961cca6cec6d7649b04ae106aae9b991_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

961cca6cec6d7649b04ae106aae9b991_JaffaCakes118
Size

2.0MB
MD5

961cca6cec6d7649b04ae106aae9b991
SHA1

3ce49de40c840c6facebf32723fdf35ab32e4ab9
SHA256

1aefc871cf047916411426953da59bcbfcfde96cbac4180242d8b3839686f8a3
SHA512

fe91a2d82a7e49f4bd8eb714188803c4f1675930c5269c5c80d6ff0007afaf5e993fdfe3ccfe8bed8ff3beae8066128ebe5b860e970364682bd98b27aa27cf96
SSDEEP

49152:Hu3ImXECPUUCak4jZDnz3+FLYCyuvTcnEjpNMdo5VipR:HuYmUC8D0NnKhYCyeZ2O5Viv

Score

3^/10

Malware Config

Signatures

Unsigned PE 23 IoCs

Checks for missing Authenticode signature.

resource
961cca6cec6d7649b04ae106aae9b991_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/AESocket.dll
unpack001/CS15Hook.dll
unpack001/CommonLib.dll
unpack001/CrashSender.exe
unpack001/FPSHook.dll
unpack001/GarenaSkin.dll
unpack001/GarenaSkin1.dll
unpack001/GarenaSkin2.dll
unpack001/GarenaTVHook.dll
unpack001/GarenaTV_UI.dll
unpack001/Inject.dll
unpack001/L4DSocket.dll
unpack001/PluginKernel.dll
unpack001/SocketHook.dll
unpack001/War3Hook.dll
unpack001/YYFileSystem.dll
unpack001/atl71.dll
unpack001/sqlite3.dll
unpack001/update.exe

Files

961cca6cec6d7649b04ae106aae9b991_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 580KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:5 windows x86 arch:x86

e981c0ab92cb1f191bb5e23392e14796

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrlenW
GlobalAlloc
lstrcmpW
GetModuleHandleW
MulDiv
lstrcpyW
lstrcpynW

user32

SetWindowTextW
SetDlgItemTextW
EndDialog
SendDlgItemMessageW
DialogBoxParamW
LoadIconW
SendMessageW
ShowWindow
GetDC

gdi32

CreateFontIndirectW
GetDeviceCaps
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 729B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 350B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/StartMenu.dll
.dll windows:5 windows x86 arch:x86

b1d9539c7cfd95718179dedb471b482f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindFirstFileW
lstrcatW
lstrcpyW
MulDiv
GetModuleHandleW
lstrcmpW
GlobalFree
lstrcpynW
GlobalAlloc
FindNextFileW
lstrcmpiW
FindClose

user32

PostMessageW
CallWindowProcW
GetWindowLongW
IsDialogMessageW
CheckDlgButton
ShowWindow
LoadIconW
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextW
IsDlgButtonChecked
GetWindowTextW
GetDlgItem
wsprintfW
CreateDialogParamW
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
SetWindowLongW
SendMessageW

gdi32

GetTextMetricsW
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoTaskMemFree

Exports

Exports

Init
Select
Show

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
AESocket.dll
.dll windows:4 windows x86 arch:x86

d19de0d004578cc7ea30566b2d8394d5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
DisableThreadLibraryCalls
GetCurrentProcess
WaitForSingleObject
SetEvent
CloseHandle
OpenEventW
GetModuleFileNameW
OpenFileMappingA
UnmapViewOfFile
GetLastError
MapViewOfFile
GetCurrentThread
GetTickCount
LoadLibraryW
FreeLibrary
GetProcAddress
ResumeThread
CreateProcessA
CreateProcessW
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryA
WriteFile
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualQuery
VirtualProtect
VirtualAlloc
GetCurrentThreadId
FlushInstructionCache
SetThreadContext
GetThreadContext
SuspendThread
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA

ws2_32

bind
recvfrom
WSARecvFrom
sendto
WSASendTo
WSAGetLastError
connect
accept
getpeername
htons
htonl
ntohl
ntohs
getsockopt
gethostbyname
gethostname
WSAIoctl
inet_ntoa

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CS15Hook.dll
.dll windows:4 windows x86 arch:x86

1040fa5da89612fa22cc7ed3c6306dbb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
DisableThreadLibraryCalls
InitializeCriticalSection
LeaveCriticalSection
GetCurrentProcess
DeleteCriticalSection
EnterCriticalSection
CloseHandle
GetModuleFileNameW
WideCharToMultiByte
OutputDebugStringW
GetLastError
MapViewOfFile
UnmapViewOfFile
OpenFileMappingA
GetCurrentThread
FreeLibrary
ResumeThread
CreateProcessA
CreateProcessW
LoadLibraryW
GetProcAddress
CompareStringW
CompareStringA
SetEndOfFile
CreateFileW
CreateFileA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LoadLibraryA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
InterlockedIncrement
InterlockedDecrement
Sleep
InterlockedExchange
InterlockedCompareExchange
MultiByteToWideChar
VirtualQuery
VirtualProtect
VirtualAlloc
GetCurrentThreadId
FlushInstructionCache
SetThreadContext
GetThreadContext
SuspendThread
SetLastError
GetSystemTimeAsFileTime
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetVersionExA
HeapAlloc
GetProcessHeap
LCMapStringA
LCMapStringW
GetCPInfo
RtlUnwind
RaiseException
GetModuleHandleA
ExitProcess
ReadFile
GetTimeZoneInformation
WriteFile
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetACP
GetOEMCP
IsValidCodePage
SetEnvironmentVariableA

ws2_32

WSASendTo
WSASetLastError
WSAGetLastError
bind
recvfrom
WSARecvFrom
sendto
connect
WSARecv
send
accept
getpeername
htonl
htons
ntohs
getsockopt
inet_ntoa
gethostbyname
gethostname

Sections

.text
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CommonLib.dll
.dll windows:4 windows x86 arch:x86

9763997563cf7d906063a7fbb8c9b1f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

v:\Common\CommonLib\Release\CommonLib.pdb

Imports

kernel32

GetLastError
CreateDirectoryW
MultiByteToWideChar
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
WideCharToMultiByte
CloseHandle
CreateFileW
lstrlenW
lstrcpyW
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetVersionExA
RaiseException
RtlUnwind
GetCPInfo
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualAlloc
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
LoadLibraryA
GetLocaleInfoW
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

shlwapi

PathFileExistsW
HashData

Exports

Exports

??0CLocationInfo@Exception@Common@@QAE@ABV012@@Z
??0CLocationInfo@Exception@Common@@QAE@PB_W0H@Z
??0CLocationInfo@Exception@Common@@QAE@XZ
??0CMyBuffer@Buffer@Common@@QAE@XZ
??0CMyStringA@Buffer@Common@@QAE@XZ
??0CMyStringW@Buffer@Common@@QAE@XZ
??0CRunTimeException@Exception@Common@@QAE@ABV012@@Z
??0CRunTimeException@Exception@Common@@QAE@PBVCLocationInfo@12@PBDK@Z
??0CRunTimeException@Exception@Common@@QAE@PBVCLocationInfo@12@PB_WK@Z
??1CLocationInfo@Exception@Common@@QAE@XZ
??1CMyBuffer@Buffer@Common@@QAE@XZ
??1CMyStringA@Buffer@Common@@QAE@XZ
??1CMyStringW@Buffer@Common@@QAE@XZ
??1CRunTimeException@Exception@Common@@QAE@XZ
??4CLocationInfo@Exception@Common@@QAEAAV012@ABV012@@Z
??4CRunTimeException@Exception@Common@@QAEAAV012@ABV012@@Z
?Attach@CMyBuffer@Buffer@Common@@QAEXPBDH@Z
?Attach@CMyStringA@Buffer@Common@@QAEXPBD@Z
?Attach@CMyStringW@Buffer@Common@@QAEXPB_W@Z
?GetAppFolder@Path@Common@@YA?BHPAVCMyStringW@Buffer@2@@Z
?GetDataLength@CMyBuffer@Buffer@Common@@QBEHXZ
?GetErrorCode@CRunTimeException@Exception@Common@@QBEKXZ
?GetErrorMessage@CRunTimeException@Exception@Common@@QBEPB_WXZ
?GetModuleFolder@Path@Common@@YA?BHPAUHINSTANCE__@@PAVCMyStringW@Buffer@2@@Z
?GetSource@CRunTimeException@Exception@Common@@QBEPB_WXZ
?HashData@Data@Common@@YAKPBDHK@Z
?IsDirectoryExists@Path@Common@@YAHPB_W@Z
?IsFileExists@Path@Common@@YAHPB_W@Z
?MakeSureDirectoryPathExists@Path@Common@@YAHPB_W@Z
?ToArray@CMyBuffer@Buffer@Common@@QBEPBDXZ
?ToString@CLocationInfo@Exception@Common@@QBEPB_WXZ
?UnicodeToUtf8@Convert@Common@@YAXPB_WPAVCMyStringA@Buffer@2@@Z
?Utf8ToUnicode@Convert@Common@@YAXPBDPAVCMyStringW@Buffer@2@@Z
?c_str@CMyStringA@Buffer@Common@@QBEPBDXZ
?c_str@CMyStringW@Buffer@Common@@QBEPB_WXZ

Sections

.text
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CrashSender.exe
.exe windows:4 windows x86 arch:x86

99b90a2d2929c63f927d0a18e66e6c20

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\NetworkLib\Garena\trunk\client_libraries\CrashReport\Release\CrashSender.pdb

Imports

wininet

InternetCrackUrlW
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersW
InternetSetOptionW
HttpSendRequestW
HttpQueryInfoW
InternetQueryDataAvailable
InternetReadFile
InternetCloseHandle

kernel32

RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
lstrlenW
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
SetLastError
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
GetTickCount
CloseHandle
TerminateThread
GetFileAttributesExW
GetProcAddress
GetVersionExW
WideCharToMultiByte
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
SetFilePointer
ReadFile
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
WriteFile
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeW
CreateFileA
CompareStringW
CompareStringA
SetEndOfFile
GetStringTypeA
CreateFileW
ExitProcess
GetModuleHandleA
GetCPInfo
GetCommandLineA
SetEnvironmentVariableA
InterlockedCompareExchange
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
Sleep
RtlUnwind
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
ExitThread
CreateThread
GetStartupInfoW
LCMapStringA
LCMapStringW

user32

SetWindowLongW
LoadStringW
DefWindowProcW
GetActiveWindow
GetSystemMetrics
LoadImageW
CreateDialogParamW
DialogBoxParamW
GetDlgItem
KillTimer
SetTimer
SetWindowTextW
EndDialog
PostQuitMessage
GetParent
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints
SetWindowPos
IsDialogMessageW
SendMessageW
GetWindowLongW
DestroyWindow
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
ShowWindow
UnregisterClassA

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW

ole32

CoUninitialize
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

Sections

.text
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
FPSHook.dll
.dll windows:5 windows x86 arch:x86

75461bf87660ee2aff3bd2b6352dbf24

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\GG\client_plugins\Release\FPSHook.pdb

Imports

kernel32

MapViewOfFile
UnmapViewOfFile
HeapAlloc
HeapFree
GetModuleHandleW
VirtualFree
GetProcessHeap
LoadLibraryW
Sleep
lstrcatA
SetThreadPriority
lstrcmpiA
GetProcAddress
VirtualAlloc
OpenFileMappingW
VirtualProtect
CloseHandle
ResumeThread
CreateThread
lstrcpyA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
GetLastError
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
WriteFile
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
LoadLibraryA
InitializeCriticalSectionAndSpinCount

user32

wsprintfA
PostMessageW

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
GGICON.ico
Gamecn.dat
Gameen.dat
Gametw.dat
Gamevn.dat
Garena.dat
Garena.exe
.exe windows:4 windows x86 arch:x86

ece51b23a942185e0583b54c9b96e838

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

57:df:ab:ea:92:d2:96:12:ea:53:6f:d1:49:bb:3f:ae
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03-11-2010 00:00

Not After

03-11-2011 23:59

Subject

CN=Garena Online Pte Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Garena Online Pte Ltd,L=Singapore,ST=Singapore,C=SG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3e:01:78:e4:b3:73:58:22:5f:44:39:bd:60:94:42:0b:9a:6f:ac:a6
Signer

Actual PE Digest

3e:01:78:e4:b3:73:58:22:5f:44:39:bd:60:94:42:0b:9a:6f:ac:a6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\NetworkLib\Garena\platform\old\garena_client\bin\Garena.pdb

