcsncpy_s tolower islower strtok_s isspace _strdup __strncnt strncpy_s strcpy_s wcsncat_s strncat_s strcat_s iswspace wcsnlen _strnicmp _wcsicmp

api-ms-win-crt-stdio-l1-1-0

fwrite __stdio_common_vswprintf_s __p__commode _set_fmode __stdio_common_vsnprintf_s __stdio_common_vfwprintf _flushall _wfopen _wfsopen fseek __stdio_common_vfprintf ftell __stdio_common_vsprintf_s fputws __acrt_iob_func fflush _fileno _dup _setmode setvbuf fputwc _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc fgetpos fgetc fputc __stdio_common_vswprintf fclose fgets __stdio_common_vsscanf fopen fputs __stdio_common_vsnwprintf_s _putws

api-ms-win-crt-runtime-l1-1-0

terminate _errno _beginthreadex abort exit _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _invalid_parameter_noinfo_noreturn _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e _exit _controlfp_s __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo _wcserror

api-ms-win-crt-convert-l1-1-0

atol _ltow_s strtoull _atoi64 strtoul wcstoul _wtoi _wcstoui64 _itow_s

api-ms-win-crt-heap-l1-1-0

calloc free _set_new_mode malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

ceil atanf atan2f atan2 atan asinf asin acosf modff cos powf pow floorf log2 atanh acosh cosf cbrt asinh asinhf ilogbf atanhf cbrtf acoshf log2f fma fmaf fmod cosh coshf modf exp expf _fdopen floor _copysign _copysignf _isnanf __setusermatherr _isnan ceilf fmodf ilogb frexp log log10 log10f logf _finite sin sinf sinh sinhf sqrt sqrtf tan tanf tanh acos tanhf

api-ms-win-crt-time-l1-1-0

_time64 wcsftime _gmtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale _lock_locales _unlock_locales setlocale __pctype_func ___lc_locale_name_func ___lc_codepage_func ___mb_cur_max_func localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _wremove _unlock_file _lock_file

Name

.text

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

271B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

214KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Combo Editor Sexitor by Calina\AlphaFS.lib

IMPHASH 0392634acac147c03d108c2d046e7996
SHA256 58a0b8c13f085a3181fecc5d97cdfe5e35892af6b4b31d79657fc88512bb520d
MD5 b9352fa2d673bf124116ba9e5639956e
SHA1 f511f3b653fc0a7a3e49d1cc58c21c9a53fcf79b
SHA512 eea7bd7ff2023e2239b6d5a5ba96d4ecdab4217ecdd6f7403947aa09b1dd54db533bde3b8ef2256cdb720086754c716842bf98810c135b4d72f281dfe5dd48df
SSDEEP 6144:1PXVt3l07qcbU0ddapOpVXMpUvRz1Kxudx:FFt3lQbU05pm2z1KxY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

115500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Combo Editor Sexitor by Calina\Colorful.Console.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f31d4fd7e729fc6cf4ecab972b6b1ee897918a325b1ca572030966f831e768fb
MD5 5f3d2cfbc21591b8feef1efa3e59a4d0
SHA1 15d1ad963a13b6c8ae28c26e7dc1cc3da2bc3bb8
SHA512 05135188c3b75cf642e4e1e833d01c24d2ce2c2b1ae71b0edf048e453a4716226d7af582365d2f6ab803b4b0fe83ce67d4c39125963fc50d597c30e56ae74a2f
SSDEEP 1536:hLeJYLqthWMjfBiRlijZFgWHdQe9nLClbWG:hxLqtQMv7d9nLqCG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

96090

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\colorful-console\src\Colorful.Console\obj\Debug\net461\Colorful.Console.pdb

Combo Editor Sexitor by Calina\Newtonsoft.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af
MD5 4df6c8781e70c3a4912b5be796e6d337
SHA1 cbc510520fcd85dbc1c82b02e82040702aca9b79
SHA512 964d9813e4d11e1e603e0a9627885c52034b088d0b0dfa5ac0043c27df204e621a2a654445f440ae318e15b1c5fea5c469da9e6a7350a787fef9edf6f0418e5c
SSDEEP 12288:rktg1lrjC8rjICqbwNjR4xq7iiX19K7Df/SoOKQrIB+jfP:rggD7PIEjR4xq7iiXTK7D3So9AIB+jn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Digest

a7:cc:fe:41:40:99:65:07:53:c6:c7:f4:1c:e3:22:5f:f1:9e:7a:db:83:aa:c0:1c:bd:9b:44:a1:54:ff:58:a1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

