Warden Dev/Researchers.
I know you read this section, so it's going to be fun to publicly humiliate you!
On the PTR, you recently added scans to detect WoWMimic using your RVA hashing routine. You should have tested this as WoWMimic nulls it's PE Header. I mean, come on; really guys?
Why did you not just calculate the RVA offset based on the .rdata section so that no matter if they unlink their module/null the PE Header, you would still find them?
Amateur work ladies. Very unimpressed.