504116fe560f21188b73ac17b6388f38

resource	yara_rule
static1/unpack001/GongShaFuZhu13/【x1】攻沙辅助/xgs/dm.dll	upx

resource	yara_rule
static1/unpack001/GongShaFuZhu13/【x1】攻沙辅助/plugin/REMOTEANSWER_JDYOU.DLL	vmprotect

resource
unpack001/GongShaFuZhu13/【x1】攻沙辅助/plugin/FILE.DLL
unpack001/GongShaFuZhu13/【x1】攻沙辅助/plugin/MSG.DLL
unpack001/GongShaFuZhu13/【x1】攻沙辅助/plugin/READ.DLL
unpack001/GongShaFuZhu13/【x1】攻沙辅助/plugin/REGDLL.DLL
unpack001/GongShaFuZhu13/【x1】攻沙辅助/plugin/REMOTEANSWER_JDYOU.DLL
unpack001/GongShaFuZhu13/【x1】攻沙辅助/plugin/SGUOBROWSER.DLL
unpack001/GongShaFuZhu13/【x1】攻沙辅助/plugin/WEBOPERATION.DLL
unpack001/GongShaFuZhu13/【x1】攻沙辅助/plugin/WINDOW.DLL
unpack001/GongShaFuZhu13/【x1】攻沙辅助/xgs/RegDll.dll
unpack001/GongShaFuZhu13/【x1】攻沙辅助/xgs/dm.dll
unpack001/GongShaFuZhu13/【x1】攻沙辅助/辅助浏览器-Browser.exe

SHA256 ca493000c5eaff8432d6e2f3fc11a35fc019f1ff30806c661fba26e9941b5fb7
MD5 504116fe560f21188b73ac17b6388f38
SHA1 0d7e3c6961e4d5e39f689641eb3c981bc5e0958d
SHA512 9a1db4b2f610c3c4c75ac0ced7c273b6cd199df68e57b8a94f7faace0239f1e353ec2549313789f94a4f1f550082f90dca2b782f1c9ebb26daadb18373aedef1
SSDEEP 196608:Kda1SgE1FyNhBQBsNANhiDajuvtdQlLCN3R2pP0iQ/p/Oh:UalBQyNAG2SbN34syh
MD5 SHA1 SHA512 SSDEEP

GongShaFuZhu13/【x1】攻沙辅助/cfgdll.dll

IMPHASH e3493c33b4da4c9e132164b491c5d2cc
SHA256 767b2e735693a9455a23b19e7a94643fd6095fa1158cbe22f612d657ebbb670d
MD5 929f56b46242fa68a616374a5403689b
SHA1 45b4ade1f0cc2bf13e74d9801eee5c7abee3c3b2
SHA512 81c69649efff9d320533bcb3256d42c671877e1d48f9df99134c514aa2d888d11ded13b9d3447949881513e376cf4644b41b997cad2a9ffb51f4f45ca3cdc641
SSDEEP 768:eaEHTGEBv6OuJjxqbhJKOBGxoVlbP2nP8oMRIEw8q:eHHTG7OuJjsKOBlVh+EoMjw8q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

48:46:3f:61:18:dc:9c:9b:07:6e:09:32:5b:4b:d9:b3:e1:3c:ed:49

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=福州创意嘉和软件有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=技术中心,O=福州创意嘉和软件有限公司,L=FuZhou,ST=FuJian,C=CN

Chains

Jan 31, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=福州创意嘉和软件有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=技术中心,O=福州创意嘉和软件有限公司,L=FuZhou,ST=FuJian,C=CN

Serial Number

2d:af:fb:7a:20:58:8a:40:87:11:b7:98:fd:3d:fc:f8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 7, 2013 - Jan 7, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

6788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GongShaFuZhu13/【x1】攻沙辅助/plugin/FILE.DLL

IMPHASH a10a0592e6925a16bb3205010b141edd
SHA256 c9515d3d0e549e978fdd8ae762bd7b73f1ec1dd49c058ad9cd4537902db87670
MD5 1b12290100f56cf13ac7bd631adebe7d
SHA1 d996c99e4ccb91876e9da397ec547aebb83c0c94
SHA512 cd0e417f7ef5d1749f78bded6ac77bcc15aa72268bbb2ec8322f964a11d70f0ecfaaa4ecc10d13a2df743329982bd88fdb8f7f785a50dad33d112e27e372b815
SSDEEP 384:Ik5Y5bNAguM1vVOiignzJjaJ5htgk0jDrmq5pp/xI3eYP5zo9Y:I4Y5pZVLiQJmltgrjDrmq5/K3ce
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10666

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord533 ord6407 ord2818 ord4278 ord536 ord858 ord535 ord2915 ord6662 ord5194 ord5465 ord924 ord939 ord1997 ord798 ord6354 ord941 ord1131 ord1132 ord5500 ord815 ord561 ord3738 ord3081 ord3262 ord354 ord5186 ord3318 ord1979 ord665 ord3790 ord6153 ord537 ord940 ord540 ord823 ord825 ord860 ord1601 ord800 ord743 ord446 ord2486 ord4226 ord5714 ord5289 ord5307 ord4698 ord4079 ord5302 ord269 ord826 ord600 ord1578 ord6467 ord1255 ord1253 ord1570 ord1197 ord1243 ord342 ord1182 ord1577 ord1168 ord1575 ord1176 ord1116 ord6877 ord859 ord1799 ord2982 ord3147 ord3259 ord4465 ord3136 ord2985 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4424 ord614 ord1206 ord2623 ord290 ord1223 ord4622 ord4003 ord4274 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300

msvcrt

_tzset atoi sscanf __CxxFrameHandler _mkdir ??1type_info@@UAE@XZ _adjust_fdiv malloc _initterm free _onexit __dllonexit wcstombs _timezone strrchr strchr rename

kernel32

CloseHandle CreateFileA WriteFile ReadFile SetFilePointer SystemTimeToFileTime OpenFile SetFileTime MoveFileA DeleteFileA GetFileAttributesA CopyFileA GetPrivateProfileStringA WritePrivateProfileStringA GetModuleFileNameA IsDebuggerPresent LocalFree LocalAlloc _lclose

comdlg32

GetOpenFileNameA

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHFileOperationA

advapi32

RegSetValueExA RegCloseKey RegOpenKeyA

ole32

StringFromCLSID CoTaskMemFree

GongShaFuZhu13/【x1】攻沙辅助/plugin/MSG.DLL

IMPHASH 822d3ecf48a41b86df18a99da942259e
SHA256 417172e573177c921715ade25a63909ca986e11e16c3858ec0ef327c3d65355b
MD5 3f92f9c3ac33dcf97741eb937c3e7c44
SHA1 8c950edebb7749dc5939fd2841a1a81d2809ed68
SHA512 5c32833e48dd6e4f8b0073d7d23e0342e00d94e460bfd83d51087dafbf0706f7e255c1458155690b223310cb4b0a6bd3afbccdedc9ea13ecacc6ff6e28eb6a23
SSDEEP 384:GEkt05A3HUNImsuw0h/g2WMbMFGc6DJz9u9IFy9ILiTnuozMh+rRL+GhD8sQI7Nm:rA30NIfobNn9uBDT5RrB+GhD8yK1
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord268 ord389 ord922 ord4204 ord2818 ord2915 ord860 ord940 ord5207 ord4203 ord825 ord1567 ord859 ord690 ord743 ord446 ord2486 ord4226 ord6354 ord1131 ord1132 ord5500 ord815 ord561 ord3738 ord823 ord858 ord536 ord941 ord939 ord540 ord535 ord3081 ord3262 ord5714 ord5289 ord5307 ord800 ord537 ord4698 ord4079 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord4003 ord1601 ord4622 ord1223 ord290 ord2623 ord1206 ord614 ord4424 ord4080 ord3079 ord3825 ord269 ord826 ord600 ord1578 ord6467 ord1255 ord1253 ord1570 ord1197 ord1243 ord342 ord1182 ord1577 ord1168 ord1575 ord1176 ord1116 ord6877 ord1799 ord2982 ord3147 ord3259 ord4465 ord3136 ord2985 ord2976 ord3830 ord3831

msvcrt

floor __CxxFrameHandler _ftol strtoul _mbscmp rand srand _adjust_fdiv malloc _initterm free ??1type_info@@UAE@XZ _onexit atoi strrchr strchr wcstombs __dllonexit sprintf fclose strncpy

kernel32

GetModuleFileNameA LocalAlloc LocalFree GetTickCount WritePrivateProfileStringA GetPrivateProfileStringA TlsGetValue GetEnvironmentVariableA IsDebuggerPresent

user32

ReleaseDC GetDC DrawTextA InvalidateRect

gdi32

SetTextColor

shell32

Shell_NotifyIconA

msvcp60

??_8?$basic_ifstream@DU?$char_traits@D@std@@@std@@7B@ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0locale@std@@QAE@XZ ??_7?$basic_filebuf@DU?$char_traits@D@std@@@std@@6B@ ?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z ??_7?$basic_ifstream@DU?$char_traits@D@std@@@std@@6B@ ?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ ??1locale@std@@QAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1ios_base@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?_Stinit@?1??_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@23@@Z@4HA ?clear@ios_base@std@@QAEXH_N@Z

advapi32

RegCloseKey RegOpenKeyA RegSetValueExA

ole32

StringFromCLSID CoTaskMemFree CoCreateInstance CLSIDFromProgID

oleaut32

VariantClear

GongShaFuZhu13/【x1】攻沙辅助/plugin/READ.DLL

IMPHASH 82690bf7a1d693113767fa30f0bfc82b
SHA256 1b0d6b44500e8fd35eed25b6951689e32b69dfc722459dcad71c252d2117dfae
MD5 daa9fd7d53682402007b0c23d53d8388
SHA1 4e2fe5e848d1c45896d5c7ed9b910c511c60c5d2
SHA512 57bf5971b2ad33aa3d8b62184bd43e09bf40d0c798e7455438d36e947f55c4cfd1108555994b84d57dbff7d88c853d5541c9e25ca6ee25f0d755cbab1ea396f3
SSDEEP 24576:Am3S712XoymTONjtHmT6klfan//UbU9Gz:H1jtM+/Ubhz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