Chains

Apr 22, 2019

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Serial Number

07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 27, 2018 - Apr 27, 2028

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

Serial Number

0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e

Issuer

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 25, 2018 - Oct 29, 2021

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

672442

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

Combo Editor Sexitor by Calina\Sexitor.exe

IMPHASH 953ddbeaf8260a562016edb32b006967
SHA256 6966e27f091f7a31fffb0e6c44fc12a56fc8f942e96328ac1e726b333a839f3a
MD5 30b901d912687b60320d97fb916afd3d
SHA1 704cba332df8d48eeee9263b880773b806a4eb83
SHA512 a3982810cafa2d1d88903aaef583a2f69b473bc22251cdb682b83ea7fd6d753f213d177aaac916d78f74d01b122f481a61c2c7cbcfc01abc8b7c6892c7bd0e58
SSDEEP 6144:M/iUMZXwnThvjiYeFHDi+DZUdHDgKh7o97cq7o:E6AnhXeFHDHCD7opcq7o
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc HeapFree GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW

version

VerQueryValueW

Combo Editor Sexitor by Calina\Sexitor.pdb

SHA256 f5ddc735ccf5942ae0b2dac19e15988eb13efd9480ea6e589b5917d6872cb089
MD5 4074872048b5a57ffa82a48b1746e0b8
SHA1 049e27cf4ba94a8c783e758486a3b4f9369ca70c
SHA512 b855d94bf282b1b583ea2b3f985178350d6e70c89123231cbbf6e16a9b2bc81dbcc433d36381a797e068659e77f9f78d4f76e3d614efe6e26591cfb02c2b615d
SSDEEP 768:mO1cLxYm49omSSCtA1LXTp7Cn9QudRVX5oKXE:kxYz7CtAhXFm9RdR1
MD5 SHA1 SHA512 SSDEEP

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Combo Editor Sexitor by Calina\TrinitySeal.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ea8e5043fce2ea44dfa01bff4336babc27e12dd0cb8509bbd1f3d1d2f98713b0
MD5 0788cb32d5eb03916c701e0d18e25a74
SHA1 760162267263322208b979b587fa5d65dd997fec
SHA512 875e369ce7a97dc061745e8c3b30099c3771f44b88359e56999fe09649e4d6458d1389d29defad62e4f398d95293a1e698d728390e4419f7409fd01c5e14b4dd
SSDEEP 6144:+Af3+mh/e+Z9f6Vg7yfFi55nyfep86fK5t9iVSHpVgMhX/tXm0jg7aO:BPZ9f6VFfFkykK5yV8pqMhvtXm0OaO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

344074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Combo Editor Sexitor by Calina\WThreads.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bbccee6275024f2609a3f38e8a22641bfa4b22a2e7628bf3d127c06c8d4ee068
MD5 304955c2b674ee9c7be115feeff079a0
SHA1 4d732e2733e521c2369389f073ec9d998b58ba8f
SHA512 ce2895aea1c84422e42c57e2c1b91b4ce8f1b53af1318024b8fcbf1fc1a5bf009776132f721bfc300a0b6ead18fc769c1e65d145820ac3b91ef1c21250dfaff4
SSDEEP 48:65GPylYD75ZlJqy5RX8uIlkxceoM2DTD8f0VNMPpfEv/cE06FCnsixTyEXtaAlag:1Jqy5R+DUYTD8Medmw6FssXOM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11490

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Deos\Desktop\WThreads\obj\Debug\WThreads.pdb

Combo Editor Sexitor by Calina\d3dcompiler_47.cfg

IMPHASH 374527fb65242b051c289078f8099fdd
SHA256 3ad26e1c16b6f49c6136c0c1c02c5943437349a310a6bcc5a8a0f4924a6f4ae4
MD5 26f56121184843056f1d6e6db3f9844b
SHA1 f8d6c767cab3be5e55608cc5abd30a4c383759e9
SHA512 13a0898a6780f474ab4ffe8e46ca0227f03f2c4d26daaf4b61862eb7374a65d887b96a8672f21247e7f3aac4c49cce77521dd1564983b52f8716219aff894b9d
SSDEEP 24576:2m3hIqxIdAtLA0Q9xtPUf0ZOxGI3ffWgR5vuv54Jdhx76g:2gWaW9xthIXWgR5vuv54Jdhx7n
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14356

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar ReadConsoleW ReadFile GetConsoleMode GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency LocalFree GetLocaleInfoEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeSRWLock InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent RaiseException GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW HeapValidate GetSystemInfo CreateThread ExitThread ResumeThread FreeLibraryAndExitThread ExitProcess GetStdHandle WriteFile GetCurrentThread GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler HeapReAlloc HeapSize HeapQueryInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP CreateFileW

winhttp

WinHttpReceiveResponse

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Combo Editor Sexitor by Calina\strip.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9259bf827bdfdde527bcf741d72ed890a9d5b4573e405e29e63caeb355b0f1d4
MD5 93714595cfefec610976eefc2effcf5e
SHA1 3e90981b88d3007ba259d54d89004332c6c53324
SHA512 83741cd5eb677fcd38fa54d11f3a37b79b4030b5b96457746ad20c7afa21d4ca3905efd2ac12623ed7f1d7fcd8a38d199227c05b7fe642e79cf7e7fe1cc1f89f
SSDEEP 3072:Bvel0Ldv7MAb8jaApdmzMsLmDa8EPXOvDcnw2ws4ozMqBl:Be2vwQ8Lp4QsiSw2ws4+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

