961cca6cec6d7649b04ae106aae9b991_JaffaCakes118

resource
961cca6cec6d7649b04ae106aae9b991_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/AESocket.dll
unpack001/CS15Hook.dll
unpack001/CommonLib.dll
unpack001/CrashSender.exe
unpack001/FPSHook.dll
unpack001/GarenaSkin.dll
unpack001/GarenaSkin1.dll
unpack001/GarenaSkin2.dll
unpack001/GarenaTVHook.dll
unpack001/GarenaTV_UI.dll
unpack001/Inject.dll
unpack001/L4DSocket.dll
unpack001/PluginKernel.dll
unpack001/SocketHook.dll
unpack001/War3Hook.dll
unpack001/YYFileSystem.dll
unpack001/atl71.dll
unpack001/sqlite3.dll
unpack001/update.exe

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 1aefc871cf047916411426953da59bcbfcfde96cbac4180242d8b3839686f8a3
MD5 961cca6cec6d7649b04ae106aae9b991
SHA1 3ce49de40c840c6facebf32723fdf35ab32e4ab9
SHA512 fe91a2d82a7e49f4bd8eb714188803c4f1675930c5269c5c80d6ff0007afaf5e993fdfe3ccfe8bed8ff3beae8066128ebe5b860e970364682bd98b27aa27cf96
SSDEEP 49152:Hu3ImXECPUUCak4jZDnz3+FLYCyuvTcnEjpNMdo5VipR:HuYmUC8D0NnKhYCyeZ2O5Viv
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/InstallOptions.dll

IMPHASH cd90e33ffbc335413a25300c682c83df
SHA256 3ccb4385cd22b5c69bc2583e181da4085477906c193f04eb5a400801e00dbcd5
MD5 786110d3394edf4bb5c14e3e9a49f9e6
SHA1 4adf64a5999a1a41870fedefba22f67840f36f3a
SHA512 e85e49b492a04188c46c90fef6ba5b177f85c670848f902748ec1540839ffb2f5d88563c14026328dd2100a48979ff8e67e7af1eee70fea0eb477c78db4d9524
SSDEEP 192:JsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5mn8ozxGUWumle:JsUHd9GN2d2iwl0impATIPdAn8Ov6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW GetModuleHandleW GlobalLock GlobalUnlock GetCurrentDirectoryW SetCurrentDirectoryW GetPrivateProfileIntW GetPrivateProfileStringW lstrcatW WritePrivateProfileStringW lstrcpynW lstrlenW lstrcpyW GlobalFree GlobalAlloc

user32

OpenClipboard DestroyIcon LoadCursorW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW ShowWindow SetWindowLongW GetClientRect SetWindowRgn LoadIconW LoadImageW CreateWindowExW MapDialogRect GetClipboardData GetWindowRect CreateDialogParamW EnableMenuItem GetSystemMenu EnableWindow GetDlgItem SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW wsprintfW CharNextW MessageBoxW CloseClipboard GetDlgCtrlID MapWindowPoints SetWindowPos PtInRect GetWindowTextW SetWindowTextW SendMessageW DestroyWindow

gdi32

SelectObject CreateRectRgn GetObjectW CombineRgn DeleteObject CreateCompatibleDC GetDIBits SetTextColor

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW CommDlgExtendedError GetSaveFileNameW

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH e981c0ab92cb1f191bb5e23392e14796
SHA256 098a384cb4c14b9639db4f4f113426d2a91d170a2affca3e6ecbe57b18d86c38
MD5 bb3707e7614a444b799d3842bf34b31b
SHA1 e4b75748e417b8a7be3a199150f4338f9d883cca
SHA512 728e7d2a7a555228f24f04829099e5f266f8e3b2f91bc44181c0d08425de158d4c1d61a25c1914bdf0ade43377462169a23b311f7cd110a1e4a07bc781ff25e4
SSDEEP 48:a6T4WeApYxYlxamAWHN+EuWkGWBBWAGr9SdLB8m0bofYZVSA:MWGSxamjHNDuWRWBBWvm0TV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH b1d9539c7cfd95718179dedb471b482f
SHA256 36220ce8d40585ef2eec800cc0ddfd348c67363485f03c388822dae4f5d53724
MD5 d911fbabec7d7edbbf2a5f77bef395a3
SHA1 755bdb5f66adefba5a0548d465105ddf30b3aba1
SHA512 1a0b669bc02dd0decf91bdbbd32f25a4b73f65578ecdc17a69b230531f83c4bbe147e0bf8f62fa25654e78a99d60c8769057857cb858d6128804f4981ebc9a1a
SSDEEP 96:sXEsZNrFQiAYLvx8RxjjL82Orp2YDDBKIakCT9KNotMQl3wJk:sXEsYYLvxcSDBxan9my3+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4357

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 689a67b30946cbe12dce92d17207ec0488e850a806be608e6fb174f853f86b57
MD5 6f98fcda445825382121e480a64ae24c
SHA1 d5071f4928fc8c38fc8d015501bfc1f4229b1799
SHA512 68cb5b4ec06e4955ea8b5208f5f8569a37120c185dc9a10966c89ab5fd2bb0c6038d901d7b0fd15b1db8409a2b1ede18451f3d09cb17156a14fe4940095a7d0d
MD5 SHA1 SHA512

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

AESocket.dll

IMPHASH d19de0d004578cc7ea30566b2d8394d5
SHA256 01dad3440a23eab59402943c6f299905acbfbaeffd33ead14da17c00345d036c
MD5 aecdb03a8def8083b08eb116b47fcb7f
SHA1 ce62bc044c1bf87ac9ddb37c746db1e36d62d9f6
SHA512 706d6fa173ca2e1d531eb5c4802a654ef45263c336d38781d36e6b85ea8e8f0e1238d0024379067bd66a30d103bec73372199802d59aa8e4e34635d1ee7ebd64
SSDEEP 3072:fZnbU+LrOBsR+l4J8TTgPJIVgbLcttNr3Lok:lxOSRZe4PmVQctHo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

56804

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess DisableThreadLibraryCalls GetCurrentProcess WaitForSingleObject SetEvent CloseHandle OpenEventW GetModuleFileNameW OpenFileMappingA UnmapViewOfFile GetLastError MapViewOfFile GetCurrentThread GetTickCount LoadLibraryW FreeLibrary GetProcAddress ResumeThread CreateProcessA CreateProcessW FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW GetConsoleMode GetConsoleCP SetFilePointer LoadLibraryA WriteFile IsValidLocale EnumSystemLocalesA GetUserDefaultLCID WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection VirtualQuery VirtualProtect VirtualAlloc GetCurrentThreadId FlushInstructionCache SetThreadContext GetThreadContext SuspendThread SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapFree GetCommandLineA GetVersionExA HeapAlloc GetProcessHeap RaiseException RtlUnwind GetCPInfo LCMapStringA LCMapStringW GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree HeapSize ExitProcess HeapDestroy HeapCreate VirtualFree HeapReAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeA GetStringTypeW GetACP GetOEMCP IsValidCodePage GetLocaleInfoA

ws2_32

bind recvfrom WSARecvFrom sendto WSASendTo WSAGetLastError connect accept getpeername htons htonl ntohl ntohs getsockopt gethostbyname gethostname WSAIoctl inet_ntoa

CS15Hook.dll

IMPHASH 1040fa5da89612fa22cc7ed3c6306dbb
SHA256 25801094dd2c2a273cf1e28b1ce8da35734e337502a70560513570ee20efbcaa
MD5 77bf893bd126e759d79193ebdb878ffe
SHA1 503bec5026113a3031a7005b320729c2ac4a94ef
SHA512 821b7d5e5d1ba9d9ccb5bca85f089f1c74b8fd2964c49523eccc47aa9976c5e428bdf8b8f446ed1236904397a7d7a8deea61b0e56f3efdf241804fad92219d51
SSDEEP 3072:IT7dz4DSyOyGY7L0W9Wm7vrxuee/biTsmJ8Xtxu5V9I:IT7HYMWD7vFe3e8XKV9I
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

74292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess DisableThreadLibraryCalls InitializeCriticalSection LeaveCriticalSection GetCurrentProcess DeleteCriticalSection EnterCriticalSection CloseHandle GetModuleFileNameW WideCharToMultiByte OutputDebugStringW GetLastError MapViewOfFile UnmapViewOfFile OpenFileMappingA GetCurrentThread FreeLibrary ResumeThread CreateProcessA CreateProcessW LoadLibraryW GetProcAddress CompareStringW CompareStringA SetEndOfFile CreateFileW CreateFileA GetLocaleInfoW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetLocaleInfoA InterlockedIncrement InterlockedDecrement Sleep InterlockedExchange InterlockedCompareExchange MultiByteToWideChar VirtualQuery VirtualProtect VirtualAlloc GetCurrentThreadId FlushInstructionCache SetThreadContext GetThreadContext SuspendThread SetLastError GetSystemTimeAsFileTime HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetVersionExA HeapAlloc GetProcessHeap LCMapStringA LCMapStringW GetCPInfo RtlUnwind RaiseException GetModuleHandleA ExitProcess ReadFile GetTimeZoneInformation WriteFile GetConsoleCP GetConsoleMode FlushFileBuffers SetHandleCount GetStdHandle GetFileType GetStartupInfoA SetFilePointer TlsGetValue TlsAlloc TlsSetValue TlsFree HeapSize HeapDestroy HeapCreate VirtualFree HeapReAlloc GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetACP GetOEMCP IsValidCodePage SetEnvironmentVariableA

ws2_32

WSASendTo WSASetLastError WSAGetLastError bind recvfrom WSARecvFrom sendto connect WSARecv send accept getpeername htonl htons ntohs getsockopt inet_ntoa gethostbyname gethostname