699890

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

iphlpapi

GetAdaptersInfo

winmm

waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose waveOutGetNumDevs waveOutOpen midiOutUnprepareHeader midiStreamOpen midiStreamProperty midiOutPrepareHeader midiStreamOut midiStreamStop midiOutReset midiStreamClose midiStreamRestart

ws2_32

recv WSAAsyncSelect closesocket send getpeername inet_ntoa WSAStartup ioctlsocket recvfrom select accept WSACleanup

rasapi32

RasGetConnectStatusA RasHangUpA

kernel32

GetVersion WideCharToMultiByte FileTimeToSystemTime InterlockedExchange IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA GetStringTypeW GetStringTypeA SetUnhandledExceptionFilter IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetStdHandle SetHandleCount GetFileType SetStdHandle GetACP HeapSize RaiseException GetLocalTime GetSystemTime RtlUnwind GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA FileTimeToLocalFileTime LocalFree InterlockedDecrement InterlockedIncrement CloseHandle WaitForSingleObject GetTickCount GetCommandLineA MulDiv GetProcAddress GetModuleHandleA GetVolumeInformationA SetCurrentDirectoryA GetFileAttributesA FindClose FindFirstFileA GlobalUnlock GlobalLock GlobalAlloc Sleep CreateEventA CreateThread GetPrivateProfileStringA WritePrivateProfileStringA GetVersionExA lstrlenA LoadLibraryA FreeLibrary GetFullPathNameA HeapAlloc GetProcessHeap HeapReAlloc HeapFree GlobalReAlloc GetTimeZoneInformation QueryPerformanceCounter QueryPerformanceFrequency SetLastError MultiByteToWideChar GlobalMemoryStatus TerminateProcess GetCurrentProcess GetFileSize SetFilePointer CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA DeviceIoControl SetEvent FindResourceA LoadResource LockResource GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA WinExec lstrcpyA FindNextFileA

user32

CreateAcceleratorTableA LoadImageA CreateMenu ModifyMenuA AppendMenuA CreatePopupMenu DrawIconEx CreateIconFromResource GetDlgCtrlID RegisterClipboardFormatA SetRectEmpty DispatchMessageA GetMessageA WindowFromPoint DrawFocusRect DrawEdge DrawFrameControl LoadIconA TranslateMessage SystemParametersInfoA GetDesktopWindow GetClassNameA EnumDisplaySettingsA ClientToScreen CloseClipboard GetSysColorBrush GetSubMenu CreateIconFromResourceEx wsprintfA GetDlgItem FindWindowExA GetWindowTextA GetForegroundWindow CallWindowProcA CreateWindowExA RegisterHotKey UnregisterHotKey SetWindowTextA EnableMenuItem ShowWindow IsWindowEnabled LoadStringA UnregisterClassA GetMenuCheckMarkDimensions GetMenuState SetMenuItemBitmaps CheckMenuItem MoveWindow IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA GetMenuItemCount GetMenuItemID SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA RemovePropA TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetSystemMenu DeleteMenu GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos InflateRect SetRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime

gdi32

GetViewportExtEx SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextMetricsA SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo ExtSelectClipRgn BeginPath TranslateCharsetInfo CreateFontA SetBkColor CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject GetObjectA CreatePen PatBlt FillRgn CreateRectRgn CombineRgn CreateSolidBrush GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegCloseKey RegOpenKeyExA RegSetValueExA RegQueryValueA RegCreateKeyExA

shell32

DragQueryFileA ShellExecuteA Shell_NotifyIconA DragFinish DragAcceptFiles

ole32

CLSIDFromString OleUninitialize OleInitialize

oleaut32

LoadTypeLi RegisterTypeLi UnRegisterTypeLi

comctl32

ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_BeginDrag ImageList_Add ImageList_DragMove ImageList_DragShowNolock ImageList_EndDrag ord17

wininet

InternetCloseHandle

comdlg32

GetFileTitleA GetOpenFileNameA GetSaveFileNameA ChooseColorA

GongShaFuZhu13/【x1】攻沙辅助/plugin/REGDLL.DLL

IMPHASH f076a1e4fbab4d2c4bccbdc4ea8a1b72
SHA256 3453bb9b4550dd5a51a64c3d2d25f1b49744b05ac740c57f2dd9f89084811318
MD5 e29d9a912204844df5306ca3935b1f1c
SHA1 19ba6440827ad2ac515aeb6c8700fbb4c896e61c
SHA512 9229d5c845eeb36cd293e8d998aca63ed14f41b43d7d11da8682ede4d24853eff19bf0801b8ab055d50c849be7cbf94b890a672d90b55eec5019cebf98925a3a
SSDEEP 96:Q+fvNT4ui9YFfZVS7pxN3LusGOKmzXyUo2SZjvnEkWRA5mJL4DwdQTDut9Zdn0K/:TcYbM1H3ysce2NEkWCG4DoQTD0d0+
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7033

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord3831 ord3825 ord3079 ord4080 ord4424 ord614 ord1206 ord2623 ord290 ord825 ord1223 ord4622 ord4226 ord2486 ord4003 ord446 ord743 ord1569 ord1196 ord1168 ord6467 ord4274 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord3830 ord5199 ord2396 ord3346 ord5300 ord5302 ord2725 ord4079 ord4698 ord5307 ord5289 ord5714 ord3262 ord3081 ord3738 ord561 ord815 ord5500 ord1132 ord1131 ord6354 ord1176 ord1575 ord1577 ord1182 ord342 ord1243 ord1197 ord1570 ord1253 ord1255 ord2976 ord2985 ord3136 ord4465 ord3147 ord3259 ord2982 ord1799 ord1089 ord823 ord1578 ord600 ord826 ord269 ord1116

msvcrt

__CxxFrameHandler wcstombs __dllonexit _onexit free ??1type_info@@UAE@XZ _adjust_fdiv malloc _initterm

kernel32

LocalFree LoadLibraryA FreeLibrary GetProcAddress LocalAlloc

advapi32

RegSetValueExA RegCloseKey RegCreateKeyExA

ole32

OleInitialize CoTaskMemFree StringFromCLSID OleUninitialize

GongShaFuZhu13/【x1】攻沙辅助/plugin/REMOTEANSWER_JDYOU.DLL

IMPHASH a96344c3cbb23ac2220c3e585f301035
SHA256 16a87d4e3d2683788e0b54672e81c50f3b9257709857681db7f85de35ea9ef32
MD5 53a11435be30e6df4850675a590a6e00
SHA1 82fced3c9187faed9727c633ed9d9dd37653f88d
SHA512 d5861e7473fa429563578ccee3451d4eecdce5590d697301f2ec2ccea9dab859c28896945535ef21b28c3a96a03982914a64c9db7ac6a88084f0fddb7b99beac
SSDEEP 49152:6Xx8e+xXb35bYAJTJWv7IQgbrq5NyYisABrUaL:6h8db3RYqwvgEIv0
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

VMProtect packed file

Detects executables packed with VMProtect commercial packer.

vmprotect
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6730290

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

731KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vmp0

Size

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp1

Size

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp2

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=615, id=1, productName=Unmarked objects,

count=9, id=152, version=20115,

count=54, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=226, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=219, id=171, productName=VS2010 SP1 build 40219, version=40219,

count=137, id=170, productName=VS2010 build 30319, version=30319,

count=162, id=171, productName=VS2010 build 30319, version=30319,

count=16, id=175, version=40219,

count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=151,

count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,

GongShaFuZhu13/【x1】攻沙辅助/plugin/SGUOBROWSER.DLL

IMPHASH 243428a951834ebf532b0ff48d317043
SHA256 7170daad1770562192dfc6cce34f09f1804a9c5852ba8a7acb5127d70acd34a9
MD5 8dc95c9231e8448c34b350486e3e1133
SHA1 c828eaaf32e053bd7f6046b5708c1fe9ebb09e37
SHA512 e4bf1925b9bc8cbd2df7dab311041fb831213d12edbad16808923b6bef3ef9ec192fe5313bfa4da3e75b106dbc86657fdf34714fb8e9d5ad4b88b1dcf5a94e46
SSDEEP 768:0G6I2742gM31Q0v+BDnHOjsIKeKsjnoyp7P:D644lmDHODhKIno07
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

19290

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord3663 ord3571 ord3626 ord2450 ord2405 ord640 ord2414 ord1641 ord535 ord4278 ord858 ord6928 ord323 ord1871 ord6354 ord941 ord1131 ord1132 ord5500 ord815 ord561 ord3738 ord3081 ord3262 ord5714 ord5289 ord5307 ord4698 ord4079 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord4204 ord537 ord1601 ord823 ord743 ord446 ord2486 ord4226 ord825 ord860 ord800 ord540 ord2818 ord2915 ord1640 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord4003 ord4622 ord1223 ord290 ord2623 ord1206 ord614 ord4424 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord269 ord826 ord600 ord1578 ord6467 ord1255 ord1253 ord1570 ord1197 ord1243 ord342 ord1182 ord1577 ord1168 ord1575 ord1176 ord1116 ord6877 ord940 ord939 ord859 ord1799 ord2982 ord3147 ord3259 ord4465 ord3136 ord2985

msvcrt

_ftol sscanf strtol atol free strncpy _mbscmp __CxxFrameHandler __dllonexit strrchr _onexit _initterm wcstombs strchr _adjust_fdiv ??1type_info@@UAE@XZ malloc sprintf

kernel32

LoadLibraryA LocalAlloc LocalFree CreateFileA WriteFile GlobalAlloc GlobalLock GlobalUnlock GlobalFree OutputDebugStringA GetProcAddress FreeLibrary UnmapViewOfFile IsDebuggerPresent GetPrivateProfileStringA WritePrivateProfileStringA CloseHandle CreateFileMappingA MapViewOfFile CreateProcessA GetModuleFileNameA Sleep GetCurrentProcessId InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection IsDBCSLeadByte

user32

GetSystemMetrics GetWindowRect ClientToScreen CopyRect GetDC SystemParametersInfoA PostMessageA SetFocus GetWindowDC SendMessageA FindWindowExA EnumWindows GetWindowThreadProcessId GetClassNameA GetWindowLongA MapVirtualKeyA IsRectEmpty IsWindow ReleaseDC

gdi32

DeleteObject DeleteDC GetBitmapBits CreateDCA CreateCompatibleDC CreateCompatibleBitmap SelectPalette BitBlt GetObjectA GetDIBits GetStockObject SelectObject RealizePalette

shell32

ShellExecuteA

msvcp60

??0Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ

advapi32

RegSetValueExA RegCloseKey RegOpenKeyA

ole32

StringFromCLSID CoTaskMemFree

GongShaFuZhu13/【x1】攻沙辅助/plugin/WEBOPERATION.DLL

IMPHASH 37a2eee5dfe023c1fccb33f88a487209
SHA256 7e81661a5d6524cda1c736dc27ff5aeba1bacbbcf66fb5f806e26ca54e19bfec
MD5 0eb164739231276b6b90a7171bded144
SHA1 fc822838bd8d0d0a5c133f144544ecaecdb2d7f3
SHA512 6850b9d097a92542a08e239efd2c950e068aba79fabfea43907358aab76e2878b1ec363c711272c49f73c9d0ad79c54daa2330d8872f8332196ddec1dde016dd
SSDEEP 3072:rs6fcX1fIUmUq7/kMU9aXU/se9CMMU5kslOHBSbdhBqnPl9tIABFIFAF:YOJ5XIT/sXtIAwk
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7420