186974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sexitor.pdb

Fortnite Checker by Burnwood\Fortnite Checker BW.exe

IMPHASH 953ddbeaf8260a562016edb32b006967
SHA256 65bbe881ecad501d055bb6141b112f2e2cba641a542ee1658a778e3f2ad3db23
MD5 47195a1409c12b69ab16e54d7384d7da
SHA1 a118a440006f07c65a5bed614e2f2a0311f59ae8
SHA512 56752d716967d0c9963a2220590e44b6044421631c739c51474007bd8fac55a84a8aa71c984e3a6c495bb195cb21072e8036b6a3f3ddc87cc50747e00ad04c12
SSDEEP 6144:Z/fUyZ+wnOpvjiweFHDi+DZUdHDgKhvo3Wcq7o:igBnyveFHDHCDvoGcq7o
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc HeapFree GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW

version

VerQueryValueW

Fortnite Checker by Burnwood\Fortnite.exe.config

SHA256 ae5e7fa8373b273fad07e0486cebfd88c18f9517ba609c2b8e6534f5d9e53dcb
MD5 da0eed2f114f1288c8de452d5b95596e
SHA1 1cf8a57c6df6c309f373a2114a88b980a49d03e5
SHA512 a2b2f1cd8a772aa3ef074864dd1ce8a37fdb2a1a811b476dfb360f1c71fc787560e9f188916e2c73b290eda74a56251ddd8ef85dd462515df12d2e073da9cf38
MD5 SHA1 SHA512

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Fortnite Checker by Burnwood\bin32.bin

IMPHASH 0392634acac147c03d108c2d046e7996
SHA256 58a0b8c13f085a3181fecc5d97cdfe5e35892af6b4b31d79657fc88512bb520d
MD5 b9352fa2d673bf124116ba9e5639956e
SHA1 f511f3b653fc0a7a3e49d1cc58c21c9a53fcf79b
SHA512 eea7bd7ff2023e2239b6d5a5ba96d4ecdab4217ecdd6f7403947aa09b1dd54db533bde3b8ef2256cdb720086754c716842bf98810c135b4d72f281dfe5dd48df
SSDEEP 6144:1PXVt3l07qcbU0ddapOpVXMpUvRz1Kxudx:FFt3lQbU05pm2z1KxY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

115500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Fortnite Checker by Burnwood\database32.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d6290b0adb56d7519214be9f40c8f12978fab6db11192a899521ed88dcde5827
MD5 fea57faef28d8ecc9e304aeed30d7865
SHA1 086c05ec752c450cb1f55b23b93a0d9031e222b4
SHA512 873b1f42e0ca0ba55eaca3fdee22a181cd20fd241acdc781e5773e4676fc17d7b96ed651af1ba4ccbd91c0234314206440e744661592865d56930d212a376211
SSDEEP 768:xOI5FfeJnKKyJLRBdWdKuv4nlui5FcuXW6V:/FfeJnpyl3cEW6V
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

39790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Fortnite Checker by Burnwood\libcef.lib

IMPHASH 374527fb65242b051c289078f8099fdd
SHA256 3ad26e1c16b6f49c6136c0c1c02c5943437349a310a6bcc5a8a0f4924a6f4ae4
MD5 26f56121184843056f1d6e6db3f9844b
SHA1 f8d6c767cab3be5e55608cc5abd30a4c383759e9
SHA512 13a0898a6780f474ab4ffe8e46ca0227f03f2c4d26daaf4b61862eb7374a65d887b96a8672f21247e7f3aac4c49cce77521dd1564983b52f8716219aff894b9d
SSDEEP 24576:2m3hIqxIdAtLA0Q9xtPUf0ZOxGI3ffWgR5vuv54Jdhx76g:2gWaW9xthIXWgR5vuv54Jdhx7n
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14356