CommonLib.dll

IMPHASH 9763997563cf7d906063a7fbb8c9b1f1
SHA256 364d33288276379433048b303655eb011a7ca6eb2baf6fc8598ae8536d0f19aa
MD5 564906d58b03e7a8e60ccaabd6f8bec4
SHA1 3672a21414bd576a5895e5bdf95298beef655bc1
SHA512 f3fad80d904008f330b4b65dcd0457ce3635defcc1f7e0c8d3fc2ac5b4a4c1cba2700aeaeb5b0b06ec03c4ebb2f2f7b93fcbd7ebd2b88e07991494d1a904047c
SSDEEP 3072:M/lflo4O0wbK2Rmx0PR7BIVmN/c9TBfNh+kMtSc:M/lHZwbK2RG05dIVmN/c9TBX+kTc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

55572

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

v:\Common\CommonLib\Release\CommonLib.pdb

kernel32

GetLastError CreateDirectoryW MultiByteToWideChar HeapAlloc GetProcessHeap HeapFree HeapReAlloc WideCharToMultiByte CloseHandle CreateFileW lstrlenW lstrcpyW GetModuleFileNameW InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA GetVersionExA RaiseException RtlUnwind GetCPInfo WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleA GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize ExitProcess SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW LoadLibraryA GetLocaleInfoW SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers

shlwapi

PathFileExistsW HashData

??0CLocationInfo@Exception@Common@@QAE@ABV012@@Z ??0CLocationInfo@Exception@Common@@QAE@PB_W0H@Z ??0CLocationInfo@Exception@Common@@QAE@XZ ??0CMyBuffer@Buffer@Common@@QAE@XZ ??0CMyStringA@Buffer@Common@@QAE@XZ ??0CMyStringW@Buffer@Common@@QAE@XZ ??0CRunTimeException@Exception@Common@@QAE@ABV012@@Z ??0CRunTimeException@Exception@Common@@QAE@PBVCLocationInfo@12@PBDK@Z ??0CRunTimeException@Exception@Common@@QAE@PBVCLocationInfo@12@PB_WK@Z ??1CLocationInfo@Exception@Common@@QAE@XZ ??1CMyBuffer@Buffer@Common@@QAE@XZ ??1CMyStringA@Buffer@Common@@QAE@XZ ??1CMyStringW@Buffer@Common@@QAE@XZ ??1CRunTimeException@Exception@Common@@QAE@XZ ??4CLocationInfo@Exception@Common@@QAEAAV012@ABV012@@Z ??4CRunTimeException@Exception@Common@@QAEAAV012@ABV012@@Z ?Attach@CMyBuffer@Buffer@Common@@QAEXPBDH@Z ?Attach@CMyStringA@Buffer@Common@@QAEXPBD@Z ?Attach@CMyStringW@Buffer@Common@@QAEXPB_W@Z ?GetAppFolder@Path@Common@@YA?BHPAVCMyStringW@Buffer@2@@Z ?GetDataLength@CMyBuffer@Buffer@Common@@QBEHXZ ?GetErrorCode@CRunTimeException@Exception@Common@@QBEKXZ ?GetErrorMessage@CRunTimeException@Exception@Common@@QBEPB_WXZ ?GetModuleFolder@Path@Common@@YA?BHPAUHINSTANCE__@@PAVCMyStringW@Buffer@2@@Z ?GetSource@CRunTimeException@Exception@Common@@QBEPB_WXZ ?HashData@Data@Common@@YAKPBDHK@Z ?IsDirectoryExists@Path@Common@@YAHPB_W@Z ?IsFileExists@Path@Common@@YAHPB_W@Z ?MakeSureDirectoryPathExists@Path@Common@@YAHPB_W@Z ?ToArray@CMyBuffer@Buffer@Common@@QBEPBDXZ ?ToString@CLocationInfo@Exception@Common@@QBEPB_WXZ ?UnicodeToUtf8@Convert@Common@@YAXPB_WPAVCMyStringA@Buffer@2@@Z ?Utf8ToUnicode@Convert@Common@@YAXPBDPAVCMyStringW@Buffer@2@@Z ?c_str@CMyStringA@Buffer@Common@@QBEPBDXZ ?c_str@CMyStringW@Buffer@Common@@QBEPB_WXZ

CrashSender.exe

IMPHASH 99b90a2d2929c63f927d0a18e66e6c20
SHA256 1c7d72e377e4f6d67337d3a1fd7e18cbfc9c50c4336731c96d84d40adcdf2008
MD5 177af1f2650d985a77281e300108673f
SHA1 f8a943b0062350c4bab800f97bc1f963a13ea308
SHA512 8d99969a45bed0aa7c51744735d4970eb1553da2a9931ad941737babd7a30333fc7f1c6e446c29cbc7a817fe22e86f10a626ce4f72542f45ccf2dc9daeda1855
SSDEEP 6144:OB1upDkJlenlONoHDW2+VA2ybGFq6ObqJr+8E9J:baensqHDD+QJ6OIWJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

153523

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\NetworkLib\Garena\trunk\client_libraries\CrashReport\Release\CrashSender.pdb

wininet

InternetCrackUrlW InternetOpenW InternetConnectW HttpOpenRequestW HttpAddRequestHeadersW InternetSetOptionW HttpSendRequestW HttpQueryInfoW InternetQueryDataAvailable InternetReadFile InternetCloseHandle

kernel32

RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection FlushInstructionCache GetCurrentProcess GetCurrentThreadId lstrlenW GetLastError InterlockedIncrement InterlockedDecrement lstrcmpiW SetLastError FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleHandleW GetModuleFileNameW GetTickCount CloseHandle TerminateThread GetFileAttributesExW GetProcAddress GetVersionExW WideCharToMultiByte GetCurrentProcessId QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetTimeZoneInformation IsValidCodePage GetOEMCP SetFilePointer ReadFile FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount HeapSize HeapCreate HeapDestroy TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle WriteFile GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetStringTypeW CreateFileA CompareStringW CompareStringA SetEndOfFile GetStringTypeA CreateFileW ExitProcess GetModuleHandleA GetCPInfo GetCommandLineA SetEnvironmentVariableA InterlockedCompareExchange HeapFree GetProcessHeap HeapAlloc LoadLibraryA IsProcessorFeaturePresent VirtualFree VirtualAlloc InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA Sleep RtlUnwind HeapReAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime ExitThread CreateThread GetStartupInfoW LCMapStringA LCMapStringW

user32

SetWindowLongW LoadStringW DefWindowProcW GetActiveWindow GetSystemMetrics LoadImageW CreateDialogParamW DialogBoxParamW GetDlgItem KillTimer SetTimer SetWindowTextW EndDialog PostQuitMessage GetParent GetWindow GetWindowRect SystemParametersInfoW GetClientRect MapWindowPoints SetWindowPos IsDialogMessageW SendMessageW GetWindowLongW DestroyWindow CharNextW PeekMessageW GetMessageW TranslateMessage DispatchMessageW ShowWindow UnregisterClassA

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegDeleteValueW

ole32

CoUninitialize CoTaskMemFree CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoInitialize

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

FPSHook.dll

IMPHASH 75461bf87660ee2aff3bd2b6352dbf24
SHA256 2d1ac975e299516f6f88f0e51ae937ac8abe14f9060b4d7b228376fc4cf7e4dc
MD5 0c3ea2b8408ffcba922a987e562882af
SHA1 36865ffa8721b2551d5c3cd0e40aa8dc0d2aa90f
SHA512 990f2db33fdb62a30b0edd872a909c941e35da52ae31bdf6c556debe774564cdbbc104f277469edf29903703708508054b98bf8c070a65e9da59e978bc422ba0
SSDEEP 768:IvrUnqmg1qYmAdfku7mt6VyKv3pg9SsW165e3H05URA2B:4r6ng4o7mulpgY6QE5UR/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14715

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\GG\client_plugins\Release\FPSHook.pdb

kernel32

MapViewOfFile UnmapViewOfFile HeapAlloc HeapFree GetModuleHandleW VirtualFree GetProcessHeap LoadLibraryW Sleep lstrcatA SetThreadPriority lstrcmpiA GetProcAddress VirtualAlloc OpenFileMappingW VirtualProtect CloseHandle ResumeThread CreateThread lstrcpyA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind GetLastError TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId LeaveCriticalSection EnterCriticalSection HeapReAlloc WriteFile GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize LoadLibraryA InitializeCriticalSectionAndSpinCount

user32

wsprintfA PostMessageW

GGICON.ico

SHA256 e42d43d9b00da8638a5434f86b80742d03daa482c985b3f7a5fe8c8b47613c2d
MD5 647361c253907ffb8e7f75ea20b50b53
SHA1 962e643acc1ec68178d7709a43f2e6de03608b5e
SHA512 c90a1ebb2fc1766c5a2bf4101395dc7edd0843c965a92d6407b6fc05625f62636e416b5848060a0c9fdb331dfd98d705bb8d58c5b0d084cd67bbfae2b8a97ce8
SSDEEP 384:30aYw8zyXQbgwyfgiLeNwmHJL9R3x4mdFY1pb:3oAQhpiLeNwQL9R3amdF2B
MD5 SHA1 SHA512 SSDEEP

Gamecn.dat

SHA256 d63be735363a34a1e2f2ec38551800f0ccd44c2660e59aeaab6ea63879221461
MD5 4de5d52fc2c8799b199f3ff50fd524da
SHA1 1088324b18fe6a56ea31554d15796a088cc0b812
SHA512 09c285fb782141bde0e0a061863fe5b8a04236da022cec71084906abc0b344de331c929feb776e103d25e2859a089cf1b16aeadd7160fd3d715380d1684c7128
SSDEEP 192:qvauT6UeaXtqTgqZWmfcuBiFYJSJVnBsRrz/dkRB+eH6/GRMkN14uG0tYQL:uXHXQTJGiEE/TRkN1o+DL
MD5 SHA1 SHA512 SSDEEP

