68f2fc3225ed6d9a44c6127c9e0e4216e33437b1e02bcae78fe495979709702d

Sharing

Copy URL Twitter E-mail

General

Target

68f2fc3225ed6d9a44c6127c9e0e4216e33437b1e02bcae78fe495979709702d
Size

5.6MB
MD5

c5cbbb63525c17a18e4cb496f06b79ea
SHA1

0a7b72cadb7ef658f11155597f7e19aa6449337e
SHA256

68f2fc3225ed6d9a44c6127c9e0e4216e33437b1e02bcae78fe495979709702d
SHA512

2ee2346590980ff9dcc18ed1e7db41ead625cd4a761175b9a255a291d91909c12b95e6a347f3a2b0803697ccaab042dd372d2536ae8b7e97b375b31761bc4d41
SSDEEP

98304:1c05ExtBacUdIUmkD34kErjseVRRcQRrrTRlecw:DeTBnkD34kEr4eVRrpTR47

Score

1^/10

Malware Config

Signatures

Files

68f2fc3225ed6d9a44c6127c9e0e4216e33437b1e02bcae78fe495979709702d
.exe windows:6 windows x86

0cd7918b25ee6da79e233b7e19d3fb99

Code Sign

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:de:eb:f5:d6:fd:7a:82:7b:69:ec:99:49:83:e5:92:ec:ec:55:98:0a:20:60:04:74:8b:e9:26:a1:0b:3a:f8
Signer

Actual PE Digest

37:de:eb:f5:d6:fd:7a:82:7b:69:ec:99:49:83:e5:92:ec:ec:55:98:0a:20:60:04:74:8b:e9:26:a1:0b:3a:f8

Digest Algorithm

sha256

PE Digest Matches

false

4e:dd:a6:2d:32:4c:85:46:3d:49:b2:b5:d1:7f:23:89:17:98:51:a8
Signer

Actual PE Digest

4e:dd:a6:2d:32:4c:85:46:3d:49:b2:b5:d1:7f:23:89:17:98:51:a8

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

caterpillar_sdk

?OnTaskFail@ChainedTask@@MAEXXZ
?OnTaskStop@ChainedTask@@MAEXXZ
?OnTaskSuccess@ChainedTask@@MAEXXZ
?shared_from_this@?$enable_shared_from_this@VChainedTask@@@std@@QAE?AV?$shared_ptr@VChainedTask@@@2@XZ
?TaskExternalLog@ChainedTask@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HH0@Z
?WaitForDone@ChainedTask@@QAEXV?$duration@_JU?$ratio@$00$0DOI@@std@@@chrono@std@@@Z
?last_error_message@ChainedTask@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?OnActionSuccess@ChainedTask@@MAEXXZ
?action_duration@ChainedTask@@QBE?AV?$duration@_JU?$ratio@$00$0PECEA@@std@@@chrono@std@@XZ
?InitSDK@CaterpillarClient@@SAXXZ
?Connect@ChainedTask@@UAEX$$QBUAction@@@Z
?Start@ChainedTask@@QAEXXZ
?CurrentActionName@ChainedTask@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?set_queue@ChainedTask@@QAEX_N@Z
?set_value@TaskData@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?StopTask@CaterpillarClient@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Stop@ChainedTask@@UAEX_N@Z
?OnActionStop@ChainedTask@@MAEXXZ
?data@ChainedTask@@QBE?AV?$shared_ptr@VTaskData@@@std@@XZ
?NotifyDone@ChainedTask@@QAEXXZ
?TaskDone@ChainedTask@@MAEXXZ
?set_last_error_message@ChainedTask@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1ChainedTask@@UAE@XZ
??0ChainedTask@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@2@0V?$function@$$A6AXV?$shared_ptr@VChainedTask@@@std@@W4TaskState@@@Z@2@@Z
??1Action@@QAE@XZ
?value@TaskData@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z
??0Action@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A_NV?$shared_ptr@VChainedTask@@@std@@@Z@2@V?$function@$$A6AXV?$shared_ptr@VChainedTask@@@std@@W4ActionResult@@@Z@2@@Z
?UninitSDK@CaterpillarClient@@SAXXZ
?OnActionFail@ChainedTask@@MAEXXZ