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar ReadConsoleW ReadFile GetConsoleMode GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency LocalFree GetLocaleInfoEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeSRWLock InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent RaiseException GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW HeapValidate GetSystemInfo CreateThread ExitThread ResumeThread FreeLibraryAndExitThread ExitProcess GetStdHandle WriteFile GetCurrentThread GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler HeapReAlloc HeapSize HeapQueryInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP CreateFileW

winhttp

WinHttpReceiveResponse

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Fortnite Checker by Burnwood\xNet-Ameliorated.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 16ea0eab1ffe6b3b05abf1b04baa7c2695885795c5bfecb6cfcfa595a0fa7b30
MD5 44d7396d8b6fbd8f1e9ff4d0278bb767
SHA1 7c8dc050381d2e19b989943f961fee45bd225b69
SHA512 320573c76b448b6f625917d26cec738c94431d274e340a9a0ac5401535a75faa9ebb65616fd23a069de39e4634baf79a67527eccf7bbd197e8f3cb823ec4d93c
SSDEEP 1536:CpGjP8+k8PDYivFAS537WYRwFH1+KZ3etqp:CpwJgYAScYRwFH1+KZ3etqp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\SEEZORR\Desktop\xNet-Ameliorated-master\xNet-Ameliorated\xNet-Ameliorated\obj\Debug\xNet-Ameliorated.pdb

Fortnite Skinner Checker v1.9.1\Bunifu_UI_v1.5.3.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

247342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Fortnite Skinner Checker v1.9.1\Fort Skinner.exe

IMPHASH 953ddbeaf8260a562016edb32b006967
SHA256 7f48cdcc82a6536aebfaa29962b2082aace573a7235daa77c79f787e5f1617c1
MD5 8daf5400fe76d53f1868391b4942814f
SHA1 9a9a8eaf7a7cd90325feb62fea41a9edab3c94b8
SHA512 2e232fef7510aa608dde4e16e1fb26c9a85234bcf6aee67df0656ab0f4b1e40a9c5489fb15844f002ddecfde74a3a82f0a91d2a37c3d3e7f0d06d4c200802934
SSDEEP 6144:1/TUKZmwn55vjiieFHDi+DZUdHDgKhnoUvcq7o:6IJn/NeFHDHCDno+cq7o
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc HeapFree GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW

version

VerQueryValueW

Fortnite Skinner Checker v1.9.1\bin32.cfg

SHA256 dcf19001c30cde78c5d66aa5df797d6be59a80b2254bdda6468565f0abf1b217
MD5 7de7ab21c58856034ac8baa72760dec8
SHA1 7a45fa73249ea210e7d61b5bf0e23ed6581410f2
SHA512 bf1573e3149fee2ea572bfeb9d74b9c8bd3f886d96c1c749cdbe4655f86b85b0a6c67d3e05bd86528f6f9b84fa31a13f822d16cdbdc28848b82613260a6a0799
SSDEEP 6144:PBhv5UHw1r5931p0dcDM5wkFTYrNeSpBYEzW57HWCZjrTs4xsS6vTNj9I39tg0tp:ZhvCHwjB7NeSpBYES57HWCZjrTs4xsST
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Fortnite Skinner Checker v1.9.1\libGLESV2.dll

IMPHASH 0392634acac147c03d108c2d046e7996
SHA256 58a0b8c13f085a3181fecc5d97cdfe5e35892af6b4b31d79657fc88512bb520d
MD5 b9352fa2d673bf124116ba9e5639956e
SHA1 f511f3b653fc0a7a3e49d1cc58c21c9a53fcf79b
SHA512 eea7bd7ff2023e2239b6d5a5ba96d4ecdab4217ecdd6f7403947aa09b1dd54db533bde3b8ef2256cdb720086754c716842bf98810c135b4d72f281dfe5dd48df
SSDEEP 6144:1PXVt3l07qcbU0ddapOpVXMpUvRz1Kxudx:FFt3lQbU05pm2z1KxY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

115500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Fortnite Skinner Checker v1.9.1\libcef.lib

IMPHASH 374527fb65242b051c289078f8099fdd
SHA256 3ad26e1c16b6f49c6136c0c1c02c5943437349a310a6bcc5a8a0f4924a6f4ae4
MD5 26f56121184843056f1d6e6db3f9844b
SHA1 f8d6c767cab3be5e55608cc5abd30a4c383759e9
SHA512 13a0898a6780f474ab4ffe8e46ca0227f03f2c4d26daaf4b61862eb7374a65d887b96a8672f21247e7f3aac4c49cce77521dd1564983b52f8716219aff894b9d
SSDEEP 24576:2m3hIqxIdAtLA0Q9xtPUf0ZOxGI3ffWgR5vuv54Jdhx76g:2gWaW9xthIXWgR5vuv54Jdhx7n
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14356

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar ReadConsoleW ReadFile GetConsoleMode GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency LocalFree GetLocaleInfoEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeSRWLock InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent RaiseException GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW HeapValidate GetSystemInfo CreateThread ExitThread ResumeThread FreeLibraryAndExitThread ExitProcess GetStdHandle WriteFile GetCurrentThread GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler HeapReAlloc HeapSize HeapQueryInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP CreateFileW

winhttp

WinHttpReceiveResponse

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Fortnite Skinner Checker v1.9.1\xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cc949931ef9533adced83f3d58862e9732e5db7ad17b5fd4cb9d209a99edb592
MD5 ac1dceddbc66a1ab7915ac9931f0cfec
SHA1 22ce2ec96192a520a2a76a0fa272656c77f1041a
SHA512 3906b3b7f8874bfd79f94e945d857dbc83ec89ed73ac13d49790c7fc4eed5c7e98c99c32ffc4a05795da9981c3163978c7f84a54298e94420e365c395392b3f9
SSDEEP 3072:PqCUxh+3H0MznY3wihz0YmcTqnV+xnEdU:PqCUxhfMUTqnV+xnEd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

118882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Developper\Contacts\Downloads\Desktop\xNet-master\xNet-master\obj\Debug\xNet.pdb

Fortnite Tracker Coded by LilToba\Colorful.Console.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 59a3696950ac3525e31cdd26727dabd9fecd2e1bdc1c47c370d4b04420592436
MD5 9f6ce7ff934fb2e786ced3516705efad
SHA1 6e7bcc7b8a5d0e2e46c15a8e0f0c76129d170b61
SHA512 d61674649fa9a091aa379fe1c227e42eb6cfd3226ad1e26ef089b747fce98b96f4eb78d736c24d6f5f60c4980bb1043ec0f1ef0d69f126870448129a47e22578
SSDEEP 1536:dJ1J4aE966w/2DtgNpWFbCagAHM9uTC/bR:dC796R/ObCagAs9uTgV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

96594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\colorful-console\src\Colorful.Console\obj\Debug\net461\Colorful.Console.pdb

Fortnite Tracker Coded by LilToba\FORTNITE TRACKER.exe

IMPHASH 953ddbeaf8260a562016edb32b006967
SHA256 8329d1ea7a47c102e6b6b95a305088cc6985d0bf6d896478a66cf2a4e5a5ca78
MD5 2a7d49278296d3882c71658c0c78cd8f
SHA1 9805da301ea170e5bc7036c4c7740d2055762ca2
SHA512 f6e74f31501060df226770127903a133afec057b4b9e0f9cd1dca0d7d30f4ce30d03949c9cdf4bd9afca3fc0f07bede09603e6163b4267bd2925d7c51825aa3c
SSDEEP 6144:L/FUSZkwnNhvjireFHDi+DZUdHDgKhboGjA0Icq7o:iA3n78eFHDHCDbo49Icq7o
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc HeapFree GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW

version

VerQueryValueW

Fortnite Tracker Coded by LilToba\FORTNITE TRACKER.exe.config

SHA256 47e5a0f101af4151d7f13d2d6bfa9b847d5b5e4a98d1f4674b7c015772746cdf
MD5 9dbad5517b46f41dbb0d8780b20ab87e
SHA1 ef6aef0b1ea5d01b6e088a8bf2f429773c04ba5e
SHA512 43825f5c26c54e1fc5bffcce30caad1449a28c0c9a9432e9ce17d255f8bf6057c1a1002d9471e5b654ab1de08fb6eabf96302cdb3e0fb4b63ba0ff186e903be8
MD5 SHA1 SHA512

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Fortnite Tracker Coded by LilToba\FORTNITE TRACKER.pdb

SHA256 0c493768cc2c2d177a9e1145454dead08a03a9ab0bb00b835822c0e54e22da05
MD5 1ac6e032e19e4d94a3018c85124528ec
SHA1 81c78312ecc0da9e63887acd4f3aa725bd93f63b
SHA512 e944c2e4ba95412db3f769386362318848c625181884ebe4e6c050c764d5aa16408c603411783be2f97833424d42d1faa2ccc0f98a6f9c42070cc5bebad67c93
SSDEEP 192:TP2AP8SAPtAP8SAPY919LOY9e/b2c4PuUKOr989LY9uv9Mu9LY99:j52G2d/bH4
MD5 SHA1 SHA512 SSDEEP

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Fortnite Tracker Coded by LilToba\Leaf.xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 de9aea105f31f3541cbc5c460b0160d0689a2872d80748ca1456e6e223f0a4aa
MD5 ea87f37e78fb9af4bf805f6e958f68f4
SHA1 89662fed195d7b9d65ab7ba8605a3cd953f2b06a
SHA512 c56bd03142258c6dcb712d1352d2548a055fbb726ee200949d847cb2d23d9c52442b1435be0df0bf355701a2c1a3c47cd05b96972501f457d2d401501d33d83a
SSDEEP 3072:gE3OJDHIfFLlL3pPiqhcLS/oZhttaMBM2cid:gHWZxJiqO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

138110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\leaf-xnet\Leaf.xNet\obj\Release\net45\Leaf.xNet.pdb