Gameen.dat

SHA256 65ad5443bb798099d1cda04fe9a61afdc6927614140ee21af7517f5f75a53f38
MD5 160ea215b9ebe36b71f6f95f95b9ad5b
SHA1 f9eed5e768deacc961552c124ecebea4e8345e99
SHA512 aebc5fce0170d530c4f927aa239d9a586d3dd5380fe660415e21a5d44863bfdd5f8449e0c41755ab2a9c72eff72fe7e645adb69eae0a87e30c478b05c509f3f3
SSDEEP 192:GvWoq3PtYuhQLyTiDDpcAxiNgE/M0wTOc5bvY4ZjpwTqtLxmaizJ4h+4hB23ifl9:Aw+hkALkOY4H/I96YRXuhA7/E
MD5 SHA1 SHA512 SSDEEP

Gametw.dat

SHA256 7de9e3c23592580e9a47944c370ff7b2792ebccb7f372e085e024ea2a9a3e621
MD5 4337993a055ccbfa3783c6d3d0380b0f
SHA1 f15c113a1cc1234160db00abc1e70b41765b255c
SHA512 960cce92a928873a6bb60482f5829cbc8112ac4b401739f44473f4e7f1a3056360f3f20656c79286169f7a88b76ac834762e5e812e15d0876d939869e48d6ff4
SSDEEP 192:bU44etHcm7RT8hRUCC+uevtulEcLkgoS/vdasWtuAxedmdHxsaITYlTK:g44ey4sRUC2v7jSuYHaaI0K
MD5 SHA1 SHA512 SSDEEP

Gamevn.dat

SHA256 b0cd4b98a7bd754defbed0220529add4baec4d575af4e9b6df72c0fec930e387
MD5 31e6f55aaacde646b104314d4a991212
SHA1 774f05160c877efe34e39e967ebe14d6548178a9
SHA512 87481426cb642e31c38a978405328fb7c92297772ab50faa5bef09d8e2cd3ffe565a5b2a3551797a74b1dc6aad3d61859d8ce853c14fc511597aa946e3ba2ad8
SSDEEP 192:DCvWoq3PtYzBiey8Kt+WtWxupn+jE/M0wTRcIBbvY4ZjpwTqtLxmaizJ4h+4hwAQ:IwW5iLYfLkOY4aAwI96YuV+Ihl
MD5 SHA1 SHA512 SSDEEP

Garena.dat

SHA256 afa0c762b1f6c81752370c1a6267295c8559b84ad139d7bcb8b8afc8a33f439a
MD5 78a34141769d66defbb3dcaff50d7062
SHA1 1b22675ef32ac57e94178782a7a50f246e4c9519
SHA512 55bdc06296f89d902d26813563348235ac2302854af513a76eecb61ac738b5796d7bdc5aff1726d07d9327006e66ede447f49895d954714f9da1bb4a76257ecc
MD5 SHA1 SHA512

Garena.exe

IMPHASH ece51b23a942185e0583b54c9b96e838
SHA256 0e2de6051a73c61dd13d8cdfa93040ae910aa4a0f7eb28c19ab4d8b17afc7a22
MD5 9ace0fec7c4d6a756715fe4cbebbd381
SHA1 28f73a2b615918cd1016bbda965cd115c5dd42f2
SHA512 f4d4ff1db9e3749ca5956ef3cb200a35939cce095b5834cfabe91103bdb833e66ca43030fc4c776ca2121d9887e1f013759cdd73a90ebd39d6d795fe5335a2d6
SSDEEP 49152:mwlEVuuiXsdDAFLB7hSI7tMPrsejY9689wkGsbTt20iOwmjMG8AZVPl:mwoYptlrZ2ZOD8A
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

3e:01:78:e4:b3:73:58:22:5f:44:39:bd:60:94:42:0b:9a:6f:ac:a6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Garena Online Pte Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Garena Online Pte Ltd,L=Singapore,ST=Singapore,C=SG

Chains

Nov 30, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Garena Online Pte Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Garena Online Pte Ltd,L=Singapore,ST=Singapore,C=SG

Serial Number

57:df:ab:ea:92:d2:96:12:ea:53:6f:d1:49:bb:3f:ae

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 3, 2010 - Nov 3, 2011

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

1508669

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\NetworkLib\Garena\platform\old\garena_client\bin\Garena.pdb

sqlite3

sqlite3_reset sqlite3_finalize sqlite3_step sqlite3_changes sqlite3_bind_text16 sqlite3_column_text16 sqlite3_column_name16 sqlite3_column_type sqlite3_prepare16 sqlite3_close sqlite3_open16 sqlite3_errmsg16 sqlite3_free sqlite3_column_count sqlite3_busy_timeout sqlite3_last_insert_rowid

inject

InjectCode

ggsec

ord1

kernel32

HeapReAlloc OpenProcess SetFilePointer SystemTimeToFileTime GetFileAttributesW LocalFileTimeToFileTime CreateDirectoryW GetCurrentDirectoryW SetFileTime WriteFile FileTimeToSystemTime GetFileInformationByHandle lstrcmpiA ExitProcess GetCurrentProcessId SetUnhandledExceptionFilter IsBadReadPtr FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CompareStringA FlushFileBuffers GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType SetHandleCount GetDateFormatA GetTimeFormatA GetTimeZoneInformation IsValidCodePage GetOEMCP HeapCreate GetModuleFileNameA GetStdHandle GetModuleHandleA GetStringTypeW GetStringTypeA GetCPInfo HeapFree LCMapStringA GetStartupInfoW ExitThread IsDebuggerPresent UnhandledExceptionFilter RtlUnwind CreateWaitableTimerA SetWaitableTimer WaitForMultipleObjects TlsSetValue TlsGetValue TlsFree TlsAlloc GetSystemTimeAsFileTime GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange HeapSize HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange GetVersionExA GetProcessHeap HeapAlloc DuplicateHandle CreateSemaphoreA ReleaseSemaphore lstrcpynW CreateFileMappingA UnmapViewOfFile CreateFileMappingW MapViewOfFile GetCommandLineA GetCommandLineW QueryPerformanceCounter GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileA SetEndOfFile SetEnvironmentVariableA LCMapStringW CreateMutexW CompareStringW lstrlenW FlushInstructionCache GetCurrentProcess RaiseException EnterCriticalSection LeaveCriticalSection GetCurrentThreadId lstrcmpiW SetLastError WideCharToMultiByte GlobalUnlock GlobalLock GlobalAlloc InitializeCriticalSection DeleteCriticalSection GetLastError lstrcmpW MulDiv GetModuleFileNameW InterlockedIncrement InterlockedDecrement SizeofResource LockResource LoadResource FindResourceW FindResourceExW lstrcpyW MultiByteToWideChar lstrlenA ResumeThread SetThreadPriority CloseHandle Sleep GetTickCount GetProcAddress FreeLibrary LoadLibraryW GetModuleHandleW CreateFileW ReadFile GetFileSize GetLocalTime GetVersionExW CreateThread LoadLibraryExW TerminateProcess CreateProcessW SetCurrentDirectoryW CreateEventA WaitForSingleObject SetEvent ResetEvent CreateEventW GlobalFree GetExitCodeThread OpenMutexW TerminateThread GetEnvironmentStringsW

user32

EnableWindow FlashWindow GetForegroundWindow SwitchToThisWindow GetWindowLongW SetWindowTextW GetWindowTextW GetWindowTextLengthW GetMenu SetWindowPos GetWindowRect GetClientRect SetFocus CheckDlgButton GetParent GetDlgItem AdjustWindowRectEx IsWindow MapWindowPoints DrawEdge GetSystemMetrics GetWindowDC SetMenuItemInfoW BringWindowToTop GetMenuItemInfoW SetMenuDefaultItem SetScrollPos GetScrollInfo TrackPopupMenu RemoveMenu GetKeyState RegisterClassW CloseClipboard SetClipboardData EmptyClipboard EnumChildWindows GetUpdateRect SetRect IsRectEmpty ChildWindowFromPoint FindWindowExW LoadIconW DestroyIcon IsMenu DrawIconEx SetActiveWindow FindWindowW MessageBoxW IntersectRect PostQuitMessage CopyRect IsZoomed DestroyCursor PeekMessageW TranslateMessage DispatchMessageW GetMessageW LoadImageW CreateWindowExW IsDialogMessageW GetMessagePos GetActiveWindow SystemParametersInfoW GetWindow GetWindowThreadProcessId GetClassInfoW OpenClipboard CheckMenuItem wsprintfW DialogBoxParamW UnregisterClassA KillTimer SetTimer GetSubMenu EnableMenuItem AppendMenuW MonitorFromPoint GetMonitorInfoW DestroyMenu CreatePopupMenu WindowFromPoint SetWindowRgn SetDlgItemInt GetDlgItemInt CreateAcceleratorTableW GetFocus DestroyAcceleratorTable DrawTextW ShowWindow CharNextW DefWindowProcW BeginPaint EndPaint GetDC ReleaseDC ReleaseCapture GetCapture ClientToScreen SetCapture PtInRect SetRectEmpty OffsetRect ScreenToClient UpdateWindow InvalidateRect GetDlgCtrlID CallWindowProcW SetCursor GetCursorPos LoadCursorW GetClassNameW GetDesktopWindow IsChild RedrawWindow InvalidateRgn MoveWindow GetSysColor RegisterWindowMessageW RegisterClassExW FillRect GetClassInfoExW CreateDialogParamW SetForegroundWindow IsIconic EndDialog SetDlgItemTextW MessageBeep IsWindowVisible SetWindowLongW DestroyWindow SendMessageW GetSysColorBrush PostMessageW

gdi32

CreateCompatibleBitmap GetDIBits CreateDIBitmap SetPixel GetPixel SelectClipRgn LineTo MoveToEx CreateBitmap CreatePatternBrush PatBlt SetBkColor ExtTextOutW CreateDCW SetViewportOrgEx Polygon CreatePen SetTextColor SetBkMode RestoreDC SaveDC CreateRectRgn CombineRgn GetDeviceCaps BitBlt CreateSolidBrush StretchBlt CreateCompatibleDC ExcludeClipRect GetStockObject CreateFontIndirectW DeleteDC GetObjectW DeleteObject SelectObject

comdlg32

ChooseFontW GetSaveFileNameW GetOpenFileNameW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW

shell32

Shell_NotifyIconW ShellExecuteW

ole32

CoTaskMemAlloc CoCreateInstance CLSIDFromString CLSIDFromProgID CoTaskMemRealloc OleLockRunning StringFromGUID2 OleUninitialize OleInitialize CreateStreamOnHGlobal CoTaskMemFree CoUninitialize CoInitialize CoGetClassObject

oleaut32

OleLoadPicture SafeArrayCreate SafeArrayRedim SafeArrayDestroy SafeArrayLock SafeArrayUnlock SafeArrayCopy SafeArrayGetVartype SafeArrayCreateVector VarUI4FromStr VarDecCmp VarDecFromStr VarR8FromStr VarI4FromStr VarDateFromStr SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData SysAllocStringByteLen DispCallFunc LoadTypeLi LoadRegTypeLi OleCreateFontIndirect SysStringByteLen SysAllocString SysAllocStringLen VariantClear VariantInit SysFreeString SysStringLen

shlwapi

PathRemoveExtensionW PathFindFileNameW

comctl32

ImageList_Draw ImageList_GetImageCount ImageList_Create ImageList_AddMasked InitCommonControlsEx DestroyPropertySheetPage CreatePropertySheetPageW ImageList_GetIcon ImageList_Add ImageList_ReplaceIcon PropertySheetW _TrackMouseEvent

msimg32

TransparentBlt

pluginkernel

ord3 ord1

commonlib

?IsFileExists@Path@Common@@YAHPB_W@Z ord6 ?MakeSureDirectoryPathExists@Path@Common@@YAHPB_W@Z ?GetErrorMessage@CRunTimeException@Exception@Common@@QBEPB_WXZ ?GetErrorCode@CRunTimeException@Exception@Common@@QBEKXZ ??0CRunTimeException@Exception@Common@@QAE@PBVCLocationInfo@12@PBDK@Z ??1CLocationInfo@Exception@Common@@QAE@XZ ??0CRunTimeException@Exception@Common@@QAE@PBVCLocationInfo@12@PB_WK@Z ??0CLocationInfo@Exception@Common@@QAE@PB_W0H@Z ??1CRunTimeException@Exception@Common@@QAE@XZ ??0CRunTimeException@Exception@Common@@QAE@ABV012@@Z ??1CMyBuffer@Buffer@Common@@QAE@XZ ?ToArray@CMyBuffer@Buffer@Common@@QBEPBDXZ ?GetDataLength@CMyBuffer@Buffer@Common@@QBEHXZ ??0CMyBuffer@Buffer@Common@@QAE@XZ ord1 ?GetSource@CRunTimeException@Exception@Common@@QBEPB_WXZ ord2 ?HashData@Data@Common@@YAKPBDHK@Z

ws2_32

recvfrom sendto getpeername listen accept bind WSAGetLastError getsockname recv send closesocket connect inet_addr socket htonl inet_ntoa gethostbyname htons WSACleanup WSAStartup ntohl ntohs gethostname

garenaskin1

_UninstallSkin@0 _GetSkinFont@4 _GetImage@8 _GetGameIcon@12 _InstallSkin@0 _GetImageFromSkin@4 _SetSkinPath@4 _TrackSkinPopupMenu@20 _GetColor@4

wininet

HttpOpenRequestW InternetCloseHandle HttpSendRequestExW HttpSendRequestW InternetWriteFile InternetReadFile InternetConnectW InternetOpenW InternetSetOptionW InternetGetLastResponseInfoW InternetCrackUrlW HttpQueryInfoW

winmm

sndPlaySoundW

psapi

GetModuleBaseNameW EnumProcesses GetModuleFileNameExW EnumProcessModules

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

388KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

120KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Garena_A

Size

4KB

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

120KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=2, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=8, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=46, id=125, productName=VS2005 build 50727, version=50727,

count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=30, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=123, productName=VS2005 build 50727, version=50727,

count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=512, id=1, productName=Unmarked objects,

count=212, id=109, productName=VS2005 build 50727, version=50727,

count=508, id=110, productName=VS2005 build 50727, version=50727,

count=1, id=122, productName=VS2005 build 50727, version=50727,

count=1, id=124, productName=VS2005 build 50727, version=50727,

count=1, id=120, productName=VS2005 build 50727, version=50727,

GarenaSkin.dll

IMPHASH 7b9c92837b1e3edbe72847ae0983b21c
SHA256 26b5bba89d2ccf9a9e7e24775db5af0b8afcceb2e01d2228d4a5844565711f2a
MD5 c2ee164eabc293eb6e0021e9192f8617
SHA1 5f4fab05c925ef3e7599469bb27fe74c1c005494
SHA512 680358ccf7f03769604eebcac246f6e10bc93d92b2cd5d4a0adeb7fec19e2dc9d76a79535cd3047458f920d4bca27f4a6c44e71467db9da1d4fd6da0471486b2
SSDEEP 12288:amn3FOFoqe6nxkowZCUSaTw65Se/YpYnCb5gM:J3FOiqtUrTZSe/YqnCNgM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

226061

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\TestApp\bin\innerrelease\GarenaSkin.pdb

kernel32

CloseHandle LocalFileTimeToFileTime FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetLocaleInfoA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount IsValidCodePage GetOEMCP HeapCreate GetModuleFileNameA GetStdHandle ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA GetCPInfo GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA RtlUnwind GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess Sleep InterlockedExchange InterlockedDecrement InterlockedIncrement GetVersionExA DeleteCriticalSection InitializeCriticalSection VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA GetProcAddress InterlockedCompareExchange SystemTimeToFileTime GetCurrentDirectoryW SetFilePointer lstrcpyW CreateFileW ReadFile WriteFile EnterCriticalSection SetLastError RaiseException LeaveCriticalSection lstrlenW MultiByteToWideChar WideCharToMultiByte GetCurrentThreadId LoadResource LockResource SizeofResource FindResourceW FindResourceExW lstrcmpiW GetLastError GlobalFree GlobalLock GetProcessHeap HeapSize GlobalAlloc FlushInstructionCache GetCurrentProcess GetACP HeapReAlloc HeapFree HeapDestroy HeapAlloc

user32

LoadCursorW GetClassInfoExW RegisterClassExW CallMsgFilterW GetMessageW GetSystemMenu GetMenuStringW IsIconic IsZoomed GetCursorPos SetWindowRgn AdjustWindowRectEx GetMenu DrawIconEx PtInRect InvalidateRect PostMessageW SetMenuItemInfoW GetMenuItemInfoW GetMenuItemCount CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnableWindow GetScrollInfo SetScrollInfo ShowWindow SetRectEmpty GetClassNameW GetClientRect GetComboBoxInfo DrawIcon DestroyWindow GetDC IsWindow TrackMouseEvent SetWindowPos EndPaint BeginPaint GetWindowTextLengthW GetWindowTextW GetIconInfo CopyRect GetDlgCtrlID GetParent CreateWindowExW ScreenToClient ReleaseCapture SetFocus SetCapture IsWindowVisible DrawTextW GetSystemMetrics SetRect GetWindowDC GetWindowRect OffsetRect ReleaseDC DefWindowProcW SendMessageW GetWindowLongW SetWindowLongW CallWindowProcW IsMenu RegisterWindowMessageW TrackPopupMenu UnregisterClassA

gdi32

CombineRgn CreateRectRgn CreateDIBitmap ExcludeClipRect GetTextMetricsW CreateSolidBrush SetTextColor SetBkMode RestoreDC SaveDC SetViewportOrgEx ExtCreateRegion GetPixel ExtTextOutW SetBkColor SelectObject CreateCompatibleDC DeleteDC CreateCompatibleBitmap BitBlt CreateFontIndirectW DeleteObject StretchBlt

comctl32

InitCommonControlsEx

msimg32

TransparentBlt

GarenaSkin1.dll

IMPHASH 258919a6008fbb6950d9201d3a038091
SHA256 2ee83c02520d07be4b0d2cfa394e4b3334a4ecaaeb059191a7b2f92d9e632c00
MD5 ef6684078a73a074749086531700cf13
SHA1 779dd30fd4041085718d2c8df8ae8762a5e92caf
SHA512 55b526324d4f35a88ddbbbc85330f1f302835cced34283cbdca7558d8b56c117547b0a9a98dd5dc45ee88c81e2fab02f787021048440a14284fc769b8535178b
SSDEEP 12288:CoQH2J+gbaZK5z87AbprzOtk5ycM3CydLI9fkLmzbPAR/DwETgm4NNpGj4309IyK:tnZaU5z8M1rzCk5ycM3CydLI9fkLmzb9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

254641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\NetworkLib\Garena\trunk\client_libraries\Bin\GarenaSkin1.pdb

kernel32

CreateFileW SetFilePointer GetCurrentDirectoryW SystemTimeToFileTime FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW GetConsoleMode GetConsoleCP IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetLocaleInfoA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount HeapCreate GetModuleFileNameA GetStdHandle IsValidCodePage GetOEMCP GetACP ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA GetCPInfo GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA RtlUnwind GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess Sleep InterlockedExchange InterlockedDecrement InterlockedIncrement GetVersionExA DeleteCriticalSection InitializeCriticalSection VirtualAlloc ReadFile WriteFile LocalFileTimeToFileTime CloseHandle LeaveCriticalSection EnterCriticalSection SetLastError RaiseException lstrlenW lstrcmpW GetCurrentThreadId FindResourceExW LoadResource LockResource SizeofResource FindResourceW lstrcmpiW FlushInstructionCache VirtualFree IsProcessorFeaturePresent GetCurrentProcess MultiByteToWideChar WideCharToMultiByte lstrcpyW LoadLibraryA GetProcAddress HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedCompareExchange GetLastError

user32

LoadCursorW GetClassInfoExW RegisterClassExW FillRect GetMenu AdjustWindowRectEx DrawIconEx PtInRect InvalidateRect PostMessageW SetMenuItemInfoW GetMenuItemInfoW GetMenuItemCount CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnableWindow GetScrollInfo SetScrollInfo ShowWindow SetRectEmpty GetClientRect GetComboBoxInfo CopyRect GetDlgCtrlID CreateWindowExW IsWindow ReleaseCapture SetFocus SetCapture DestroyWindow IsWindowVisible DrawTextW TrackMouseEvent DrawIcon SetWindowPos EndPaint GetClassNameW BeginPaint GetParent GetWindowTextLengthW GetWindowTextW GetIconInfo GetSystemMetrics OffsetRect ReleaseDC GetWindowDC GetWindowRect GetWindow GetTopWindow DefWindowProcW CallWindowProcW IsMenu GetWindowLongW SetWindowLongW SendMessageW GetDC GetDesktopWindow RegisterWindowMessageW TrackPopupMenu UnregisterClassA ScreenToClient

gdi32

CreateCompatibleDC ExcludeClipRect GetTextMetricsW CreateSolidBrush SetViewportOrgEx SetTextColor SetBkMode RestoreDC SaveDC StretchBlt BitBlt ExtTextOutW SelectObject SetBkColor CreateDIBSection DeleteDC CreateCompatibleBitmap CreateFontIndirectW DeleteObject CreateDIBitmap

comctl32

InitCommonControlsEx

msimg32

TransparentBlt

GarenaSkin2.dll

IMPHASH 258919a6008fbb6950d9201d3a038091
SHA256 fae2ce152aa390560310d9a7ddcbf529c61c03358e8d1d790c5820b614a69f66
MD5 5964123a29c684ccf215975922bd8f15
SHA1 c14f7fc101c09bdc4b9a79194cc2b93cd57bd57b
SHA512 2bb4b00b6abe9e054170841f79f98621d80ecfb68398e047260e2f9dd40ad06709a95da164786faa4df2fe6f162be60781e89c872cd6575c22b78e1384ca707d
SSDEEP 12288:Xmmn+/CtVAj6bJn13uJnietHZMM3oydLI9fkLmzbPAR/DwETgm4NNpGj4309IyoJ:21/3jSJn1+piyHZMM3oydLI9fkLmzbPV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

254625

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\NetworkLib\Garena\trunk\client_libraries\Bin\GarenaSkin2.pdb

kernel32

CreateFileW SetFilePointer GetCurrentDirectoryW SystemTimeToFileTime FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW GetConsoleMode GetConsoleCP IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetLocaleInfoA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount HeapCreate GetModuleFileNameA GetStdHandle IsValidCodePage GetOEMCP GetACP ExitProcess TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA GetCPInfo GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA RtlUnwind GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess Sleep InterlockedExchange InterlockedDecrement InterlockedIncrement GetVersionExA DeleteCriticalSection InitializeCriticalSection VirtualAlloc ReadFile WriteFile LocalFileTimeToFileTime CloseHandle LeaveCriticalSection EnterCriticalSection SetLastError RaiseException lstrlenW lstrcmpW GetCurrentThreadId FindResourceExW LoadResource LockResource SizeofResource FindResourceW lstrcmpiW FlushInstructionCache VirtualFree IsProcessorFeaturePresent GetCurrentProcess MultiByteToWideChar WideCharToMultiByte lstrcpyW LoadLibraryA GetProcAddress HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedCompareExchange GetLastError

user32

LoadCursorW GetClassInfoExW RegisterClassExW FillRect GetMenu AdjustWindowRectEx DrawIconEx PtInRect InvalidateRect PostMessageW SetMenuItemInfoW GetMenuItemInfoW GetMenuItemCount CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnableWindow GetScrollInfo SetScrollInfo ShowWindow SetRectEmpty GetClientRect GetComboBoxInfo CopyRect GetDlgCtrlID CreateWindowExW IsWindow ReleaseCapture SetFocus SetCapture DestroyWindow IsWindowVisible DrawTextW TrackMouseEvent DrawIcon SetWindowPos EndPaint GetClassNameW BeginPaint GetParent GetWindowTextLengthW GetWindowTextW GetIconInfo GetSystemMetrics OffsetRect ReleaseDC GetWindowDC GetWindowRect GetWindow GetTopWindow DefWindowProcW CallWindowProcW IsMenu GetWindowLongW SetWindowLongW SendMessageW GetDC GetDesktopWindow RegisterWindowMessageW TrackPopupMenu UnregisterClassA ScreenToClient

gdi32

CreateCompatibleDC ExcludeClipRect GetTextMetricsW CreateSolidBrush SetViewportOrgEx SetTextColor SetBkMode RestoreDC SaveDC StretchBlt BitBlt ExtTextOutW SelectObject SetBkColor CreateDIBSection DeleteDC CreateCompatibleBitmap CreateFontIndirectW DeleteObject CreateDIBitmap

comctl32

InitCommonControlsEx

msimg32

TransparentBlt

GarenaTV.xml

SHA256 2f1424855129bab0c41825c05b64f233e62371160725ddba83cb5097c1eb8a61
MD5 3628d0143c7e39eb1528d19fec138978
SHA1 3c953dcc3ff12dd19ca4f8a24d7d83d7a984adf3
SHA512 51f16c8580b6b114497e6648dea464370e04f4aa7d4955fb04d93a4f7b370758dd84aa86f0f35374c60dd38d8ccfb826862334b4fdb866369e6d42dc6adf4afa
MD5 SHA1 SHA512

GarenaTVHook.dll

IMPHASH 930a3e550691d71e620afa22f1fad2a6
SHA256 95bef630518fc76e1164417ab0be5d9fcc02fb21fab3226337b037e03d1540a5
MD5 47dde81c0b6d4d952dee95f0583881ff
SHA1 c0e2cf2691bbff8eda576e3b679f11605ab5495e
SHA512 53dedde5b1e3bac63bbb1e7bf7eb56030c0a99605251f4cb38c72a73dd424a010fa0fd29b4180c6e5e70e01764a15a1b622db0b5a8f424cf7c08596295a112c2
SSDEEP 768:zENCo5MQKXh6yqADb7Hl3w67LVFdGunDsRfCie0Vt34tpNie:Qt5eXh7vH55NQR/dtonNi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5047

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\GG\ggtv_app\GarenaTV\release\GarenaTVHook.pdb

Name

.text

Size

40KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.HOOKDAT

Size

4KB

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

GarenaTV_UI.dll

IMPHASH 8b9c32e53642706195bf0a559bae6131
SHA256 12831910bf2af04483fe80cdce003309ecbc20b074e65f918ab73b0056911ffa
MD5 a8e8f3204ede6b24b7838d0f0eedcfbd
SHA1 5e71c85311ea871a25ff12631b3282fcf68ae680
SHA512 357d771a95bc6ab2bfa97482fa1f31b7e9ecf529b096110054ee78bc3526d8f697873dcfe4d652355a1d1d284004d41d1f26e3ec9bf7c03851e8c4eb3e4a29b0
SSDEEP 12288:PANfedg3V/RaV2khBnLA1byW0L9513pn:UVZZkTLb5L951N
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

246026

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\GG\client_plugins\Release\GarenaTV_UI.pdb

kernel32

lstrcmpiA GetTickCount FlushFileBuffers CreateFileA SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetModuleHandleA GetConsoleMode GetConsoleCP GetStringTypeW GetStringTypeA LCMapStringA InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapDestroy HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount LCMapStringW IsValidCodePage WaitForSingleObject GetACP VirtualProtectEx GetTimeZoneInformation ExitProcess HeapSize InterlockedDecrement InterlockedIncrement TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA lstrlenA RtlUnwind GetCommandLineA GetDateFormatA GetTimeFormatA CreateThread GetLastError ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange VirtualAlloc VirtualFree GlobalFree GlobalAlloc lstrcatW OpenProcess Process32NextW Module32NextW Module32FirstW Process32FirstW CreateToolhelp32Snapshot CreateProcessW lstrlenW lstrcmpiW RaiseException SetLastError lstrcpyW GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetModuleHandleW FreeLibrary GetCurrentThread DeleteCriticalSection InitializeCriticalSection Sleep MultiByteToWideChar GetProcAddress LoadLibraryW CreateFileW SetEndOfFile GetFileSize LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapAlloc GetModuleFileNameW lstrcmpW lstrcpynW lstrcpynA WriteProcessMemory GetStdHandle ReadProcessMemory TerminateThread lstrcpyA lstrcmpA HeapReAlloc SetFilePointer ReadFile WriteFile WideCharToMultiByte GetCPInfo CloseHandle HeapFree GetOEMCP

user32

SetWindowRgn GetWindowDC ReleaseDC DrawTextW MoveWindow GetCursorPos GetClientRect GetWindowTextLengthW SendMessageW ScreenToClient ClientToScreen GetParent GetActiveWindow GetClassInfoExW RegisterClassExW DialogBoxParamW TrackMouseEvent CreateDialogParamW ShowWindow CallWindowProcW DefWindowProcW SetCursor LoadCursorW GetWindowLongW SetWindowLongW SetWindowPos SetTimer InvalidateRect KillTimer MessageBoxW wsprintfW PostMessageW RegisterWindowMessageW InflateRect CreateWindowExW SetForegroundWindow FindWindowW InvalidateRgn GetSystemMetrics DestroyIcon LoadIconW EnableWindow UnregisterClassA SetLayeredWindowAttributes RemoveMenu AppendMenuW EndDialog GetWindow MonitorFromWindow GetMonitorInfoW MapWindowPoints AdjustWindowRectEx CopyRect SetFocus wsprintfA GetWindowTextW SetWindowTextW BringWindowToTop CreatePopupMenu IsDialogMessageW GetDlgItem ReleaseCapture SetCapture GetMessagePos PtInRect GetWindowRect GetCapture DestroyMenu DestroyWindow

gdi32

CreateCompatibleDC SelectObject CreateRoundRectRgn CreatePolygonRgn CreatePatternBrush CreateSolidBrush CreateRectRgnIndirect CreatePenIndirect GetDIBits StretchBlt BitBlt GetTextExtentPointW Polygon GetStockObject CreateFontIndirectW GetObjectW DeleteObject CombineRgn ExtTextOutW SetBkColor SetTextColor SetBkMode CreateFontW

comdlg32

GetOpenFileNameW

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

shell32

Shell_NotifyIconW ShellExecuteW

garenatvhook

ord1 ord2

shlwapi

StrToIntA PathRemoveExtensionW PathFindFileNameW StrCmpNIW StrCSpnA StrCmpNA StrCmpNW StrCmpNIA PathRemoveFileSpecW PathFileExistsW

ws2_32

closesocket recvfrom sendto ioctlsocket connect htonl select WSAGetLastError htons ntohs shutdown setsockopt recv bind socket __WSAFDIsSet send listen accept inet_addr getpeername ntohl gethostbyname

comctl32

ImageList_Create

msimg32

AlphaBlend

wininet

InternetReadFile HttpQueryInfoW HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetCloseHandle InternetConnectW InternetOpenW

garenaskin1

_UninstallSkin2@4 _TrackSkinPopupMenu@20 _GetImageFromSkin@4 _GetImageFromSkin2@8 _InstallSkin2@8

Gn.ggz

SHA256 e6d631142da2d27ae375405f0a50d8278c0c91682314bcbde3dba056b9f8ffe2
MD5 f8ddd3f2f90d1101aeb4c9bf8775877d
SHA1 4610f5bf5e5c90bff131ab4cbf80546899488c5d
SHA512 295c57df137ac4deb2778acfee646895f40e8b11ab0663b3268459d35c5ad3090e02c58b7476af239fa3d670a78617e20443c16efb26f18505b72a8f11adc2b4
SSDEEP 48:kSfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffy:0
MD5 SHA1 SHA512 SSDEEP

Inject.dll

IMPHASH c6fac98baceae40e97f7fe1744c76f5c
SHA256 d9f0d049707c3031576f12622ffac641beda11584c6b2e034df315926fe8386a
MD5 12be495da7d58512c54f5e08078163c1
SHA1 8d0743af2824b8efe1b0701dc7d6da58ae3736b6
SHA512 02bf45cdc1ef3fa6fe300019fc2da0716b7b76781dc85fa8fce033af20c745af02d515efa14e9ac6a71d7ef0226badb6cfc848aeb08a99a142b211318e32c1b8
SSDEEP 768:joXMpWhsya6ZB7pAehTp7nYxgwo6Oi30Vt0m4:EcQVptbYxgAgt5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\InGG\NewClient\Trunk\projects\Inject\Release\Inject.pdb

L4DSocket.dll

IMPHASH c5b5a649d9aefe570d326b60f7e7fbf8
SHA256 a331891424a479dfc2dabe16b4a557ff41a2622392344638ecb77331b8f66f34
MD5 d75c153b0bb642d91c3c39b6f4a273ff
SHA1 996a99ea091cae7571ea15749d7434be370dd486
SHA512 fdef4de0bbf7675c8a06db88b452205442b1d5dc14d794ce978aff4b8083a27c05eba814680043a77ac434a8d4cb2ff1590a8f00cd07e0992443ca6eb04b728c
SSDEEP 1536:OYdUCkXfPzPgvzpvhS8f7HvOqmCcJ6rdeDx6Ac/U2zVQltJZPvNJBkRIK8LZX:OKUHjPgLpk8fDfjwoz6lndvjBkRy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

37844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls TerminateProcess GetCurrentProcess WaitForSingleObject SetEvent CloseHandle OpenEventW GetModuleFileNameW GetLastError UnmapViewOfFile MapViewOfFile OpenFileMappingA GetCurrentThread LoadLibraryW FreeLibrary GetProcAddress GetTickCount ResumeThread CreateProcessA CreateProcessW FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetLocaleInfoA VirtualQuery VirtualProtect VirtualAlloc InterlockedCompareExchange GetCurrentThreadId FlushInstructionCache SetThreadContext GetThreadContext SuspendThread SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap RaiseException RtlUnwind GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement Sleep HeapSize ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage WriteFile LoadLibraryA InitializeCriticalSection SetFilePointer GetConsoleCP GetConsoleMode

ws2_32

bind recvfrom WSARecvFrom sendto WSASendTo WSAGetLastError ntohl ntohs getsockopt connect accept getpeername htons htonl inet_ntoa WSAIoctl gethostbyname gethostname

PluginKernel.dll

IMPHASH 0d9ed8a323a24cab42183f7eb588a764
SHA256 c81bde4f95f76dc4ffbd31004704969483432683d81578348b42550f1dd2a5c3
MD5 689f904255d69394d282fcb935cfcfe2
SHA1 17d1a1743647c2d2094740dccb04e7fd3c2a770b
SHA512 fa4eaf8766dbfc98acd2a71d4b2eddb5a180dab1aea04977a76d34e67ae358de79401239ae298e0fc32947371dd6fd87cd72a4c636da2748fc991511de8a1796
SSDEEP 1536:LY91UHLhbFV1QTKCyqF1S1V5eXnxwlgXj:LO6LhhjrnonxwlgX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

19545

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

RecConfig.xml

SHA256 e7e2cffe3fecc623c405d35f7831c759b0a05ac47a2249d6b3c85a0f98882dcd
MD5 5a9e6516ddab7ff5447bba85fa988697
SHA1 b5a1b084d2ccb849a35c96d1340d7002c1a7a4bf
SHA512 9466b8735e2d2b2b3c9979e2393090664d1e49e581116600e5c91522bf6dfea407c9982002f1ecbf565cab2c44be9f93d4e64909ada1f61e4f137f471051edbe
MD5 SHA1 SHA512

Roomcn.dat

SHA256 cd535d1bd2507141a78a019e4d902ca376e681027a1ab3762a3bfc225a857a4f
MD5 45c22a283d3a8812b19672c55305d71d
SHA1 6a88743d7b51fae361aac9dd0c88cf3cb875522f
SHA512 fc5996373a5f6daeb736be086e47b5c4768f0c894bc7abd8a975254e9c00dfe64fccf8bf9eb2974c871062eab6f9cd9edecb4e92e6c8972af3b3b3cbaefbe029
SSDEEP 3072:q2jr9Qsz64XuN2JB/3udhOHDQPKArVONyCHjEtyk86y9nnX9+hAAg9S5e+vRznpi:zJBIsEBjl+rftmgK6
MD5 SHA1 SHA512 SSDEEP

Roomen.dat

SHA256 32eb7f8b21ba96a0ccf0f2883b85e6bcac9c6112abf7545d7c768b96083c4cab
MD5 a38ec42907bd1f7e35751bbdc7a33ccc
SHA1 08997fb55fe1df1f4a0817463fac22ae38368a82
SHA512 52ae35b39794eb311f5cae733e8e4f66c7ee77ba7dc1787afde117e43ed70e8c31202d2bbba2eba19cc9cc078f52d49e09f3ab8795d1158138c43849e530b3fd
SSDEEP 3072:0z6P/lFaj0B10hrwzt5g9fls9KM/sZQhq8vFVT7YA8i7leVadVKXd6TQdnQ4Dz1L:06TahqDLzArQ4Nzh
MD5 SHA1 SHA512 SSDEEP

Roomtw.dat

SHA256 834f040bb843b785191e56236fd8569a65db906ad0c73c42e2580c27ec2c2628
MD5 785798b96637aa594d81597651c331a7
SHA1 44fc61c0f292084c598c8fad86389c368a37eb14
SHA512 e062614e62a724b26ac268407d7e205b8f0ed436d02c896c8e7200802ecb8958891b7533099706090439196549e4b3a3c61488e2eaefd703bde891befafcbbaf
SSDEEP 3072:Gy7GUSj+Sb0kbRVpLwC2qXkRMTUDgn0/QviePeUfqvhvEEpioJbHGSWdhrqccXfd:j1ADpEC2n/YQNC/p+4e
MD5 SHA1 SHA512 SSDEEP

Skins.xml

SHA256 f01a2bf28db786b11406fb1713a0df6e70d3297124cc6ebf24e840361a743a04
MD5 a2b14fab92e9272a449f95114f8a405a
SHA1 03f7e7b8d5e949372cffd8309a1baf64a257eadd
SHA512 a6aa5708825c11ab72ab094e5190e00f4ee163be2b2099fadaa735ccbaf432047e79f87c8ee103eb3d81229c441f788251e30aaec787cd683e79d67aaf41b4a1
MD5 SHA1 SHA512

SocketHook.dll

IMPHASH 55cc66bd61551ce6d23f9ee96a62098c
SHA256 7ddd59aa69cdb63cb985b4b2c65a4f85956f5846e5bcf67015262782b0370d14
MD5 9c8cef2a1b1fc4856644d58a3288b271
SHA1 7f5910bcbab045bd395709c2ef23e99ff6025493
SHA512 5b3c992c5ec8048f9bdbcd2cbd8164c1d6af17eabbc63756f4579e4fb50672e7692c61fb68e35b4434079d5399c5a38e278b7f9097b0877dccb7b2ef6fe43bdb
SSDEEP 1536:BqV8/TnGguTQWJS011ChY7ENvy59kw4OLXYnHl6BBoEH2TJ:UW/qguTQT0118SrXYHABBoEWT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

31844

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess DisableThreadLibraryCalls TerminateProcess WaitForSingleObject SetEvent CloseHandle OpenEventW GetModuleFileNameW OpenFileMappingA UnmapViewOfFile GetLastError MapViewOfFile GetCurrentThread FreeLibrary ResumeThread CreateProcessA CreateProcessW LoadLibraryW GetProcAddress FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA VirtualQuery VirtualProtect VirtualAlloc InterlockedCompareExchange GetCurrentThreadId FlushInstructionCache SetThreadContext GetThreadContext SuspendThread SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap RaiseException RtlUnwind GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement Sleep HeapSize ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc WriteFile LoadLibraryA InitializeCriticalSection SetFilePointer GetConsoleCP GetConsoleMode GetLocaleInfoA

ws2_32

recvfrom WSARecvFrom sendto WSASendTo WSASetLastError WSAGetLastError connect accept getpeername htons htonl ntohl ntohs gethostbyname inet_ntoa gethostname

War3Hook.dll

IMPHASH 84c6282fff898cc561946a8e7feb0672
SHA256 0dc2817bc1ab510e78dccb2c1ebe74171df47da1fb29963d11fcdeba5d138180
MD5 ad1ab19a95fc2b0d0db580fe86da713b
SHA1 ed3867faf473bcca4f8855135b8cafe6bb97abc5
SHA512 e626cd20d45c950adcfb41b4ad1718d507e79b72c082f84e7e3577b38c516cbc5d4ef3a800af5ee22306d9011131c179af85daca77dfd5d0113acc23e172588e
SSDEEP 1536:9ea6GNwYP9NKVRSLwlZccIRmNjDL2Y3nezLqOYIufJQHFBZniSPZUZ:9ea6YlNKu83mLIIs6HFBZniuZU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28308

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess DisableThreadLibraryCalls GetCurrentProcess WaitForSingleObject SetEvent CloseHandle OpenEventW GetModuleFileNameW OpenFileMappingA UnmapViewOfFile GetLastError MapViewOfFile GetCurrentThread GetTickCount FreeLibrary GetProcAddress ResumeThread FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA VirtualQuery VirtualProtect VirtualAlloc InterlockedCompareExchange GetCurrentThreadId FlushInstructionCache SetThreadContext GetThreadContext SuspendThread SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap RaiseException RtlUnwind GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement Sleep HeapSize ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapReAlloc WriteFile LoadLibraryA InitializeCriticalSection SetFilePointer GetConsoleCP GetConsoleMode GetLocaleInfoA

ws2_32

WSASetLastError WSAGetLastError recvfrom WSARecvFrom sendto WSASendTo connect htons htonl ntohl ntohs gethostbyname inet_ntoa gethostname

YYFileSystem.dll

IMPHASH e07f48095153d0e038099b8d719882cc
SHA256 e5c5bec56d74703d644050e4377e995eef5aa93579b11193b45190fe49b1c199
MD5 37426921adb925a37c537af5dc559401
SHA1 2cf6b8840c52deb19715f4da0e1be8da5c220c69
SHA512 c09f283ac12c1d1b4fc0cacc899cb72f31139af767aa0eb615ecd499d40c4876b526757a55723024f610e50184de1ace0ae6000f6d4b94e73e39e74a587e4744
SSDEEP 1536:F++6UbPh8zvUgGuVVwSeee9nVz/+k/n72QF7UCaBZ7VIOcVnToIfNTCY5W:gDUbu/GsVwSPe9VSIFLwfc9TBfNTd5W
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

68556

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\InGG\Demo\YYFileSystem\bin\Release\lib\YYFileSystem.pdb

kernel32

MultiByteToWideChar GetLastError HeapAlloc GetProcessHeap WideCharToMultiByte HeapFree CreateFileW CloseHandle GetFileSize WriteFile ReadFile HeapReAlloc SetFilePointer TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetStdHandle GetModuleFileNameA LCMapStringA SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc GetConsoleCP GetConsoleMode LoadLibraryA InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers

pluginkernel

ord2

commonlib

?GetDataLength@CMyBuffer@Buffer@Common@@QBEHXZ ?ToArray@CMyBuffer@Buffer@Common@@QBEPBDXZ ord1 ??1CMyBuffer@Buffer@Common@@QAE@XZ ??0CMyBuffer@Buffer@Common@@QAE@XZ ord2

atl71.dll

IMPHASH a0bd0cbc6c3c1f3095dd9342b630fcb9
SHA256 3d116a14cfc3723257521ea309ef1fb3c950691756a89a839df3f8dbfbae56be
MD5 1f1d608abcc34ca2a5369c95b47605f0
SHA1 3340aa7ba25c25ce8cd3fd657aa6b04fb8319099
SHA512 a76532a8ce8055314bf1da6f8f3d8eda051457560f9c5ee9b2ea75c2da71830d6da0cc180661d51ba5080837198bc669124c89d88c71440018021a54c1d7ad16
SSDEEP 1536:hIlL9T5Xx1ogKMvw5Br7KLKLI+Xe+QnyH4Cc0tR6nGVp/VTbZEaDE4Zwmr7f:itvBOI+FQny5R6nG//vrtZwmX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

51314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

atl71.pdb

kernel32

InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId lstrlenW lstrcpyW GetLastError DisableThreadLibraryCalls GetVersionExA InterlockedIncrement InterlockedDecrement FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW lstrcmpiW lstrcpynW CloseHandle ReadFile GetFileSize CreateFileW GetModuleHandleW GetModuleFileNameW WideCharToMultiByte WaitForSingleObject GlobalAlloc FindResourceA MulDiv lstrcatW FlushInstructionCache GetCurrentProcess GlobalUnlock GlobalLock lstrcmpW SetLastError GlobalFree GlobalHandle LockResource lstrcmpA GetModuleHandleA GetTickCount LocalAlloc VirtualQuery HeapFree GetProcessHeap InterlockedCompareExchange HeapAlloc GetProcAddress LoadLibraryA IsProcessorFeaturePresent VirtualFree VirtualAlloc ExitProcess HeapSize DebugBreak HeapReAlloc QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime lstrcatA lstrcpyA lstrlenA GetModuleFileNameA RtlUnwind

shlwapi

PathFindExtensionW

ggsec.dll

IMPHASH cbeb80efb2fbf8a66a12527eb1b83144
SHA256 db4d2e46c96b38b58fa4c596efe6d72d381b6b0a05beed391462f86b39bb87df
MD5 0a7d01092b940f02bd5f5cba2a62bc6c
SHA1 488d4fba43a27b2d04d64e1e7c40759b20c4d290
SHA512 fe5d46fa477145c57c93f6e63ffa39f8f6d579698c1f399a971f693de6a8f08aa154469adb7896ad306e3d04aa468d5b67eeff2fbcef7ef9383350272a75c75d
SSDEEP 3072:zliEVmIzfT3h+9Sk0ctIjAdRQC9q80Rw/kJtWvoIsFe3XM58e9Zk:zQO7h+h03sR90tdSns8ejk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

d9:9e:49:55:98:68:cd:49:f3:ce:a0:de:14:cb:e8:ca:40:ec:2c:da

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Garena Interactive Pte Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Garena Interactive Pte Ltd,L=Singapore,ST=Singapore,C=SG

Chains

Nov 10, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Garena Interactive Pte Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Garena Interactive Pte Ltd,L=Singapore,ST=Singapore,C=SG

Serial Number

79:88:f9:ad:0f:e6:52:ee:3f:4d:3d:bf:03:21:73:01

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 9, 2009 - Dec 3, 2012

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

0

Major OS version

5

Entry point

44999

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\garena\dev\anti-hack\lobby_2\ggsec\Release\ggsec.pdb

kernel32

CloseHandle GetProcAddress LoadLibraryW GetCurrentDirectoryW SetCurrentDirectoryW GetModuleFileNameW GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW IsBadReadPtr CreateProcessW IsBadWritePtr SizeofResource LockResource LoadResource FindResourceW FindResourceExW InitializeCriticalSection DeleteCriticalSection WaitForSingleObject GetCurrentProcess DuplicateHandle IsBadCodePtr EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent CreateEventW CreateThread TerminateThread SetEndOfFile UnlockFile LockFile ReadFile FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException GetVersion SetLastError VirtualQuery DisableThreadLibraryCalls InterlockedDecrement VirtualAlloc VirtualFree GetLastError GetModuleHandleW FreeLibrary VirtualProtect MultiByteToWideChar WideCharToMultiByte TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA RtlUnwind TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement Sleep ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer GetConsoleCP GetFileSize

wininet

HttpSendRequestW HttpOpenRequestW HttpQueryInfoW InternetConnectW InternetOpenW InternetCloseHandle InternetSetOptionW InternetCrackUrlW InternetReadFile

Name

.text

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data0

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data1

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

hc.xml

SHA256 71d87a6a2e5f2e735164ab34de8daf3bb2d11f052749eaafc9397fd198034f0b
MD5 f5a50a2b2b42794b34b0e91320a081ad
SHA1 d03e285cf80c650d510f5297dec8407f094612d1
SHA512 699cea8452ca61129c90a4c6f9976f2e5466b77fc4c4828320fb84760c30f90c09cb68387f2b62fecc6fbc1ef7a29396dbcea00d89d094bc17885d50e662d3d4
MD5 SHA1 SHA512

langs.xml

SHA256 0fe2da38b12fdee0ee377e42779de949e339c95417717d8fdc4f90045f19d229
MD5 b3981186517c6c334f77681d2fb1e1dd
SHA1 2400a14321bb234a1ace90c257f232e8b8e2f6df
SHA512 7ebd2c47c539ef5fb3314eda9ea1cc948cd0b8baf9f05f7694f69a115be70dfe7c6b19585f83c7aafcbff5d3920ef8710b388927bd921d92b69b8045733c7f6c
MD5 SHA1 SHA512

mdata.ggz

SHA256 59625b63598d628a650d3905574b0e84772d818463af58ddb65b0b6df4e70a19
MD5 ec6273a498fd521820af370c4430ca4b
SHA1 add30b154fb03b5410a2812cefd50610d9470c39
SHA512 acde13f47975869f90829e469681ff9d0a59f09e9a49da73b0bea3e1ce4c3ee5e5810410ef90ddf7be6b2def385806d7f52e1feaaa77c773fef4217ad6266e09
MD5 SHA1 SHA512

newgame.ggz

SHA256 c042904647cb4a330e5f994aba0f7aa55eb049a46aefd841ff609288b135adbb
MD5 69b34b7c30c4b687a23b6f07676e9692
SHA1 81e83cc665b0f89dc890dc93946e83e63508c61a
SHA512 7ab51f491e9f90e9edc3345025c7da6eca26974658a61caeb4e794a85d1ce4b54f3daf7e3ad563b55d86cf0da09d2619606bf804ebe4b9cf50c511c2bab3830f
MD5 SHA1 SHA512

onlinegame.ggz

SHA256 62f4c4db6c572b4bc91e68e9ec415ddd7e52cd865e268d9e1e4af89aa15d8df5
MD5 7fb4ac2d4accf5d8d9bf46cadd51bf14
SHA1 6846dc97e706b7a4719723943a10a15a149d7ba2
SHA512 9f6f09ee982c1bf44b3de5c98fba97d1eba27f89fd9413b47431b8821369f09227bed68b70d94f1b1f6cf5aa19122dc56a49b4f96c237eee3ae7854087c5e74a
MD5 SHA1 SHA512

safeapi.dll

IMPHASH cd391c5814cad8d0c3f552d040c36b87
SHA256 76f9aa3c46820fba81ba121c5269f277e9fce030f2c373f683ff9873d67ed075
MD5 dd057a940fd5cb230fa0e8ae780ea0c6
SHA1 e2ae7661f19e7ff194ca2880be2c7e7ca5d9c97b
SHA512 8c2b30538cea4b201e2f49c1f368c023cc158b89c5ed2c1bbc06a9d67f8aa0aef6319009eac9e249f45432809057f3024ad8be66911137b4d77b5bd95575b97e
SSDEEP 3072:ajmMXaExVqJRq80+lfeuN3rt9fmn98S0rfFO9OF:ajZi6MfeuN3rttO98S0gUF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

52:ed:95:f2:0e:4f:7e:6c:74:17:03:0b:d5:51:e1:90:4a:a2:f5:5d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Garena Interactive Pte Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Garena Interactive Pte Ltd,L=Singapore,ST=Singapore,C=SG

Chains

Oct 25, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Garena Interactive Pte Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Garena Interactive Pte Ltd,L=Singapore,ST=Singapore,C=SG

Serial Number

79:88:f9:ad:0f:e6:52:ee:3f:4d:3d:bf:03:21:73:01

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 9, 2009 - Dec 3, 2012

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

0

Major OS version

5

Entry point

13591

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\garena\dev\anti-hack\garena_safe\src\bin\freevm\safeapi.pdb

kernel32

DisableThreadLibraryCalls GetModuleFileNameW DeleteFileW SetFileAttributesW CreateFileW CloseHandle DeviceIoControl GetLastError GetCurrentProcess GetProcAddress GetModuleHandleW WriteFile SetFilePointer SizeofResource LockResource LoadResource FindResourceW LocalAlloc FreeLibrary InterlockedExchange LoadLibraryA RaiseException HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap MultiByteToWideChar WideCharToMultiByte RtlUnwind GetCommandLineA GetVersionExA VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCurrentThreadId GetModuleHandleA ExitProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter OutputDebugStringA SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP Sleep LoadLibraryExA InitializeCriticalSection GetConsoleCP GetConsoleMode GetLocaleInfoA GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers

Name

.text

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data0

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data1

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

server.xml

SHA256 9c8c2e23ede3c457b8e4afc736b0179808e9f4f3275251623eaa3cf2006b031b
MD5 caa38fa542c79b98ff7f10add292284f
SHA1 37f3725489ad49b712764f13ba082e190324a6e0
SHA512 ad8b692c9724234f0943ebc297b447baf3f6d75c7865a1a4d71dce6ad1be8cd709f3927d40bc7b9501daaadb952b3daff8955467118418bfaf4b72a82e1f6227
MD5 SHA1 SHA512

slotmachine.ggz

SHA256 0de0bc34739aa203e14b11e3571bf2b73535daef3f71069f699825368549324c
MD5 7734ffb80f7c18087f1aef1b43c10256
SHA1 f4313d2ad13e98bf06e72259f4cc06ccc3aab867
SHA512 2c32a17f83d45da4991f650133a730a2eaee96a684c580259b71c744bd1ee3c0e87da42037bb97b13774b648ca943117ab974ad0f996c3b8bb327c2d19527c1c
MD5 SHA1 SHA512

source.xml

SHA256 151247e76149f01be54f32ce15177447dcb25b77ac864c9fc2dd126e6d48bfd4
MD5 381061392f0e25bee9b2754169a2beca
SHA1 5d445e21fddb2f2233c415b01ec48ee28e4b2fe7
SHA512 1210251b761fce1733e3b3926ce1377106523da5389181ada64327c34651b5ac02be2b441389b05e5da21b86bb1287bc7ff8d174ef8e786816fe6cd5c1e24f7d
MD5 SHA1 SHA512

sqlite3.dll

IMPHASH fe62f9dce6776626b1ed9d7894e7710d
SHA256 1ca02cf19ca9728127674132823947ae8f60ea417e4b1173ef2278987c06c258
MD5 0a764b1e2ae70d5223b095cb9e7cc5d7
SHA1 327d73848f2a8378cd94f4aa9a91d9620e378ce9
SHA512 1d7a66b5f843a237b71f4ab14527993423a526ca65e4ffb464b048904d6a94c7b24ea7a108d5a1b151f0fe074fb9228378590180334cef8a68c5051062af5269
SSDEEP 6144:g2YXPFsclAKSPAoqQdpDbuLFBvIqKrcmzvdiULvBz8yV2dMmCDE6fwnJXeE/kxJt:g2YZre/DbuLFKqKrccdiU9bLDXYIV/Z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_DLL

PDB paths

sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_db_config sqlite3_db_handle sqlite3_db_mutex sqlite3_db_status sqlite3_declare_vtab sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_exec sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_value sqlite3_result_zeroblob sqlite3_rollback_hook sqlite3_rtree_geometry_callback sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_step sqlite3_stmt_status sqlite3_strnicmp sqlite3_table_column_metadata sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_transfer_bindings sqlite3_update_hook sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_hook sqlite3_win32_mbcs_to_utf8

Name

.text

Size

415KB

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.stab

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.stabstr

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

update.dat

SHA256 968403ca3f310eff3ebe9120fddc96e9adfbcff5ee1e06ece38887e8c3183dd0
MD5 8ab82cf311f20f9c2461286558116685
SHA1 dc4f8b96b75a680053d8546c3819ef408c4f3b5d
SHA512 0fb7b326e2dfabf0bfb0679511735de32a5b81753c95c256da4d96a4f9e88ed248807843b59aec13a19284da06163f3cea2b604a7f50512543978475d5a9196c
SSDEEP 384:Y3eX0lVySzSliNXCywm5b+DWEH37rZORpmc6SXWy6V5T+RYRKUPEvQHo:6eX0pzSYpn9b+DWG37dORlTpaTeYLMII
MD5 SHA1 SHA512 SSDEEP

update.exe

SHA256 cb70a40b51cc0df95c38688720f240fe4afbb616645f103171d5561d8e39e250
MD5 273d9cea90ab99049ce97f25918ce7a8
SHA1 64509b2fbfbb0b7acfb48f232e6713cf4563f193
SHA512 44485c04337e9cf96550496080b0cf1ac5ae8b9a26454775d67cb7a92b3a658a2d4c90f869b044a939c1274c55e32398c84987c83ebe5c09956f7b1277456867
SSDEEP 1536:TyhpI2VsTxi34fLrr4MSlCv+huIg5zXd9bPazbQ:TyfI2Vs9VLgMSlC6uDtrGo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

253206

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer