ShGuardian.dll

Description:

Authors:

Version:

Architecture: 32-bit

Operating System:

SHA256: 113a618efd60b0bbf7c1d8c8c0e8d5f1

File Size: 147.0 KB

Uploaded At: Aug. 30, 2026, 6:52 a.m.

Views: 12

Security Warning

This file has been flagged as potentially dangerous.

Reason: Detected potentially dangerous functions used for process injection: OpenProcess

Exported Functions

Main (Ordinal: 1, Address: 0x1970)

Imported DLLs & Functions

GDI32.dll

GetStockObject (Address: 0x1001b000)
SelectObject (Address: 0x1001b00c)
SetBkMode (Address: 0x1001b008)
SetTextColor (Address: 0x1001b004)

KERNEL32.dll

CloseHandle (Address: 0x1001b024)
CompareStringW (Address: 0x1001b1ac)
CreateEventA (Address: 0x1001b030)
CreateFileW (Address: 0x1001b158)
CreateMutexA (Address: 0x1001b07c)
CreateProcessA (Address: 0x1001b05c)
CreateThread (Address: 0x1001b0e8)
CreateToolhelp32Snapshot (Address: 0x1001b03c)
DecodePointer (Address: 0x1001b06c)
DeleteCriticalSection (Address: 0x1001b138)
EncodePointer (Address: 0x1001b12c)
EnterCriticalSection (Address: 0x1001b130)
ExitProcess (Address: 0x1001b174)
FileTimeToSystemTime (Address: 0x1001b170)
FindClose (Address: 0x1001b0d8)
FindFirstFileExW (Address: 0x1001b0d4)
FindNextFileW (Address: 0x1001b0d0)
FlsAlloc (Address: 0x1001b198)
FlsFree (Address: 0x1001b1a4)
FlsGetValue (Address: 0x1001b19c)
FlsSetValue (Address: 0x1001b1a0)
FlushFileBuffers (Address: 0x1001b08c)
FreeEnvironmentStringsW (Address: 0x1001b0ac)
FreeLibrary (Address: 0x1001b150)
GetACP (Address: 0x1001b0c8)
GetCommandLineA (Address: 0x1001b0bc)
GetCommandLineW (Address: 0x1001b0b8)
GetConsoleMode (Address: 0x1001b084)
GetConsoleOutputCP (Address: 0x1001b088)
GetCPInfo (Address: 0x1001b0c0)
GetCurrentDirectoryW (Address: 0x1001b18c)
GetCurrentProcess (Address: 0x1001b04c)
GetCurrentProcessId (Address: 0x1001b02c)
GetCurrentThreadId (Address: 0x1001b104)
GetDriveTypeW (Address: 0x1001b15c)
GetEnvironmentStringsW (Address: 0x1001b0b0)
GetFileInformationByHandle (Address: 0x1001b160)
GetFileSizeEx (Address: 0x1001b0a0)
GetFileType (Address: 0x1001b164)
GetFullPathNameW (Address: 0x1001b190)
GetLastError (Address: 0x1001b01c)
GetLocalTime (Address: 0x1001b058)
GetModuleFileNameA (Address: 0x1001b0e4)
GetModuleFileNameW (Address: 0x1001b17c)
GetModuleHandleA (Address: 0x1001b018)
GetModuleHandleExW (Address: 0x1001b178)
GetModuleHandleW (Address: 0x1001b118)
GetOEMCP (Address: 0x1001b0c4)
GetProcAddress (Address: 0x1001b060)
GetProcessHeap (Address: 0x1001b0a4)
GetStartupInfoW (Address: 0x1001b114)
GetStdHandle (Address: 0x1001b188)
GetStringTypeW (Address: 0x1001b098)
GetSystemTimeAsFileTime (Address: 0x1001b108)
GetTempPathA (Address: 0x1001b054)
GetTimeZoneInformation (Address: 0x1001b094)
HeapAlloc (Address: 0x1001b184)
HeapFree (Address: 0x1001b180)
HeapReAlloc (Address: 0x1001b0ec)
HeapSize (Address: 0x1001b080)
InitializeCriticalSectionAndSpinCount (Address: 0x1001b13c)
InitializeCriticalSectionEx (Address: 0x1001b1a8)
InitializeSListHead (Address: 0x1001b10c)
InterlockedFlushSList (Address: 0x1001b124)
IsDebuggerPresent (Address: 0x1001b110)
IsProcessorFeaturePresent (Address: 0x1001b0fc)
IsValidCodePage (Address: 0x1001b0cc)
LCMapStringW (Address: 0x1001b1b0)
LeaveCriticalSection (Address: 0x1001b134)
LoadLibraryExW (Address: 0x1001b154)
MultiByteToWideChar (Address: 0x1001b194)
OpenEventA (Address: 0x1001b0e0)
OpenProcess (Address: 0x1001b038)
PeekNamedPipe (Address: 0x1001b168)
Process32First (Address: 0x1001b034)
Process32FirstW (Address: 0x1001b068)
Process32Next (Address: 0x1001b040)
Process32NextW (Address: 0x1001b064)
QueryPerformanceCounter (Address: 0x1001b100)
RaiseException (Address: 0x1001b120)
ReadConsoleW (Address: 0x1001b074)
ReadFile (Address: 0x1001b078)
ReadProcessMemory (Address: 0x1001b044)
ResetEvent (Address: 0x1001b028)
RtlUnwind (Address: 0x1001b11c)
SetEndOfFile (Address: 0x1001b070)
SetEnvironmentVariableW (Address: 0x1001b0a8)
SetEvent (Address: 0x1001b020)
SetFilePointerEx (Address: 0x1001b09c)
SetLastError (Address: 0x1001b128)
SetStdHandle (Address: 0x1001b0dc)
SetUnhandledExceptionFilter (Address: 0x1001b0f8)
Sleep (Address: 0x1001b0f0)
SystemTimeToTzSpecificLocalTime (Address: 0x1001b16c)
TerminateProcess (Address: 0x1001b050)
TlsAlloc (Address: 0x1001b140)
TlsFree (Address: 0x1001b14c)
TlsGetValue (Address: 0x1001b144)
TlsSetValue (Address: 0x1001b148)
UnhandledExceptionFilter (Address: 0x1001b0f4)
VirtualProtect (Address: 0x1001b048)
WaitForSingleObject (Address: 0x1001b014)
WideCharToMultiByte (Address: 0x1001b0b4)
WriteConsoleW (Address: 0x1001b1b4)
WriteFile (Address: 0x1001b090)

USER32.dll

BeginPaint (Address: 0x1001b22c)
ClientToScreen (Address: 0x1001b1fc)
CreateWindowExA (Address: 0x1001b210)
DefWindowProcA (Address: 0x1001b20c)
DestroyWindow (Address: 0x1001b1dc)
DispatchMessageA (Address: 0x1001b1d8)
DrawTextA (Address: 0x1001b1f4)
EndPaint (Address: 0x1001b230)
EnumWindows (Address: 0x1001b208)
FindWindowA (Address: 0x1001b1f8)
FindWindowExA (Address: 0x1001b234)
GetActiveWindow (Address: 0x1001b1e4)
GetClientRect (Address: 0x1001b21c)
GetForegroundWindow (Address: 0x1001b204)
GetMessageA (Address: 0x1001b1d0)
GetWindow (Address: 0x1001b1d4)
GetWindowLongA (Address: 0x1001b200)
GetWindowTextA (Address: 0x1001b1c0)
GetWindowThreadProcessId (Address: 0x1001b1cc)
IsWindow (Address: 0x1001b1ec)
IsWindowVisible (Address: 0x1001b1e0)
KillTimer (Address: 0x1001b220)
MessageBoxA (Address: 0x1001b1c8)
RegisterClassExA (Address: 0x1001b224)
SetLayeredWindowAttributes (Address: 0x1001b214)
SetTimer (Address: 0x1001b1f0)
SetWindowLongA (Address: 0x1001b238)
ShowWindow (Address: 0x1001b1e8)
TranslateMessage (Address: 0x1001b218)
UpdateWindow (Address: 0x1001b228)
WaitForInputIdle (Address: 0x1001b1c4)
WindowFromPoint (Address: 0x1001b1bc)