Fortnite Tracker Coded by LilToba\Leaf.xNet.xml

SHA256 52631a555c91918bf0922474667dc6bb3576f1eaece34480ae8addabcc7d0f08
MD5 b033607c30c9e7a25ba3e478b0a00e18
SHA1 f5d51a5a92be9f5dc7b355ce08f6476d57017bb9
SHA512 44f6641e785ed352fb0b68b82a745a58e59de03513314baaa2b1be3ae2162655747ffb9590ddff4a081df85a325b30670c1351e6f0b238e8eac5fba6e8808d12
SSDEEP 6144:qad+PiKgyxxE15ywFLOpXDKwEwXAwTeBufMJ3fMVd4PMvMP35M93P:qaoPiKgy+ywFLOt+X+AceB6w3fkd4Ps7
MD5 SHA1 SHA512 SSDEEP

polyglot

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Fortnite Tracker Coded by LilToba\alocal.cfg

IMPHASH 0392634acac147c03d108c2d046e7996
SHA256 58a0b8c13f085a3181fecc5d97cdfe5e35892af6b4b31d79657fc88512bb520d
MD5 b9352fa2d673bf124116ba9e5639956e
SHA1 f511f3b653fc0a7a3e49d1cc58c21c9a53fcf79b
SHA512 eea7bd7ff2023e2239b6d5a5ba96d4ecdab4217ecdd6f7403947aa09b1dd54db533bde3b8ef2256cdb720086754c716842bf98810c135b4d72f281dfe5dd48df
SSDEEP 6144:1PXVt3l07qcbU0ddapOpVXMpUvRz1Kxudx:FFt3lQbU05pm2z1KxY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

115500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Fortnite Tracker Coded by LilToba\api32.lib

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b4944579c04fa10f787d735a85b241519ab0094ff0ea69528bffa8303fad2c5e
MD5 0c59e3357a0f1218a3ef23690862678e
SHA1 724b2ff8b3e173f3a27fc407de617048dee66767
SHA512 4927adcdfc47aa8fc0a1b3f33c9e34f839c63101be27bb7cd5007b1832fab599fac5ee8d1f3adc673f3ff48e7d9c56a78c9aeebfcfcfb6daa8b017bcd2bfb6ac
SSDEEP 384:WupJEsolZCs0HG5Kzls4gxB5AebgrK0DfljHI8gxsRmheJZBX96dyj9u:Wur8lZB0HGUuP5Aog+0zlHExo3JZnv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Arshian\source\repos\FORTNITE FRANCE TRACKERZ\FORTNITE FRANCE TRACKERZ\obj\Debug\FORTNITE FRANCE TRACKER.pdb

Fortnite Tracker Coded by LilToba\mcl64.bin

IMPHASH 374527fb65242b051c289078f8099fdd
SHA256 3ad26e1c16b6f49c6136c0c1c02c5943437349a310a6bcc5a8a0f4924a6f4ae4
MD5 26f56121184843056f1d6e6db3f9844b
SHA1 f8d6c767cab3be5e55608cc5abd30a4c383759e9
SHA512 13a0898a6780f474ab4ffe8e46ca0227f03f2c4d26daaf4b61862eb7374a65d887b96a8672f21247e7f3aac4c49cce77521dd1564983b52f8716219aff894b9d
SSDEEP 24576:2m3hIqxIdAtLA0Q9xtPUf0ZOxGI3ffWgR5vuv54Jdhx76g:2gWaW9xthIXWgR5vuv54Jdhx7n
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14356

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar ReadConsoleW ReadFile GetConsoleMode GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency LocalFree GetLocaleInfoEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeSRWLock InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent RaiseException GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW HeapValidate GetSystemInfo CreateThread ExitThread ResumeThread FreeLibraryAndExitThread ExitProcess GetStdHandle WriteFile GetCurrentThread GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler HeapReAlloc HeapSize HeapQueryInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP CreateFileW

winhttp

WinHttpReceiveResponse

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

TCMsSkin Checker - Fortnite Tool\Bunifu_UI_v1.5.3.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
MD5 2ecb51ab00c5f340380ecf849291dbcf
SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

247342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

TCMsSkin Checker - Fortnite Tool\ElasticEmail.WebApiClient.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fcb20d1d58e61dd42a7fb7b36073c8e06882b7986f0ce1db9986a7ddac8b2bee
MD5 b2d7e5f0aeff90ae193649be10287a4c
SHA1 fd1c71ed97432425053ce8a1bfb28b506596c21a
SHA512 a7e658bcc019ec4dbb1e39d81a964d0ffef5dd6765b34a721f2954118e11c5ddc22c396cd1615c9fbb1e6dc20a56cfe0c975044eff1dce86dfa49f2f7d48794a
SSDEEP 24576:4/jFUpDhGwvE+mHDKo/ndVWySLkiZjcYvzOf3Fnq/i+3HYKr5sgfWfVV4hpg/U:+m9hGbJwLkiZjcYvSRq6+IKr5XLiU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

