+���P|����;Υ��� �u�����e���Y0�S)��\�q:5 ӁX��Ш�S�w��jݐ ��Rav���M�1+�R��Ǥ�S��4�X�\沬�j�n�]6�6��z�hG0U�M �Q���/86����g2��d���z��FP��/����S����✿�V5vW���mx�r<�R]��Y��6q�ф�����\*��D��"g��%���%��@%Η~+�GyV�~m������栚�d�76��0[���(� �<w�'�~�/�:h[�5���I�{�{�?�a]9�C��J��*`La���������"g�h�8T�Te����a2�~��w_W���Ս�<O�nZ���^���c���v�612�b1�p<����PS��.;�{���(�4�e���c��:u�|:V.~��i���!�q�>���:U�l:�֯��]�9����H��ʝZU��f������gR���%�P�A >�`����['�ͲЙN�|��Y��@�։�%��<��R�Df�R�7�g��9-���2��q�u5+��hh[�&�]4?Dm���d/�U�y^�;ߔ�d.g�ۉ/���r��e;�B���)s���0g5� 1����Sԃ ��U��>ۊ�������cz)����g&HAeh�Ս�K���\���czGR�&G�ʅ�*��Ց_Q��/ |���˔�md���]���*}_#�X�6�r���4]2= �Ko�v�D�XWb?&'�U����p6O���U����Ԡay�Hdi��UȭKr�'��e�=�P�����>D>J�9=�`�OD'rK���o�&���e<m��EQ= ��<>��ګ�WsXk��oV��k�O��E��ٙ����J�n���%�!���0[co�aJ�ze�̎2&pA�lS�rC�?���@�{:9�JCW�ڗw�Y��&�ӧ@�ǩ~���u&��A্P���8r�=�"8uߠn���^��(���#̤H��!�bRJ����P�v�R���u��la(CQdzd�\��{�'�ņ<��p�#�Vu{�XG�l`d/"n�7�0�.dC������L7�ZK�)J^p� 2�Y\����o�v_OEwᑚ��H\�KnEli�o�?����SF��W�W&�6�6��(�V3�^�F��]�__U"=8x�(U�t=v%*��A���8#�����Ӡ��e[�fL8��� ���e}}z.�Q5vշ#)r����d���q�����Pv7y�=�u��ϑ��M#Dզu��JB�������E<W�&����=���x#��vX�.��i�����������g��?X��1�H@Ƭ0����?)��3��?�!p�,�B�Q���w#Szܼ�{��K�;�7�K˗��$�ś�J�6躷�����}��mT��?F���R�6#�~�)�ݳ�'����b�%��$6Ь�o���������� f�Q�ښ���"I�ձ�� < J���.B�S��;�\�������F���w. gI��o��vwI ����l��RFN�o��7�������j:0?t�x�����8�׆a��>L eS��Lȳ+�'��3�?�ہ:O�*c���2�_&�+�X\��q���9*y��@�1�6��>OX�C!v�c�.hl�Yx�K�<�¯�h�퐴����� 6��R���7�{�b>|^�b����g��ץ�,������Zj�ZE��p��6�����K�f�����#���ʔ�Bc��lg`d��fY�G��Yk��cO�6��� �Eh�-8� ��<�(Q-b��˘(�E�T��� �)J��'D������xd�ۘ��I��v_iЖ�NPܳ��IӟF�DZ�j�Lc���o��^!��y�d�L�����xG���1����\��o_�fd��g�5^'3��@�Z�ah���<�23Y�h�9�y6*���<\�W���Q�&����S[��Ĕ�MS�Z*սD���cA��� ���7x`GL���>lJ�hS��f��Dׄ��%���m��QP�H�w�ӳ�@,e�o���}T�� ����jDͺ�Y~{�����7��9.g�����x���w�sn����;4�����*����_5\a���pDj���1%cy�&���k��� ���I/vx-A��q{�6Ϻ������ѣ�k�_D��SSC��Q$����6��w��~N�����!��?����8�ԋ�S��C�H��c[��ۓ/���%������}۞��ڃ5:���>u��y��U��{����ocp����4�9!u���"A��smDn�����j3�&�9�ur�������Nl��KM3������������ݝ@���r�7�OHĘ�C�;���/~��@;\�7�4[7��DW\�|�+��*x��Fb�D�86?3V� w���0��e��n�w�<�⳦����.����J�fqIgX����oET�oHz� NG�!Q�K�� i���5�XN����sQ�3��2�]|In�Z�ٓ �+�[EX]aޚ@;����)�;����i4~=g�gjS&���}�9B ���+?�Og�)�N������=u�v�N1�K��oگ���NO�@Ӣ�jomdRG]���w�_qi�r�a�e�����gz�0�Q�Y����^}xUy���> ]�b������tq�H{����`ةD�����h%�w��`���06�~ ÓK�K;_�C~^-��`���W��#�+c;t�z�1�/I���c���Aс�L�v&�{�`�������Z�R�(Ü1`��A�_Wq"��E�_�wC���୪�8o����x�aQ#o�� ����M���}t�x���Pb��8��b�mW���!F�eH6����y0E�b�3Q�䚀y� T�c��l�[�ʘ��Ժ)q ueI!�1t��%d;y�L�`b*�S����NxD_ S�B���a �"�@?�{L��ɫV-O�rfw:��L�N?���e -6"��&%E1��)�N��W������{`�f�g%�ɷ��ġVzG[�-�X���hTՅc&N�}��G�ְ�w�n��cQ� ��p<�$>��$h�E�l�m�
Overview
overview
7Static
static
7أˣ...m2.dll
windows7-x64
5أˣ...m2.dll
windows10-2004-x64
5أˣ...me.exe
windows7-x64
5أˣ...me.exe
windows10-2004-x64
5أˣ...in.exe
windows7-x64
3أˣ...in.exe
windows10-2004-x64
3أˣ...et.dll
windows7-x64
7أˣ...et.dll
windows10-2004-x64
7أˣ...sy.dll
windows7-x64
5أˣ...sy.dll
windows10-2004-x64
5أˣ...lq.dll
windows7-x64
5أˣ...lq.dll
windows10-2004-x64
5أˣ...Dp.dll
windows7-x64
5أˣ...Dp.dll
windows10-2004-x64
5أˣ...te.exe
windows7-x64
7أˣ...te.exe
windows10-2004-x64
3أˣ...km.dll
windows7-x64
5أˣ...km.dll
windows10-2004-x64
5أˣ...ȫ.url
windows7-x64
1أˣ...ȫ.url
windows10-2004-x64
1أˣ...վ.url
windows7-x64
1أˣ...վ.url
windows10-2004-x64
1أˣ...��.exe
windows7-x64
3أˣ...��.exe
windows10-2004-x64
3أˣ...��.url
windows7-x64
1أˣ...��.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
أˣ./3km2.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
