blackmoon | a7f5926b055adfd307ab599c53eb1a3e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a7f5926b055adfd307ab599c53eb1a3e_JaffaCakes118
Size

5.1MB
MD5

a7f5926b055adfd307ab599c53eb1a3e
SHA1

350b6725efcf8e0e4f4eb03e5f97cca44c764ae0
SHA256

ce5d4da734e24fac7c0826f8adf7a041f2f0f8ee16ec8bab1632c1b013d7afb9
SHA512

baa744ff066e1ce384bed738578045f2441e0f663a0769ec50304ba821cb31cf7f4d220061ec0f27fa37bc9971e41b1d1def9105e610894dfd09f8b77ae1fc63
SSDEEP

98304:ZimmugItdMCmdp7wJ5dsGWnz3ju4Tkoee0ZvJWLtizCDVQtbTfAYN7na:Y7uzdFmdVg5BWnTj3kbZxdCutbToYN7a

Score

10^/10

upx blackmoon

Malware Config

Signatures

Blackmoon family
blackmoon

Detect Blackmoon payload 1 IoCs

resource	yara_rule
static1/unpack001/仙侣情缘2.5A完整包/华景机器人专用/QQRobotsApi.dll	family_blackmoon

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/仙侣情缘2.5A完整包/酷Q机器人专用/cqapi.dll	acprotect
static1/unpack001/仙侣情缘2.5A完整包/酷Q机器人专用/plugin/.onoff.cqp.dll	acprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/仙侣情缘2.5A完整包/酷Q机器人专用/CoolQ.exe	upx
static1/unpack001/仙侣情缘2.5A完整包/酷Q机器人专用/cqapi.dll	upx
static1/unpack001/仙侣情缘2.5A完整包/酷Q机器人专用/plugin/.onoff.cqp.dll	upx

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack001/仙侣情缘2.5A完整包/华景机器人专用/CQapi.dll
unpack001/仙侣情缘2.5A完整包/华景机器人专用/QQRobots.exe
unpack001/仙侣情缘2.5A完整包/华景机器人专用/QQRobotsApi.dll
unpack001/仙侣情缘2.5A完整包/华景机器人专用/RobotProtect.exe
unpack001/仙侣情缘2.5A完整包/华景机器人专用/plugin/仙侣2.5A内测版体验版.cqp.dll
unpack002/out.upx
unpack003/out.upx
unpack001/仙侣情缘2.5A完整包/酷Q机器人专用/cskin.dll
unpack001/仙侣情缘2.5A完整包/酷Q机器人专用/plugin/.onoff.cqp.dll
unpack001/仙侣情缘2.5A完整包/酷Q机器人专用/plugin/仙侣2.5A内测版体验版.cqp.dll
unpack001/仙侣情缘2.5A完整包/酷Q机器人专用/sqlite3.dll

Files

a7f5926b055adfd307ab599c53eb1a3e_JaffaCakes118
.rar
仙侣情缘2.5A完整包/仙侣情2.5GM手册.doc
.doc windows office2003
仙侣情缘2.5A完整包/仙侣新手手册以及攻略.doc
.doc windows office2003
仙侣情缘2.5A完整包/华景机器人专用/CQapi.dll
.dll windows:4 windows x86 arch:x86

bd9b2189a40f2711f7dee0c8505466d1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalUnlock
SetStdHandle
IsBadCodePtr
IsBadReadPtr
CompareStringW
CompareStringA
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualAlloc
FindClose
LCMapStringA
SetEnvironmentVariableA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetACP
HeapSize
TerminateProcess
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
ReadFile
GetLastError
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
WinExec
lstrcpyA
FindNextFileA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetFullPathNameA
FreeLibrary
LoadLibraryA
lstrlenA
GetVersionExA
WritePrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
FindFirstFileA
GlobalLock
GetFileTime
GetFileSize
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GetVersion
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetCurrentProcess
DuplicateHandle
lstrcpynA
SetLastError
GetFileAttributesA
SetCurrentDirectoryA
FileTimeToLocalFileTime
FileTimeToSystemTime
LocalFree
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
LCMapStringW
CloseHandle

user32

OpenClipboard
GetClipboardData
CloseClipboard
SetClipboardData
EmptyClipboard
wsprintfA
GetSystemMetrics
GetCursorPos
MessageBoxA
SetWindowPos
SendMessageA
DestroyCursor
SetParent
IsWindow
PostMessageA
GetTopWindow
GetParent
GetFocus
GetClientRect
InvalidateRect
ValidateRect
UpdateWindow
EqualRect
GetWindowRect
SetForegroundWindow
DestroyMenu
IsChild
ReleaseDC
IsRectEmpty
FillRect
SystemParametersInfoA
TranslateMessage
LoadIconA
DrawFrameControl
DrawEdge
DrawFocusRect
WindowFromPoint
GetMessageA
DispatchMessageA
SetRectEmpty
RegisterClipboardFormatA
CreateIconFromResourceEx
CreateIconFromResource
DrawIconEx
CreatePopupMenu
AppendMenuA
ModifyMenuA
CreateMenu
CreateAcceleratorTableA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetClassInfoA
DefWindowProcA
GetDlgCtrlID
GetSubMenu
EnableMenuItem
ClientToScreen
EnumDisplaySettingsA
LoadImageA
GetKeyState
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetWindowTextA
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
GetDlgItem
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetDC
GetLastActivePopup
GetMessageTime
RemovePropA
CallWindowProcA
GetPropA
UnhookWindowsHookEx
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
CreateWindowExA
GetMenuItemID
GetMenuItemCount
RegisterClassA
GetScrollPos
GetForegroundWindow
AdjustWindowRectEx
MapWindowPoints
SendDlgItemMessageA
ScrollWindowEx
IsDialogMessageA
SetWindowTextA
MoveWindow
CheckMenuItem
SetMenuItemBitmaps
GetMenuState
GetMenuCheckMarkDimensions
GetClassNameA
GetDesktopWindow
UnregisterClassA
LoadStringA
GetSysColorBrush
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
InflateRect
SetRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor

gdi32

CreateRectRgnIndirect
SetStretchBltMode
GetClipRgn
CreatePolygonRgn
SelectClipRgn
DeleteObject
CreateDIBitmap
GetSystemPaletteEntries
CreatePalette
StretchBlt
SelectPalette
RealizePalette
GetDIBits
BeginPath
EndPath
PathToRegion
CreateEllipticRgn
CreateRoundRectRgn
GetWindowExtEx
GetViewportOrgEx
GetWindowOrgEx
GetTextColor
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateBitmap
SelectObject
GetObjectA
CreatePen
PatBlt
FillRgn
CreateRectRgn
CombineRgn
CreateSolidBrush
GetStockObject
CreateFontIndirectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
BitBlt
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetTextColor
GetTextMetricsA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetViewportExtEx
ExtSelectClipRgn
LineTo
MoveToEx
ExcludeClipRect
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetBkColor

winmm

waveOutReset
midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiStreamOut
midiOutPrepareHeader
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutOpen
waveOutGetNumDevs
waveOutClose
waveOutUnprepareHeader
waveOutPause
waveOutWrite
waveOutPrepareHeader

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegQueryValueA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA

shell32

Shell_NotifyIconA
ShellExecuteA

ole32

OleUninitialize
CLSIDFromString
OleInitialize

oleaut32

UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi

comctl32

ImageList_Destroy
ord17

ws2_32

ioctlsocket
recv
getpeername
accept
inet_ntoa
WSACleanup
closesocket
WSAAsyncSelect
recvfrom

comdlg32

GetFileTitleA
GetSaveFileNameA
GetOpenFileNameA
ChooseColorA

Exports

Exports

api_kick_group
api_message_friend_send
api_message_group_send
tw_StartApi

Sections

.text
Size: 392KB - Virtual size: 388KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
仙侣情缘2.5A完整包/华景机器人专用/CQapi接口.hplug.ins
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/仙侣情缘指令集.INI
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/玩家数据/desktop.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/仙侣情缘总配置.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/任务数据.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/功能键配置.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/商店列表.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/地图列表.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/婚姻等级数据.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/宝箱配置.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/宠物数据配置.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/封号数据.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/彩票配置.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/怪物列表.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/打开宝箱.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/抽奖列表.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/掉落物品列表.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/排行配置.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/推送数据.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/经验等级配置.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/行会数据.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/行会配置.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/装备列表.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/道具列表.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘/系统数据/防外挂数据.ini
仙侣情缘2.5A完整包/华景机器人专用/Config/仙侣情缘备份数据/备份数据/备份日志.ini
仙侣情缘2.5A完整包/华景机器人专用/QQRobots.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.Ebp
Size: - Virtual size: 6.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Esp
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
仙侣情缘2.5A完整包/华景机器人专用/QQRobotsApi.dll
.dll windows:4 windows x86 arch:x86

11b98ecf74ccf3ddafef8783bb0e58e8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
wsprintfA
MessageBoxA

kernel32

GetProcessHeap
GetModuleHandleA
ExitProcess
HeapReAlloc
HeapFree
IsBadReadPtr
GetCommandLineA
GetModuleFileNameA
LCMapStringA
HeapAlloc
GetEnvironmentStrings
GetVersion
InterlockedDecrement
InterlockedIncrement
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
GetProcAddress
RaiseException
VirtualAlloc
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
CloseHandle
SetFilePointer
MultiByteToWideChar
LCMapStringW
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers

Exports

Exports

AddFriend
AddQun
ChangeMemberInformation
ChangeNick
ChangeQunImformation
ChangeSignature
ChangeStatus
DelFriend
ExitQun
GetClientKey
GetLicenseID
GetMyNick
GetNick
GetOnlineNumber
GetQQList
GetQunAdmin
GetQunAnnouncement
GetQunCard
GetQunIntroduce
GetQunList
GetQunMemberList
GetQunNick
GetQunSexRatio
GetStatus
Internal_GetFriendInformation
Internal_GetMemberInformation
Internal_GetQunInformation
Internal_Start
Invite
Killout
Output
SendCode
SendMsg
SendTempMsg
SetQunAdmin
StartApi

Sections

.text
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
仙侣情缘2.5A完整包/华景机器人专用/RobotProtect.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.Ebp
Size: - Virtual size: 656KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Esp
Size: 233KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
仙侣情缘2.5A完整包/华景机器人专用/Settings.ini
仙侣情缘2.5A完整包/华景机器人专用/plugin/仙侣2.5A内测版体验版.cqp.dll
.dll windows:4 windows x86 arch:x86

3afeaf9280f2541f907af6c857a24ce4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

rasapi32

RasHangUpA
RasGetConnectStatusA

iphlpapi

GetAdaptersInfo

winmm

midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiStreamOut
midiOutPrepareHeader
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
waveOutPause
waveOutReset
waveOutClose
waveOutGetNumDevs
waveOutOpen

ws2_32

accept
recv
ioctlsocket
recvfrom
WSAAsyncSelect
closesocket
send
select
WSACleanup
WSAStartup
inet_ntoa
getpeername

kernel32

GetVersion
SetEnvironmentVariableA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetStdHandle
SetHandleCount
GetFileType
SetStdHandle
GetACP
HeapSize
GetLocalTime
GetSystemTime
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
lstrcpynA
FileTimeToLocalFileTime
LocalFree
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
GetFileSize
SetFilePointer
Beep
GetWindowsDirectoryA
LoadLibraryExA
SetLastError
GetTimeZoneInformation
FileTimeToSystemTime
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
ReadFile
GetLastError
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
RemoveDirectoryA
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
WinExec
lstrcpyA
FindNextFileA
GetDriveTypeA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetUserDefaultLCID
GetFullPathNameA
FreeLibrary
LoadLibraryA
lstrlenA
lstrlenW
GetVersionExA
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathA
FindFirstFileA
FindClose
SetFileAttributesA
GetFileAttributesA
DeleteFileA
CopyFileA
CreateDirectoryA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
CloseHandle
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
IsBadReadPtr
IsBadCodePtr
InterlockedExchange
GetEnvironmentStringsW

user32

EnableMenuItem
GetSubMenu
GetDlgCtrlID
CreateIconFromResourceEx
RegisterClipboardFormatA
SetRectEmpty
DispatchMessageA
GetMessageA
WindowFromPoint
DrawFocusRect
DrawEdge
DrawFrameControl
LoadIconA
TranslateMessage
SystemParametersInfoA
CallWindowProcA
CreateWindowExA
RegisterHotKey
UnregisterHotKey
SetWindowTextA
GetClassNameA
GetWindowTextA
GetMenuState
GetMenuItemID
GetMenuItemCount
CallNextHookEx
CreateAcceleratorTableA
UnhookWindowsHookEx
LoadStringA
CopyIcon
GetIconInfo
CreateIconIndirect
ClientToScreen
EnumDisplaySettingsA
LoadImageA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
GetKeyState
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetSystemMenu
DeleteMenu
GetClassInfoA
DefWindowProcA
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
GetDesktopWindow
CreateMenu
ModifyMenuA
AppendMenuA
CreatePopupMenu
DrawIconEx
SetWindowsHookExA
GetDlgItem
FindWindowExA
CreateIconFromResource
GetSysColorBrush
UnregisterClassA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
MoveWindow
IsDialogMessageA
ScrollWindowEx
SendDlgItemMessageA
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
InflateRect
SetRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
IsRectEmpty
ReleaseDC
IsChild
TrackPopupMenu
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
MapWindowPoints
AdjustWindowRectEx
GetScrollPos
RegisterClassA
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetMessageTime
GetLastActivePopup
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow

gdi32

GetDIBits
GetWindowExtEx
GetViewportOrgEx
GetWindowOrgEx
BeginPath
EndPath
PathToRegion
CreateEllipticRgn
CreateRoundRectRgn
GetTextColor
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateBitmap
SelectObject
CreatePen
PatBlt
FillRgn
CreateRectRgn
CombineRgn
CreateSolidBrush
CreateFontIndirectA
GetStockObject
GetObjectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
RealizePalette
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
SelectClipRgn
CreatePolygonRgn
GetClipRgn
SetStretchBltMode
CreateDIBSection
CreateRectRgnIndirect
SetBkColor
CreateFontA
TranslateCharsetInfo
FrameRgn
OffsetRgn
GetTextMetricsA
SetTextColor
LineTo
MoveToEx
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
ExcludeClipRect
ExtSelectClipRgn
GetViewportExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectPalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
BitBlt
DeleteObject

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryValueA
RegCloseKey

shell32

DragQueryFileA
DragFinish
DragAcceptFiles
Shell_NotifyIconA
ShellExecuteA
SHEmptyRecycleBinA
SHGetSpecialFolderPathA

ole32

CLSIDFromProgID
OleInitialize
OleUninitialize
CLSIDFromString
CoCreateInstance
OleRun

oleaut32

UnRegisterTypeLi
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayPutElement
SafeArrayCreate
SafeArrayDestroy
SysAllocString
VariantInit
VariantCopyInd
SafeArrayGetElement
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantChangeType
VariantClear
VariantCopy

comctl32

ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_GetImageCount
ImageList_SetBkColor
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
ord17
ImageList_LoadImageA
ImageList_Read
ImageList_Duplicate

wininet

InternetConnectA
InternetSetOptionA
InternetCloseHandle
InternetOpenA
InternetCanonicalizeUrlA
InternetCrackUrlA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile

comdlg32

GetSaveFileNameA
ChooseColorA
GetOpenFileNameA
GetFileTitleA

Exports

Exports

info
plugmain
��ƱͶע
��
��̳�ӿ�ϵͳ
ȡQQ��
ȡ�ұ��ı�
ȡ��ı�
��GMϵͳ
��VIPϵͳ
��°��ϵͳ
��±չ�
��³��ϵͳ
��³��
��´��
��º��ϵͳ
��»��ϵͳ
��ϵͳ
��ϵͳ
��ǩ��
��Ǯׯϵͳ
��ϵͳ
��λ��
��л�ϵͳ
��ϵͳ
��ϵͳ

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 276KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
仙侣情缘2.5A完整包/华景机器人专用/use.edb
仙侣情缘2.5A完整包/华景机器人专用/说明.txt
仙侣情缘2.5A完整包/更新说明.txt
仙侣情缘2.5A完整包/酷Q机器人专用/CoolQ.exe
.exe windows:5 windows x86 arch:x86

Code Sign

04:7a:55
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:58

Not After

03/03/2024, 12:58

Subject

CN=Certum Time-Stamping Authority,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

04:7a:53
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:53

Not After

03/03/2024, 12:53

Subject

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

60:78:46:15:09:5b:a1:03:93:0d:94:d4:de:68:34:3f
Certificate

Issuer

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

09/11/2013, 12:38

Not After

09/11/2014, 12:38

Subject

CN=Open Source Developer\, zhe fan Gong,O=zhe fan Gong,C=CN,1.2.840.113549.1.9.1=#0c0c6d6540636f7878732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:a4:42:e3:00:c1:30:73:a9:a4:aa:1d:0d:71:a5:5d:42:af:2b:95
Signer

Actual PE Digest

36:a4:42:e3:00:c1:30:73:a9:a4:aa:1d:0d:71:a5:5d:42:af:2b:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 932KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 446KB - Virtual size: 448KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 783KB - Virtual size: 782KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 251KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
仙侣情缘2.5A完整包/酷Q机器人专用/config/[config目录说明].txt
仙侣情缘2.5A完整包/酷Q机器人专用/config/basic.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/cqset.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/group.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/lang.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/login.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/reply.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/仙侣情缘指令集.INI
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/玩家数据/desktop.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/仙侣情缘总配置.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/任务数据.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/功能键配置.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/商店列表.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/地图列表.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/婚姻等级数据.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/宝箱配置.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/宠物数据配置.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/封号数据.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/彩票配置.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/怪物列表.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/打开宝箱.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/抽奖列表.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/掉落物品列表.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/排行数据.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/排行配置.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/推送数据.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/经验等级配置.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/行会数据.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/行会配置.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/装备列表.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/道具列表.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘/系统数据/防外挂数据.ini
仙侣情缘2.5A完整包/酷Q机器人专用/config/仙侣情缘备份数据/备份数据/备份日志.ini
仙侣情缘2.5A完整包/酷Q机器人专用/cqapi.dll
.dll windows:4 windows x86 arch:x86

Code Sign

01:00:20
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

11/06/2002, 10:46

Not After

11/06/2027, 10:46

Subject

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

04:7a:55
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:58

Not After

03/03/2024, 12:58

Subject

CN=Certum Time-Stamping Authority,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

04:7a:53
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:53

Not After

03/03/2024, 12:53

Subject

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

60:78:46:15:09:5b:a1:03:93:0d:94:d4:de:68:34:3f
Certificate

Issuer

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

09/11/2013, 12:38

Not After

09/11/2014, 12:38

Subject

CN=Open Source Developer\, zhe fan Gong,O=zhe fan Gong,C=CN,1.2.840.113549.1.9.1=#0c0c6d6540636f7878732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

19:06:81:a7:e3:6b:c7:82:d4:09:2e:ef:96:26:f6:a0:c9:52:a7:3c
Signer

Actual PE Digest

19:06:81:a7:e3:6b:c7:82:d4:09:2e:ef:96:26:f6:a0:c9:52:a7:3c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CQ_0
CQ_1
CQ_2
api_cq_qa_add
api_kick_group
api_message_friend_send
api_message_group_send
api_other_md5

Sections

UPX0
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1019B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
仙侣情缘2.5A完整包/酷Q机器人专用/cskin.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

SkinH_AdjustAero
SkinH_AdjustHSV
SkinH_Attach
SkinH_AttachEx
SkinH_AttachExt
SkinH_AttachRes
SkinH_AttachResEx
SkinH_Detach
SkinH_DetachEx
SkinH_GetColor
SkinH_LockUpdate
SkinH_Map
SkinH_NineBlt
SkinH_SetAero
SkinH_SetBackColor
SkinH_SetFont
SkinH_SetFontEx
SkinH_SetForeColor
SkinH_SetMenuAlpha
SkinH_SetTitleMenuBar
SkinH_SetWindowAlpha
SkinH_SetWindowMovable
SkinH_VerifySign

Sections

.Hmily
Size: - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.52PoJie
Size: 98KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
仙侣情缘2.5A完整包/酷Q机器人专用/gzip.dll
.dll windows:5 windows x86 arch:x86

63bc622ddbb364868c646ebb5f982ffe

Code Sign

01:00:20
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

11/06/2002, 10:46

Not After

11/06/2027, 10:46

Subject

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

04:7a:55
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:58

Not After

03/03/2024, 12:58

Subject

CN=Certum Time-Stamping Authority,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

04:7a:53
Certificate

Issuer

CN=Certum CA,O=Unizeto Sp. z o.o.,C=PL

Not Before

03/03/2009, 12:53

Not After

03/03/2024, 12:53

Subject

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

60:78:46:15:09:5b:a1:03:93:0d:94:d4:de:68:34:3f
Certificate

Issuer

CN=Certum Level III CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

09/11/2013, 12:38

Not After

09/11/2014, 12:38

Subject

CN=Open Source Developer\, zhe fan Gong,O=zhe fan Gong,C=CN,1.2.840.113549.1.9.1=#0c0c6d6540636f7878732e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

72:e7:c9:ae:9d:26:7f:e6:f4:1e:f6:6e:b0:fa:c6:b1:c4:24:61:80
Signer

Actual PE Digest

72:e7:c9:ae:9d:26:7f:e6:f4:1e:f6:6e:b0:fa:c6:b1:c4:24:61:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

gzip.pdb

Imports

kernel32

LocalFree
LocalAlloc
DisableThreadLibraryCalls
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

Exports

Exports

Compress
CreateCompression
CreateDecompression
DeInitCompression
DeInitDecompression
Decompress
DestroyCompression
DestroyDecompression
InitCompression
InitDecompression
ResetCompression
ResetDecompression

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
仙侣情缘2.5A完整包/酷Q机器人专用/plugin/.onoff.cqp.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

info
tycq

Sections

UPX0
Size: - Virtual size: 108KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
仙侣情缘2.5A完整包/酷Q机器人专用/plugin/.onoff.cqp.dll.ini
仙侣情缘2.5A完整包/酷Q机器人专用/plugin/[plugin目录说明].txt
仙侣情缘2.5A完整包/酷Q机器人专用/plugin/cqonoff.ini
仙侣情缘2.5A完整包/酷Q机器人专用/plugin/仙侣2.5A内测版体验版.cqp.dll
.dll windows:4 windows x86 arch:x86

3afeaf9280f2541f907af6c857a24ce4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

rasapi32

RasHangUpA
RasGetConnectStatusA

iphlpapi

GetAdaptersInfo

winmm

midiStreamRestart
midiStreamClose
midiOutReset
midiStreamStop
midiStreamOut
midiOutPrepareHeader
midiStreamProperty
midiStreamOpen
midiOutUnprepareHeader
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
waveOutPause
waveOutReset
waveOutClose
waveOutGetNumDevs
waveOutOpen

ws2_32

accept
recv
ioctlsocket
recvfrom
WSAAsyncSelect
closesocket
send
select
WSACleanup
WSAStartup
inet_ntoa
getpeername

kernel32

GetVersion
SetEnvironmentVariableA
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetStdHandle
SetHandleCount
GetFileType
SetStdHandle
GetACP
HeapSize
GetLocalTime
GetSystemTime
RaiseException
RtlUnwind
GetOEMCP
GetCPInfo
GetProcessVersion
SetErrorMode
GlobalFlags
GetCurrentThread
GetFileTime
TlsGetValue
LocalReAlloc
TlsSetValue
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
lstrcmpA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
lstrcpynA
FileTimeToLocalFileTime
LocalFree
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
GetFileSize
SetFilePointer
Beep
GetWindowsDirectoryA
LoadLibraryExA
SetLastError
GetTimeZoneInformation
FileTimeToSystemTime
CreateSemaphoreA
ResumeThread
ReleaseSemaphore
EnterCriticalSection
LeaveCriticalSection
GetProfileStringA
WriteFile
ReadFile
GetLastError
WaitForMultipleObjects
CreateFileA
SetEvent
FindResourceA
LoadResource
LockResource
RemoveDirectoryA
GetModuleFileNameA
GetCurrentThreadId
ExitProcess
GlobalSize
GlobalFree
DeleteCriticalSection
InitializeCriticalSection
lstrcatA
WinExec
lstrcpyA
FindNextFileA
GetDriveTypeA
GlobalReAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetUserDefaultLCID
GetFullPathNameA
FreeLibrary
LoadLibraryA
lstrlenA
lstrlenW
GetVersionExA
GetPrivateProfileSectionNamesA
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateThread
CreateEventA
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathA
FindFirstFileA
FindClose
SetFileAttributesA
GetFileAttributesA
DeleteFileA
CopyFileA
CreateDirectoryA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetVolumeInformationA
GetModuleHandleA
GetProcAddress
MulDiv
GetCommandLineA
GetTickCount
WaitForSingleObject
CloseHandle
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
IsBadReadPtr
IsBadCodePtr
InterlockedExchange
GetEnvironmentStringsW

user32

EnableMenuItem
GetSubMenu
GetDlgCtrlID
CreateIconFromResourceEx
RegisterClipboardFormatA
SetRectEmpty
DispatchMessageA
GetMessageA
WindowFromPoint
DrawFocusRect
DrawEdge
DrawFrameControl
LoadIconA
TranslateMessage
SystemParametersInfoA
CallWindowProcA
CreateWindowExA
RegisterHotKey
UnregisterHotKey
SetWindowTextA
GetClassNameA
GetWindowTextA
GetMenuState
GetMenuItemID
GetMenuItemCount
CallNextHookEx
CreateAcceleratorTableA
UnhookWindowsHookEx
LoadStringA
CopyIcon
GetIconInfo
CreateIconIndirect
ClientToScreen
EnumDisplaySettingsA
LoadImageA
ShowWindow
IsWindowEnabled
TranslateAcceleratorA
GetKeyState
CopyAcceleratorTableA
PostQuitMessage
IsZoomed
GetSystemMenu
DeleteMenu
GetClassInfoA
DefWindowProcA
GetMenu
SetMenu
PeekMessageA
IsIconic
SetFocus
GetActiveWindow
GetWindow
DestroyAcceleratorTable
SetWindowRgn
GetMessagePos
GetDesktopWindow
CreateMenu
ModifyMenuA
AppendMenuA
CreatePopupMenu
DrawIconEx
SetWindowsHookExA
GetDlgItem
FindWindowExA
CreateIconFromResource
GetSysColorBrush
UnregisterClassA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
CheckMenuItem
MoveWindow
IsDialogMessageA
ScrollWindowEx
SendDlgItemMessageA
ScreenToClient
ChildWindowFromPointEx
CopyRect
LoadBitmapA
WinHelpA
KillTimer
SetTimer
ReleaseCapture
GetCapture
SetCapture
GetScrollRange
SetScrollRange
SetScrollPos
InflateRect
SetRect
IntersectRect
DestroyIcon
PtInRect
OffsetRect
IsWindowVisible
EnableWindow
RedrawWindow
GetWindowLongA
SetWindowLongA
GetSysColor
SetActiveWindow
SetCursorPos
LoadCursorA
SetCursor
GetDC
FillRect
IsRectEmpty
ReleaseDC
IsChild
TrackPopupMenu
DestroyMenu
SetForegroundWindow
GetWindowRect
EqualRect
UpdateWindow
ValidateRect
InvalidateRect
GetClientRect
GetFocus
GetParent
GetTopWindow
PostMessageA
IsWindow
SetParent
DestroyCursor
SendMessageA
SetWindowPos
MessageBoxA
GetCursorPos
GetSystemMetrics
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
wsprintfA
MapWindowPoints
AdjustWindowRectEx
GetScrollPos
RegisterClassA
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetMessageTime
GetLastActivePopup
GetWindowTextLengthA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetNextDlgTabItem
GetWindowPlacement
RegisterWindowMessageA
GetForegroundWindow

gdi32

GetDIBits
GetWindowExtEx
GetViewportOrgEx
GetWindowOrgEx
BeginPath
EndPath
PathToRegion
CreateEllipticRgn
CreateRoundRectRgn
GetTextColor
GetBkMode
GetBkColor
GetROP2
GetStretchBltMode
GetPolyFillMode
CreateCompatibleBitmap
CreateDCA
CreateBitmap
SelectObject
CreatePen
PatBlt
FillRgn
CreateRectRgn
CombineRgn
CreateSolidBrush
CreateFontIndirectA
GetStockObject
GetObjectA
EndPage
EndDoc
DeleteDC
StartDocA
StartPage
RealizePalette
CreateCompatibleDC
Ellipse
Rectangle
LPtoDP
DPtoLP
GetCurrentObject
RoundRect
GetTextExtentPoint32A
GetDeviceCaps
SelectClipRgn
CreatePolygonRgn
GetClipRgn
SetStretchBltMode
CreateDIBSection
CreateRectRgnIndirect
SetBkColor
CreateFontA
TranslateCharsetInfo
FrameRgn
OffsetRgn
GetTextMetricsA
SetTextColor
LineTo
MoveToEx
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetClipBox
ExcludeClipRect
ExtSelectClipRgn
GetViewportExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectPalette
StretchBlt
CreatePalette
GetSystemPaletteEntries
CreateDIBitmap
BitBlt
DeleteObject

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryValueA
RegCloseKey

shell32

DragQueryFileA
DragFinish
DragAcceptFiles
Shell_NotifyIconA
ShellExecuteA
SHEmptyRecycleBinA
SHGetSpecialFolderPathA

ole32

CLSIDFromProgID
OleInitialize
OleUninitialize
CLSIDFromString
CoCreateInstance
OleRun

oleaut32

UnRegisterTypeLi
LoadTypeLi
LHashValOfNameSys
RegisterTypeLi
SafeArrayPutElement
SafeArrayCreate
SafeArrayDestroy
SysAllocString
VariantInit
VariantCopyInd
SafeArrayGetElement
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
VariantChangeType
VariantClear
VariantCopy

comctl32

ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_GetImageCount
ImageList_SetBkColor
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_EndDrag
ord17
ImageList_LoadImageA
ImageList_Read
ImageList_Duplicate

wininet

InternetConnectA
InternetSetOptionA
InternetCloseHandle
InternetOpenA
InternetCanonicalizeUrlA
InternetCrackUrlA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
DeleteUrlCacheEntry
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile

comdlg32

GetSaveFileNameA
ChooseColorA
GetOpenFileNameA
GetFileTitleA

Exports

Exports

info
plugmain
��ƱͶע
��
��̳�ӿ�ϵͳ
ȡQQ��
ȡ�ұ��ı�
ȡ��ı�
��GMϵͳ
��VIPϵͳ
��°��ϵͳ
��±չ�
��³��ϵͳ
��³��
��´��
��º��ϵͳ
��»��ϵͳ
��ϵͳ
��ϵͳ
��ǩ��
��Ǯׯϵͳ
��ϵͳ
��λ��
��л�ϵͳ
��ϵͳ
��ϵͳ

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 276KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 350KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
仙侣情缘2.5A完整包/酷Q机器人专用/sqlite3.dll
.dll windows:4 windows x86 arch:x86

12baaaec299bc9ff52d20c16e4d0e96a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetCurrentProcessId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExA
GetVersionExW
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
InterlockedCompareExchange
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
ReadFile
SetEndOfFile
SetFilePointer
Sleep
SystemTimeToFileTime
TlsGetValue
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile

msvcrt

__dllonexit
_errno
_iob
_winmajor
abort
calloc
fflush
free
fwrite
localtime
malloc
memcmp
memmove
memset
qsort
realloc
strcmp
strncmp
vfprintf

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strnicmp
sqlite3_table_column_metadata
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_write_debug

Sections

.text
Size: 434KB - Virtual size: 434KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/35
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/51
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/63
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/77
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/89
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 512B - Virtual size: 269B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/113
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/124
Size: 512B - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bd9b2189a40f2711f7dee0c8505466d1

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

Exports

Exports

Sections

.text Size: 392KB - Virtual size: 388KB

.rdata Size: 64KB - Virtual size: 60KB

.data Size: 60KB - Virtual size: 121KB

.rsrc Size: 24KB - Virtual size: 21KB

.reloc Size: 64KB - Virtual size: 61KB

Headers

File Characteristics

Sections

.Ebp Size: - Virtual size: 6.2MB

.Esp Size: 2.2MB - Virtual size: 2.2MB

.rsrc Size: 99KB - Virtual size: 100KB

11b98ecf74ccf3ddafef8783bb0e58e8

Headers

File Characteristics

Imports

user32

kernel32

Exports

Exports

Sections

.text Size: 48KB - Virtual size: 45KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 16KB - Virtual size: 31KB

.rsrc Size: 4KB - Virtual size: 788B

.reloc Size: 8KB - Virtual size: 4KB

Headers

File Characteristics

Sections

.Ebp Size: - Virtual size: 656KB

.Esp Size: 233KB - Virtual size: 236KB

.rsrc Size: 113KB - Virtual size: 116KB

3afeaf9280f2541f907af6c857a24ce4

Headers

File Characteristics

Imports

rasapi32

iphlpapi

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

wininet

comdlg32

Exports

Exports

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 276KB - Virtual size: 274KB

.data Size: 76KB - Virtual size: 350KB

.text
Size: 392KB - Virtual size: 388KB

.rdata
Size: 64KB - Virtual size: 60KB

.data
Size: 60KB - Virtual size: 121KB

.rsrc
Size: 24KB - Virtual size: 21KB

.reloc
Size: 64KB - Virtual size: 61KB

.Ebp
Size: - Virtual size: 6.2MB

.Esp
Size: 2.2MB - Virtual size: 2.2MB

.rsrc
Size: 99KB - Virtual size: 100KB

.text
Size: 48KB - Virtual size: 45KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 16KB - Virtual size: 31KB

.rsrc
Size: 4KB - Virtual size: 788B

.reloc
Size: 8KB - Virtual size: 4KB

.Ebp
Size: - Virtual size: 656KB

.Esp
Size: 233KB - Virtual size: 236KB

.rsrc
Size: 113KB - Virtual size: 116KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 276KB - Virtual size: 274KB

.data
Size: 76KB - Virtual size: 350KB

.rsrc
Size: 24KB - Virtual size: 21KB

.reloc
Size: 140KB - Virtual size: 138KB

04:7a:55
Certificate

04:7a:53
Certificate

60:78:46:15:09:5b:a1:03:93:0d:94:d4:de:68:34:3f
Certificate

36:a4:42:e3:00:c1:30:73:a9:a4:aa:1d:0d:71:a5:5d:42:af:2b:95
Signer

UPX0
Size: - Virtual size: 932KB

UPX1
Size: 446KB - Virtual size: 448KB

.rsrc
Size: 36KB - Virtual size: 36KB

.text
Size: 783KB - Virtual size: 782KB

.rdata
Size: 251KB - Virtual size: 251KB

.data
Size: 53KB - Virtual size: 180KB

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 86KB - Virtual size: 86KB

01:00:20
Certificate

04:7a:55
Certificate

04:7a:53
Certificate

60:78:46:15:09:5b:a1:03:93:0d:94:d4:de:68:34:3f
Certificate

19:06:81:a7:e3:6b:c7:82:d4:09:2e:ef:96:26:f6:a0:c9:52:a7:3c
Signer

UPX0
Size: - Virtual size: 80KB

UPX1
Size: 8KB - Virtual size: 12KB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 4KB - Virtual size: 1019B

.data
Size: 4KB - Virtual size: 49KB

.reloc
Size: 4KB - Virtual size: 662B

.Hmily
Size: - Virtual size: 224KB

.52PoJie
Size: 98KB - Virtual size: 114KB

01:00:20
Certificate

04:7a:55
Certificate