2209070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

TCMsSkin Checker - Fortnite Tool\HazardEdit.Tools.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f4c2d7627c2637d1966d80e83632f99ad6abf036d4a7fc5cf7a23c7e95861034
MD5 5a615646e6d5bb2594347caed5da0f54
SHA1 afd504c55e30c19d73052748810de108cc271f84
SHA512 a4922b8f8721cdd2b104b08424e5cfcfe5564361fa0c6b38952815611528dafa6b78ec2d24b7254a2249ce71aa973749f20292f79313b3237d31e4fb8112ee02
SSDEEP 49152:k9hGbJwLkiZjcYvSRq6+IKr5XDIth01wZ3pYAHbFc1COI0/RRC:k9OuQqIIwb7bFc1COZ7C
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1625006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

TCMsSkin Checker - Fortnite Tool\HtmlAgilityPack.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8019602af8f267c4e09489b3d80b514b2498a495d0fa3d7d74c2eb86b1e25781
MD5 45223650cff5e89e56c1bdd4cb7fb786
SHA1 110bee36ca7afc5fe404b82d5fed5de482758cd2
SHA512 23d75f48b21b08650d081a6b081efc35d0ec4132f9400537e1813dd53fa0a51d735e8935b914ce7cdc38d271b08f1bd9585e346708cdedd42e2753202d6efb20
SSDEEP 1536:3trxCwY9I/QndjSOXAiW4XO2TSBVt4l6Y5lF4cglELWPGr1Y7KmYDw5yz8S:zQIInsOQWX+BVM6YycAww5K8S
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

120742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Jonathan\Desktop\Z\zzzproject\HtmlAgilityPack\HtmlAgilityPack\obj\Release\HtmlAgilityPack.pdb

TCMsSkin Checker - Fortnite Tool\MailKit.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 786e2126d22afabcb42d57cf07760690c18c21007c93abaed0cb4c7fe2044eb6
MD5 be99f9896236c6106887959541d22f05
SHA1 12fc2ac3bda1b2023bed12320cd3a140413a5850
SHA512 dd995323b28ef7a3a492f5fa966d278a4495bd5d5703fc9bd066d665ceafbb57851429cca80e89aba4c09598d786206e1f7efddd44c185bd71b825958e4de330
SSDEEP 6144:b7GoLbF2oxbF/j/FFYgIQ0APJAO62mGQ0HhWt5ZMdYJwjvinKzGQ1kNnav2P0hsv:bJYsbqhGhHhh3jvinKqZ4earo88XA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

673450

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

TCMsSkin Checker - Fortnite Tool\Newtonsoft.Json.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 973fd70ce48e5ac433a101b42871680c51e2feba2aeec3d400dea4115af3a278
MD5 f33cbe589b769956284868104686cc2d
SHA1 2fb0be100de03680fc4309c9fa5a29e69397a980
SHA512 ffd65f6487bc71c967abcf90a666080c67b8db010d5282d2060c9d87a9828519a14f5d3a6fe76d81e1d3251c2104a2e9e6186af0effd5f331b1342682811ebf4
SSDEEP 12288:WvS56CuBAXYxeeNvWHc3oY2osSeBTdb+:K07SAIxOhAVeBTdS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

658686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb

TCMsSkin Checker - Fortnite Tool\TCMFortniteTool.exe

IMPHASH 953ddbeaf8260a562016edb32b006967
SHA256 b32a0013e6000d2b235f583ae6e00c93b73965193c57cab3519c51686718fb20
MD5 d674e4ccb61d2d786f2d02cd7bf78433
SHA1 a449e823d84c910a9b5f47ab3f4c5d9044d0115e
SHA512 6d7e1c602d4f2765462fb8d14982d0ebb8044c75bffd61542f0eaed43f83478e9398f70acd486145e8d9a3378f4227f9ed410fef80ee615aac1e32a9cf76ae76
SSDEEP 12288:KGlnjleFHDHCDjo8JbLQ/uUVoMDV2MFScq7o:Lj4FHDiDjfCNVB2KScA
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar LoadLibraryExA CreateFileW CloseHandle WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc HeapFree GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW

version

VerQueryValueW

TCMsSkin Checker - Fortnite Tool\api32.lib

IMPHASH 0392634acac147c03d108c2d046e7996
SHA256 58a0b8c13f085a3181fecc5d97cdfe5e35892af6b4b31d79657fc88512bb520d
MD5 b9352fa2d673bf124116ba9e5639956e
SHA1 f511f3b653fc0a7a3e49d1cc58c21c9a53fcf79b
SHA512 eea7bd7ff2023e2239b6d5a5ba96d4ecdab4217ecdd6f7403947aa09b1dd54db533bde3b8ef2256cdb720086754c716842bf98810c135b4d72f281dfe5dd48df
SSDEEP 6144:1PXVt3l07qcbU0ddapOpVXMpUvRz1Kxudx:FFt3lQbU05pm2z1KxY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