minicorelib

??1AppBase@minilib@@UAE@XZ
?instance@AppBase@minilib@@SAPAV12@XZ
?run@AppBase@minilib@@QAEXXZ
?quit@AppBase@minilib@@QAEXXZ
?runLoop@AppBase@minilib@@MAEXXZ
??0Path@minilib@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?setSize@File@minilib@@QAE_N_J@Z
?seek@File@minilib@@QAE_N_J@Z
?getDPIScale@DPI@Windows@@QBEMXZ
??0AppBase@minilib@@QAE@XZ
?scaleY@DPI@Windows@@QBEHH@Z
?size@File@minilib@@QBE_JXZ
?fileName@Path@minilib@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?extension@Path@minilib@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?threadId@AppUI@@YA?AVid@thread@std@@XZ
??1IWindowMessageFilter@minilib@@UAE@XZ
??0IWindowMessageFilter@minilib@@QAE@XZ
?handle@Window@minilib@@QBEPAUHWND__@@XZ
?hide@Window@minilib@@QAEXXZ
?forceClose@Window@minilib@@QAEXXZ
??0TObject@minilib@@QAE@PAV01@@Z
??1TObject@minilib@@UAE@XZ
?addObj@WeakGuard@minilib@@SAXPAPAVTObject@2@@Z
?removeObj@WeakGuard@minilib@@SAXPAPAVTObject@2@@Z
?isActive@Timer@minilib@@QBE_NXZ
??0File@minilib@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?interval@Timer@minilib@@QBEHXZ
?open@File@minilib@@QAE_NW4OpenMode@12@@Z
?write@File@minilib@@QAEHPBEH@Z
?readAll@File@minilib@@QAE?AVBuffer@2@XZ
?exists@File@minilib@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?applicationDirPath@Utils@minilib@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?toUtf8@Utils@minilib@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?instance@DPI@Windows@@SAPAV12@XZ
?scaleX@DPI@Windows@@QBEHH@Z
?fromUtf8@Utils@minilib@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?toUtf8@Utils@minilib@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_WH@Z
?appDataPath@Utils@minilib@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
??0Timer@minilib@@QAE@XZ
??1Timer@minilib@@QAE@XZ
?start@Timer@minilib@@QAEXH@Z
?stop@Timer@minilib@@QAEXXZ
?timeOutEvent@Timer@minilib@@QAEAAV?$Event@$$A6AXPAVTimer@minilib@@@ZVmutex@std@@@2@XZ
?writeLine@File@minilib@@QAEHABVBuffer@2@@Z
?remove@File@minilib@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0Path@minilib@@QAE@XZ
?fullPath@Path@minilib@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?absoluteDir@Path@minilib@@QBE?AV12@XZ
??1Path@minilib@@QAE@XZ
?toLower@Ascii@@SAHH@Z
?fromUtf8@Utils@minilib@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBDH@Z
?makeSureDirExist@Utils@minilib@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?appProcessName@Utils@minilib@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?post@AppBase@minilib@@QAEX$$QAV?$function@$$A6AXXZ@std@@@Z
?postDelayed@AppBase@minilib@@QAEX$$QAV?$function@$$A6AXXZ@std@@H@Z
?async@AppUI@@YAX$$QAV?$Callback@$$A6AXXZ@minilib@@@Z
?asyncDelayed@AppUI@@YAX$$QAV?$Callback@$$A6AXXZ@minilib@@H@Z
?static_pplScheduler@AppUI@@YA?AV?$shared_ptr@Uscheduler_interface@Concurrency@@@std@@XZ
?static_pplScheduler@concurrency_@@YAAAV?$shared_ptr@Uscheduler_interface@Concurrency@@@std@@XZ
?close@File@minilib@@QAEXXZ
?stop@WorkerPool@minilib@@QAEXXZ
?async@WorkerPool@minilib@@SAX$$QAV?$Callback@$$A6AXXZ@2@@Z
?pool@WorkerPool@minilib@@SAPAV12@XZ
??1File@minilib@@QAE@XZ
?removeDir@Utils@minilib@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z

