0611c84a4c3f16db1384c17c13d1d966a7a35a779e5923d570b6be5d848cd0b5

Sharing

Copy URL Twitter E-mail

General

Target

0611c84a4c3f16db1384c17c13d1d966a7a35a779e5923d570b6be5d848cd0b5
Size

8.9MB
MD5

ea2f419e61d6e86503706953d5f01b78
SHA1

d969c50187b68f171592101874041d3c27c28959
SHA256

0611c84a4c3f16db1384c17c13d1d966a7a35a779e5923d570b6be5d848cd0b5
SHA512

b38af0fe03c29289701784f1a0dc121ca387966aee68527cb35e05f289da0b3fbb673984720eda670498048f8ebd8645afe60360d426d985fe66aae6bc8a76fe
SSDEEP

196608:byW7OyYYMXjfkrKlOzoZvAoBP6fLpSsfZmx9vPBWeQcpotgUk:byWyMlSOMZvAoBCdShOTS

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bazifuzugongju-main/BaZiFuZuGongJu/lunar.dll
unpack001/bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.dll
unpack001/bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/apphost.exe
unpack001/bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/ref/BaZiFuZuGongJu.dll
unpack001/bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/refint/BaZiFuZuGongJu.dll
unpack001/bazifuzugongju-main/八字排盘工具v96.exe

Office document contains embedded OLE objects 2 IoCs

Detected embedded OLE objects in Office documents.

resource	yara_rule
sample	office_ole_embedded
static1/unpack001/bazifuzugongju-main/易学/天干地支的关系/十二长生.docx	office_ole_embedded

Files

0611c84a4c3f16db1384c17c13d1d966a7a35a779e5923d570b6be5d848cd0b5
.zip
bazifuzugongju-main/BaZiFuZuGongJu/128X128.ico
bazifuzugongju-main/BaZiFuZuGongJu/BaZiFuZuGongJu.csproj
bazifuzugongju-main/BaZiFuZuGongJu/BaZiFuZuGongJu.csproj.user
bazifuzugongju-main/BaZiFuZuGongJu/BaZiFuZuGongJu.sln
bazifuzugongju-main/BaZiFuZuGongJu/Form1.Designer.cs
bazifuzugongju-main/BaZiFuZuGongJu/Form1.cs
bazifuzugongju-main/BaZiFuZuGongJu/Form1.resx
.vbs
bazifuzugongju-main/BaZiFuZuGongJu/Program.cs
bazifuzugongju-main/BaZiFuZuGongJu/lunar.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/Users/apple/work/netstandard2.0/lunar-csharp/lunar/obj/Release/netstandard2.0/lunar.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 405KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bazifuzugongju-main/BaZiFuZuGongJu/obj/BaZiFuZuGongJu.csproj.nuget.dgspec.json
bazifuzugongju-main/BaZiFuZuGongJu/obj/BaZiFuZuGongJu.csproj.nuget.g.props
bazifuzugongju-main/BaZiFuZuGongJu/obj/BaZiFuZuGongJu.csproj.nuget.g.targets
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/BaZiFuZuGongJu.1.0.0.nuspec
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/BaZiFuZuGongJu杜净隆.7.2.0.nuspec
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.AssemblyInfo.cs
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.AssemblyInfoInputs.cache
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.Form1.resources
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.GeneratedMSBuildEditorConfig.editorconfig
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.GlobalUsings.g.cs
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.assets.cache
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.csproj.AssemblyReference.cache
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.csproj.CoreCompileInputs.cache
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.csproj.FileListAbsolute.txt
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.csproj.GenerateResource.cache
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.designer.deps.json
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.designer.runtimeconfig.json
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.dll
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BaZiFuZuGongJu\obj\Debug\net8.0-windows10.0.22621.0\BaZiFuZuGongJu.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.genruntimeconfig.cache
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/BaZiFuZuGongJu.pdb
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/apphost.exe
.exe windows:6 windows x64 arch:x64

5c16479801aac25e19e4d3e71f54842d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

Imports

kernel32

FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_exit
__p___argc
__p___wargv
_c_exit
_errno
_register_thread_local_exe_atexit_callback
exit
_configure_wide_argv
abort
_initterm_e
_initterm
_initialize_wide_environment
_get_initial_wide_environment
terminate
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__p__commode
setvbuf
__stdio_common_vswprintf
_set_fmode
__stdio_common_vfwprintf
fflush
__stdio_common_vsnwprintf_s
_wfsopen
fputws
fputwc
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
malloc
calloc
_callnewh

api-ms-win-crt-string-l1-1-0

strcpy_s
wcsncmp
toupper
wcsnlen
_wcsdup

api-ms-win-crt-convert-l1-1-0

wcstoul
_wtoi

api-ms-win-crt-time-l1-1-0

_gmtime64_s
wcsftime
_time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func
___lc_codepage_func
___lc_locale_name_func
_configthreadlocale
setlocale
_unlock_locales
_lock_locales
__pctype_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 792B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/ref/BaZiFuZuGongJu.dll
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.mvid
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bazifuzugongju-main/BaZiFuZuGongJu/obj/Debug/net8.0-windows10.0.22621.0/refint/BaZiFuZuGongJu.dll
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.mvid
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bazifuzugongju-main/BaZiFuZuGongJu/obj/project.assets.json
bazifuzugongju-main/BaZiFuZuGongJu/obj/project.nuget.cache
bazifuzugongju-main/README.md
bazifuzugongju-main/八字排盘工具v96.exe
.exe windows:4 windows x86 arch:x86

340b26a6ac96e1f65d062cee2842c6ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysAllocStringLen
SysAllocString
VariantClear
SysFreeString
SysStringLen

ole32

CoUninitialize
CoTaskMemFree
CoCreateInstance
CoInitialize
OleInitialize

user32

CheckDlgButton
IsDlgButtonChecked
EndDialog
SetDlgItemTextW
GetFocus
SetFocus
GetKeyState
InvalidateRect
SetWindowTextW
EnableWindow
PostMessageW
MessageBoxW
DialogBoxParamW
SetWindowLongW
GetWindowLongW
SetTimer
GetParent
ShowWindow
MoveWindow
ScreenToClient
GetDlgItem
GetWindowRect
MapDialogRect
MonitorFromWindow
GetMonitorInfoA
SystemParametersInfoW
GetWindowTextLengthW
GetWindowTextW
SendMessageW
LoadStringW
SetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
CharUpperW
LoadIconW
SetCursor
LoadCursorW
KillTimer

shell32

SHBrowseForFolderW
SHGetFileInfoW
SHGetPathFromIDListW

msvcrt

free
wcsstr
wcscmp
strlen
_beginthreadex
_except_handler3
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
memcpy
memmove
memset
_purecall
memcmp
_CxxThrowException
__CxxFrameHandler
malloc

kernel32

GetStartupInfoA
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
GetVersion
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
SetPriorityClass
WaitForMultipleObjects
DeleteCriticalSection
Sleep
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GlobalFree
GlobalAlloc
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
GetFileInformationByHandle
GetFileAttributesW
GetModuleHandleA
FindNextFileW
FindFirstFileW
FindClose
GetTickCount
GetCurrentDirectoryW
SetLastError
DeleteFileW
CreateDirectoryW
GetModuleHandleW
MoveFileW
RemoveDirectoryW
SetFileAttributesW
CreateFileW
SetFileTime
CloseHandle
GetSystemDirectoryW
FormatMessageW
LocalFree
GetModuleFileNameW
LoadLibraryExW
GlobalLock
GlobalUnlock
MultiByteToWideChar
GetLastError
LoadLibraryW
GetProcAddress
FreeLibrary
GetCommandLineW
GetVersionExW

Sections

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bazifuzugongju-main/易学/《道德经》原版全文及译文.txt
bazifuzugongju-main/易学/具体算法.txt
bazifuzugongju-main/易学/十神详解/七杀.txt
bazifuzugongju-main/易学/十神详解/伤官.txt
bazifuzugongju-main/易学/十神详解/偏财.txt
bazifuzugongju-main/易学/十神详解/劫财.txt
bazifuzugongju-main/易学/十神详解/枭神.txt
bazifuzugongju-main/易学/十神详解/正印.txt
bazifuzugongju-main/易学/十神详解/正官.txt
bazifuzugongju-main/易学/十神详解/正财.txt
bazifuzugongju-main/易学/十神详解/比肩.txt
bazifuzugongju-main/易学/十神详解/食神.txt
bazifuzugongju-main/易学/古今中外名人八字集锦.txt
bazifuzugongju-main/易学/合冲刑破害/八字算命中的暗合.txt
bazifuzugongju-main/易学/合冲刑破害/半三合.txt
bazifuzugongju-main/易学/合冲刑破害/地支三会.txt
bazifuzugongju-main/易学/合冲刑破害/地支三合.txt
bazifuzugongju-main/易学/合冲刑破害/地支六冲.txt
bazifuzugongju-main/易学/合冲刑破害/地支六合.txt
bazifuzugongju-main/易学/合冲刑破害/地支六害.txt
bazifuzugongju-main/易学/合冲刑破害/地支六破.txt
bazifuzugongju-main/易学/合冲刑破害/地支相刑.txt
bazifuzugongju-main/易学/合冲刑破害/天干五合.txt
bazifuzugongju-main/易学/合冲刑破害/天干冲.txt
bazifuzugongju-main/易学/合冲刑破害/拱合.txt
bazifuzugongju-main/易学/周易起名字.txt
bazifuzugongju-main/易学/基本知识.txt
bazifuzugongju-main/易学/天干地支MAX.png
.png .ps1 polyglot
bazifuzugongju-main/易学/天干地支及其阴阳的天文学背景.txt
bazifuzugongju-main/易学/天干地支的关系/以“五行”破解五脏六腑之疾病.txt
bazifuzugongju-main/易学/天干地支的关系/伏吟的判断方法.txt
bazifuzugongju-main/易学/天干地支的关系/入墓库出墓库.txt
bazifuzugongju-main/易学/天干地支的关系/十二长生.docx
.docx office2007
bazifuzugongju-main/易学/天干地支的关系/四墓库详解.txt
bazifuzugongju-main/易学/天干地支的关系/墓库运.txt
bazifuzugongju-main/易学/天干地支的关系/天干地支与人体器官之对应.txt
bazifuzugongju-main/易学/天干地支的关系/天干地支入门知识.txt
bazifuzugongju-main/易学/天干地支的关系/方位.txt
bazifuzugongju-main/易学/神煞精解查询/《三奇贵人》.txt
bazifuzugongju-main/易学/神煞精解查询/《五鬼》.txt
bazifuzugongju-main/易学/神煞精解查询/《亡神》.txt
bazifuzugongju-main/易学/神煞精解查询/《伏吟》.txt
bazifuzugongju-main/易学/神煞精解查询/《元辰》.txt
bazifuzugongju-main/易学/神煞精解查询/《内桃花》.txt
bazifuzugongju-main/易学/神煞精解查询/《劫煞》.txt
bazifuzugongju-main/易学/神煞精解查询/《勾绞煞》.txt
bazifuzugongju-main/易学/神煞精解查询/《十恶大败》.txt
bazifuzugongju-main/易学/神煞精解查询/《十灵日》.txt
bazifuzugongju-main/易学/神煞精解查询/《华盖》.txt
bazifuzugongju-main/易学/神煞精解查询/《咸池》.txt
bazifuzugongju-main/易学/神煞精解查询/《四废日》.txt
bazifuzugongju-main/易学/神煞精解查询/《国印贵人》.txt
bazifuzugongju-main/易学/神煞精解查询/《墓库》.txt
bazifuzugongju-main/易学/神煞精解查询/《天乙贵人》.txt
bazifuzugongju-main/易学/神煞精解查询/《天医》.txt
bazifuzugongju-main/易学/神煞精解查询/《天厨贵人》.txt
bazifuzugongju-main/易学/神煞精解查询/《天喜》.txt
bazifuzugongju-main/易学/神煞精解查询/《天官贵人》.txt
bazifuzugongju-main/易学/神煞精解查询/《天德贵人》.txt
bazifuzugongju-main/易学/神煞精解查询/《天狗》.txt
bazifuzugongju-main/易学/神煞精解查询/《天罗地网》.txt
bazifuzugongju-main/易学/神煞精解查询/《天赦》.txt
bazifuzugongju-main/易学/神煞精解查询/《太极贵人》.txt
bazifuzugongju-main/易学/神煞精解查询/《孤辰寡宿》.txt
bazifuzugongju-main/易学/神煞精解查询/《孤鸾煞》.txt
bazifuzugongju-main/易学/神煞精解查询/《学堂》.txt
bazifuzugongju-main/易学/神煞精解查询/《将星》.txt
bazifuzugongju-main/易学/神煞精解查询/《德秀贵人》.txt
bazifuzugongju-main/易学/神煞精解查询/《文昌》.txt
bazifuzugongju-main/易学/神煞精解查询/《文曲星》.txt
bazifuzugongju-main/易学/神煞精解查询/《月德贵人》.txt
bazifuzugongju-main/易学/神煞精解查询/《正桃花》.txt
bazifuzugongju-main/易学/神煞精解查询/《流霞煞》.txt
bazifuzugongju-main/易学/神煞精解查询/《灾煞》.txt
bazifuzugongju-main/易学/神煞精解查询/《白虎煞》.txt
bazifuzugongju-main/易学/神煞精解查询/《破碎煞》.txt
bazifuzugongju-main/易学/神煞精解查询/《禄神》.txt
bazifuzugongju-main/易学/神煞精解查询/《福德贵人》.txt
bazifuzugongju-main/易学/神煞精解查询/《福星贵人》.txt
bazifuzugongju-main/易学/神煞精解查询/《空亡》.txt
bazifuzugongju-main/易学/神煞精解查询/《童子煞》.txt
bazifuzugongju-main/易学/神煞精解查询/《红艳煞》.txt
bazifuzugongju-main/易学/神煞精解查询/《红鸾星》.txt
bazifuzugongju-main/易学/神煞精解查询/《金匮星》.txt
bazifuzugongju-main/易学/神煞精解查询/《金神》.txt
bazifuzugongju-main/易学/神煞精解查询/《金舆》.txt
bazifuzugongju-main/易学/神煞精解查询/《铁扫》.txt
bazifuzugongju-main/易学/神煞精解查询/《阴阳差错》.txt
bazifuzugongju-main/易学/神煞精解查询/《隔角煞》.txt
bazifuzugongju-main/易学/神煞精解查询/《飞刃》.txt
bazifuzugongju-main/易学/神煞精解查询/《馆词》.txt
bazifuzugongju-main/易学/神煞精解查询/《驿马》.txt
bazifuzugongju-main/易学/神煞精解查询/《魁罡》.txt
bazifuzugongju-main/易学/纳音全解.txt
bazifuzugongju-main/易学/身旺弱与方位.png
.png

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 405KB - Virtual size: 404KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rsrc Size: 66KB - Virtual size: 65KB

.reloc Size: 512B - Virtual size: 12B

5c16479801aac25e19e4d3e71f54842d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 88KB - Virtual size: 88KB

.rdata Size: 37KB - Virtual size: 37KB

.data Size: 2KB - Virtual size: 5KB

.pdata Size: 5KB - Virtual size: 4KB

_RDATA Size: 512B - Virtual size: 348B

.reloc Size: 1024B - Virtual size: 792B

.rsrc Size: 66KB - Virtual size: 65KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.mvid Size: 512B - Virtual size: 16B

.text Size: 2KB - Virtual size: 1KB

.rsrc Size: 66KB - Virtual size: 65KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.mvid Size: 512B - Virtual size: 16B

.text Size: 2KB - Virtual size: 1KB

.rsrc Size: 66KB - Virtual size: 65KB

.reloc Size: 512B - Virtual size: 12B

340b26a6ac96e1f65d062cee2842c6ed

Headers

DLL Characteristics

File Characteristics

Imports

.text
Size: 405KB - Virtual size: 404KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 1.6MB - Virtual size: 1.6MB

.rsrc
Size: 66KB - Virtual size: 65KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 88KB - Virtual size: 88KB

.rdata
Size: 37KB - Virtual size: 37KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 5KB - Virtual size: 4KB

_RDATA
Size: 512B - Virtual size: 348B

.reloc
Size: 1024B - Virtual size: 792B

.rsrc
Size: 66KB - Virtual size: 65KB

.mvid
Size: 512B - Virtual size: 16B

.text
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 66KB - Virtual size: 65KB

.reloc
Size: 512B - Virtual size: 12B

.mvid
Size: 512B - Virtual size: 16B

.text
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 66KB - Virtual size: 65KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 171KB - Virtual size: 170KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 512B - Virtual size: 17KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 10KB - Virtual size: 9KB