Imports

sqlite3

sqlite3_reset
sqlite3_finalize
sqlite3_step
sqlite3_changes
sqlite3_bind_text16
sqlite3_column_text16
sqlite3_column_name16
sqlite3_column_type
sqlite3_prepare16
sqlite3_close
sqlite3_open16
sqlite3_errmsg16
sqlite3_free
sqlite3_column_count
sqlite3_busy_timeout
sqlite3_last_insert_rowid

inject

InjectCode

ggsec

ord1

kernel32

HeapReAlloc
OpenProcess
SetFilePointer
SystemTimeToFileTime
GetFileAttributesW
LocalFileTimeToFileTime
CreateDirectoryW
GetCurrentDirectoryW
SetFileTime
WriteFile
FileTimeToSystemTime
GetFileInformationByHandle
lstrcmpiA
ExitProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
IsBadReadPtr
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CompareStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
GetDateFormatA
GetTimeFormatA
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
HeapCreate
GetModuleFileNameA
GetStdHandle
GetModuleHandleA
GetStringTypeW
GetStringTypeA
GetCPInfo
HeapFree
LCMapStringA
GetStartupInfoW
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
RtlUnwind
CreateWaitableTimerA
SetWaitableTimer
WaitForMultipleObjects
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
GetSystemTimeAsFileTime
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
HeapSize
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetVersionExA
GetProcessHeap
HeapAlloc
DuplicateHandle
CreateSemaphoreA
ReleaseSemaphore
lstrcpynW
CreateFileMappingA
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetCommandLineA
GetCommandLineW
QueryPerformanceCounter
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
SetEndOfFile
SetEnvironmentVariableA
LCMapStringW
CreateMutexW
CompareStringW
lstrlenW
FlushInstructionCache
GetCurrentProcess
RaiseException
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
lstrcmpiW
SetLastError
WideCharToMultiByte
GlobalUnlock
GlobalLock
GlobalAlloc
InitializeCriticalSection
DeleteCriticalSection
GetLastError
lstrcmpW
MulDiv
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
lstrcpyW
MultiByteToWideChar
lstrlenA
ResumeThread
SetThreadPriority
CloseHandle
Sleep
GetTickCount
GetProcAddress
FreeLibrary
LoadLibraryW
GetModuleHandleW
CreateFileW
ReadFile
GetFileSize
GetLocalTime
GetVersionExW
CreateThread
LoadLibraryExW
TerminateProcess
CreateProcessW
SetCurrentDirectoryW
CreateEventA
WaitForSingleObject
SetEvent
ResetEvent
CreateEventW
GlobalFree
GetExitCodeThread
OpenMutexW
TerminateThread
GetEnvironmentStringsW

user32

EnableWindow
FlashWindow
GetForegroundWindow
SwitchToThisWindow
GetWindowLongW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetMenu
SetWindowPos
GetWindowRect
GetClientRect
SetFocus
CheckDlgButton
GetParent
GetDlgItem
AdjustWindowRectEx
IsWindow
MapWindowPoints
DrawEdge
GetSystemMetrics
GetWindowDC
SetMenuItemInfoW
BringWindowToTop
GetMenuItemInfoW
SetMenuDefaultItem
SetScrollPos
GetScrollInfo
TrackPopupMenu
RemoveMenu
GetKeyState
RegisterClassW
CloseClipboard
SetClipboardData
EmptyClipboard
EnumChildWindows
GetUpdateRect
SetRect
IsRectEmpty
ChildWindowFromPoint
FindWindowExW
LoadIconW
DestroyIcon
IsMenu
DrawIconEx
SetActiveWindow
FindWindowW
MessageBoxW
IntersectRect
PostQuitMessage
CopyRect
IsZoomed
DestroyCursor
PeekMessageW
TranslateMessage
DispatchMessageW
GetMessageW
LoadImageW
CreateWindowExW
IsDialogMessageW
GetMessagePos
GetActiveWindow
SystemParametersInfoW
GetWindow
GetWindowThreadProcessId
GetClassInfoW
OpenClipboard
CheckMenuItem
wsprintfW
DialogBoxParamW
UnregisterClassA
KillTimer
SetTimer
GetSubMenu
EnableMenuItem
AppendMenuW
MonitorFromPoint
GetMonitorInfoW
DestroyMenu
CreatePopupMenu
WindowFromPoint
SetWindowRgn
SetDlgItemInt
GetDlgItemInt
CreateAcceleratorTableW
GetFocus
DestroyAcceleratorTable
DrawTextW
ShowWindow
CharNextW
DefWindowProcW
BeginPaint
EndPaint
GetDC
ReleaseDC
ReleaseCapture
GetCapture
ClientToScreen
SetCapture
PtInRect
SetRectEmpty
OffsetRect
ScreenToClient
UpdateWindow
InvalidateRect
GetDlgCtrlID
CallWindowProcW
SetCursor
GetCursorPos
LoadCursorW
GetClassNameW
GetDesktopWindow
IsChild
RedrawWindow
InvalidateRgn
MoveWindow
GetSysColor
RegisterWindowMessageW
RegisterClassExW
FillRect
GetClassInfoExW
CreateDialogParamW
SetForegroundWindow
IsIconic
EndDialog
SetDlgItemTextW
MessageBeep
IsWindowVisible
SetWindowLongW
DestroyWindow
SendMessageW
GetSysColorBrush
PostMessageW

gdi32

CreateCompatibleBitmap
GetDIBits
CreateDIBitmap
SetPixel
GetPixel
SelectClipRgn
LineTo
MoveToEx
CreateBitmap
CreatePatternBrush
PatBlt
SetBkColor
ExtTextOutW
CreateDCW
SetViewportOrgEx
Polygon
CreatePen
SetTextColor
SetBkMode
RestoreDC
SaveDC
CreateRectRgn
CombineRgn
GetDeviceCaps
BitBlt
CreateSolidBrush
StretchBlt
CreateCompatibleDC
ExcludeClipRect
GetStockObject
CreateFontIndirectW
DeleteDC
GetObjectW
DeleteObject
SelectObject

comdlg32

ChooseFontW
GetSaveFileNameW
GetOpenFileNameW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW

shell32

Shell_NotifyIconW
ShellExecuteW

ole32

CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoTaskMemRealloc
OleLockRunning
StringFromGUID2
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoUninitialize
CoInitialize
CoGetClassObject