cef_frame

CreateBrowser
IsNameReolveError
TbsAppInstance

gmesdk

QAVSDK_AuthBuffer_GenAuthBuffer
ITMGContextGetInstance

comctl32

InitCommonControlsEx

common

?InitPlatformCoreConfig@Boot@Util@@YAHXZ
??0CTXStringW@@QAE@UtagUTF8@@PBDH@Z
??8@YA_NPB_WABVCTXBSTR@@@Z
??ICTXBSTR@@QAEPAPA_WXZ
??0CTXBSTR@@QAE@XZ
?SetAsyncCallback@TXTimer@@YAHPAUITXAsyncCallback@@I@Z
?SafeLoadLibrary@Sys@Util@@YAPAUHINSTANCE__@@PB_W@Z
?Detach@CTXBSTR@@QAEPA_WXZ
?Empty@CTXStringW@@QAEXXZ
??4CTXStringW@@QAEAAV0@PA_W@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?Utf8ToWS@Convert@Util@@YA?AVCTXStringW@@PBDH@Z
?Utf8FromWS@Convert@Util@@YA?AVCTXStringA@@PB_WH@Z
?GetString@CTXStringW@@QBEPB_WXZ
??BCTXStringA@@QBEPBDXZ
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?CreateFileW@FS@@YAHPB_WKPAPAUITXFile@@@Z
?GetBSTR@CTXStringW@@QBEPA_WXZ
?Left@CTXStringW@@QBE?AV1@H@Z
?Mid@CTXStringW@@QBE?AV1@HH@Z
?Mid@CTXStringW@@QBE?AV1@H@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
?Delete@CTXStringW@@QAEHHH@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?GetLength@CTXStringW@@QBEHXZ
??YCTXStringW@@QAEAAV0@PB_W@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
??0CTXStringW@@QAE@ABV0@@Z
?AppendFormat@CTXStringW@@QAAXPB_WZZ
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?GetBuffer@CTXStringW@@QAEPA_WXZ
?Format@CTXStringW@@QAAXPB_WZZ
??0CTXStringW@@QAE@XZ
?CreateTXArray@Data@Util@@YAHPAPAUITXArray@@@Z
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
??M@YA_NABVCTXStringA@@0@Z
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?OnUninitCom@Misc@Util@@YAXXZ
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
?SetConfigFile@TXI18N@@YAHPB_W0@Z
ord4
ord6
ord10
ord5
??1CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@PB_W@Z
??BCTXStringW@@QBEPB_WXZ
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
?TXLoadString@@YAPB_WPB_W0@Z
?TXAssert@@YAHPB_W0H@Z
??0CTXStringA@@QAE@XZ
??1CTXStringA@@QAE@XZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
?Format@CTXStringA@@QAAXPBDZZ
??0CTXStringW@@QAE@UtagEN@@PBDH@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
??7CTXStringW@@QBE_NXZ
??0CTXBSTR@@QAE@PB_W@Z
??1CTXBSTR@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
??0CTXStringW@@QAE@PA_W@Z
??H@YA?AVCTXStringW@@_WABV0@@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z

gf

?ScaleX@DPI@GF@Util@@YAHH@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@PAUITXCore@@H@Z
?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z
?ScaleRECT@DPI@GF@Util@@YAXPAUtagRECT@@@Z
?ScaleSIZE@DPI@GF@Util@@YAXPAUtagSIZE@@@Z
?UnscaleSIZE@DPI@GF@Util@@YAXPAUtagSIZE@@@Z
?UnscaleLONG@DPI@GF@Util@@YAXPAJ@Z
?IsScaleIgnore@DPI@GF@Util@@YA_NXZ
?HandleMessageScale@DPI@GF@Util@@YAXPAUtagBaseArg@@@Z
??0CDPIScaleIgnoreResetHelper@@QAE@XZ
??1CDPIScaleIgnoreResetHelper@@QAE@XZ
?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z

xgraphic32

SetColor
FillSolidRectEx
DrawEllipse

ws2_32

recv
gethostname
WSASocketW
WSARecv
WSAIoctl
WSASetLastError
recvfrom
WSACleanup
WSAStartup
sendto
listen
getsockopt
getsockname
getpeername
bind
accept
__WSAFDIsSet
freeaddrinfo
getaddrinfo
WSAGetLastError
socket
setsockopt
select
ioctlsocket
connect
closesocket
WSASend
send
ntohs
WSAAddressToStringW
htonl
htons
ntohl

comdlg32

GetOpenFileNameW

ximage

?Resample2@CxImage@@QAE_NJJW4InterpolationMethod@1@W4OverflowMethod@1@QAV1@_N@Z
?Save@CxImage@@QAE_NPB_WK@Z
?Load@CxImage@@QAE_NPB_WK@Z
?Destroy@CxImage@@QAE_NXZ
??0CxImage@@QAE@K@Z

wininet

InternetOpenUrlA
InternetReadFile
DeleteUrlCacheEntryW
InternetSetOptionW
InternetCloseHandle
InternetOpenW

wldap32

ord145
ord118
ord142
ord41
ord133
ord14
ord147
ord79
ord27
ord26
ord127
ord46
ord301
ord167
ord208
ord216

zlib

zlibVersion
inflateInit_

libeay32

ord4445
ord224
ord253
ord222
ord227
ord298
ord3212
ord3189
ord1802
ord52
ord109
ord89
ord66
ord1800
ord196
ord197
ord1804
ord2604
ord2949

ssleay32

ord138
ord143
ord151
ord158
ord155
ord183
ord96
ord170
ord12
ord8
ord83
ord74
ord75
ord48
ord35
ord43
ord78
ord108
ord45
ord6
ord58

msvcp140

??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Winerror_message@std@@YAKKPADK@Z
_Stat
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
_Thrd_start
_Thrd_join
_Thrd_id
_Mtx_init
_Mtx_destroy
_Cnd_init
_Cnd_destroy
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_broadcast
_Cnd_signal
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z
?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ
?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ
??0task_continuation_context@Concurrency@@AAE@XZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?setf@ios_base@std@@QAEHHH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
_Thrd_hardware_concurrency
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??Bios_base@std@@QBE_NXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
?classic@locale@std@@SAABV12@XZ
?toupper@?$ctype@D@std@@QBEDD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?eof@ios_base@std@@QBE_NXZ
?fail@ios_base@std@@QBE_NXZ
?bad@ios_base@std@@QBE_NXZ
?exceptions@ios_base@std@@QBEHXZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
_Thrd_sleep
?id@?$ctype@D@std@@2V0locale@2@A
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?_Assign@_ContextCallback@details@Concurrency@@AAEXPAX@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
_To_byte
_To_wide
_Thrd_detach
_Remove_dir
_Lstat
_Unlink
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
_Strcoll
_Strxfrm
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?is@?$ctype@D@std@@QBE_NFD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
_Thrd_yield
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??Bid@locale@std@@QAEIXZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?_XGetLastError@std@@YAXXZ
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?width@ios_base@std@@QAE_J_J@Z