أˣ./3km2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
أˣ./Game.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
أˣ./Game.exe
Resource
win10v2004-20240910-en
Behavioral task
behavioral5
Sample
أˣ./Main.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
أˣ./Main.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
أˣ./Net.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
أˣ./Net.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
أˣ./Sysy.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
أˣ./Sysy.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
أˣ./WeDlq.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
أˣ./WeDlq.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
أˣ./WeDp.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
أˣ./WeDp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
أˣ./update.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
أˣ./update.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
أˣ./xkm.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
أˣ./xkm.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral19
Sample
أˣ./Сɐ۽̴̳ȫ.url
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
أˣ./Сɐ۽̴̳ȫ.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
أˣ./Сɰٷվ.url
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
أˣ./Сɰٷվ.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
أˣ./Сɰԣ.exe
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
أˣ./Сɰԣ.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
أˣ./֣ɣ߹.url
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
أˣ./֣ɣ߹.url
Resource
win10v2004-20240802-en
General
-
Target
0878f702ad2bce738d258255f7595dae_JaffaCakes118
-
Size
14.0MB
-
MD5
0878f702ad2bce738d258255f7595dae
-
SHA1
3e4b1f36d6500b82fe5373ee5039ab87b75939b2
-
SHA256
73a10974bfadbc4993834895fff5364c79e108e3e405019ae520b6fc09c7c8b3
-
SHA512
dc55016e8ca443e68e332bb2aac8edddf8077a2caaf8360f1b7c0e9f39423dcf908f64386f1ef2cc37026279977479537866b96516307a35d5681e6634e88dc7
-
SSDEEP
393216:iSWOou94EU0mMzTxvOq2SvdwFRc/DGJyqWkcD0oogjK:iESBMvxmq2LFu/DGJyqWkcD0pn
Malware Config
Signatures
-
resource yara_rule static1/unpack001/أˣ./Game.dat aspack_v212_v242 -
resource yara_rule static1/unpack001/أˣ./Net.dat vmprotect -
Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/أˣ./3km2.dat unpack001/أˣ./Game.dat unpack001/أˣ./Main.dat unpack001/أˣ./Net.dat unpack001/أˣ./Sysy.dat unpack001/أˣ./WeDlq.dat unpack001/أˣ./WeDp.dat unpack001/أˣ./update.exe unpack001/أˣ./xkm.dat unpack001/أˣ./Сɰԣ.exe
Files
-
0878f702ad2bce738d258255f7595dae_JaffaCakes118.zip
-
أˣ./3km2.dat.dll windows:5 windows x86 arch:x86
1780ac9aa34f17b7737802fc3c31b5f9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
UnhandledExceptionFilter
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
ShowWindow
MessageBoxA
shlwapi
StrStrIA
comctl32
ord6
ws2_32
send
Exports
Exports
Sections
.text Size: 175KB - Virtual size: 174KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
HookStub Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data0 Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 279KB - Virtual size: 279KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
أˣ./Game.dat.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 754KB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 22KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: 5KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UWVG Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UWVG Size: 133KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 124KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UWVG Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UWVG Size: 121KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UWVG Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
أˣ./Main.dat.exe windows:5 windows x86 arch:x86
97849939036f94cc1d30d7d8e9219598
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
E:\我的作品\辅助2012\XK22012\新协议版本\20121028\XK2_Login2012\Release\XK2_Login2012.pdb
Imports
kernel32
GetProcessId
MultiByteToWideChar
FindResourceA
SizeofResource
LoadResource
LockResource
TerminateProcess
lstrlenA
CreateThread
WaitForSingleObject
GetVersionExA
GetWindowsDirectoryA
DeleteFileA
GetSystemDirectoryA
FindFirstFileA
FindClose
SetFileAttributesA
lstrcmpiA
IsDBCSLeadByte
WideCharToMultiByte
lstrlenW
LeaveCriticalSection
RaiseException
EnterCriticalSection
GetLastError
LoadLibraryExA
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCurrentDirectoryA
WritePrivateProfileStringA
CreateFileA
WriteFile
GetCurrentThreadId
SetLastError
FlushInstructionCache
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
LoadLibraryW
CreateRemoteThread
VirtualAllocEx
GetCurrentProcess
SuspendThread
ResumeThread
Module32Next
Module32First
HeapFree
GetModuleFileNameA
Thread32Next
SetEndOfFile
Thread32First
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
SetFilePointer
GetConsoleMode
GetConsoleCP
RtlUnwind
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
ExitProcess
FreeLibrary
HeapAlloc
GetProcessHeap
HeapReAlloc
LoadLibraryA
IsBadReadPtr
VirtualProtect
VirtualFree
VirtualAlloc
lstrcatA
GetModuleHandleW
lstrcmpA
CreateToolhelp32Snapshot
GetProcAddress
GetModuleHandleA
SetThreadContext
GetThreadContext
OpenThread
lstrcpyA
GetCurrentProcessId
Sleep
WriteProcessMemory
VirtualProtectEx
Process32Next
CloseHandle
ReadProcessMemory
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
GetCommandLineA
VirtualQuery
GetSystemInfo
GetSystemTimeAsFileTime
HeapSize
HeapCreate
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
VirtualQueryEx
VirtualFreeEx
ReadFile
WaitNamedPipeA
GetVolumeInformationA
GetLocalTime
CopyFileA
GetTickCount
CreateProcessA
IsProcessorFeaturePresent
InterlockedCompareExchange
OpenProcess
Process32First
CreateFileW
user32
ReleaseCapture
SetDlgItemTextA
UnhookWindowsHookEx
CheckDlgButton
SendDlgItemMessageA
EnableWindow
GetDlgItem
SendMessageA
IsDlgButtonChecked
GetMessagePos
ScreenToClient
GetParent
SetDlgItemInt
ChangeDisplaySettingsA
KillTimer
FindWindowA
UnregisterClassA
DestroyWindow
MessageBoxA
EndDialog
CharNextA
DialogBoxParamA
LoadIconA
GetClientRect
SetWindowTextA
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
BeginPaint
EndPaint
IsChild
GetFocus
GetWindow
IsWindow
GetDlgItemTextA
GetSysColor
SetWindowPos
RedrawWindow
GetClassInfoExA
CreateWindowExA
CreateAcceleratorTableA
ClientToScreen
MoveWindow
SetCapture
GetClassNameA
FillRect
InvalidateRgn
CallWindowProcA
InvalidateRect
GetDC
ReleaseDC
GetDesktopWindow
DestroyAcceleratorTable
GetWindowLongA
SetWindowLongA
DefWindowProcA
LoadCursorA
RegisterClassExA
CreateDialogParamA
GetWindowThreadProcessId
SetTimer
ShowWindow
SetFocus
gdi32
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
BitBlt
DeleteDC
GetStockObject
GetObjectA
GetDeviceCaps
CreateSolidBrush
comdlg32
GetOpenFileNameA
advapi32
RegQueryValueExA
RegDeleteValueA
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
StartServiceA
DeleteService
shell32
DragQueryFileA
ole32
OleInitialize
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
StringFromGUID2
OleUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CLSIDFromString
oleaut32
LoadRegTypeLi
SysStringLen
SysAllocStringLen
OleCreateFontIndirect
VariantClear
SysAllocString
VariantInit
VarUI4FromStr
LoadTypeLi
SysFreeString
shlwapi
StrStrIA
StrStrA
StrCmpNIA
comctl32
ord6
ord17
psapi
GetMappedFileNameA
GetModuleFileNameExA
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
ws2_32
WSAGetLastError
connect
WSAAsyncSelect
socket
htons
inet_addr
WSACleanup
closesocket
WSAStartup
msvcrt
calloc
iphlpapi
GetInterfaceInfo
Sections
.text Size: 9.5MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 98KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
أˣ./Net.dat.dll windows:5 windows x86 arch:x86
6ee8cded5a3555058a2c5ce10eaa6b68
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
GetCommandLineA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
wsprintfW
advapi32
RegCloseKey
oleaut32
SafeArrayPtrOfIndex
ole32
CoCreateInstance
shell32
ShellExecuteA
iphlpapi
GetAdaptersInfo
Exports
Exports
IPC_AnswerServerStart
IPC_PubSet
IPC_Question
IPC_close
ks_CheckKeyE
ks_GetData
ks_GetMsg
ks_advapi
ks_apidatafree
ks_destr
ks_edit
ks_editK
ks_exit
ks_prepaid
ks_reguser
ks_setExtVal
ks_setKVal
ks_setSoftVal
ks_setUVal
ks_setUpVal
ks_unbind
ks_viewinfo
Sections
CODE Size: - Virtual size: 160KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 20KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: - Virtual size: 527B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 164B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
أˣ./Sysy.dat.dll windows:5 windows x86 arch:x86
4cfbe88394c9a5edf715e62402b24146
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
Process32First
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CheckDlgButton
MessageBoxA
comctl32
ord6
shlwapi
StrStrA
Exports
Exports
1��Ii�?���c}�Ԡ��#+�MY�4�A�}pʝ��x�"ng�Ǫ���� �����%ңcI�O���斴[U4/O�����oUۊ� �ix���wq*�R�C"p��ʈ%r�ORpu�%諦������� C�U�l����P$��G���|��Ou��o�d��R�� ���Ggׯn*�QW��������D��j�� �o �<x��4�˗�����f)�K��j�@DlE�EF3g��KF�>G�}��XN����g�z>����2��B'V�{I�v�~��%�3G��4 �Z#$P�U��� #����!�L4�nt��n�.���3��-hѰ����E�C��������W��Ȑk��#;��kC��W,�]�[�E���̷yK̒Nw�HL�������-[��`Q�&e�=7,�r4���־£�܁���qH�D.��'�������iK���l�B�{kK� �@dK� �T�U�EXr"P+�p���xOQC�7=V#:67��(��ٛ����c$z�����iik,�Dj��e��=�z3�M�"�!D�o(އ2y� ��l���{��ct�g�dtc�gw�,��Pj~{�b�p�����`H�b��_�8}`�������B�^�7�����9Dz��sY��_Jk����h�h�{��Nv�#^�z| �XNu�.��=ý5����uk��.��읂�L�1\Q� OsB�h�I�Yo�CNdIA������<s23ݮ��%q�n��F������w�8_�.~�6q�q_���n�o'�+Jb�Bhr{hd��:F�n�Q����X�h���&� ��j�1z�.��]""��(�3��x��V�ͮ�Z'/�� ���}i�0i@��tC{X��/a��G����m��fF�G�n��cd([ѹ�Հ-T�Ɓy����ңK!/[��X���"�hLa`_�(�kN�a�Ir��T_�$��: ���Ԝ��WD,߆�*����V({!.P!4( ����P�fF:be(�G��i\P?̃�&�G�'������]���q瞈�e /nNQ�Y��e"���:A.��Pr��/����h��V�m�Rn}���^̆�|���D���gIY�� �!��l�s�"�!L�n��]�QN��L�)կ��gׅ�*YF6��0�Dzj��m˝Է�$|�������7��r{�ٍ���Y�Baـ�Pbk�����gw�\�E ^�`hi5�Ƕm�*OK�G�[f��߅$%�������Ƚv��&��W�E�N�nQ9�QF��"�>�?p!��4{6���ġ��`����j��*�����wYW3��YTZ��:^�<>Z��m�I����e�ԑ��\��-c��VY�m�,�e-��X��5n$�.���d�&4������"��E/����m)|Bſ��:��ؤX�4��!{<Y������]�0���'}���b��Y��`�%;� ����O4��RQ(�5CJ���=_K���$n�:A���C��;I��跤y��GÖ���ty܍�w�Aew�z:�������o��9,JU�&ЂS���J�T���$Nkmc4fl-�]Df�7�G}�b�܋�͐5����}�m��m�H���k|o��-+�u�O~745�s�����#r�GtkRR�c����`?�{���i4�7��L�9g��Q U��S�Z.��U�Ɣ����D�+\�J#���;�(D� �p�gE�p '�3h/��5���{�[�U����>�?>��$</�fB�/����ڂ%�R���h��\۔P��8~��X�$��GQ�Džt�Z�����<3�oKG�� ~�Y�YB��U Xp#2�0\�jpN��)�Bن�(�,�93����~��#74� P�؊Ե�Sn?Ț<��s�d���K��=���S� ��[�|aZZ��v|9���M�X�.wo^��\KFnѴ�1�Vt�S�tZ���N� �1��U�Ժ!�jA��ۿ���χ�^%舤�pa���4�:MO�Z�f�����B�&Ƒ���+�%=k>!�����}UĪB����?J,�2!��Yq��3�����jn�2� ƹ3��`{V2d�E�k������T�E�)����@$��x)�G�������&ښ���p�Rŀ:փG;�PWV8Zz�$ h �\L��'��.�bH8mQ��.X&�k��J3�FX=��s��q�6BhC�;m�(aH��XqΧ�('lD�H��{%XPl��*��I�r��>������O ��x��yya+א� _Y% b; ���yic&�I?�x!2x%���� %Q��JX�9@頭�]��D#%r"�e��Ł�SbGF,�v]It0� �R�9��#��+ �mf��~p�U�|���.7pҾ��mi�p�C�*�'w"cl�pk��=��h��g~=�y�"��F���toDz3�D��;A��ӱTӂ/<"�*x⩠���-ĢW��7ʰ���L?Hh�?ϐ��.��G���2>���c���@*�UW���ɞ�@=p"*����A�5u._��`�v���mı{�e���V���5R��"����7�CZiI�����o�d�?���}|��YȐ�_��wDz�F8�%�d�1�>�(�!y�_K��=�e��F!%��dp+MM�|�amڍ�L��lq���C4x��u���.�r�+�~�n�0�G����Ig���m��i�h���!ॠ�o��'�31������ц��y!�)ֳ�O���,�FtQ����@2�c�_H��^��=��:�@�2��MK���G�5�)>����'���c�k <�Z�~���@fg�i����G��E��r��hioX �oCe�X�Q5�#�R�8��%���O�43C�_yD�����y[�(�f��n�����2s5��*Z5����v$+�J,h[g�b*��5��{��������}N��O�)�u�1��VW;*�s�D����O����S���P���|m4�vu��Bb-z�v>�������*��ۂ�����7���N�O���n䯗t\�R���`<=����(.N"��C��n�~0�Q�8��
EncrytData
GetGame
GetLoginText
GetLoginThread
GetMirText
_EncrytData@16
_GetGame@12
_GetLoginText@12
_GetLoginThread@24
_GetMirText@12
Sections
.text Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
HookStub Size: 512B - Virtual size: 88B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bmw Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data0 Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 266KB - Virtual size: 266KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 66KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
أˣ./Ver0203.dat
-
أˣ./Ver0323.dat
-
أˣ./WeDlq.dat.dll windows:5 windows x86 arch:x86
733c693ee99316d7cf82bd05af3c6600
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
HeapAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
RegSetValueExA
psapi
GetModuleFileNameExA
shlwapi
StrStrIA
user32
MessageBoxA
Exports
Exports
(�M|jx�'��]/�~���i���!�e3Y�a����������=���в���h]w�:��iՇZ�XL!O��Cԭ�&�m���W��8s�ں��9��fl��P����#9d-�Z ��M:J�e_1�o1��{Ӆ��3}t˚����l ���m�)j�?���|�d�;'N7&v��b^�-rR�G���=���#Qr�U�N:��$ Q�c��ű����4�r�sqDP#:)��`~v���~xǢ�W%��-0?U�����U��Y�z�R�=�'nl�%`�������o3�sK"�)�R����1�P������4��Us��@�5��^~ �i�j�����+*�&IT�M�?QL�+C$�g#��SA���٩���u�k��~����u[�9!���%����I7��źj��I�Y�Y�馲�] W�q#�k�I�p+^S5�,����&K�zZ�=����<��`��/���2l�.�=e���>�������f��$�5�5~z)|��um�:s-��6�j�Q����wfusv���"���.�~�+�7�Y�7��E� �0h�G?Q�qe�-�m�@�\�a_*��L���j 0�]����(k�"��0�`����!����1B�"G�a��joH����W��!3Z��-)~<�{��]L<�Ԩ��# 1W��o��8O��r�ߴݡ��o�b��`I�n�4� ��f|�m/��KB;P)�]��l7�-ވp����^5�_��ݥ�I������G��P��wZ�( j�"- �NDN{� )����J��1�#�h4���<ږ�*Nz��A&XVa��0/�\�^���D�a�CJ���-i;&ʢ����X��u�F�Rj���ξ7�<J_�mA��x**'z�z����S{��e��^;��L�A�;t;�DIb0 �}��p$�^��M�V$L���&a�p1��䭲;��O��+��������S�ZXy%�ڹ�פ?s���ְ#)5y�{�K��Y�+�:J�s��RHj��*/�le ��c?�r�.UY��ϷBDb~X#�L�Zu�*��=$��0j����@�˘�5��-�z|B ����:u,�*�EF^�5����]��2 [�����.CgNm��i\�0��=�h0��qCwi����0��A,`�OE���Uׯe�Mء��ZC����xQ�@����!�I�нGa��xg4��dgBIྶ52.�� �@��Q���(o�lҁ b���r�q��(!�7*�#B&00���9�֬����Hy3��j��2��N>A~�c�Mt�ؚ�K���G�aS_���,>4��������A��Y���#�����p&6Dh2��HC"�b{����Yq �S7r�w���p��������u�D>���;)�%���5��~�&T��@���"=�J�!(��/��?�+�S���ٺ~h�U ���{�٬u�J�����r����l�2i�H"YqU���kR$�H������J�qV+ ц*h�w���*���8���d�pt�]n�`ֿv���]=u�r.]�b�?��3%����S��`JVO�����iJc�`m(��*��o�1���^�Z���7�ϗ|&�R��?٢�:���V��F����Ģ��� *�j������������d���]3.eu��`t\�'kϴH1�N����gJ�f���7b��t���7����S�e�����6���₹V�������s��#����I��e�%� ����揩m��6ɠ!�\Y�/IG�B�qߍJ묖� o���y�Al��QL�L�p���A��t�qUM)��`��Kg<�x���郁@6Έ�o�0�BS��Mϙ�]���{����ԣί�я�� \�M����R�X0�U��xl�@ڥ���~\�+����F�k���ѝQ�)W0����R��{�E5b�C&��P��&��4ٍƴ+�dū:s��f8M�&5��H=`$��h���V}�A���r(���_|�����٢�QDk���L���JS��@y_�H"�65�N�Jjn �����͐�{6"�����x��G*j�`��ƻ�cH��B��"fv6Z�81���/<�����;�=uGV���S9�x���U+�?*v�IR�W3�Y�����.0Q���q�)u�w#�_�F�Y�]����<q�m����\�|J31-^�#v)h&��Ȓ��u��&ZS`Bw��p��K�b���D��m�p؝��=r7 #�@_z��"��u��ߢ�_���Vo֞n�|N���J#d9\�4��p �M9�R�I~�3y.a��(ԍT��0��H�H���ocKM��j���B�i����4�@���`��Snu�?�8ǁ�KW��um�z����.c~,����M]P>*[u����6�?����R�7돺�_~�����k��xn}~=�J��75p�oܯ�7�4n(�����Z`�΄k�����I�iy{=V����]_^�aI} ���^M=PG���y��y���T1�|w)�{Bs��ޯ����VyiI��!}�"�e�N�~ʓ͐�K9��8����umu*|-e����2�x���r$Á�����>���-�oI9��� �ܒ�W�ʧ�חKM�J��{����-!��TfR�����|�- �UH����4K�o�aQ�BZ\�;��M3o��hh���/��̋.�Xf�z"��|���M]R��~ ��O)Ly�� ֒��Әq ɂI�B�*��sݝeh�[��X���ސ5?� ]��9�Vl�x�(&X��v�Gr�1h1� ����E��w������+��R��7^O��pؗ�s�}�3G$�.��{J���&֚ �鈗�\^����!�`��;�,��᱁oR\4�j29'�$27��h�����TL:KJ$�w`�c��(a$��PYg�{9��v[� {��O�#��|<�]=w^�l u�Ø�r̭t����27�[8�KҼ�pnsPb�\�W���m"gfs���jD�/� ��X����x�[�g�}m�!�hA*��x+�*��XSz� ��+N�WD|�{u�H�E��0�:1����
DoUnFuck
Find001
Find002
_Find001@20
_Find002@12
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
HookStub Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
textx Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data0 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
أˣ./WeDp.dat.dll windows:5 windows x86 arch:x86
ec853d71c857d095d65d755df0c59c49
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcmpA
lstrcatA
DeleteFileA
CreateFileA
WriteFile
CloseHandle
OpenProcess
VirtualQuery
HeapSize
ExitProcess
GetModuleHandleA
VirtualAllocEx
CreateRemoteThread
GetExitCodeProcess
TerminateProcess
Sleep
GetCurrentProcess
GetLastError
LoadLibraryA
GetProcAddress
HeapFree
VirtualProtect
HeapAlloc
WriteProcessMemory
HeapCreate
GetCurrentThreadId
GetCommandLineA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
advapi32
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
psapi
GetModuleFileNameExA
shlwapi
StrStrIA
user32
MessageBoxA
Exports
Exports
DoUnFuck
Find001
Find002
_Find001@20
_Find002@12
�z�������Ѕ��nB�j.{I�-�S�ܗ�L��0���n by�!/c@a��x�;��ʊ��h7������9�I�&� qN9� Ԣ/�K5[}O���D.��W��X��ߎH���ٗ���̼��z$���`\?>�� $�S�t�lX����:7�-^�$�N��#�)�9�* =|�g�����v���rh6BF�;@�p܉���P��|H�gJu?�/��NM!yO��)9/C)^?��Eg�Y�Ec�o�����P,PeE?ϴ���B)��`�4��EG��Σ���Ԥ`�N�ԡɍoh=F�+�������~��I��b7�k�ʐ,ŀ�n����i۽y`�ϯ�V��v��^�R��ł9E�����������t�7��c�+�1��8�!�ùq�R��{I����#�@"(躿^�VQ3��T;=�d�[�PǶ��������0����S'~\;(;C�r�� ����Z�����sn汌��M`9" �Ԁ�>x�z) �6�]�v�����a�c������������J5TZ� �XO��sa�`�,V�͟g��#M���{=���c�Ձp� ?*�'�Wy�խ�C��|�s���)��(؈L�q��]�� �̱bpǗ".�� o���Wa����o��bJ��s�����A�����wˡL���#1��e-:�Rō �մ\��ͅ I��r�����*b;����+��U��AJ����^-}�[κ.�/+��s�9 ��<�-�����\�.��o��-��A�Ŀ6=���ߊX}1�G ����)�M7k��<�s/g<������~�T��=Xݣ�3�-I(f�y3GXhb�7���n53���k ;�{�g{�Ed�y̓���/�(C�v��4�;�v�GhW����lZ��!S�W�8�"!�����2O��w�ʧ@���O�V�ט��� 8E �H��i�_�XY�S^�ۧ�)�C,G�匷�L+�Rt;��"�����5��̫��*[)٢k���&��W��ץ���B�[I��I��5g�Ŷ�4�N��i��i+��F�W���!��x��� tI�(P ��I�]�y����[$�\j��=�S;��B��G���U������'���:g7> ��.��זk-X�Xa\�B�a�A�LT@Gi�S8,��폊���� ��ǹ0e��L����}u ��qD��˹�W��0W�ܴu�`��1)j����{���e�FՃyT2����֗�]��Qy�X�i���pn����f�yi�ǀ�����j�������:2��� �w�L�إz䨍���=��O�Ѳa��ýVYU��C�h#�y�%A�!�K��$P�g�������h�Qmx�G�Ȁ�d�X�w�<�gd|�yL��ى���Z@���Ǽ��M�(X�{�4-}���!��{6SSf���Ǟ]�8V�@~�� �{�쇸��' n�٠��E��N�����Ŀ�e���*J�:�=5I%�0P'��?���E��Y�-�E,�.��|�3����8@���ʋP��_Z���x���D��iy�!kJ6eٿ��0�9���`G��N}� 8ػu�O�zޔ�&(�垩�l�e_z2FR�����v����/���xI��4�m=ԮS�p���/:��%؇6"��Ղ��~Q������0�&]�%�A!/t���ڀN��Hg ���%:7�g5]4˅�b�i\E���g�](s~=~ٸ��z��Q�,����g��7�N �u:4hk�_Ї�O*N�ͤa �J��,�BT'��:F$�G��z.�l�8l �J��)2-�h����5-��Z~9�8'(���%�yr 6aN��/�?`|��#RY; ;L4ʉ�_�QaFY����n��-usū<�����Y`��w�6�2sO�ˉT���ȁ�<�u�{����x~Q�)������%���[�I:�s䓬L.��L_�J����Ww���Hh��J��4ͤ���2DV+:��+�fJ�ı���x������t� $��Dn��p�z�KPx��-�/��D�ss>�y�]�t�H9?u�%��kn�g}V"��.�*~�d����N cGM@}+9��{�_K���g\0�/aP'B�����z��;�y�ν�]���Bv�Ɓ�j�^wvVF"�����~ץ&=�k��8���~���?]�%�;Y=1�1�~��R��(�n�Mˬ�F>{��?����f4�N�V�v�8M�je��v�#�מ���0��c���j�ؚ�ǡbH������#�i���7�(x������a�;i��[���<�I�g4��B�@���nc�1P�*w����됲��BP�� 6�m�G GnAė�(r\**���d%9��'(�DjN��N8�om�u~AI��(|BMI��ξu��`�:�J5�'FYT9�.A��ճ^�z�p����e��nL����b����N�yy<`�4���I�?��k�f{��6�f�&��y�TK7�D���)���BY��;��S$�ѕQ�E �=��a�B[c�/��~`7%���ս�ퟟ���^�ރ^���i<��o���b�z9.��[�L$b&��sI^�Z3��Х!%�"c/�X"< zE!�W�,��xI��~}��� �9��Z�Y4�S^6����������e�&��/�Ǵ����� ��(��#�o��+��O�G����ގ/HqC��)���I������Z�wg� ��qW�߄�%���戂��"Y%�T6����j�F�r����N4��Pq�2��NW�BFQ���L'B�C����|F�7��_���u��"�OqQ u����gx�P�{5�| Xq�� �d`� B��`1z�eL��%�<}8NK���H���\˹!�����/�[f�}�����Ǫ�vM������<�R9�%���_�d���S3ap�ˆ���[��>��D�jq�v�R�x�;�����+K�W��Ev�n�]r!���I>{� �� ���9�Q��$�VW��~�d5�C�+o$��BBm�؆�TH嘶�8���T�z�B�䲷-��py`�$��B���hѰ�p
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
HookStub Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
textx Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xkp0 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xkp1 Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xkp2 Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
أˣ./update.exe.exe windows:5 windows x86 arch:x86
2928fdd87ecb20e7c12b84acdd5b8d09
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
urlmon
URLDownloadToFileA
msvbvm60
EVENT_SINK_GetIDsOfNames
msvcrt
malloc
iphlpapi
GetAdaptersInfo
psapi
GetMappedFileNameW
kernel32
QueryDosDeviceW
user32
IsWindow
advapi32
RegOpenKeyExA
Sections
.text Size: 32KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
أˣ./xkm.dat.dll windows:5 windows x86 arch:x86
a9812d54be05f79ead1a25da2e970882
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetStdHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CheckDlgButton
MessageBoxA
shlwapi
StrStrA
comctl32
ord17
ws2_32
send
Exports
Exports
/�,�c��\l4j��WB[��U��e�^/!���һ����1�3N�a�7�z%%�5�B��o�*�J;�NauVG�,�&X��®�/c�ΕSP�k{�6�A� ���Z��V�����ný b�GH[��Җ��,�����ֱ�F1oG����Uw�0��S��9SE�J��&�2h��75{fCۧ}͑XK��Mg��B�oړ��r p�@�I������Z$��ιəч�(:�mB�)��S�� �2(5#2e�j�7o�I�� �=Gr`i�����!}����:�`��!6x8�ʌ�"a�J'�m\+@�%�-=;����4��1�ݵ#s���6 ��U�=�� �XYo�)�k��}M6-�~*���)�* xi�h��N�b���E_ܑjѩ�U��gQ���L���n�W �싌� �Hi7��{*#e��G�E��}Rt���� `A�F1\�\Lk�n��+���Sٛ���Ew�O� ����E�r�K+?{�l]h�nFQ�����j<Kal(�%&��lF�+�*a��V�2�Y���7a+<�Q��j�.c���l ������������o�.�)$��q��B�^7� �X��L�$�śW90�+�����B+�JfϐPh��%Ia�ٿv��� �@��b-��NU���EPnm�b�Ȑ��^S�5m�J�\"Y����7Ti�d��/1����')�:�����*J2���m�G����i�P�Xq��?V,��X���V핍J(Q��'d3�2dV(b[�0$���p4!=k����Y���VR�8Q�L@����n�'��;���z7$&(����h���`�Q!d�MZ6�#�8b��T�n��-�t�D�����G ���{+��*�<�x��0<��s�h�/�����Ρ��Bڭ���+'��&B�?�).G����<��r�ج�8q�o�B�7+�ɦ;!�K�3n�b��)��탷�|�X�F�(�>_�$���蝹�6|[[�&y0�TRPrJS�D1ܞ>�nX�����Uk���3�H8��ᨧ2s��.'�����'�G�������dUg�㜑��� �}��2֯�! ���]�"�%�1��I�> f;��5_�0и�z���L"^Jr��v�%�bG��ou�a�y�-�������ue��n6$B��QL�É��/��n^�`��`���wyF:'yT����\ ف��V�kP#r�@� ���V@�lD)��$ śT�a�i�:��t�H�ce���'���mRuA ��HLTfT��#��OWX�A0�X�װjW��6�~��%�8MEy��Gh��:«������D��� ��ǥ�n�q:"x�Av�߾E�o�D�m52~)� �z4S-='��>4������8�e�R�U��l�\��OC�v��s+VL���ts��<;-L#}���cl'�f6�q�r��Z~h��-B7��.���Ѹ$���X��\�>nF�� �o�X����-�w�Cl�먄Y��3�M����%IJ<L�P��I����<%�^���Uo+͌cZ��a�N��5����;�Q�I��]�<��Xa�'�����/�����V��L������ 6A���#��?�S � ٿ��K��22�`ߛZ?�L]�8���,�$�[�N^\��"��n�4�>���З �d��,VO�,JV��rq?��ST>0�Z�͏S!Z �pA 4]I�C:���p?���"��ܬ5�w&�����$0��0Тg�J���t۫{���w. ��P����Q��5�m��?���L��2PϹS# �J��)ѱ�n噍q��C�N�u �&��N�����\���y=]t�/�.$��n )3�H��a®����7�v\9ßƯ�'ߚpYk�n_\�P*7���~��# Ք9B���ӢO3d��:����N�eUnX���aՂ�����i��YBf�+Ͽ�v���;�4a���}��,֨���������{I�H��"���&1Ӑ JsY�[j�E��!KS��C\����ã����9ɞ��9����1��h`�Dq,M�O������[��������G�N�憴�e����0iLO��*7A(���`u�CV��<J �|��^=#"�(��6��:��r�M�'��1�0}�P��K����o�헹%%�Ùkh��e巓�ݠ9������T�UC5Q���?�uY!L�� �O��\/���H'$�������PEc�M�'ye<+լ7,���푞n%�6rP���h6hq��)�XO�,�ư�j\_ {���㲜�@��:T�������S/��<ᛕg}4;YU�&����������Yl����}��������`��w����s�<��?ip��9�`���DT���<�6�]�y�F5��P�k{��B���9�`�ƻ�,��;��+��߯���j2i��AI3s����q�,�u4i �Ǵ�����7��Wd��F�E���~�g6�>c�ǁ7u���@����#2b�^���� ��(o�a�,7_}͌C���zV[�#��q4o`/�ul����ݖo��=ccz��C^/7��.*�V]���s����&��y�/}�o�#���gSB��jp6 &�S !*T퀙��m���^]����������JG�;Ar�Q�<�#-g�4z}�u&�h�7���_ۆ��/�#� g�z��0�q�� �3��Hy�;+~2�����/�/òD\���Ӥ(�Y�`���R���>�}�<�r�ʹ�u-�\�s�}�ٵr��՝HG6S�*���UR u���\��v���E�۹�U����xozk.���5� |���^F���6���?��_����|R�VD�YVw�����iߖ���_�rze�2w#V��2�o?�� ���D�� ��b�q�&TV�nUs���I�����U��A���ᕕa&E�����/Y�2���o���A�\M�ְ��2A�w6#�v�j4|n�*��á��r*2�a��|8y8`�T�����:X��,/�����ӽ������_�T�W�~[s�y��&�$w���'��";�#�%:
Sections
.text Size: 175KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
HookStub Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data0 Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data1 Size: 271KB - Virtual size: 270KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data2 Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
أˣ./Сɐ۽̴̳ȫ.url
-
أˣ./Сɰٷվ.url
-
أˣ./Сɰԣ.exe.exe windows:4 windows x86 arch:x86
8291f82e207ae31a3d766f1710393434
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord2621
ord1134
ord535
ord941
ord800
ord537
ord540
ord823
ord668
ord1168
ord1980
ord2770
ord356
ord860
ord922
ord924
ord858
ord926
ord3790
ord939
ord5710
ord2614
ord5856
ord4278
ord2514
ord3663
ord6055
ord1776
ord5290
ord3402
ord5265
ord4376
ord4853
ord4998
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord4627
ord4425
ord3597
ord1146
ord567
ord324
ord2135
ord2302
ord4234
ord4287
ord4160
ord2863
ord4710
ord4277
ord6662
ord5683
ord2379
ord755
ord470
ord6215
ord798
ord1997
ord5465
ord532
ord5440
ord6383
ord5450
ord6394
ord1949
ord4034
ord818
ord641
ord815
ord825
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord4673
ord1576
msvcrt
__dllonexit
_itoa
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_setmbcp
__CxxFrameHandler
fclose
fread
fopen
fwrite
exit
_mbscmp
_controlfp
kernel32
CloseHandle
GetCurrentDirectoryA
Sleep
CreateFileA
WinExec
GetModuleFileNameA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
GetStartupInfoA
WriteFile
SizeofResource
DeleteFileA
GetTempPathA
LockResource
FindResourceA
LoadResource
user32
KillTimer
IsIconic
GetSystemMetrics
DrawIcon
GetSystemMenu
AppendMenuA
SendMessageA
SetWindowPos
SetTimer
EnableWindow
LoadIconA
GetClientRect
msvcp60
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
Sections
.text Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 540B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 444KB - Virtual size: 440KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
أˣ./֣ɣ߹.url
-
أˣ./.˵.txt
-
أˣ./ļ/SKY/1.76վ.ini
-
أˣ./ļ/SKY/1.76𣨷.ini
-
أˣ./ļ/SKY/1.85սʿר.ini
-
أˣ./ļ/SKY/1.85ר.ini
-
أˣ./ļ/SKY/1.99Ӱս.ini
-
أˣ./ļ/SKY/1.99Ӱ.ini
-
أˣ./ļ/SKY/ר.ini
-
أˣ./ļ/SKY/бר.ini