115500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

TCMsSkin Checker - Fortnite Tool\libcef.lib

IMPHASH 374527fb65242b051c289078f8099fdd
SHA256 3ad26e1c16b6f49c6136c0c1c02c5943437349a310a6bcc5a8a0f4924a6f4ae4
MD5 26f56121184843056f1d6e6db3f9844b
SHA1 f8d6c767cab3be5e55608cc5abd30a4c383759e9
SHA512 13a0898a6780f474ab4ffe8e46ca0227f03f2c4d26daaf4b61862eb7374a65d887b96a8672f21247e7f3aac4c49cce77521dd1564983b52f8716219aff894b9d
SSDEEP 24576:2m3hIqxIdAtLA0Q9xtPUf0ZOxGI3ffWgR5vuv54Jdhx76g:2gWaW9xthIXWgR5vuv54Jdhx7n
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14356

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA MultiByteToWideChar ReadConsoleW ReadFile GetConsoleMode GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA EncodePointer DecodePointer CompareStringEx GetCPInfo WideCharToMultiByte LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency LocalFree GetLocaleInfoEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeSRWLock InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent RaiseException GetStartupInfoW GetCurrentProcessId InitializeSListHead GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW HeapValidate GetSystemInfo CreateThread ExitThread ResumeThread FreeLibraryAndExitThread ExitProcess GetStdHandle WriteFile GetCurrentThread GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler HeapReAlloc HeapSize HeapQueryInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetConsoleOutputCP CreateFileW

winhttp

WinHttpReceiveResponse

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

TCMsSkin Checker - Fortnite Tool\libexec.bin

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 061588df54483aad90ad5d4c21670126de7627fae0ef74853d1bab6f604bb633
MD5 1891c66d1e608fa5d9714c1f77d93b67
SHA1 31babb771070135b5511d88c5c23febd74a830a0
SHA512 08f4cdb161654a1fab8eb4e29cb46787e38462d3e78560110e9ad7a783878dc9ab08dddcef457d1675bd21fb2b9fab3b1f4420ee23408c09bc61d49444167e13
SSDEEP 49152:RWf4KGf4Kdf4KN1Caf4Kdf4Kr9hGbJwLkiZjcYvSRq6+IKr5XHjwd8fuEdf4K:RWALA6AcAMAc9OuQCjXHdA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6201518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

TCMsSkin Checker - Fortnite Tool\xNet.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6c7ec4cc31a2ce0b97703b7a42e3448e9b87d96dda12761ca24d8787ac27cff1
MD5 158defd55a804aa8d4d67bfdf7a4af9c
SHA1 9dd41914fa181cb5225e593373f7dca062d7af0b
SHA512 e98062b3b035d7d87c3457621c5ffc0aefed490544739219c4f4cafc3e7de248f1cf91edb3564e49d406f9fcaf314838d33b2ddd7e3b1a1751e5819b9ab798d6
SSDEEP 3072:0IALHSH7PhqKnUqnV+xnEdSCo5E/awN5lRd0YjJ0:07LyIqnV+xnEdEmf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

112190

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

Fortnite-Tools-Pack.zip

AIO Giftcard Generator by Acquire\AIOgenerator by Acquire.exe

kernel32

version

generic

AIO Giftcard Generator by Acquire\Qt5CoreVBox.bin

kernel32

winhttp

generic

AIO Giftcard Generator by Acquire\bin32.lib

kernel32

generic

AIO Giftcard Generator by Acquire\core.cfg

kernel32

advapi32

ole32

oleaut32

user32

version

shell32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic

Combo Editor Sexitor by Calina\AlphaFS.lib

kernel32

generic

Combo Editor Sexitor by Calina\Colorful.Console.dll

mscoree

dotnet

Combo Editor Sexitor by Calina\Newtonsoft.Json.dll

mscoree

dotnet

Combo Editor Sexitor by Calina\Sexitor.exe

kernel32

version

generic

Combo Editor Sexitor by Calina\Sexitor.pdb

Combo Editor Sexitor by Calina\TrinitySeal.dll

mscoree

dotnet

Combo Editor Sexitor by Calina\WThreads.dll

mscoree

dotnet

Combo Editor Sexitor by Calina\d3dcompiler_47.cfg

kernel32

winhttp

generic

Combo Editor Sexitor by Calina\strip.dll

mscoree

dotnet

Fortnite Checker by Burnwood\Fortnite Checker BW.exe

kernel32

version

generic

Fortnite Checker by Burnwood\Fortnite.exe.config

Fortnite Checker by Burnwood\bin32.bin

kernel32

generic

Fortnite Checker by Burnwood\database32.dll

mscoree

dotnet

Fortnite Checker by Burnwood\libcef.lib

kernel32

winhttp

generic

Fortnite Checker by Burnwood\xNet-Ameliorated.dll

mscoree