kernel32

GetNumberFormatW
GetCurrencyFormatW
FormatMessageA
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
SignalObjectAndWait
OpenFileMappingW
ReleaseSemaphore
CreateSemaphoreW
IsDebuggerPresent
FileTimeToLocalFileTime
ProcessIdToSessionId
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
VirtualAlloc
GetTimeFormatW
GetDateFormatW
SwitchToThread
K32GetModuleFileNameExA
IsProcessorFeaturePresent
OpenEventW
OutputDebugStringA
SetEndOfFile
FlushFileBuffers
FreeResource
PeekNamedPipe
CreatePipe
SetHandleInformation
GetACP
QueryPerformanceFrequency
QueryPerformanceCounter
GlobalFree
K32GetProcessImageFileNameW
ReadDirectoryChangesW
CancelIoEx
CompareFileTime
ExpandEnvironmentStringsW
GetProcessTimes
GlobalAddAtomW
GlobalUnlock
GlobalLock
GlobalSize
SetEnvironmentVariableW
GetTempFileNameW
GetFileSizeEx
LoadLibraryExA
ResetEvent
CreateFileA
Module32NextW
Module32FirstW
Thread32Next
Thread32First
ReadProcessMemory
VirtualAllocEx
GetStartupInfoW
InitializeSListHead
SuspendThread
OpenThread
SetErrorMode
SetUnhandledExceptionFilter
DuplicateHandle
SearchPathW
GetFileInformationByHandle
SetFileTime
LocalFileTimeToFileTime
VerifyVersionInfoW
GetModuleHandleA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcessId
QueueUserAPC
SleepEx
InitializeCriticalSectionAndSpinCount
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
SetLastError
VerSetConditionMask
lstrcmpW
SetFileAttributesW
CreateDirectoryW
K32GetModuleFileNameExW
GetSystemTimeAsFileTime
RaiseException
EnumResourceNamesW
K32GetPerformanceInfo
GetSystemPowerStatus
GetSystemTimes
OutputDebugStringW
GetVersion
GetUserDefaultLangID
SystemTimeToTzSpecificLocalTime
MoveFileW
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
WTSGetActiveConsoleSessionId
GetSystemWindowsDirectoryW
RemoveDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
GetLocaleInfoW
GetModuleFileNameA
GetEnvironmentVariableW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
GetExitCodeProcess
GetFileAttributesExA
DeleteFileA
lstrcpyW
GlobalAlloc
SystemTimeToFileTime
GetTempPathA
CreateWaitableTimerW
WaitForMultipleObjects
GetSystemTime
GlobalMemoryStatusEx
CreateProcessA
CreateThread
CancelWaitableTimer
SetWaitableTimer
GetFileAttributesExW
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetFileAttributesW
GetCommandLineW
IsWow64Process
DeviceIoControl
GetLogicalDrives
GetDiskFreeSpaceExW
CopyFileW
GetModuleFileNameW
GetTickCount
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
WaitForSingleObjectEx
UnhandledExceptionFilter
CreateProcessW
WriteFile
SetFilePointerEx
SetFilePointer
ReadFile
GetFileSize
CreateFileW
FileTimeToSystemTime
MoveFileExW
GetLocalTime
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
IsBadWritePtr
IsBadReadPtr
WritePrivateProfileStringW
GetPrivateProfileIntW
LoadLibraryW
LoadLibraryA
lstrcpynW
FormatMessageW
LocalFree
LoadLibraryExW
FreeLibrary
WriteProcessMemory
VirtualQuery
VirtualProtect
GetVersionExW
GetSystemDirectoryW
GetSystemInfo
TerminateThread
GetCurrentThreadId
GetCurrentThread
TerminateProcess
GetCurrentProcess
OpenMutexW
CreateMutexW
ReleaseMutex
GetTempPathW
GetDriveTypeW
GetSystemDefaultLangID
GetUserDefaultUILanguage
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleW
FindResourceExW
Sleep
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CloseHandle

user32

GetClassNameW
EnumThreadWindows
EqualRect
WindowFromPoint
GetClientRect
GetWindowThreadProcessId
GetForegroundWindow
AttachThreadInput
KillTimer
SetTimer
MonitorFromRect
PostMessageA
LoadImageW
EnumWindows
SetActiveWindow
IsIconic
ShowWindow
PostThreadMessageW
FindWindowA
SendMessageTimeoutA
GetParent
GetKeyState
UpdateWindow
MsgWaitForMultipleObjectsEx
IsWindowVisible
MessageBoxA
SetForegroundWindow
BringWindowToTop
CreateWindowExW
RegisterClassExW
UnregisterClassW
UnregisterHotKey
RegisterHotKey
CharNextW
CharUpperW
SendMessageW
CreateWindowExA
IsWindow
DestroyWindow
EnableWindow
GetDC
ReleaseDC
SetWindowTextW
GetWindowTextW
MessageBoxW
SetCursorPos
GetCursorPos
GetWindowLongW
SetWindowLongW
FindWindowExW
wsprintfW
ExitWindowsEx
GetLastInputInfo
GetSystemMetrics
DefWindowProcW
RegisterClassExA
FindWindowW
EnumDisplaySettingsW
EnumDisplayDevicesA
EnumDisplayDevicesW
MonitorFromWindow
GetMonitorInfoW
DestroyIcon
CreateIconFromResource
GetIconInfoExW
GetDesktopWindow
MoveWindow
GetWindowRect
LoadIconW
DispatchMessageW
PeekMessageW
PostMessageW
MsgWaitForMultipleObjects
SystemParametersInfoW
SetWindowPos
SendMessageTimeoutW

advapi32

CryptEnumProvidersA
CryptGenRandom
CryptAcquireContextA
RegEnumKeyExW
RegQueryValueExA
CloseServiceHandle
ControlService
RegCloseKey
RegCreateKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
BuildExplicitAccessWithNameW
RegQueryInfoKeyW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
QueryServiceStatus
RegSetValueExA
RegOpenKeyExA
RegGetValueW
RegDeleteKeyW
QueryServiceConfigW
CreateServiceW
ChangeServiceConfigW
RegOpenKeyA
RegSetKeyValueW
OpenServiceW
OpenSCManagerW
DeleteService
ImpersonateLoggedOnUser

ole32

CoInitialize
CreateStreamOnHGlobal
CoCreateGuid
CLSIDFromString
StringFromGUID2
CoCreateInstance
CoInitializeEx
PropVariantClear
OleInitialize
OleUninitialize
GetHGlobalFromStream
CoAddRefServerProcess
CoReleaseServerProcess
CoUninitialize

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetFolderPathW
ord155
ord190
SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHFileOperationW
SHGetMalloc
SHChangeNotify
SHGetDesktopFolder
SHBrowseForFolderW
Shell_NotifyIconW
ord165
ShellExecuteW
SHOpenFolderAndSelectItems

oleaut32

SysFreeString
SysAllocString
SysStringLen
SystemTimeToVariantTime
VariantClear
VariantInit
LoadRegTypeLi
VarBstrCmp
LoadTypeLi
VariantTimeToSystemTime

shlwapi

PathCombineW
StrStrIA
PathAppendW
PathFindFileNameW
PathFileExistsW
PathAddBackslashW
PathIsDirectoryW
PathRemoveFileSpecW
StrFromTimeIntervalW
StrFormatKBSizeW
StrFormatByteSizeW
wnsprintfW
SHCopyKeyW
SHDeleteKeyW
SHGetValueW
SHStrDupW
PathRemoveBackslashW
PathRemoveFileSpecA
StrStrIW

iphlpapi

GetIfTable
GetIfEntry
GetAdaptersInfo

opengl32

glGetString
wglGetProcAddress
wglMakeCurrent
wglGetCurrentContext
wglDeleteContext
wglCreateContext

urlmon

URLDownloadToFileA
URLDownloadToFileW

psapi

GetProcessMemoryInfo

wtsapi32

WTSQueryUserToken

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

d3d9

Direct3DCreate9

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

gdi32

DeleteDC
DeleteObject
CreateFontIndirectW
GetObjectW
GetDeviceCaps
SetPixelFormat
ChoosePixelFormat
GetTextExtentPoint32W
SelectObject
CreateDCW
GetStockObject

netapi32

NetWkstaGetInfo
NetApiBufferFree

winhttp

WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpOpenRequest

vcruntime140

strchr
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
__RTDynamicCast
strrchr
__std_type_info_name
_set_purecall_handler
__std_type_info_compare
wcschr
wcsrchr
strstr
memchr
memset
__std_exception_destroy
__std_exception_copy
wcsstr
memcpy
__CxxFrameHandler3
_CxxThrowException
memmove
__std_terminate
_purecall

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_controlfp_s
_invalid_parameter_noinfo_noreturn
strerror
_initterm
_invalid_parameter_noinfo
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_errno
__sys_nerr
terminate
_beginthreadex
_cexit
_crt_atexit
exit
_register_onexit_function
_set_invalid_parameter_handler
_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

_recalloc
_malloc_base
malloc
_callnewh
_set_new_mode
calloc
realloc
free
_free_base

api-ms-win-crt-string-l1-1-0

wcsnlen
_strnicmp
_strdup
islower
isupper
isgraph
_wcsdup
isalpha
_wcslwr
strncat_s
strncpy_s
wmemcpy_s
isalnum
wcsncat_s
wcsncpy_s
_wcsicmp
tolower
strncmp
isspace
towlower
_wcsupr_s
isxdigit
strncpy
isdigit
strnlen
_wcslwr_s
towupper
wcscspn
wcsspn
_wcsnicmp
wcscpy_s
wcstok_s
wcscat_s
_stricmp
isprint
_wcsicoll
wcscoll
strpbrk
toupper
wcsncmp
wcsncpy
iswdigit

api-ms-win-crt-convert-l1-1-0

strtod
_i64toa_s
_wtoi
_wtol
wcstol
mbstowcs_s
_ltoa
_wtoi64
_wcstoui64
strtol
strtoull
atol
atoll
_strtoi64
atoi
_itoa
wcstoll
wcstoul
_strtoui64
_itow
strtoul
_ecvt_s
wcstod
strtoll

api-ms-win-crt-stdio-l1-1-0

_ftelli64
__acrt_iob_func
fread
fopen
fsetpos
_lseeki64
__stdio_common_vsscanf
fgetwc
fputwc
fgets
__stdio_common_vfwprintf_s
fclose
_wfopen
__stdio_common_vsprintf_s
_open
__stdio_common_vfprintf
_get_stream_buffer_pointers
__stdio_common_vfprintf_s
ftell
fseek
fflush
fgetc
fgetpos
fputc
fputs
ungetwc
__stdio_common_vswscanf
_fseeki64
fwrite
__stdio_common_vsprintf
__stdio_common_vswprintf_s
__stdio_common_vswprintf
_set_fmode
_close
_write
setvbuf
__p__commode
_read
putwchar
__stdio_common_vsnprintf_s
putchar
__stdio_common_vsnwprintf_s
ungetc
ferror

api-ms-win-crt-math-l1-1-0

_libm_sse2_pow_precise
_dtest
_finite
__setusermatherr
_CIfmod
floor
_except1
_isnan
ceil
_dsign

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv
setlocale

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand
ldiv

api-ms-win-crt-time-l1-1-0

_localtime64_s
_mktime64
strftime
_gmtime64
_time32
wcsftime
_time64

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s
_stat64
_lock_file
_unlock_file
_waccess
_fstat64

api-ms-win-crt-multibyte-l1-1-0

_mbsstr
_mbslwr_s
_mbsinc
_mbsrchr

api-ms-win-crt-environment-l1-1-0

getenv

beacon_sdk

?UninitSDK@BeaconClient@@SAXXZ
?Report@BeaconClient@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@3@W4RequestPriority@Beacon@@@Z
?set_common_params@BeaconClient@@SAXABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@Z
?set_common_param_getters@BeaconClient@@SAXABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@@std@@@2@@std@@@Z
?BeaconDeviceId@BeaconClient@@SAABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?InitSDK@BeaconClient@@SAXABUBeaconConfig@@@Z

Exports

Exports

AmdPowerXpressRequestHighPerformance
GetModuleHandle64
GetProcAddress64
NvOptimusEnablement
X64Call

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 757KB - Virtual size: 757KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 193B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 549KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tvm0
Size: 50KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 203KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0cd7918b25ee6da79e233b7e19d3fb99

Code Sign

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

37:de:eb:f5:d6:fd:7a:82:7b:69:ec:99:49:83:e5:92:ec:ec:55:98:0a:20:60:04:74:8b:e9:26:a1:0b:3a:f8Signer

4e:dd:a6:2d:32:4c:85:46:3d:49:b2:b5:d1:7f:23:89:17:98:51:a8Signer

Headers

DLL Characteristics

File Characteristics

Imports

caterpillar_sdk

minicorelib

cef_frame

gmesdk

comctl32

common

gf

xgraphic32

ws2_32

comdlg32

ximage

wininet

wldap32

zlib

libeay32

ssleay32

msvcp140

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

iphlpapi

opengl32

urlmon

psapi

wtsapi32

version

d3d9

rpcrt4

gdi32

netapi32

winhttp

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

37:de:eb:f5:d6:fd:7a:82:7b:69:ec:99:49:83:e5:92:ec:ec:55:98:0a:20:60:04:74:8b:e9:26:a1:0b:3a:f8
Signer

4e:dd:a6:2d:32:4c:85:46:3d:49:b2:b5:d1:7f:23:89:17:98:51:a8
Signer

.text
Size: 3.9MB - Virtual size: 3.9MB

.rdata
Size: 757KB - Virtual size: 757KB

.data
Size: 39KB - Virtual size: 61KB

.tls
Size: 512B - Virtual size: 193B

.gfids
Size: 512B - Virtual size: 92B

.rsrc
Size: 549KB - Virtual size: 549KB

.tvm0
Size: 50KB - Virtual size: 52KB

.reloc
Size: 203KB - Virtual size: 204KB