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaGosubReturn __vbaAptOffset __vbaStrVarMove __vbaLateIdCall __vbaLenBstr __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList ord516 __vbaStrErrVarCopy _adj_fprem1 ord518 __vbaVarCmpNe __vbaStrCat __vbaLsetFixstr __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaVargVarCopy __vbaLenVar _adj_fdiv_m32 __vbaAryDestruct __vbaLateMemSt __vbaVarIndexLoadRefLock __vbaVarForInit __vbaExitProc __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord520 __vbaBoolVar __vbaBoolVarNull __vbaRefVarAry _CIsin ord524 ord709 ord632 __vbaVargVarMove __vbaChkstk __vbaGosubFree ord526 EVENT_SINK_AddRef __vbaGenerateBoundsError ord528 __vbaStrCmp __vbaVarTstEq __vbaObjVar __vbaI2I4 ord562 DllFunctionCall __vbaVarOr __vbaVarLateMemSt __vbaCastObjVar _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd __vbaRedim EVENT_SINK_Release __vbaUI1I2 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaExceptHandler ord711 ord712 __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 ord607 __vbaI2Str ord608 ord716 __vbaFPException __vbaInStrVar ord717 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaI2Var ord644 _CIlog __vbaErrorOverflow __vbaNew2 __vbaInStr __vbaVarLateMemCallLdRf __vbaVarInt _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaVarSetObj ord573 ord681 __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 __vbaVarTstNe ord101 __vbaVarSetVar ord102 __vbaI4Var ord103 __vbaVarCmpEq ord104 ord105 __vbaAryLock __vbaLateMemCall __vbaVarAdd __vbaStrComp __vbaStrToAnsi __vbaVarDup ord616 __vbaVarLateMemCallLd __vbaVarCopy __vbaFpI4 ord617 __vbaLateMemCallLd _CIatan __vbaCastObj __vbaStrMove __vbaI2ErrVar __vbaStrVarCopy ord619 _allmul _CItan __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj ord581

GongShaFuZhu13/【x1】攻沙辅助/plugin/WINDOW.DLL

IMPHASH 23c0230a3203b217bd8c3dbcb089c026
SHA256 9707781fc0d1d932e527612cff1dd5cb5a555e3ee247a91338aa58885b7bd92d
MD5 215fce089f76039fe9846dbf18d0301d
SHA1 c64e520094461914117261f94907e486d1cc9d9f
SHA512 eec412f9dd95d01c3d5d5d884cb8e9c1a7d52501ad9368a5e266e833f51db39d8a2e844d97f088a7aaf76ffe853985cef6e6d6cc874cd7895c75a7dbef02e8bd
SSDEEP 768:8MiTToZEA9PVIv69VXVqrGny6AcDlDSC6:8MeTgEA9Nk69VXAGny6A+Sh
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord861 ord535 ord5440 ord6383 ord5450 ord6394 ord2915 ord540 ord1871 ord6354 ord941 ord1131 ord1132 ord5500 ord815 ord561 ord3738 ord3081 ord3262 ord5714 ord5289 ord5307 ord4698 ord4079 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord860 ord539 ord537 ord2764 ord2818 ord939 ord800 ord1601 ord3663 ord825 ord823 ord743 ord446 ord4226 ord2486 ord2512 ord2554 ord4486 ord6375 ord4274 ord4003 ord4622 ord1223 ord290 ord2623 ord1206 ord614 ord4424 ord4080 ord3079 ord3825 ord3831 ord3830 ord269 ord826 ord600 ord1578 ord6467 ord1255 ord1253 ord1570 ord1197 ord1243 ord342 ord1182 ord1577 ord1168 ord1575 ord1176 ord1116 ord6877 ord940 ord859 ord1799 ord2982 ord3147 ord3259 ord4465 ord3136 ord2985 ord2976

msvcrt

_mbscmp _ftol __CxxFrameHandler sscanf sprintf strchr strrchr free wcstombs malloc __dllonexit _onexit _initterm _adjust_fdiv ??1type_info@@UAE@XZ atoi

kernel32

Sleep WritePrivateProfileStringA GetPrivateProfileStringA lstrlenA TlsGetValue GetEnvironmentVariableA LocalAlloc LocalFree MultiByteToWideChar GetModuleHandleA GetProcAddress GetCurrentThreadId CreateToolhelp32Snapshot Module32First IsDebuggerPresent GetModuleFileNameA CloseHandle

user32

SetWindowTextA AttachThreadInput GetGUIThreadInfo GetWindow ClientToScreen GetWindowThreadProcessId GetClassNameA SendMessageA SetWindowPos GetWindowRect MoveWindow ShowWindow PostMessageA IsWindow SetForegroundWindow EnumWindows GetWindowTextA GetWindowLongA IsZoomed IsIconic IsWindowVisible SetParent GetParent SetWindowRgn GetCursorPos WindowFromPoint GetForegroundWindow FindWindowExA FindWindowA MapVirtualKeyA GetClientRect

gdi32

CreatePolygonRgn CreateEllipticRgn

oleaut32

SysAllocString VariantClear VariantCopy

msvcp60

??0Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ

advapi32

RegSetValueExA RegCloseKey RegOpenKeyA

ole32

CoTaskMemFree CLSIDFromProgID CoCreateInstance StringFromCLSID

GongShaFuZhu13/【x1】攻沙辅助/plugin/WINDOW.ini

SHA256 8b20b1e2a3068a64c980914bc3bf9f649ce3d6a9e5d1095c5a958c55ffbe2a39
MD5 29295c439cd3067a4ea4aeed949afdeb
SHA1 e88b57e47aa226cc77ef6e2052e5e0148e40159c
SHA512 4a287a6543e66871d17679cb110d2da85b6b52b46452b023bcd55ae132dc5df93f64f3c1b016fbcea322eedc97298230c5fe5d7f60f3dd68e5ca8397ee45c376
SSDEEP 96:IuA2A9iyzwZc88WiKkPERalUOI7Svgk6ZDC5wf4tKXKKxRJ1JPLq4bbSnbbS1/DE:NA2AbA+WdKrlDgk6Awf4QXDjTr/Sn/Sq
MD5 SHA1 SHA512 SSDEEP

GongShaFuZhu13/【x1】攻沙辅助/uservar.ini

SHA256 a186bed45c9d36b22ea5323ea8178c60297778896070122a7f281b074157f125
MD5 bf81e45ed5d644f7a0dd3328475484ec
SHA1 86e80dd2f76931a0ad6e45170375e3e0f8e145c7
SHA512 8bcb8d8aefe91f250c3f1831ba8fe49acb6cb012043451e8085a17ed2540f346620bf0e3bf2676979155fdf2a3fa9f81ae568493a9bdd2d267f08be0c52b8722
SSDEEP 96:IMl+LlIeIflDslwdl6flKXlOrIBoulElbrlJYzlTlNaRl8Yal5rlGolXGelsulJU:IMl+LlIeIflDslwdl6flMlOrIBoulEl9
MD5 SHA1 SHA512 SSDEEP

GongShaFuZhu13/【x1】攻沙辅助/xgs/RegDll.dll

IMPHASH f076a1e4fbab4d2c4bccbdc4ea8a1b72
SHA256 7f5183494801b0b4314fe387589b7d5d41e03025dff3dde70f7c7e09723ef5c1
MD5 a2d61eff3148f2c70404927c0146306e
SHA1 cd9f8247d726a9b437a49a5824dbad9b1a6928a7
SHA512 d2eff12a8baa1911ec2f28c43243afb7fcbbe3e6cdeb799364db95089fd370dc8f30b49c7ea3eb81ae4b846e29860428a84c96497ecdb1f5f928200605fc5e00
SSDEEP 1536:I2FWCT03n3KYFcZvi5/0LI6LdEavoWZpEkt/Edm50E:lFWCT03n3KyyqmJFbpEOE0C
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28672

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord3831 ord3825 ord3079 ord4080 ord4424 ord614 ord1206 ord2623 ord290 ord825 ord1223 ord4622 ord4226 ord2486 ord4003 ord446 ord743 ord1569 ord1196 ord1168 ord6467 ord4274 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord3830 ord5199 ord2396 ord3346 ord5300 ord5302 ord2725 ord4079 ord4698 ord5307 ord5289 ord5714 ord3262 ord3081 ord3738 ord561 ord815 ord5500 ord1132 ord1131 ord6354 ord1176 ord1575 ord1577 ord1182 ord342 ord1243 ord1197 ord1570 ord1253 ord1255 ord2976 ord2985 ord3136 ord4465 ord3147 ord3259 ord2982 ord1799 ord1089 ord823 ord1578 ord600 ord826 ord269 ord1116

msvcrt

__CxxFrameHandler wcstombs __dllonexit _onexit free ??1type_info@@UAE@XZ _adjust_fdiv malloc _initterm

kernel32

LocalFree LoadLibraryA FreeLibrary GetProcAddress LocalAlloc

advapi32

RegSetValueExA RegCloseKey RegCreateKeyExA

ole32

OleInitialize CoTaskMemFree StringFromCLSID OleUninitialize

Name

.text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

722B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rmnet

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

GongShaFuZhu13/【x1】攻沙辅助/xgs/beibao.bmp

SHA256 4923158fc9bf50226cfdfe4f8670d375c22e9f9458a4569b2c6ba5eb65855881
MD5 872d1d81c0162262bcc4a18a1383e4a0
SHA1 c08e40c8306c999a8d231f26d43ae5b23d65f5b0
SHA512 f28a48014b8d3262aa8e97170a3783d50a20fe704273ae3c9bfb5edffce96e1abd7dc6ed7be5a5305b40f97df7fe0884105bbe30d0db5ab60cdba1b433907439
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/boss.bmp

SHA256 6ff3bdb4aefdc63a5d9c8555db8067cbca106cc4716969212e0e8aac916e60e5
MD5 59540402d55dc03b2b5a08d8f3ffc849
SHA1 d772bc6a241ebb4849b12c4337497dbd0318c442
SHA512 17c5b73720e2b85843c879b0aacfdc554c4b6ff664d2c9f18c8309dde04dfdc96711a38dcc687c0684fded08e7d1ee562c9672aadad94b7fc209865cdfa6720d
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/bossdk.bmp

SHA256 b5a19980d21f52d28f9ac5aed6aaf51456fac957b6eb7f218d97439ce5313aed
MD5 6fc31edc3e87c5a5e15e4045085eea50
SHA1 6b0aebd794b21d6c565d1908a8dcc921faf2b22a
SHA512 a1239a14c2e67f53f6dccc4d9eb254257716efd6590abeeeeb88eb8a96b4be14ccb3d4a40f93d4eee8496f147bdab1e773d166101a4c39a0b87aeeb2b532eb9d
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/bossdk1.bmp

SHA256 d13d3d5d73a39f46d35240d6a048f29b346215bb62a355bb3e1f89a7b44f733b
MD5 eb300158d0fd2ea7754893d50f83c88b
SHA1 db7a138508a24b7f68c4287bb79c57231e7b65bb
SHA512 6ac5fda951ad2bc24299fb87b5503783f6804324b30dd52c0a1a0dfef1262f7b4fa678ea180a54a7f59efe4f1444cfee65dd77fd736032ae9edd98ede60f5ed7
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/chuansy.bmp

SHA256 a06b5f08e9152639c347b2666804ae3cd6aa28476c0f64f56921ce58f0fc137a
MD5 8ab50a10d9d55a0da53cbff62ae6534d
SHA1 8a24fb2776aba3b2c34dafb21a490b3b8997cb45
SHA512 dd2d50d8d659cfc6c6f1cf893a67cc966efe175861d2c2f88c6ad4732d84add7e75bae68dfd42af42c767d2e46b8fc95ad0e5974bcc9a0c16319262876f1cf11
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/cmrenwu.bmp

SHA256 574afbbc01aedc9342ffcc948607899f11b1c471a85452c0bd3e03c7b437b091
MD5 89d68d22a91325a571331c5026a8f0a7
SHA1 44950cc47ea8c949b67a511cbd74fdb33f34e71b
SHA512 5ff2f65de11048fb4f4da73f21ca954fa3d0f8fc299c5ba854c6fc0ccd3676c93eb3ab5f4734fe6e2f57742c26bcee88f6b842f9dd9e4060aedcf23d750a9d56
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/ditu.bmp

SHA256 18a3a82a756d8b7e6946c9fe59f756fb92e1aeaa1fa8dab29572d900d7703928
MD5 6d3b02da7fb27a5162f2f7e9d9dcf4cb
SHA1 07e21f49d784aff75cb7d3d19abbecb4db756b98
SHA512 e3fba79e245bfa869223efdbb751a8f93704aa5f4c1da33ff373572f17739d7294115e5534812252a54617d4b986e643dc4804ac884454eb40dc21fba2d0bbd3
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/dj.txt

SHA256 4ca32455b2524edac751cca47642eced56edc6da100fc9b4127e61f14e9fdd2a
MD5 c8c4ee658f7285bca8b6fff449753004
SHA1 fb603fd3a28e734e54c939243b85b9c2ac24fc29
SHA512 d5e3827b882123dbbc6808c8f231608a18350db5d4a202b0e30efbda9cd2347990744e52b0d0e00b9e8df59b34d3c8b16289dc1bbe7b41727a80dcfdd244448f
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/dm.dll

SHA256 d003f814a6828ee02a26049407d38785262e969faeb00b6bc3179ed4fec061ae
MD5 faf2c7db70ec0fe4596c0395e5eb228f
SHA1 bcc89bff37ac8eccd85162c44c0477f412f2c616
SHA512 1b0ee5731f1726cce2047800e8c8adcc725f92b3c94b0e56e9cc2d33f64e3f9e1a0356558e97b8ed80ca40ba068dc07b70f4df46f6dc62729428d05e8725828a
SSDEEP 24576:DWQBeP+QrqH2zKBd3G0Ypdrcc2iIZl2mBVU89XQBpizYho1SH:DWZnGIKb20Ar8iIZfBVdXQBpuYw
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1593344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

generic

count=2, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=95, version=2190,

count=3, id=11, version=8798,

count=65, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=18, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=5, id=12, version=7291,

count=15, id=19, version=8022,

count=13, productName=Unmarked objects (old),

count=20, id=19, version=8034,

count=3, id=11, version=8047,

count=3, id=14, version=7299,

count=5, id=10, version=8047,

count=4, id=4, version=8047,

count=3, id=4, version=9782,

count=662, id=1, productName=Unmarked objects,

count=57, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

GongShaFuZhu13/【x1】攻沙辅助/xgs/duanzao.bmp

SHA256 76a5d64399d6313e68e6652c24ff718be2e253cc95ef881937cc0bb0969d716b
MD5 6dfc89eadbe5a03e33c778ed7144d249
SHA1 b50e2c917baee45c46a90fc5bafd05c82aed270b
SHA512 edccd77a99ca5183c5f5894c45c900002aa4a363023103d5e31ce2771c6ca64411082cf6a0d5aae0074ce3aaac532811ae37117f724c72171dc6ed49a1c2bcdf
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/fuben.bmp

SHA256 b6c23673141ebaa1e86baaef7943137a1d5ecb6221265a822ded28415fcf667f
MD5 d500d69b0659d0ef62e49ec7246b1a9c
SHA1 daa705037fdebfa12e60f2da114875769d58811c
SHA512 e7ac9bfc42918f70cef0a710d36c57c5983acf42e04f52ff50c24d4117ec1020defdb80f4f6c53ea20a2b8304e57d31689ece5ea7f6d271905a0bb0a6b0201db
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/gjz.bmp

SHA256 2d9597547466d96af811169e0cd114603c2caa51662d1e561de8fea792794583
MD5 643b584d79456ef42fec8615180b51a5
SHA1 2f4db46930a85b0d21835588856f3c3607730dff
SHA512 5bf173fb6516f3f1cf2dcbfb402676c2ecd49c4a93eac051f8171eedeb1589bfe7591e2d0721ac08665c4d6350d0b9c428aacda7d97b04321b635b5b87a6197a
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/gjz1.bmp

SHA256 f2f729f48a56508ca7de82fa36f885e65ea9040f102219f9524be35b7d029690
MD5 f3feeb82642ef8df22bb140388682f9c
SHA1 cd10fd8ab55e03f42f20a72c5c1ddd8bb11a198a
SHA512 8ae207d6a37644b1012cf61d2668feacace9896320ab53b5c24447a4eab64d61e077c054c68e97673415cf7dedfcbf29128a027a70f3ee710d8ac0b64f7baf4c
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/guanbi.bmp

SHA256 214f2886d4f62959c300ebe8dcff5551e56f2823a881d0aaff589c382335bbab
MD5 2ab15b8e2dcd7d9e63336498d7a419a6
SHA1 84a7f969bbf0813e48fec26aba48ca743375fd88
SHA512 509f9748f85b7204d8e613e2c518ad26fe3035a7f53a96c46f6c7e847a941790c2ca79f7017a544813aa8f68cbd402047ecf9e229f34becdf2d80e66e39d4efe
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/guanbi1.bmp

SHA256 9ad4d3aa3b44246d3cf9a1068365116527eca585ddb7d1112ba582d6254c7a1d
MD5 229ab0b880152c3b0ffbd4f1b83c7df8
SHA1 777c50713de37d660d08f0d02548e5110a2baca9
SHA512 8d252ee4ce63017b80f03f14d1d176b3c34f3f3a4989ecfef7ae89b65ef1ed0d483f7c9c2e57c69f4b5c2193121372835962a2dc42f8fc25a4c1f3cdbdf35c85
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/hanhua.bmp

SHA256 8c8acdeaf63e5fa32fb2a29f80df0d279ea73e9f7e9f32dbf0d2505075b39e7a
MD5 39eaa5f7fe47ce6fdc7858f613ae2f69
SHA1 a7ea98df32a67d023101e66e3b2fe667a35e67aa
SHA512 f7eea666d839dde052c2ae613e89d39e8303f20b77e06de155a0cb9cf654adb0aa444fbdb9b4d685913c9bfd2445cc336080c2383667ed915873ae9ae71f8268
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/help.doc

SHA256 d0a325e5f120dd6a733bc043dd3fae2c0c7e5844f1b335d3081e8d1c5d032eee
MD5 470b257f2ce348e6dbf6efac504f6167
SHA1 7eb1d611bef0744a04ae7e6723003e9a584d08bf
SHA512 78cf130d0f6769025dd3264d2b31c944564417af37c783cd682485e7a3e057c8b5a57f04d8072d0c6121edf41609267a3ae8f7acccef1ee362ec9c961945b80b
SSDEEP 192:J1N77BcWyZQANt9Uo6Squ2xVagUky4j0k/8sad/u:HN7VcWvAb9Uo63Wgny4j0k/8
MD5 SHA1 SHA512 SSDEEP

windows office2003

GongShaFuZhu13/【x1】攻沙辅助/xgs/huishou.bmp

SHA256 f794c371cfa1a2278fe9716fc6b99bbea3f293f0e16fd625b4e6c0afc96f6152
MD5 5d5d5fd1c075bd30067b9bd37c6fc1b5
SHA1 7e69425603201454b177487f116b0548067e7fe0
SHA512 d6a4479e8e7a7ff643cc232400b5415ea0d2eedbbefd3eda9634f40cba4ac4545152e4fcab1b26939e01715ffc0f88b975912f4fc58a94dc380ece31f838c85a
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/huweidk.bmp

SHA256 7df42eaf2450a5437b1a7bf38c0758074ac307fa05c26c1bc573c3103a88d0dc
MD5 c5e4827ba097553d3704a676e0b0098f
SHA1 42bdbc99b418f132afee1e3a5a80f57edb832b25
SHA512 744bb12539b7636115ecb5ed87492aa0bd7a727b93b4f0bf83b6215d945cb1e1f26dfc9f9060de3801aa077efea30fdd2684716860a4ee036a515f691000b06e
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/jldting.bmp

SHA256 0deca2cefc1ad9f08c7f8b6439b93a2434d622c93c2238ec7e93bee4a93d53a5
MD5 19d3bcb4a7e8f3fe0f6f7023f54e3092
SHA1 c8b9dfb8fa49bd9a2d12c096148195ef730ca3a1
SHA512 cc06bf0a028fc67a5bb7f9fcbd66524481e1c5aa758a5ee025877121829f48182ea0306c04b12ac307ddff940dfc47c0b106355804489c9fce1a5000e11b1803
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/jldtingdk.bmp

SHA256 138835ad183d8cab833a2cd4645200687de3d3b37b46bec7cb95fe8e9e5fd7a6
MD5 4d5af7cd4c4115cf48662c09c9f398a0
SHA1 9d5d5b28f476f42967b9c6619df209fdce617a5a
SHA512 4205eae7e4f08ff76e8a97920b57eb83fbbac95b613cd9f57897a4d79664f675358030ca1979fe01f002b7f437fec6bb0d82d40a79950bd11b9af8fb9bf7d2a8
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/jldtingdk1.bmp

SHA256 12ef3f9b5fc127359bb6cb8135ea0083b22737d362828347378759ea566d3afa
MD5 9fc06e2dbca0326d1eff54f427f536f5
SHA1 83880e99cbe171801af089ce962004f620884594
SHA512 d0e98055fb70346d19d5e4e77b6faa78d5c7200ce12b4bda19a32891bbeaeaff64eb39f9581bc05f009d5bdd13ac5654ab07792552c2ac3bef4fae9b403146ff
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/kaiqi.bmp

SHA256 443fbcf3b51df985c6e04bec88584303d1b31a8ca89fb99ecbce805fe679fd0d
MD5 a06539f6375331e357457947a5a1117e
SHA1 f8e9b326ff96753f51bf4079dde6f0a0ebb0b0e7
SHA512 b7cb187cfeeae00cacf88d253f503181568cb1e2ca703c7c64efa419cef8fb7daca7cde9fc380cee3b50746a9a3687fecb0e1eea120f962c48a5a23347a6d497
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/key.txt

SHA256 a55d485c5bb6c1dfd6d7c696d7aed1c4c3c332e5bbc529a52ce934ce0d987467
MD5 beab2ef6ef2c0b7a1de145661d7c5a79
SHA1 3fe18c9c1de406020e9b754d0263c0f95ffcb9ab
SHA512 f468aa03177b9003de0944fe745e570e9192d914743c55302e810ea44821900acb0de0be940e83390797fa01cd0f6af2b8e5858bcb983e6951bf7e67f7a3b4d6
SSDEEP 96:4XArEgMtn7u8vW2KXIO76p2rfmxqI9S6Y/U9ujpSG4ODZp35t/:PV268e2KXIc6gTmjY/UQIG/DZp351
MD5 SHA1 SHA512 SSDEEP

GongShaFuZhu13/【x1】攻沙辅助/xgs/kfhd.bmp

SHA256 a40def9bb1bd0dbe91fd80116ec08b40ceaf6ae45d9b13bbf81cc97e4f253766
MD5 0cc3a5d04a6a012a853de65e3019958f
SHA1 2a50e99709c202097445bf1194d5188c0472753f
SHA512 962009016a9f9b580c005516d1b1f9064d5ca1e294e3a31f1713f863221e70a87e54e022b3b58329ec01302fcf093797d6fd7f12331cb5bbb821c4579c0d4799
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/kfhddk.bmp

SHA256 2cac5fe78ddefa45ce773ac884ba372f3b1d4acdc3e2c7418ea26e1b060b3110
MD5 268390288703e3e29049085eba1a8406
SHA1 edd8c823460082d1ed0c0291568872a490f1dff2
SHA512 edd0be1897f3923a497190240eee1b42af9a673b270de27a0e826da1c95688014301b67626c0bb2bb631a5fd19743bb6c4a6c0dc8162851607a810930e055015
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/kfhddk1.bmp

SHA256 9139ec27a7b8dc04a50c45e14c2831e56bb09592679f59b12f09c4e97430b66d
MD5 a0e4018fbc4764da343a0a3973b46dff
SHA1 56029556539ed02914557a93d6ca229a86a2dbca
SHA512 a4220ee639e51dc451a6aee706433bd0590a8d424c39e971c7cbfbfb6a4bc0f5e479727caee23c21dce24254362a70e9f82f1eef88d20db85523aa3e178a2c04
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/manxing.bmp

SHA256 105ff49b5dc399254ae5f9ed76362a7f4834f50b04a3100883546bbc952e270e
MD5 35ad3aa417ec4a96b6f2d75cac9ada79
SHA1 2676cbbf2fb9b4f462a79f042179d0fd2dd22e98
SHA512 acb2bd9c8a478e32300ec6f10f6b3fb2223492ae42205e1b223964fee273f0343f6f7a709f77937ace6384dfb2f735d063051fd10a7e0d3e760707549e1bc051
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/pingbi.bmp

SHA256 5bd8d65df156c16b14c01b6a72a34d93a09e355fe8a244ff644fd67fff8cae0b
MD5 5ab3fc289a0a5c6781d7b59a0caec150
SHA1 f1b49887216b70de045d84558b3124c00f36a1f6
SHA512 d00c0cf271ac4188124e25df370945166ab4b0f39593e03f7b8604de6fe534a493e80e7f72babf93b876058f5af416f100845ca17a77e0d07219af270e255209
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/pingbile.bmp

SHA256 a0be604633d4860681fb733fb5aa99272f5c4fd90d2e49588979d0fe7da7765b
MD5 e3c6aab04b1674134a6c8f68b038c4da
SHA1 e144bc423cd6a2d0845562fab5e8af06d6492a80
SHA512 e62b97c639154792c16d171023b613ce3f648c6d264c02113328f314989e75347effe864b23a846ac5899242f38ce0dc87e1ba68099e1e348ca95237b00b0811
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/saizi.bmp

SHA256 fc9803802a2a94fc16d8eec4f7fbc4cafffa6cbcb57ede0bcdcd66b90f7c8e23
MD5 68db6e6e4fbb97acc91249a057cfbc1a
SHA1 7e91fb466b46de0195f7e946ba78b290ba657582
SHA512 a14fe06afdc3c74a461547749312afa7d688be2f56cc623d14913ab815d4bc6ff8f0d1f8caab65ff80c65d488fd1d7b34bcfd70aef2c6a0a83522e5aca8639fe
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/suishen.bmp

SHA256 3b08b9bbbdc7e5f5f07a62a56436ee514e91c7c35eaa6c4dbcb5c3e0872cc1ad
MD5 b8faced4ea58273243257afa779a5076
SHA1 d2018529160eb2f38801e51d9fa0ae9416763097
SHA512 5e41187a6438970fa351a2ab6106ee403d036e96af674195a70a2dae2e42d657810d9345f9dc538e7376641828aaaaf6fb031cf991062273b452880163f9a5ce
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/sying.bmp

SHA256 a1075cf4ec7210fbb22774d132027bdce2da09c80ce640d7ad3d8f0d611b8c9a
MD5 b3a8f160c24150890939cb3ae93e3968
SHA1 2eb549a80d1516ec507f912ba905018a4ac0ce27
SHA512 4dbd6c52cde6de7bdc7c39df003861308066fb7baa1d504d2e928dc0d4e8301b800cc70876017e47cb26485282779cccb14f6885f0d67c628c610458f1690bf4
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/syingle.bmp

SHA256 15ce7e4a90e977bd75fe7b1dff552c56c96a111ebdcddd249fa1508489b06292
MD5 46fa1de84244fa4fdc82e0b53c4e9cfc
SHA1 700cbdce59b0e93dafa3c5629bc61835a9bab8f8
SHA512 e71bc8e62c4e03d35c4b233bb5b35d2cb4afaa2f854d97b997c78db9073655ebaa1b909a84cf68a1a0f51e4f5f41766ffa82e886fe9efab77be324fe71394461
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/tafang.bmp

SHA256 973a74ec85c2a024c470759e248bdd948fc6c5354b1ab96b3d0f78ce96029c0b
MD5 c2384a06b80169b57d9109940f868e49
SHA1 c8624d36bc3609450f432f2ec802ecf7d2e86e75
SHA512 a20c722f9eab0c1ac5e49b3a0c21e116e588cb495b9e432ec9ee6731d27ea86fde2f4438d959510dc6b664c1abb3d572a5c44b79ff1dfc6dcdeb202f03c8220a
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/tafanglm.bmp

SHA256 62afd6f38f83d42fef89ddd45aa0ee71dc34887bc066db4ae5c58e4a481b78dd
MD5 bf138ae40640339375f28f8feb5626d7
SHA1 22c219c80bf959fec7700c7189257ba1a70873e2
SHA512 5d22a41f8af98f35d7156f68629a9c0163875f079bf6dc5daab9d2896eee8309303f643449600d7a75ed8cc2a53f7ab81e45d67df44c0b16bb959f0566eb897e
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/tafanglm1.bmp

SHA256 3d8bb2eaaaec1148abd5c1076ef74c8a34e61735b5983f64dae2017bef56a6ed
MD5 91b33d1757266a1842d08b366180660e
SHA1 a728cda2ada11903f41cefe6e91d3b1895adae46
SHA512 9ce751737f83ac45169c4202d4a50b013228effa38973fde8ac1131e9b619fc31e7c0fa459734796fcbdba562bd546feed5cd4ef371446dbfbce4cd22da0235a
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/tafling.bmp

SHA256 2307c68fa82900018830ad6c75cb70486cdec475ae98132f43ff4c1d6276c191
MD5 88af4c8a571da8b75634390549dd947f
SHA1 8a7e9b1d57560aaeed20e8bf58df04eca3a42d90
SHA512 e5bee4dfcb2309d66efa357a0c973b2eb515952e3f6884d8c91fbea6bb20b07aab4e1b172aea670a02a57129a45135d6860bfc2492a364cf9ec81e522a01b1f2
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/tflingqu.bmp

SHA256 7384e984fbbe7d0b3da1e28afb810f4c49092357e406edee3d18d63685fe42e2
MD5 de7dbdda8bc28a4d60fcd0953cd3d505
SHA1 fb297599370f3e158adf592e1f778c2e23bbc855
SHA512 ee859aecc6a399286b2f7f2682150539f38f52427fba3b378fd44cd165a0637a45c6d4a18d416e0cf4f2ad1204bc5764cac26cbd3d0128ff74f9d1b8ffda91d2
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/tflingqu1.bmp

SHA256 82c06d4df0175d0e22c91ac84ae5e341cd73072807fc5f8a650bc7e1fb37e639
MD5 4cd9371e1f97880afe0b4683484303ed
SHA1 34a922c8a886bcf71ab151b2e3469a1d0e626339
SHA512 aeee6aa2ccfb0f07b240e9a13f8d847f3c3d83fba620974b3c59d0ecdc01c544fbbff67571e1997fd48c54222050004220259eb1304776931365b40ec6deb845
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/weiduan.bmp

SHA256 bd05fec055b0fccccbef0c46cb3ed1177ee206d18789e64263d92bae05f49459
MD5 456c5d7788185674408baaac8f552a3c
SHA1 af705a599a3bad0ae27534e1879a653284d1977a
SHA512 9239209a6cb2ea0509371b03e68a80d720f5a10fd5188ecc8d035b3f1ec6c487e835f9743897df17df8b139a5d535460f8b4ce7539c36a44b3749c94d5425a2c
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/weiduandk.bmp

SHA256 270031eaf7728d755c76a62b230dda17296a6c8cd81628a38b5c2e1206546867
MD5 6ae9828296e793165a9a17790016a271
SHA1 01e6af59f4dc4335dfa4ea06adc8db0bc2ff31b4
SHA512 e90f05e2a467cc4c9d059840f3b0b0a4049286469a46f30de3e73a1cc7ddee0a56d4d4b7f2c7df2f806a454723cf18e00b763cb565b5bae0fbefc94964d7c381
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/weiduandk1.bmp

SHA256 66e73fe5b509939eb656d0ca2b64ca6f952afae3e9423409251abf16dad85285
MD5 8342318f59136633bf1cef8fa3509fc2
SHA1 6ff0c94c94bf9b5041fe4a55c7b4780006799cd8
SHA512 e0d8cbbbd762bc0ce9cf9b17562f0c093eaed2c19afd24a7489817faddc408af8332f883940f6963022dd369be6bfe59989f14101e9163d7140cfea156af2d1f
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/weizhisd.bmp

SHA256 bbebd3bf2bc64a97757d4d37f2d3aa1e4dfaa3d95d8ea207aeaa9eaa00fdaaa3
MD5 86dd093f9f60ddcca44cdf079b60d458
SHA1 45a218c51bc3370699b0b4412c4288522a25e23a
SHA512 47fd465a26d862d5a3ab72041d38b15580cb71ad1a519e5e4a0076a668d6aa07ad185ca0a08c307aadfc918e136d7043cf6fd8bd37a5653bbbd2e11d2323f0e8
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/wzlqueding.bmp

SHA256 5cfa8994433f91e7f42b0b2648fd8f0fa2ac2832460c49a7e5d692d322d9f7af
MD5 b1c3f1786f01f94eb4825e34021547d1
SHA1 dc754d457d4a061cd3db08240fb5bf698fa3ac22
SHA512 60a05654bf12755c6c811496a7a6bb9d96866ef34bb6a3db018c9dd070c9ff0cbb4550cc8915f170d5dfa3503e84aa4cb7d6fc1790a5cc5b015845f07d3fb375
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/xp_key.txt

SHA256 9869276fecbdbb1cbc175705345395e4d02a67200803d212b339a07325b8e1ca
MD5 67a66ed2aa58d7bf39860d2a6c0c08d3
SHA1 8ac5fd93144d59f0f056e0d2ae41f97dfab578bb
SHA512 a25755afb3995384e33c3f0d3547775121bc17852a6ed119097264fc32d0763ad7e800dc8c1b655e840b5471751eba7b003bd7e4e6129a05b417f19913753233
SSDEEP 96:DLp4X/BBIOSCao3rYwTaAC5l6UoNaOEdRECbaQLB2u6jh:np4B0wTgl6UwahGQLLkh
MD5 SHA1 SHA512 SSDEEP

GongShaFuZhu13/【x1】攻沙辅助/xgs/xunluzhong.bmp

SHA256 1336b13409878f069e502b711cf993b0a81b77430f125e8cddd627bedf1ff171
MD5 53a10f22bd4500ff1e784d4033f9c7cd
SHA1 59c3b97c891ee7efd811240f4f2e019d4470da6e
SHA512 fe3ba83eee25dfcd16d5902d13689770adf608288ff49b001d5ac2ff682df4a000bb94027b422816fdb9b278dcf310c4c5d3e890642bd5715ea24a23c3e5e8f5
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/yuanbao.bmp

SHA256 7a2cc85fe86453c978219d7c533398fe0c7be176a5426eefe61c468c0a073b84
MD5 13fa62a8b9de942645abe2c1e134b7e0
SHA1 5b689b4fc5fae0542824ca0c895d0c63ba91d2f1
SHA512 a31f85cce757f6bfb895af765ded47866ae3cf3a822340818503a9eb8c3d22c785254ec5b8953d2b354f4cba99fb48def030387d963c9aead89db5638dcfee8a
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/zuola.bmp

SHA256 9d8d022048637c00c2bf260172c54381b2152b08bb3e57e57ac67c2c57d614d8
MD5 616f82b141663a20bbfcacc8f48cf28b
SHA1 03efd725580912dc1662217c0bf533a638005665
SHA512 bcb2721da441329d6cd3ce8aee9426e4a8bef9759cd75a1f20b2caa273adc1a267602ed3af4b5ffbd6755834c2ff83bf31449e72d1c1da823c4dec6441ff64a8
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/xgs/zuola1.bmp

SHA256 afbd796c1401a629b92d144fbb22ca30c46dff66936d0a854c27f7e7878bc147
MD5 61c2b00310a6456e3a93b8dbbdcbd2c5
SHA1 f7661b8aa75e3d147373fe2d32c062d20a1f7836
SHA512 d200a8b54f0640fd11164dfa5c8252002f4984f2b2bfc577ff90b9d4134c50187661fa39ad63e43df67896c5d6f74d77998c1afe29ac87df0b21da09fc5bf66e
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/攻沙辅助v1.3.exe

IMPHASH 963f688e3ccfca5020e281b80e7e2145
SHA256 85dd8661b619b7a91f4516c69801007c7576a92feb491b70cb9a043a3b691e4a
MD5 a73b9eb2e3dc9aa3b24064924b87b43c
SHA1 6ccefc45328173090cebc5c249c4e1dda1c8cd92
SHA512 05331048c85fa118e2a5a54e9e009c839ef31413474a8ceafe1636a99e2157eb4b51182d9ee65379a62f8eea98db22806541fd1f5e7e49a8aded21344c7ac388
SSDEEP 98304:T5lG4JA2toGeAMzBl8TDZCthjG3DO7jd8vtdUCo8G0OmOyndn44CWZXGp/n0iceM:TANhiDajuvtdQlLCN3R2pP0iQT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

bc:73:31:ee:ef:28:53:c3:47:81:1b:b7:ec:f4:3b:1f:e2:a0:1a:81

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=福州创意嘉和软件有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=技术中心,O=福州创意嘉和软件有限公司,L=FuZhou,ST=FuJian,C=CN

Chains

Feb 22, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

Serial Number

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=福州创意嘉和软件有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=技术中心,O=福州创意嘉和软件有限公司,L=FuZhou,ST=FuJian,C=CN

Serial Number

2d:af:fb:7a:20:58:8a:40:87:11:b7:98:fd:3d:fc:f8

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 7, 2013 - Jan 7, 2015

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

365674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord5860 ord807 ord2920 ord2012 ord2120 ord554 ord4163 ord1644 ord1146 ord5572 ord2919 ord940 ord941 ord5787 ord4133 ord4297 ord1621 ord4202 ord5856 ord536 ord2452 ord2753 ord1195 ord472 ord5161 ord5162 ord5160 ord4905 ord4742 ord4976 ord4948 ord4358 ord4377 ord4854 ord5287 ord4835 ord491 ord1907 ord4258 ord489 ord768 ord283 ord4478 ord4267 ord2450 ord1908 ord4406 ord3729 ord1690 ord2528 ord5288 ord4439 ord2054 ord4431 ord771 ord804 ord4259 ord4284 ord4715 ord2370 ord6334 ord6877 ord857 ord465 ord1572 ord1199 ord2575 ord4396 ord3574 ord609 ord556 ord809 ord2122 ord2639 ord2862 ord3996 ord1168 ord3302 ord2817 ord801 ord5829 ord3726 ord541 ord2065 ord3716 ord790 ord2301 ord2358 ord6111 ord926 ord2642 ord3610 ord656 ord4299 ord5053 ord4774 ord5981 ord6270 ord613 ord289 ord6358 ord1088 ord4203 ord6449 ord2727 ord6467 ord2730 ord2729 ord1568 ord6380 ord2393 ord6283 ord6282 ord4278 ord3089 ord2860 ord3797 ord1200 ord1158 ord6883 ord773 ord501 ord2448 ord3903 ord5834 ord2044 ord3887 ord2830 ord4222 ord5467 ord1581 ord2918 ord1989 ord2805 ord960 ord6314 ord4179 ord6389 ord5445 ord6012 ord5775 ord2603 ord3180 ord3183 ord3176 ord3508 ord3652 ord703 ord6143 ord1802 ord1934 ord1935 ord6662 ord923 ord925 ord4673 ord4274 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300 ord5302 ord2725 ord4079 ord4698 ord5307 ord5289 ord5714 ord4622 ord3738 ord561 ord815 ord4046 ord2145 ord2144 ord6225 ord5231 ord5247 ord2132 ord4601 ord715 ord2621 ord1205 ord1134 ord824 ord5435 ord1683 ord1673 ord2628 ord5980 ord2641 ord4122 ord6214 ord6196 ord4298 ord5948 ord3088 ord3875 ord3872 ord3871 ord6198 ord4286 ord4283 ord3137 ord3796 ord5719 ord6092 ord3524 ord4032 ord6095 ord4035 ord2549 ord2433 ord3353 ord3579 ord426 ord3425 ord826 ord2820 ord498 ord415 ord755 ord470 ord5637 ord5849 ord3475 ord4287 ord2109 ord1081 ord1008 ord6928 ord4476 ord284 ord6453 ord798 ord1997 ord6407 ord5194 ord533 ord5303 ord2726 ord2408 ord5715 ord3741 ord817 ord2256 ord565 ord3361 ord326 ord4400 ord3630 ord3706 ord5786 ord2582 ord4402 ord3370 ord3640 ord693 ord682 ord4243 ord6907 ord5861 ord3998 ord6007 ord3286 ord6675 ord6888 ord3495 ord3698 ord765 ord2108 ord2244 ord4457 ord4981 ord4499 ord1949 ord4034 ord6929 ord2765 ord913 ord4204 ord6876 ord859 ord5600 ord1083 ord5607 ord5278 ord3496 ord3528 ord3005 ord2136 ord1601 ord403 ord879 ord2740 ord2801 ord882 ord547 ord699 ord700 ord603 ord2454 ord1969 ord273 ord404 ord3438 ord1871 ord6571 ord5620 ord5642 ord6307 ord521 ord6379 ord777 ord1770 ord462 ord743 ord3702 ord2827 ord6140 ord397 ord341 ord4167 ord861 ord4188 ord912 ord5631 ord2170 ord3584 ord543 ord803 ord1842 ord850 ord844 ord3939 ord398 ord5601 ord4189 ord394 ord696 ord698 ord3937 ord396 ord3437 ord909 ord4185 ord4187 ord3435 ord911 ord812 ord6144 ord5862 ord5610 ord559 ord1799 ord614 ord2623 ord290 ord4226 ord2486 ord4003 ord446 ord6354 ord5500 ord3237 ord4694 ord5148 ord3138 ord683 ord2243 ord3226 ord3631 ord1233 ord5597 ord1176 ord1243 ord1578 ord600 ord269 ord3957 ord5953 ord3880 ord551 ord2096 ord1175 ord5785 ord2078 ord2754 ord2080 ord2116 ord6616 ord6669 ord6442 ord2114 ord2089 ord2113 ord2119 ord6785 ord2094 ord3223 ord4386 ord1093 ord2593 ord3221 ord2042 ord4317 ord4023 ord1829 ord816 ord562 ord6605 ord2411 ord2023 ord4218 ord2578 ord4398 ord3582 ord6743 ord1771 ord6366 ord2413 ord2024 ord4219 ord2581 ord4401 ord3639 ord3719 ord692 ord616 ord793 ord6515 ord5781 ord6654 ord6762 ord3293 ord955 ord3021 ord3711 ord2405 ord323 ord1640 ord6194 ord640 ord3619 ord3596 ord5864 ord6061 ord5571 ord5579 ord5736 ord5678 ord5794 ord5789 ord5873 ord6172 ord6021 ord6189 ord4330 ord6186 ord5756 ord6192 ord5759 ord2971 ord1641 ord2614 ord5788 ord2567 ord2414 ord4277 ord5875 ord3626 ord3693 ord3573 ord3571 ord2859 ord5606 ord2863 ord4083 ord6142 ord2438 ord3654 ord2584 ord4220 ord1862 ord500 ord3701 ord772 ord686 ord384 ord4160 ord2302 ord795 ord3721 ord6394 ord6383 ord5440 ord5450 ord2379 ord3301 ord6930 ord5710 ord4129 ord6927 ord2777 ord6569 ord4853 ord4710 ord3092 ord6242 ord6696 ord6905 ord3874 ord4234 ord324 ord542 ord3597 ord4425 ord5280 ord1775 ord6052 ord4998 ord4376 ord5265 ord353 ord6010 ord2514 ord802 ord641 ord2763 ord5683 ord6648 ord1768 ord537 ord6199 ord6880 ord535 ord4467 ord5282 ord2135 ord366 ord2092 ord674 ord3623 ord4427 ord5252 ord4436 ord783 ord6128 ord3752 ord2112 ord2099 ord4124 ord1844 ord1270 ord1232 ord2380 ord4123 ord3803 ord2818 ord939 ord354 ord922 ord5186 ord3318 ord5442 ord1979 ord858 ord1105 ord665 ord924 ord2915 ord823 ord2841 ord825 ord567 ord540 ord2864 ord2124 ord818 ord3663 ord3742 ord4424 ord4627 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5277 ord2446 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord1665 ord2649 ord5237 ord4077 ord4151 ord2878 ord2879 ord3403 ord5472 ord975 ord5012 ord3350 ord4303 ord5103 ord5100 ord3059 ord2390 ord2723 ord3402 ord5290 ord389 ord268 ord5207 ord1567 ord690 ord2107 ord3811 ord860 ord5216 ord3758 ord3408 ord3227 ord4699 ord3054 ord4441 ord4837 ord3798 ord4353 ord6374 ord5163 ord2385 ord5241 ord4407 ord1776 ord4078 ord6055 ord4275 ord2688 ord4242 ord5030 ord539 ord2764 ord800 ord6197 ord6215 ord1576 ord726 ord654

msvcrt

?terminate@@YAXXZ _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp _strnicmp _beginthreadex _mbstok _pctype _isctype __mb_cur_max _setmbcp ??1type_info@@UAE@XZ _onexit __dllonexit isxdigit printf qsort strncmp _iob fprintf _stricmp calloc _getch _tempnam _itoa _CxxThrowException ??0exception@@QAE@ABQBD@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABV0@@Z _mbsnbicmp _mbspbrk _ismbcspace tolower _mbschr isspace _except_handler3 _mbsicmp strncpy fwrite _strdup _splitpath isprint islower isalnum _mbsstr strstr strchr isalpha sprintf _mbsnbcpy _purecall memmove _ftol wcslen wcscpy malloc ftell rewind fread free fgets fopen fseek fgetc fclose fputc rand time srand _mbscmp __CxxFrameHandler sscanf atoi ??8type_info@@QBEHABV0@@Z

kernel32

GlobalSize GlobalReAlloc SetUnhandledExceptionFilter Module32Next Module32First CreateToolhelp32Snapshot MulDiv SystemTimeToFileTime GetFileSizeEx SleepEx TerminateThread FileTimeToSystemTime SetFilePointer GetFileInformationByHandle WriteFile GetLocalTime LocalFileTimeToFileTime SetFileTime VirtualFree VirtualQuery GetSystemInfo LCMapStringA GetStringTypeExA GetUserDefaultLCID InterlockedCompareExchange FlushInstructionCache VirtualAlloc GetStartupInfoA LocalFree ReleaseMutex CreateMutexA ReadProcessMemory OutputDebugStringA GetCurrentThread SuspendThread CopyFileA FormatMessageA LocalAlloc GetFileSize ReadFile GlobalFree GetACP WaitForMultipleObjects PulseEvent ResumeThread TlsAlloc TlsSetValue SetEnvironmentVariableA VirtualProtect InterlockedIncrement SetEvent ResetEvent Beep IsDebuggerPresent GlobalAlloc GlobalLock GlobalUnlock GetCurrentDirectoryA GetFileAttributesExA InterlockedExchange GetCurrentThreadId QueryPerformanceFrequency OpenProcess GetCurrentProcessId MoveFileA OpenMutexA CreateFileMappingA MapViewOfFile UnmapViewOfFile GetFileAttributesA SizeofResource SetCurrentDirectoryA GetSystemDirectoryA IsDBCSLeadByte InterlockedDecrement EnterCriticalSection LeaveCriticalSection GetModuleHandleA GetModuleFileNameA GetTempFileNameA GetPrivateProfileStringA CreateFileA DeviceIoControl GetProcAddress CompareStringA lstrcatA WinExec lstrcpyA GetWindowsDirectoryA LoadLibraryA FreeLibrary lstrcpynA GetProcessHeap HeapAlloc HeapFree CreateThread GetLastError CreateEventA CloseHandle Sleep GetCurrentProcess SetPriorityClass WritePrivateProfileStringA GetPrivateProfileIntA lstrcmpiA FindResourceA LoadResource LockResource GetCPInfo lstrlenW WideCharToMultiByte lstrlenA MultiByteToWideChar GetVersion GetVersionExA DeleteCriticalSection InitializeCriticalSection CreateProcessA WaitForSingleObject GetTempPathA CreateDirectoryA DeleteFileA IsBadReadPtr SetFileAttributesA MoveFileExA GetTickCount QueryPerformanceCounter SetLastError OpenEventA

user32

GetSystemMetrics AppendMenuA GetMenuItemCount GetDC DrawTextA ReleaseDC ModifyMenuA GetMenuState GetMenuItemID CreatePopupMenu DrawIconEx DestroyIcon GetSysColor CopyRect FillRect DrawEdge SetRect GetMenuItemInfoA EnableWindow SendMessageA GetParent RedrawWindow IsWindow CreateMenu GetMenuStringA GetSysColorBrush GetKeyState SystemParametersInfoA SetWindowLongA SetWindowPos KillTimer SetTimer LoadBitmapA PostMessageA GetDesktopWindow GetSubMenu TabbedTextOutA GrayStringA IsWindowVisible GetClientRect GetWindowRect GetWindowLongA MessageBoxA SetCursorPos ClipCursor GetAsyncKeyState EqualRect SetParent GetWindowDC GetMessageA GetForegroundWindow GetGUIThreadInfo DestroyWindow PostThreadMessageA PeekMessageA TranslateMessage DispatchMessageA CallNextHookEx UnhookWindowsHookEx GetWindowThreadProcessId SetWindowsHookExA GetCursorPos ScreenToClient IsIconic DrawIcon LoadIconA LoadMenuA LoadCursorA CopyIcon PtInRect ReleaseCapture SetCapture wsprintfA SetForegroundWindow IsMenu SetWindowTextA EndDialog LoadImageA GetIconInfo SendInput UnregisterHotKey RegisterHotKey MapVirtualKeyA GetDoubleClickTime CheckMenuItem SetCaretPos GetCapture CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EnumDisplaySettingsA DefWindowProcA UnregisterClassA CreateWindowExA RegisterClassA ShowWindow EnumWindows SetClassLongA GetClassLongA SetRectEmpty GetFocus RegisterWindowMessageA IsRectEmpty UpdateWindow LockWindowUpdate BringWindowToTop GetClassInfoA DrawFrameControl ShowScrollBar LoadStringA DrawStateA FrameRect InflateRect OffsetRect DrawFocusRect ClientToScreen WindowFromPoint GetActiveWindow InvalidateRect SetCursor GetDlgCtrlID PostQuitMessage GetNextDlgTabItem DestroyCursor

gdi32

GetNearestColor SetPixelV CreateRectRgn GetCurrentObject GetBkColor GetBrushOrgEx SetBrushOrgEx RoundRect SetDIBits TextOutA Rectangle RectVisible GetDeviceCaps GetBkMode CreatePen ExtTextOutA Escape GetStockObject SetTextColor SetBkColor CreateBitmap CreateRectRgnIndirect GetDIBits CreateDCA CreateSolidBrush CreateFontIndirectA CreateCompatibleDC CreateCompatibleBitmap GetTextExtentPoint32W GetTextExtentPoint32A Ellipse DeleteDC DeleteObject BitBlt SelectObject CreateDIBSection SetPixel GetPixel GetObjectA PtVisible PatBlt

advapi32

CloseServiceHandle RegCreateKeyExA CreateServiceA DeleteService OpenServiceA StartServiceA ControlService OpenSCManagerA RegCloseKey RegQueryValueExA RegQueryValueA RegDeleteValueA RegOpenKeyExA RegSetValueExA

shell32

SHGetSpecialFolderPathA Shell_NotifyIconA SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteExA ShellExecuteA

comctl32

ImageList_GetImageCount ImageList_GetImageInfo ImageList_GetBkColor ImageList_SetBkColor ImageList_GetIcon ImageList_AddMasked ImageList_ReplaceIcon _TrackMouseEvent ImageList_Draw

ole32

CLSIDFromString CLSIDFromProgID StgCreateDocfileOnILockBytes CoInitializeEx CoUninitialize OleRun StgCreateDocfile CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes CoFreeUnusedLibraries ProgIDFromCLSID CoTaskMemFree StringFromCLSID CoInitialize CoCreateInstance

oleaut32

SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy SysStringLen SysAllocStringLen VariantCopy LoadTypeLi SysAllocString VariantInit VariantClear SysFreeString GetErrorInfo

urlmon

URLDownloadToFileA

msvcp60

?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ??_7runtime_error@std@@6B@ ??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ??0runtime_error@std@@QAE@ABV01@@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??Ostd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??Nstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??1runtime_error@std@@UAE@XZ ??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IID@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z ?_Doraise@runtime_error@std@@MBEXXZ ?what@runtime_error@std@@UBEPBDXZ ??1logic_error@std@@UAE@XZ ??0bad_exception@std@@QAE@ABV01@@Z ??1bad_exception@std@@UAE@XZ ??_7bad_exception@std@@6B@ ?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0PBD1@Z ?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ??_7logic_error@std@@6B@ ??8std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ?what@logic_error@std@@UBEPBDXZ ?_Xlen@std@@YAXXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??_8?$basic_ifstream@DU?$char_traits@D@std@@@std@@7B@ ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0locale@std@@QAE@XZ ??_7?$basic_filebuf@DU?$char_traits@D@std@@@std@@6B@ ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1ios_base@std@@UAE@XZ ??1locale@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ??0logic_error@std@@QAE@ABV01@@Z ??0out_of_range@std@@QAE@ABV01@@Z ??1out_of_range@std@@UAE@XZ ??_7out_of_range@std@@6B@ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?clear@ios_base@std@@QAEXH_N@Z ?_Stinit@?1??_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@23@@Z@4HA ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z ??_7?$basic_ifstream@DU?$char_traits@D@std@@@std@@6B@

winmm

timeGetTime PlaySoundA

shlwapi

SHDeleteKeyA PathFileExistsA

ws2_32

gethostbyname

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA

imagehlp

MakeSureDirectoryPathExists ImageNtHeader

dinput8

DirectInput8Create

uxtheme

SetThemeAppProperties

comdlg32

GetOpenFileNameA

olepro32

ord251

generic

count=1, id=29, version=9178,

count=2, id=28, version=9178,

count=2, id=25, version=9210,

count=22, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=16, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=9, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=3, id=11, version=8798,

count=18, id=19, version=8022,

count=22, id=19, version=8034,

count=3, id=11, version=8047,

count=11, id=10, version=8047,

count=4, id=4, version=8047,

count=8, id=12, version=7291,

count=9, id=14, version=7299,

count=2, id=4, version=9782,

count=5, id=93, version=2179,

count=33, productName=Unmarked objects (old),

count=1347, id=1, productName=Unmarked objects,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=136, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

GongShaFuZhu13/【x1】攻沙辅助/攻沙辅助v1.3.ini

SHA256 0e305bb46ce87dd332fcd0a05c6f6d014f2d6372c5a62ae385d8ddf9860433b3
MD5 b8b894334ca31a48477fff3d6ce8d0ba
SHA1 2d892ea187bed5446ae7911b519822907af4739e
SHA512 740bb962be023d2678e6e42bfea9855b2026bda69d265d72c073cc2cc164f7867b679988ef840c126de893b20ff46ab7b7cc652d747c891cbac9e5b023697459
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/更新记录.txt

SHA256 186d6ab4bd5a4921f57be53de2096b7f74bd777fd8ebc92a9d5885ce3afd0d4e
MD5 00cf0f9c5f5ab3d53c42547347ed5a10
SHA1 18ddeba343b44035852f06b2782a17f857741a5f
SHA512 8e302a614ab72196234b828770d23ebab5ee8a07baba916a6ff42327eb07482a067a06259effac93525b689f51d5c0804c4a101c1ffa4b7a3265ff11844071e0
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/辅助保留以前设置更新方法.txt

SHA256 c422f7fb017a6f9c47c6a9395486521da4dd6a0ca25783ef4ad1797afb99e620
MD5 da1efa24b05624dda09a95cdc5244893
SHA1 0c867ffbefa61eb47f1ec403207d2b9f4f3a7146
SHA512 74bdebe355df5338dab083e7ba485d8717722835b262f3acecd5387616de210e3dc34b3cbc5b0dcbe7e9ed21b23ce8e8da54b5476824dac6150536afab60d07d
MD5 SHA1 SHA512

GongShaFuZhu13/【x1】攻沙辅助/辅助浏览器-Browser.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ff4351ade586b170a211fcc58a91795a6e0c526d7e5714076210e32ab26c9132
MD5 06a7e93d59d85b421341e8f42a73304a
SHA1 89921c4d91ed76695a36c22aebd58ce43f13ff46
SHA512 cfdca04b1fe0eb08ebb82f5a4a3d0f52c7704c7feefc7b47691910563038994ec0e8fa7b599c5671861e88e39cc22e4a5e9b4f6c60af7a7ee2e48692b441d2c0
SSDEEP 1536:5Cz3tcnp0HSOBVbky/z3tcnp0HSOBVbkyz9NKgkfdTlrrKhi+z3tcnp0HSOBVbky:5Cz92+jBjz92+jBsIi+z92+jB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

103150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GongShaFuZhu13/【x1】攻沙辅助/辅助浏览器平台网址.txt

SHA256 d380879dc1856077f0edea594d65771477ae44fc1bd98fcfba9c3061f7d06778
MD5 3d2578cea35fb583a2325ef275dd52ad
SHA1 451b6b31d7377aa6d2ca200e1655e3f33e3d2c7c
SHA512 61fcc7ff371abc9b8b4fe1b3a8323f09fd77daa9e93c78f688454444aed62a21447c766fccc40cb865410af0643d6259187c4666be2578bda9b8f9f21d0b396e
MD5 SHA1 SHA512

GongShaFuZhu13/游迅网.url

SHA256 cde0b34adaa12cdc1a54e5d7ecf7a4875ffbafd69d6811c4e3f22344290f5c7a
MD5 1e73d11eb7965dda7e821b0d261600cf
SHA1 a781cb6a6eb203f0d19686e40ef1c8361ec22c23
SHA512 65325d5976db3f65ebf426a9cd4021d250a2bc43f6990996a2f553de08dc28e9a5b617decd9738f174de76c13e0cb047c634abbbd01a2047643c20fc9252429d
MD5 SHA1 SHA512

GongShaFuZhu13/说明.txt

SHA256 0e4a59349a9f4ed8c3d82f0502abe9d2b6ca22c326625fe85d4289e1df5d7238
MD5 8fe7763194b17afa45548d7b50f35bab
SHA1 096e275376f53cae0679c4c3c7e5e18588c46b27
SHA512 f19035748a835ccdc4479270b0b2fc632b1635a60c8291d7d2f957d94162c44221fdf1f4f318db838ceeed1d6881826d88bed3f5f54c73eaa44b701d7e2b8de2
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer