0d1b59122989f96b0d75e30c2dbeae94_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
0d1b59122989f96b0d75e30c2dbeae94_JaffaCakes118
Size 2.0MB
Sample240502-bvzaksdb4s
SHA256 d95cb9eb34bf8a32f075c83d4d2badc5eeeee69d8c1ef4c9d1883899d745a149
MD5 0d1b59122989f96b0d75e30c2dbeae94
SHA1 ab845590cf79abf11a0a3fa48213ca65317adb79
SHA512 70b77a223e6efd6e0afe7006f73740cc64e9511b586eeb6c1ceb1e22d2b5d8ed24c7dd02883b44668d26895bed6141046d30c82b2a2add7854bbf02966807b62
SSDEEP 49152:pNlSAdrafQuRIitKlBmWWDO9LzHR8D2zmA:7lpAQ3EKlArELzxs2zmA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack002/HID.dll
unpack002/LOLHTCHINA.dll
unpack001/英雄配置文件双击运行不要改目录.exe

File Explorer

0d1b59122989f96b0d75e30c2dbeae94_JaffaCakes118

.rar 2.0MB
F8 F9中文翻译.txt

1KB
F8F9图片对照翻译.jpg

.jpg 753KB
xzone5.7 插件解压后文件放国服game 文件夹下.rar

.rar 1.1MB
HID.dll

.dll 832KB
LOLHTCHINA.dll

.dll 806KB
英雄配置文件双击运行不要改目录.exe

.exe 289KB
辅助中文对照表.txt

1KB
辅助功能说明.txt

3KB
连招说明.txt

2KB
配置文件解压密码 .txt

40B

0d1b59122989f96b0d75e30c2dbeae94_JaffaCakes118

SHA256 d95cb9eb34bf8a32f075c83d4d2badc5eeeee69d8c1ef4c9d1883899d745a149
MD5 0d1b59122989f96b0d75e30c2dbeae94
SHA1 ab845590cf79abf11a0a3fa48213ca65317adb79
SHA512 70b77a223e6efd6e0afe7006f73740cc64e9511b586eeb6c1ceb1e22d2b5d8ed24c7dd02883b44668d26895bed6141046d30c82b2a2add7854bbf02966807b62
SSDEEP 49152:pNlSAdrafQuRIitKlBmWWDO9LzHR8D2zmA:7lpAQ3EKlArELzxs2zmA
MD5 SHA1 SHA512 SSDEEP

HID.dll

IMPHASH 5d25ec35574374e562f07a5e5f27e807
SHA256 885fa2612fd39c55572ce0e8c87183505a1e93b6e5b014b2c6f72d217a41032c
MD5 787253ad5c2012fc889e80b2fb6742a1
SHA1 e0549ffe6d8c124ee86693b8393d169ceeb692a0
SHA512 b9dec41e7ee61bfb3b325b1ddbf90502edf0accce349d5d62f13ead7c8549e7ba2ec90f3c8c4f827f49933057dedc6926345deaccb13d12a12cdfe7d6da646c8
SSDEEP 12288:fixEvuxzhaaWtbL5cT6/OUo9PzrDPzL0wFgmq:fTuzFWt5ce/9o9rHzL0tm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

946176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winmm

midiStreamOut midiStreamRestart midiStreamClose midiOutReset midiStreamStop waveOutGetNumDevs midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause waveOutReset waveOutClose

ws2_32

WSAAsyncSelect recv ioctlsocket closesocket WSACleanup inet_ntoa accept recvfrom getpeername

kernel32

SetLastError GetTimeZoneInformation GetVersion GetStringTypeW GetStringTypeA SetUnhandledExceptionFilter IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetACP HeapSize RaiseException GetLocalTime GetSystemTime RtlUnwind GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement TerminateProcess GetFileSize SetFilePointer WideCharToMultiByte MultiByteToWideChar GetCurrentProcess CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock FindFirstFileA FindClose GetFileAttributesA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount WaitForSingleObject CloseHandle CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetStdHandle InterlockedExchange

user32

IsWindowEnabled ShowWindow SystemParametersInfoA GetDlgCtrlID CreateAcceleratorTableA CreateMenu ModifyMenuA AppendMenuA CreatePopupMenu DrawIconEx CreateIconFromResource CreateIconFromResourceEx RegisterClipboardFormatA SetRectEmpty DispatchMessageA GetMessageA LoadImageA DrawFocusRect DrawEdge DrawFrameControl TranslateMessage LoadIconA GetForegroundWindow EnumDisplaySettingsA ClientToScreen GetDesktopWindow GetClassNameA TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA EnableMenuItem WindowFromPoint GetSubMenu GetDlgItem IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBeep MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA GetWindowTextA GetSysColorBrush LoadStringA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions UnregisterClassA

gdi32

SetWindowExtEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetTextColor SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject GetObjectA CreatePen ScaleWindowExtEx CombineRgn CreateRectRgn FillRgn CreateSolidBrush GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps GetClipRgn SetStretchBltMode CreateRectRgnIndirect SetBkColor GetClipBox ExcludeClipRect MoveToEx LineTo ExtSelectClipRgn GetViewportExtEx PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextMetricsA StretchBlt CreatePalette GetSystemPaletteEntries CreateDIBitmap DeleteObject PatBlt CreatePolygonRgn SelectClipRgn

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegOpenKeyExA RegSetValueExA RegQueryValueA RegCreateKeyExA RegCloseKey

shell32

ShellExecuteA Shell_NotifyIconA

ole32

OleInitialize OleUninitialize CLSIDFromString

oleaut32

LoadTypeLi RegisterTypeLi UnRegisterTypeLi

comctl32

ord17 ImageList_Destroy

comdlg32

GetSaveFileNameA ChooseColorA GetFileTitleA GetOpenFileNameA

Name

.text

Size

512KB

Virtual Size

509KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rmnet

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

LOLHTCHINA.dll

IMPHASH 748c428fb24e5d47aea73c226af601ff
SHA256 6d1bb7b061a8dc7269d67ed9274a257191c3b254f09ae535506b76ce85a2b93e
MD5 0028c81b1416b355970fe691e3eebaaf
SHA1 6992d48af54e7de0649ff145e2b11864b8692893
SHA512 e79689ac11dd8b2f196af7ea4c6177f48e33945bdf66919e814bbf0427d0273af1c5a585213cd19133b7b6b9548a337635839b67137e1a4ca38e133fb0f151cf
SSDEEP 24576:Cj6O2kI/tPNfRSRjd0nCvLQs0WIhUDWYbD:Cj6F/tPNIRjmCvLzrmUDnbD
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1128749

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetVersion GetCurrentThreadId InterlockedDecrement InterlockedIncrement VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenA lstrcpynA LoadLibraryExA GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary FindFirstFileA FindClose ExitProcess WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle TlsSetValue TlsGetValue TlsFree TlsAlloc LocalFree LocalAlloc WriteProcessMemory WritePrivateProfileStringA WriteFile WaitForSingleObject VirtualQuery VirtualProtectEx VirtualProtect VirtualFree VirtualAllocEx VirtualAlloc TerminateProcess Sleep SetThreadPriority SetFilePointer SetEvent SetEndOfFile ResetEvent ReadFile OpenProcess OpenMutexA LoadLibraryA LeaveCriticalSection IsBadReadPtr InitializeCriticalSection GlobalUnlock GlobalReAlloc GlobalHandle GlobalLock GlobalFree GlobalFindAtomA GlobalAlloc GetWindowsDirectoryA GetVersionExA GetVersion GetTickCount GetThreadLocale GetStringTypeExA GetStdHandle GetProcAddress GetPrivateProfileStringA GetModuleHandleA GetModuleFileNameA GetLocaleInfoA GetLocalTime GetLastError GetFullPathNameA GetFileAttributesA GetDiskFreeSpaceA GetDateFormatA GetCurrentThreadId GetCurrentProcessId GetCurrentProcess GetCPInfo GetACP FormatMessageA FindNextFileA FindFirstFileA FindClose FileTimeToLocalFileTime FileTimeToDosDateTime ExitProcess EnumCalendarInfoA EnterCriticalSection DisableThreadLibraryCalls DeleteCriticalSection CreateThread CreateMutexA CreateFileA CreateEventA CreateDirectoryA CompareStringA CloseHandle Sleep LoadLibraryA GetProcAddress GetLastError FreeLibrary InitializeCriticalSection GetModuleFileNameW GetModuleHandleW TerminateProcess GetCurrentProcess DeleteCriticalSection LoadLibraryW CreateEventW CompareStringW SetLastError GetModuleHandleA VirtualProtect GetTickCount EnterCriticalSection LeaveCriticalSection VirtualFree VirtualAlloc WriteProcessMemory CreateToolhelp32Snapshot GetCurrentProcessId GetCurrentThreadId Thread32First OpenThread Thread32Next CloseHandle SuspendThread ResumeThread GetSystemInfo LoadResource MultiByteToWideChar WideCharToMultiByte FindResourceExW FindResourceExA GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW HeapAlloc HeapFree HeapDestroy HeapCreate GetSystemTime GetLocalTime SystemTimeToFileTime CompareFileTime GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree LCMapStringA LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WriteFile GetStdHandle GetModuleFileNameA RaiseException Sleep ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA RtlUnwind HeapSize SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers VirtualQuery GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

GetKeyboardType LoadStringA MessageBoxA CharNextA MessageBoxA LoadStringA GetSystemMetrics GetAsyncKeyState CharNextA CharLowerBuffA CharUpperBuffA CharToOemA MessageBoxTimeoutA MessageBoxW CharUpperBuffW

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegQueryValueExA RegOpenKeyExA RegFlushKey RegCreateKeyExA RegCloseKey

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

d3dx9_33

D3DXCreateTextureFromResourceExA D3DXCreateTextureFromFileExA D3DXGetImageInfoFromResourceA D3DXGetImageInfoFromFileA D3DXCreateLine D3DXCreateFontA D3DXCreateSprite D3DXVec3Project

ntdll

NtQueryInformationProcess

Name

CODE

Size

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xzr0

Size

Virtual Size

583KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xzr1

Size

803KB

Virtual Size

802KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

英雄配置文件双击运行不要改目录.exe

IMPHASH 3eaa732d4dae53340f9646bdd85dac41
SHA256 3a0fb6adef6b1d47bf5d65b2dfa39c122c075468d80be554ff28fcaf65a39740
MD5 0beb4fad2a27b6f1cac52926a0042a66
SHA1 e298d249ec2b05a17be94922c4836368c4947329
SHA512 f8c756dee808ed9da55cd0c2deeabf74ccd8340dfd9187449528575e17b94f37c3205ba3e7b8ca4917c1bb196ea97ba622bfbcc33ef81346933e8b0e4b9f064b
SSDEEP 6144:Oa4InuJg58BkgqPoDH49n8Bb/cT0L3o/xsXG145:Oat0EAH49n8Bhuj4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

comctl32

InitCommonControlsEx

shlwapi

SHAutoComplete

kernel32

ReadFile GetFileAttributesW SetFileAttributesW FindNextFileW GetFullPathNameW GetModuleFileNameW FindResourceW GetModuleHandleW FreeLibrary GetProcAddress LoadLibraryW GetCurrentProcessId GetLocaleInfoW GetNumberFormatW ExpandEnvironmentStringsW WaitForSingleObject DosDateTimeToFileTime GetDateFormatW GetTimeFormatW FileTimeToSystemTime FileTimeToLocalFileTime GetExitCodeProcess GetTempPathW MoveFileExW Sleep UnmapViewOfFile MapViewOfFile GetCommandLineW CreateFileMappingW GetTickCount SetEnvironmentVariableW OpenFileMappingW CreateThread EnterCriticalSection LeaveCriticalSection GetProcessAffinityMask ReleaseSemaphore ResetEvent DeleteCriticalSection SetEvent SetThreadPriority InitializeCriticalSection CreateEventW CreateSemaphoreW SystemTimeToFileTime GetSystemTime LocalFileTimeToFileTime WideCharToMultiByte MultiByteToWideChar CompareStringW IsDBCSLeadByte FindFirstFileW GetFileType SetCurrentDirectoryW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetStringTypeW GetStringTypeA LoadLibraryA GetConsoleMode GetConsoleCP InitializeCriticalSectionAndSpinCount QueryPerformanceCounter SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetModuleFileNameA ExitProcess HeapSize IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess VirtualAlloc VirtualFree HeapCreate InterlockedDecrement GetCurrentThreadId InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetStartupInfoA GetCommandLineA RaiseException GetSystemTimeAsFileTime SetEndOfFile SetFilePointer GetStdHandle WriteFile FlushFileBuffers GetLongPathNameW MoveFileW GetShortPathNameW CreateDirectoryW RemoveDirectoryW GlobalAlloc DeleteFileW FindClose CreateFileW DeviceIoControl SetFileTime GetCurrentProcess CloseHandle CreateHardLinkW SetLastError GetLastError GetCurrentDirectoryW CreateFileA GetCPInfo HeapAlloc HeapReAlloc HeapFree RtlUnwind

user32

EnableWindow ShowWindow GetDlgItem MessageBoxW FindWindowExW GetParent MapWindowPoints CreateWindowExW UpdateWindow LoadCursorW RegisterClassExW DefWindowProcW DestroyWindow CopyRect IsWindow CharUpperW OemToCharBuffA LoadIconW PostMessageW GetSysColor SetForegroundWindow WaitForInputIdle IsWindowVisible DialogBoxParamW DestroyIcon SetFocus GetClassNameW SendDlgItemMessageW EndDialog GetDlgItemTextW SetDlgItemTextW wvsprintfW SendMessageW GetDC ReleaseDC PeekMessageW GetMessageW TranslateMessage DispatchMessageW LoadStringW GetWindowRect GetClientRect SetWindowPos GetWindowTextW SetWindowTextW GetSystemMetrics GetWindow GetWindowLongW SetWindowLongW LoadBitmapW

gdi32

GetDeviceCaps CreateCompatibleDC GetObjectW CreateCompatibleBitmap SelectObject StretchBlt DeleteDC DeleteObject

comdlg32

GetSaveFileNameW CommDlgExtendedError GetOpenFileNameW

advapi32

RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegSetValueExW RegCloseKey SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

shell32

SHChangeNotify SHGetFileInfoW SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteExW SHFileOperationW

ole32

CLSIDFromString CoCreateInstance OleInitialize OleUninitialize CreateStreamOnHGlobal

oleaut32

VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

0d1b59122989f96b0d75e30c2dbeae94_JaffaCakes118

F8 F9中文翻译.txt

F8F9图片对照翻译.jpg

xzone5.7 插件解压后文件 放国服game 文件夹下.rar

HID.dll

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

comdlg32

generic

LOLHTCHINA.dll

kernel32

user32

advapi32

oleaut32

d3dx9_33

ntdll

generic

英雄配置文件双击运行不要改目录.exe

comctl32

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

辅助中文对照表.txt

辅助功能说明.txt

连招说明.txt

配置文件解压密码 .txt

xzone5.7 插件解压后文件放国服game 文件夹下.rar