oleaut32

OleLoadPicture
SafeArrayCreate
SafeArrayRedim
SafeArrayDestroy
SafeArrayLock
SafeArrayUnlock
SafeArrayCopy
SafeArrayGetVartype
SafeArrayCreateVector
VarUI4FromStr
VarDecCmp
VarDecFromStr
VarR8FromStr
VarI4FromStr
VarDateFromStr
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringByteLen
DispCallFunc
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysStringByteLen
SysAllocString
SysAllocStringLen
VariantClear
VariantInit
SysFreeString
SysStringLen

shlwapi

PathRemoveExtensionW
PathFindFileNameW

comctl32

ImageList_Draw
ImageList_GetImageCount
ImageList_Create
ImageList_AddMasked
InitCommonControlsEx
DestroyPropertySheetPage
CreatePropertySheetPageW
ImageList_GetIcon
ImageList_Add
ImageList_ReplaceIcon
PropertySheetW
_TrackMouseEvent

msimg32

TransparentBlt

pluginkernel

ord3
ord1

commonlib

?IsFileExists@Path@Common@@YAHPB_W@Z
ord6
?MakeSureDirectoryPathExists@Path@Common@@YAHPB_W@Z
?GetErrorMessage@CRunTimeException@Exception@Common@@QBEPB_WXZ
?GetErrorCode@CRunTimeException@Exception@Common@@QBEKXZ
??0CRunTimeException@Exception@Common@@QAE@PBVCLocationInfo@12@PBDK@Z
??1CLocationInfo@Exception@Common@@QAE@XZ
??0CRunTimeException@Exception@Common@@QAE@PBVCLocationInfo@12@PB_WK@Z
??0CLocationInfo@Exception@Common@@QAE@PB_W0H@Z
??1CRunTimeException@Exception@Common@@QAE@XZ
??0CRunTimeException@Exception@Common@@QAE@ABV012@@Z
??1CMyBuffer@Buffer@Common@@QAE@XZ
?ToArray@CMyBuffer@Buffer@Common@@QBEPBDXZ
?GetDataLength@CMyBuffer@Buffer@Common@@QBEHXZ
??0CMyBuffer@Buffer@Common@@QAE@XZ
ord1
?GetSource@CRunTimeException@Exception@Common@@QBEPB_WXZ
ord2
?HashData@Data@Common@@YAKPBDHK@Z

ws2_32

recvfrom
sendto
getpeername
listen
accept
bind
WSAGetLastError
getsockname
recv
send
closesocket
connect
inet_addr
socket
htonl
inet_ntoa
gethostbyname
htons
WSACleanup
WSAStartup
ntohl
ntohs
gethostname

garenaskin1

_UninstallSkin@0
_GetSkinFont@4
_GetImage@8
_GetGameIcon@12
_InstallSkin@0
_GetImageFromSkin@4
_SetSkinPath@4
_TrackSkinPopupMenu@20
_GetColor@4

wininet

HttpOpenRequestW
InternetCloseHandle
HttpSendRequestExW
HttpSendRequestW
InternetWriteFile
InternetReadFile
InternetConnectW
InternetOpenW
InternetSetOptionW
InternetGetLastResponseInfoW
InternetCrackUrlW
HttpQueryInfoW

winmm

sndPlaySoundW

psapi

GetModuleBaseNameW
EnumProcesses
GetModuleFileNameExW
EnumProcessModules

Exports

Exports

AddGame
AddMidPanel
CalcEValue
CanAccess
CurrentRoomDisplaySystemInfo
GGTVNewGame
GetCurrentRoomInfo
GetGamePathByGameId
GetIdByName
GetMyInfo
GetMyUserType
GetRoomType
GetService
GetStringById
GetUILanguage
GetUIObject
GetWnd
LaunchGame
MyMessageBox
NotifyTrayMsg
RegisterUIEvent
SendToMainServer
SendToRoomServer
SendToUser
SetUserGamingStatus
ShowGameSettingDlg
ShowMidPanel

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 388KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 120KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Garena_A
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
GarenaSkin.dll
.dll windows:4 windows x86 arch:x86

7b9c92837b1e3edbe72847ae0983b21c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\TestApp\bin\innerrelease\GarenaSkin.pdb

Imports

kernel32

CloseHandle
LocalFileTimeToFileTime
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
HeapCreate
GetModuleFileNameA
GetStdHandle
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
InterlockedCompareExchange
SystemTimeToFileTime
GetCurrentDirectoryW
SetFilePointer
lstrcpyW
CreateFileW
ReadFile
WriteFile
EnterCriticalSection
SetLastError
RaiseException
LeaveCriticalSection
lstrlenW
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
LoadResource
LockResource
SizeofResource
FindResourceW
FindResourceExW
lstrcmpiW
GetLastError
GlobalFree
GlobalLock
GetProcessHeap
HeapSize
GlobalAlloc
FlushInstructionCache
GetCurrentProcess
GetACP
HeapReAlloc
HeapFree
HeapDestroy
HeapAlloc

user32

LoadCursorW
GetClassInfoExW
RegisterClassExW
CallMsgFilterW
GetMessageW
GetSystemMenu
GetMenuStringW
IsIconic
IsZoomed
GetCursorPos
SetWindowRgn
AdjustWindowRectEx
GetMenu
DrawIconEx
PtInRect
InvalidateRect
PostMessageW
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemCount
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
EnableWindow
GetScrollInfo
SetScrollInfo
ShowWindow
SetRectEmpty
GetClassNameW
GetClientRect
GetComboBoxInfo
DrawIcon
DestroyWindow
GetDC
IsWindow
TrackMouseEvent
SetWindowPos
EndPaint
BeginPaint
GetWindowTextLengthW
GetWindowTextW
GetIconInfo
CopyRect
GetDlgCtrlID
GetParent
CreateWindowExW
ScreenToClient
ReleaseCapture
SetFocus
SetCapture
IsWindowVisible
DrawTextW
GetSystemMetrics
SetRect
GetWindowDC
GetWindowRect
OffsetRect
ReleaseDC
DefWindowProcW
SendMessageW
GetWindowLongW
SetWindowLongW
CallWindowProcW
IsMenu
RegisterWindowMessageW
TrackPopupMenu
UnregisterClassA

gdi32

CombineRgn
CreateRectRgn
CreateDIBitmap
ExcludeClipRect
GetTextMetricsW
CreateSolidBrush
SetTextColor
SetBkMode
RestoreDC
SaveDC
SetViewportOrgEx
ExtCreateRegion
GetPixel
ExtTextOutW
SetBkColor
SelectObject
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
BitBlt
CreateFontIndirectW
DeleteObject
StretchBlt

comctl32

InitCommonControlsEx

msimg32

TransparentBlt

Exports

Exports

_GetColor@4
_GetImageFromSkin@4
_InstallSkin@0
_SetSkinPath@4
_TrackSkinPopupMenu@20
_UninstallSkin@0

Sections

.text
Size: 308KB - Virtual size: 304KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GarenaSkin1.dll
.dll windows:4 windows x86 arch:x86

258919a6008fbb6950d9201d3a038091

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\NetworkLib\Garena\trunk\client_libraries\Bin\GarenaSkin1.pdb

Imports

kernel32

CreateFileW
SetFilePointer
GetCurrentDirectoryW
SystemTimeToFileTime
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapCreate
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
VirtualAlloc
ReadFile
WriteFile
LocalFileTimeToFileTime
CloseHandle
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
lstrlenW
lstrcmpW
GetCurrentThreadId
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
lstrcmpiW
FlushInstructionCache
VirtualFree
IsProcessorFeaturePresent
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
lstrcpyW
LoadLibraryA
GetProcAddress
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
GetLastError

user32

LoadCursorW
GetClassInfoExW
RegisterClassExW
FillRect
GetMenu
AdjustWindowRectEx
DrawIconEx
PtInRect
InvalidateRect
PostMessageW
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemCount
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
EnableWindow
GetScrollInfo
SetScrollInfo
ShowWindow
SetRectEmpty
GetClientRect
GetComboBoxInfo
CopyRect
GetDlgCtrlID
CreateWindowExW
IsWindow
ReleaseCapture
SetFocus
SetCapture
DestroyWindow
IsWindowVisible
DrawTextW
TrackMouseEvent
DrawIcon
SetWindowPos
EndPaint
GetClassNameW
BeginPaint
GetParent
GetWindowTextLengthW
GetWindowTextW
GetIconInfo
GetSystemMetrics
OffsetRect
ReleaseDC
GetWindowDC
GetWindowRect
GetWindow
GetTopWindow
DefWindowProcW
CallWindowProcW
IsMenu
GetWindowLongW
SetWindowLongW
SendMessageW
GetDC
GetDesktopWindow
RegisterWindowMessageW
TrackPopupMenu
UnregisterClassA
ScreenToClient

gdi32

CreateCompatibleDC
ExcludeClipRect
GetTextMetricsW
CreateSolidBrush
SetViewportOrgEx
SetTextColor
SetBkMode
RestoreDC
SaveDC
StretchBlt
BitBlt
ExtTextOutW
SelectObject
SetBkColor
CreateDIBSection
DeleteDC
CreateCompatibleBitmap
CreateFontIndirectW
DeleteObject
CreateDIBitmap

comctl32

InitCommonControlsEx

msimg32

TransparentBlt

Exports

Exports

_GetColor2@8
_GetColor@4
_GetGameIcon@12
_GetImage@8
_GetImageFromSkin2@8
_GetImageFromSkin@4
_GetSkinFont@4
_InstallSkin2@8
_InstallSkin@0
_RemoveSkin@4
_SetSkinPath@4
_TrackSkinPopupMenu@20
_UninstallSkin2@4
_UninstallSkin@0

Sections

.text
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GarenaSkin2.dll
.dll windows:4 windows x86 arch:x86

258919a6008fbb6950d9201d3a038091

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\NetworkLib\Garena\trunk\client_libraries\Bin\GarenaSkin2.pdb

Imports

kernel32

CreateFileW
SetFilePointer
GetCurrentDirectoryW
SystemTimeToFileTime
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapCreate
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
VirtualAlloc
ReadFile
WriteFile
LocalFileTimeToFileTime
CloseHandle
LeaveCriticalSection
EnterCriticalSection
SetLastError
RaiseException
lstrlenW
lstrcmpW
GetCurrentThreadId
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
lstrcmpiW
FlushInstructionCache
VirtualFree
IsProcessorFeaturePresent
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
lstrcpyW
LoadLibraryA
GetProcAddress
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
GetLastError

user32

LoadCursorW
GetClassInfoExW
RegisterClassExW
FillRect
GetMenu
AdjustWindowRectEx
DrawIconEx
PtInRect
InvalidateRect
PostMessageW
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuItemCount
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
EnableWindow
GetScrollInfo
SetScrollInfo
ShowWindow
SetRectEmpty
GetClientRect
GetComboBoxInfo
CopyRect
GetDlgCtrlID
CreateWindowExW
IsWindow
ReleaseCapture
SetFocus
SetCapture
DestroyWindow
IsWindowVisible
DrawTextW
TrackMouseEvent
DrawIcon
SetWindowPos
EndPaint
GetClassNameW
BeginPaint
GetParent
GetWindowTextLengthW
GetWindowTextW
GetIconInfo
GetSystemMetrics
OffsetRect
ReleaseDC
GetWindowDC
GetWindowRect
GetWindow
GetTopWindow
DefWindowProcW
CallWindowProcW
IsMenu
GetWindowLongW
SetWindowLongW
SendMessageW
GetDC
GetDesktopWindow
RegisterWindowMessageW
TrackPopupMenu
UnregisterClassA
ScreenToClient

gdi32

CreateCompatibleDC
ExcludeClipRect
GetTextMetricsW
CreateSolidBrush
SetViewportOrgEx
SetTextColor
SetBkMode
RestoreDC
SaveDC
StretchBlt
BitBlt
ExtTextOutW
SelectObject
SetBkColor
CreateDIBSection
DeleteDC
CreateCompatibleBitmap
CreateFontIndirectW
DeleteObject
CreateDIBitmap

comctl32

InitCommonControlsEx

msimg32

TransparentBlt

Exports

Exports

_GetColor2@8
_GetColor@4
_GetGameIcon@12
_GetImage@8
_GetImageFromSkin2@8
_GetImageFromSkin@4
_GetSkinFont@4
_InstallSkin2@8
_InstallSkin@0
_RemoveSkin@4
_SetSkinPath@4
_TrackSkinPopupMenu@20
_UninstallSkin2@4
_UninstallSkin@0

Sections

.text
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GarenaTV.xml
.xml
GarenaTVHook.dll
.dll windows:4 windows x86 arch:x86

930a3e550691d71e620afa22f1fad2a6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\GG\ggtv_app\GarenaTV\release\GarenaTVHook.pdb

Imports

user32

UnhookWindowsHookEx
PostMessageW
GetWindowThreadProcessId
CallNextHookEx
SetWindowsHookExW

kernel32

HeapDestroy
LCMapStringW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA

Exports

Exports

InstallHook
RemoveHook

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.HOOKDAT
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GarenaTV_UI.dll
.dll windows:5 windows x86 arch:x86

8b9c32e53642706195bf0a559bae6131

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Projects\GG\client_plugins\Release\GarenaTV_UI.pdb

Imports

kernel32

lstrcmpiA
GetTickCount
FlushFileBuffers
CreateFileA
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetModuleHandleA
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
IsValidCodePage
WaitForSingleObject
GetACP
VirtualProtectEx
GetTimeZoneInformation
ExitProcess
HeapSize
InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
lstrlenA
RtlUnwind
GetCommandLineA
GetDateFormatA
GetTimeFormatA
CreateThread
GetLastError
ExitThread
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
VirtualAlloc
VirtualFree
GlobalFree
GlobalAlloc
lstrcatW
OpenProcess
Process32NextW
Module32NextW
Module32FirstW
Process32FirstW
CreateToolhelp32Snapshot
CreateProcessW
lstrlenW
lstrcmpiW
RaiseException
SetLastError
lstrcpyW
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GetModuleHandleW
FreeLibrary
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSection
Sleep
MultiByteToWideChar
GetProcAddress
LoadLibraryW
CreateFileW
SetEndOfFile
GetFileSize
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapAlloc
GetModuleFileNameW
lstrcmpW
lstrcpynW
lstrcpynA
WriteProcessMemory
GetStdHandle
ReadProcessMemory
TerminateThread
lstrcpyA
lstrcmpA
HeapReAlloc
SetFilePointer
ReadFile
WriteFile
WideCharToMultiByte
GetCPInfo
CloseHandle
HeapFree
GetOEMCP

user32

SetWindowRgn
GetWindowDC
ReleaseDC
DrawTextW
MoveWindow
GetCursorPos
GetClientRect
GetWindowTextLengthW
SendMessageW
ScreenToClient
ClientToScreen
GetParent
GetActiveWindow
GetClassInfoExW
RegisterClassExW
DialogBoxParamW
TrackMouseEvent
CreateDialogParamW
ShowWindow
CallWindowProcW
DefWindowProcW
SetCursor
LoadCursorW
GetWindowLongW
SetWindowLongW
SetWindowPos
SetTimer
InvalidateRect
KillTimer
MessageBoxW
wsprintfW
PostMessageW
RegisterWindowMessageW
InflateRect
CreateWindowExW
SetForegroundWindow
FindWindowW
InvalidateRgn
GetSystemMetrics
DestroyIcon
LoadIconW
EnableWindow
UnregisterClassA
SetLayeredWindowAttributes
RemoveMenu
AppendMenuW
EndDialog
GetWindow
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
AdjustWindowRectEx
CopyRect
SetFocus
wsprintfA
GetWindowTextW
SetWindowTextW
BringWindowToTop
CreatePopupMenu
IsDialogMessageW
GetDlgItem
ReleaseCapture
SetCapture
GetMessagePos
PtInRect
GetWindowRect
GetCapture
DestroyMenu
DestroyWindow

gdi32

CreateCompatibleDC
SelectObject
CreateRoundRectRgn
CreatePolygonRgn
CreatePatternBrush
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
GetDIBits
StretchBlt
BitBlt
GetTextExtentPointW
Polygon
GetStockObject
CreateFontIndirectW
GetObjectW
DeleteObject
CombineRgn
ExtTextOutW
SetBkColor
SetTextColor
SetBkMode
CreateFontW

comdlg32

GetOpenFileNameW

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges

shell32

Shell_NotifyIconW
ShellExecuteW

garenatvhook

ord1
ord2

shlwapi

StrToIntA
PathRemoveExtensionW
PathFindFileNameW
StrCmpNIW
StrCSpnA
StrCmpNA
StrCmpNW
StrCmpNIA
PathRemoveFileSpecW
PathFileExistsW

ws2_32

closesocket
recvfrom
sendto
ioctlsocket
connect
htonl
select
WSAGetLastError
htons
ntohs
shutdown
setsockopt
recv
bind
socket
__WSAFDIsSet
send
listen
accept
inet_addr
getpeername
ntohl
gethostbyname

comctl32

ImageList_Create

msimg32

AlphaBlend

wininet

InternetReadFile
HttpQueryInfoW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetCloseHandle
InternetConnectW
InternetOpenW

garenaskin1

_UninstallSkin2@4
_TrackSkinPopupMenu@20
_GetImageFromSkin@4
_GetImageFromSkin2@8
_InstallSkin2@8

Sections

.text
Size: 311KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Gn.ggz
Inject.dll
.dll windows:4 windows x86 arch:x86

c6fac98baceae40e97f7fe1744c76f5c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\InGG\NewClient\Trunk\projects\Inject\Release\Inject.pdb

Imports

kernel32

lstrlenW
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetProcAddress
GetModuleHandleW
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

Exports

Exports

InjectCode

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
L4DSocket.dll
.dll windows:4 windows x86 arch:x86

c5b5a649d9aefe570d326b60f7e7fbf8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
TerminateProcess
GetCurrentProcess
WaitForSingleObject
SetEvent
CloseHandle
OpenEventW
GetModuleFileNameW
GetLastError
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetCurrentThread
LoadLibraryW
FreeLibrary
GetProcAddress
GetTickCount
ResumeThread
CreateProcessA
CreateProcessW
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetLocaleInfoA
VirtualQuery
VirtualProtect
VirtualAlloc
InterlockedCompareExchange
GetCurrentThreadId
FlushInstructionCache
SetThreadContext
GetThreadContext
SuspendThread
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
LoadLibraryA
InitializeCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode

ws2_32

bind
recvfrom
WSARecvFrom
sendto
WSASendTo
WSAGetLastError
ntohl
ntohs
getsockopt
connect
accept
getpeername
htons
htonl
inet_ntoa
WSAIoctl
gethostbyname
gethostname

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PluginKernel.dll
.dll windows:4 windows x86 arch:x86

0d9ed8a323a24cab42183f7eb588a764

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FindFirstFileW
LoadLibraryW
GetModuleFileNameW
FindClose
FindNextFileW
GetCurrentThreadId
GetCommandLineA
GetVersionExA
RtlUnwind
RaiseException
HeapAlloc
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
HeapFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
SetUnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
InitializeCriticalSection
InterlockedExchange
VirtualQuery
LoadLibraryA
IsBadReadPtr
IsBadCodePtr
VirtualProtect
GetSystemInfo
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RecConfig.xml
Roomcn.dat
Roomen.dat
Roomtw.dat
Skins.xml
.xml
SocketHook.dll
.dll windows:4 windows x86 arch:x86

55cc66bd61551ce6d23f9ee96a62098c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
DisableThreadLibraryCalls
TerminateProcess
WaitForSingleObject
SetEvent
CloseHandle
OpenEventW
GetModuleFileNameW
OpenFileMappingA
UnmapViewOfFile
GetLastError
MapViewOfFile
GetCurrentThread
FreeLibrary
ResumeThread
CreateProcessA
CreateProcessW
LoadLibraryW
GetProcAddress
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
VirtualQuery
VirtualProtect
VirtualAlloc
InterlockedCompareExchange
GetCurrentThreadId
FlushInstructionCache
SetThreadContext
GetThreadContext
SuspendThread
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA

ws2_32

recvfrom
WSARecvFrom
sendto
WSASendTo
WSASetLastError
WSAGetLastError
connect
accept
getpeername
htons
htonl
ntohl
ntohs
gethostbyname
inet_ntoa
gethostname

Sections

.text
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
War3Hook.dll
.dll windows:4 windows x86 arch:x86

84c6282fff898cc561946a8e7feb0672

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
DisableThreadLibraryCalls
GetCurrentProcess
WaitForSingleObject
SetEvent
CloseHandle
OpenEventW
GetModuleFileNameW
OpenFileMappingA
UnmapViewOfFile
GetLastError
MapViewOfFile
GetCurrentThread
GetTickCount
FreeLibrary
GetProcAddress
ResumeThread
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
VirtualQuery
VirtualProtect
VirtualAlloc
InterlockedCompareExchange
GetCurrentThreadId
FlushInstructionCache
SetThreadContext
GetThreadContext
SuspendThread
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSection
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA

ws2_32

WSASetLastError
WSAGetLastError
recvfrom
WSARecvFrom
sendto
WSASendTo
connect
htons
htonl
ntohl
ntohs
gethostbyname
inet_ntoa
gethostname

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
YYFileSystem.dll
.dll windows:5 windows x86 arch:x86

e07f48095153d0e038099b8d719882cc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\InGG\Demo\YYFileSystem\bin\Release\lib\YYFileSystem.pdb

Imports

kernel32

MultiByteToWideChar
GetLastError
HeapAlloc
GetProcessHeap
WideCharToMultiByte
HeapFree
CreateFileW
CloseHandle
GetFileSize
WriteFile
ReadFile
HeapReAlloc
SetFilePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetStdHandle
GetModuleFileNameA
LCMapStringA
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetConsoleCP
GetConsoleMode
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

pluginkernel

ord2

commonlib

?GetDataLength@CMyBuffer@Buffer@Common@@QBEHXZ
?ToArray@CMyBuffer@Buffer@Common@@QBEPBDXZ
ord1
??1CMyBuffer@Buffer@Common@@QAE@XZ
??0CMyBuffer@Buffer@Common@@QAE@XZ
ord2

Sections

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
atl71.dll
.dll windows:4 windows x86 arch:x86

a0bd0cbc6c3c1f3095dd9342b630fcb9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

atl71.pdb

Imports

kernel32

InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
lstrlenW
lstrcpyW
GetLastError
DisableThreadLibraryCalls
GetVersionExA
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
lstrcpynW
CloseHandle
ReadFile
GetFileSize
CreateFileW
GetModuleHandleW
GetModuleFileNameW
WideCharToMultiByte
WaitForSingleObject
GlobalAlloc
FindResourceA
MulDiv
lstrcatW
FlushInstructionCache
GetCurrentProcess
GlobalUnlock
GlobalLock
lstrcmpW
SetLastError
GlobalFree
GlobalHandle
LockResource
lstrcmpA
GetModuleHandleA
GetTickCount
LocalAlloc
VirtualQuery
HeapFree
GetProcessHeap
InterlockedCompareExchange
HeapAlloc
GetProcAddress
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
ExitProcess
HeapSize
DebugBreak
HeapReAlloc
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
lstrcatA
lstrcpyA
lstrlenA
GetModuleFileNameA
RtlUnwind

shlwapi

PathFindExtensionW

Exports

Exports

AtlAdvise
AtlAxAttachControl
AtlAxCreateControl
AtlAxCreateControlEx
AtlAxCreateControlLic
AtlAxCreateControlLicEx
AtlAxCreateDialogA
AtlAxCreateDialogW
AtlAxDialogBoxA
AtlAxDialogBoxW
AtlAxGetControl
AtlAxGetHost
AtlAxWinInit
AtlCallTermFunc
AtlComModuleGetClassObject
AtlComModuleRegisterClassObjects
AtlComModuleRegisterServer
AtlComModuleRevokeClassObjects
AtlComModuleUnregisterServer
AtlComPtrAssign
AtlComQIPtrAssign
AtlCreateRegistrar
AtlCreateTargetDC
AtlDevModeW2A
AtlFreeMarshalStream
AtlGetObjectSourceInterface
AtlGetVersion
AtlHiMetricToPixel
AtlIPersistPropertyBag_Load
AtlIPersistPropertyBag_Save
AtlIPersistStreamInit_Load
AtlIPersistStreamInit_Save
AtlInternalQueryInterface
AtlLoadTypeLib
AtlMarshalPtrInProc
AtlModuleAddTermFunc
AtlPixelToHiMetric
AtlRegisterClassCategoriesHelper
AtlRegisterTypeLib
AtlSetErrorInfo
AtlUnRegisterTypeLib
AtlUnadvise
AtlUnmarshalPtr
AtlUpdateRegistryFromResourceD
AtlWaitWithMessageLoop
AtlWinModuleAddCreateWndData
AtlWinModuleExtractCreateWndData
AtlWinModuleInit
AtlWinModuleRegisterClassExA
AtlWinModuleRegisterClassExW
AtlWinModuleRegisterWndClassInfoA
AtlWinModuleRegisterWndClassInfoW
AtlWinModuleTerm

Sections

.text
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ggsec.dll
.dll windows:5 windows x86 arch:x86

cbeb80efb2fbf8a66a12527eb1b83144

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:88:f9:ad:0f:e6:52:ee:3f:4d:3d:bf:03:21:73:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09-10-2009 00:00

Not After

03-12-2012 23:59

Subject

CN=Garena Interactive Pte Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Garena Interactive Pte Ltd,L=Singapore,ST=Singapore,C=SG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:9e:49:55:98:68:cd:49:f3:ce:a0:de:14:cb:e8:ca:40:ec:2c:da
Signer

Actual PE Digest

d9:9e:49:55:98:68:cd:49:f3:ce:a0:de:14:cb:e8:ca:40:ec:2c:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\garena\dev\anti-hack\lobby_2\ggsec\Release\ggsec.pdb

Imports

kernel32

CloseHandle
GetProcAddress
LoadLibraryW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleFileNameW
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
IsBadReadPtr
CreateProcessW
IsBadWritePtr
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
GetCurrentProcess
DuplicateHandle
IsBadCodePtr
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
CreateEventW
CreateThread
TerminateThread
SetEndOfFile
UnlockFile
LockFile
ReadFile
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
GetVersion
SetLastError
VirtualQuery
DisableThreadLibraryCalls
InterlockedDecrement
VirtualAlloc
VirtualFree
GetLastError
GetModuleHandleW
FreeLibrary
VirtualProtect
MultiByteToWideChar
WideCharToMultiByte
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
Sleep
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LoadLibraryA
InitializeCriticalSectionAndSpinCount
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetFileSize

wininet

HttpSendRequestW
HttpOpenRequestW
HttpQueryInfoW
InternetConnectW
InternetOpenW
InternetCloseHandle
InternetSetOptionW
InternetCrackUrlW
InternetReadFile

Sections

.text
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data0
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data1
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
hc.xml
.xml
langs.xml
mdata.ggz
.zip
newgame.ggz
.zip
onlinegame.ggz
.zip
safeapi.dll
.dll windows:5 windows x86 arch:x86

cd391c5814cad8d0c3f552d040c36b87

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:88:f9:ad:0f:e6:52:ee:3f:4d:3d:bf:03:21:73:01
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

09-10-2009 00:00

Not After

03-12-2012 23:59

Subject

CN=Garena Interactive Pte Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Garena Interactive Pte Ltd,L=Singapore,ST=Singapore,C=SG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:ed:95:f2:0e:4f:7e:6c:74:17:03:0b:d5:51:e1:90:4a:a2:f5:5d
Signer

Actual PE Digest

52:ed:95:f2:0e:4f:7e:6c:74:17:03:0b:d5:51:e1:90:4a:a2:f5:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\garena\dev\anti-hack\garena_safe\src\bin\freevm\safeapi.pdb

Imports

kernel32

DisableThreadLibraryCalls
GetModuleFileNameW
DeleteFileW
SetFileAttributesW
CreateFileW
CloseHandle
DeviceIoControl
GetLastError
GetCurrentProcess
GetProcAddress
GetModuleHandleW
WriteFile
SetFilePointer
SizeofResource
LockResource
LoadResource
FindResourceW
LocalAlloc
FreeLibrary
InterlockedExchange
LoadLibraryA
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
RtlUnwind
GetCommandLineA
GetVersionExA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
GetModuleHandleA
ExitProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
OutputDebugStringA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
Sleep
LoadLibraryExA
InitializeCriticalSection
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers

Exports

Exports

GetModule

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data0
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data1
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
server.xml
.xml
slotmachine.ggz
.zip
source.xml
.xml
sqlite3.dll
.dll windows:4 windows x86 arch:x86

fe62f9dce6776626b1ed9d7894e7710d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileW
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetCurrentProcessId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetProcAddress
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExA
InitializeCriticalSection
InterlockedCompareExchange
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
SetEndOfFile
SetFilePointer
Sleep
UnlockFile
UnlockFileEx
UnmapViewOfFile
WideCharToMultiByte
WriteFile

msvcrt

atoi
free
localtime
malloc
memcpy
memmove
memset
qsort
realloc
strcmp
strncmp

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_db_config
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_step
sqlite3_stmt_status
sqlite3_strnicmp
sqlite3_table_column_metadata
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_hook
sqlite3_win32_mbcs_to_utf8

Sections

.text
Size: 415KB - Virtual size: 415KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 784B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.stab
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.stabstr
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
update.dat
update.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 372KB - Virtual size: 369KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 580KB

.rsrc Size: 39KB - Virtual size: 39KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

e981c0ab92cb1f191bb5e23392e14796

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 729B

.data Size: - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 352B

.reloc Size: 512B - Virtual size: 350B

b1d9539c7cfd95718179dedb471b482f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 296B

.reloc Size: 1024B - Virtual size: 572B

d19de0d004578cc7ea30566b2d8394d5

Headers

File Characteristics

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 580KB

.rsrc
Size: 39KB - Virtual size: 39KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 729B

.data
Size: - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 350B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 296B

.reloc
Size: 1024B - Virtual size: 572B

.text
Size: 123KB - Virtual size: 122KB

.rdata
Size: 29KB - Virtual size: 28KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 11KB - Virtual size: 11KB

.text
Size: 162KB - Virtual size: 161KB

.rdata
Size: 33KB - Virtual size: 32KB

.data
Size: 7KB - Virtual size: 14KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 12KB

.text
Size: 108KB - Virtual size: 106KB

.rdata
Size: 36KB - Virtual size: 32KB

.data
Size: 8KB - Virtual size: 19KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 12KB - Virtual size: 8KB

.text
Size: 264KB - Virtual size: 261KB

.rdata
Size: 48KB - Virtual size: 44KB

.data
Size: 12KB - Virtual size: 18KB

.rsrc
Size: 28KB - Virtual size: 26KB

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 5KB - Virtual size: 7KB

.rsrc
Size: 512B - Virtual size: 436B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate