RBXE 90[.]rar | Triage™

Resubmissions

26/11/2023, 01:07

231126-bgmdvsdh6610

26/11/2023, 00:01

231126-aazj6sdh5w10

Sharing

Copy URL Twitter E-mail

General

Target
RBXE 90.rar
Size 9.4MB
Sample231126-bgmdvsdh66
SHA256 2c75533039b603bb821f88d1758471ef96f6bda92c4d6a44f5111ae634736334
MD5 8e526bbbb4ebee74649392cc4995cc2b
SHA1 4634af2c6a84d41ddf8ab9e0dccea8114be8abac
SHA512 832c411369f09a3de744e2050f36dca4ad72e9a5bc817a17d32afbe621efd964d84cdea1a52966d7c1d593d2dd45bbd6ec239f3ae20e137252f6c89f789a9bc0
SSDEEP 196608:eh1HHuWh08VDWbKp1N4bnVr2StZB4e0/HgDdVgq2lOEVh:ebO808VCO9WlX0PgxVgqENH
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/RBXE 90/Executor.exe

File Explorer

RBXE 90.rar

.rar 9.4MB
RBXE 90/Client.config

.exe 33.0MB
RBXE 90/Executor.exe

.exe 285KB
RBXE 90/Read before installing.txt

990B
RBXE 90/ai.cfg

44B
RBXE 90/cacert.pem

2KB
RBXE 90/config.vdf

14KB

RBXE 90.rar

SHA256 2c75533039b603bb821f88d1758471ef96f6bda92c4d6a44f5111ae634736334
MD5 8e526bbbb4ebee74649392cc4995cc2b
SHA1 4634af2c6a84d41ddf8ab9e0dccea8114be8abac
SHA512 832c411369f09a3de744e2050f36dca4ad72e9a5bc817a17d32afbe621efd964d84cdea1a52966d7c1d593d2dd45bbd6ec239f3ae20e137252f6c89f789a9bc0
SSDEEP 196608:eh1HHuWh08VDWbKp1N4bnVr2StZB4e0/HgDdVgq2lOEVh:ebO808VCO9WlX0PgxVgqENH
MD5 SHA1 SHA512 SSDEEP

Password

2023

RBXE 90/Client.config

IMPHASH 59bafed0fa1382619aa4b845f3f73552
SHA256 f9aae2ca83d60ae3a6e443d23c91672cda766f73003e4f3f0f99eec1f336d946
MD5 157bca5bfbab154797fbbe947946084f
SHA1 280096391abd2ea592198d205b6e44cdd2408121
SHA512 5fbbaa59d4425779ecae554372a476414a60b70fe190ca408a0505b13064866d1576e6409e657d2933cd5922a053aacdf7c01b457b3385476dabfe1c46b5c1da
SSDEEP 786432:BeCve2OlHAoFfgrh96BKMZvBx9ImCrWFi6:BejjlHAopI9xABx9ErWFi6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Password

2023

Digest

fa:54:07:ca:08:9a:e7:56:21:18:cf:45:36:1d:d4:67:2b:49:97:22

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Electronic Arts\, Inc.,OU=Contingency Studios,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US

Chains

Sep 23, 2020

CN=Electronic Arts\, Inc.,OU=Contingency Studios,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Electronic Arts\, Inc.,OU=Contingency Studios,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

53:22:a5:0e:e8:2e:3b:74:26:1b:03:9b:bb:27:96:f2

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 21, 2020 - Feb 21, 2021

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

22718113

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

imm32

ImmGetContext ImmDisableTextFrameService ImmGetCandidateListW ImmGetCompositionStringW ImmAssociateContext ImmSetCompositionWindow ImmReleaseContext ImmGetVirtualKey

winmm

mmioGetInfo timeGetDevCaps mmioSetInfo mmioAdvance mmioDescend mmioRead mmioWrite mmioAscend mmioCreateChunk mmioSeek mmioClose mmioOpenA timeGetTime timeBeginPeriod PlaySoundA timeEndPeriod

ws2_32

sendto gethostbyname WSAGetLastError accept closesocket ioctlsocket getsockname htonl listen ntohs select ntohl WSAAccept WSACloseEvent WSACreateEvent WSAGetOverlappedResult WSARecv WSAResetEvent WSASend WSASetEvent WSAWaitForMultipleEvents inet_ntoa getaddrinfo freeaddrinfo getsockopt gethostbyaddr gethostname WSAIoctl WSARecvFrom WSASocketA inet_pton getpeername getservbyname WSAEventSelect WSACleanup connect WSAStartup inet_addr recvfrom socket htons shutdown setsockopt send bind __WSAFDIsSet recv

tbbg

?internal_size@concurrent_queue_base_v3@internal@tbb@@IBEHXZ ?internal_empty@concurrent_queue_base_v3@internal@tbb@@IBE_NXZ ?internal_set_capacity@concurrent_queue_base_v3@internal@tbb@@IAEXHI@Z ?internal_finish_clear@concurrent_queue_base_v3@internal@tbb@@IAEXXZ ?allocate@allocate_additional_child_of_proxy@internal@tbb@@QBEAAVtask@3@I@Z ?terminate@task_scheduler_init@tbb@@QAEXXZ ?allocate@allocate_root_with_context_proxy@internal@tbb@@QBEAAVtask@3@I@Z ??1task_group_context@tbb@@QAE@XZ ?reset@task_group_context@tbb@@QAEXXZ ?cancel_group_execution@task_group_context@tbb@@QAE_NXZ ?internal_pop_if_present@concurrent_queue_base_v3@internal@tbb@@IAE_NPAX@Z __TBB_machine_cmpswp8 __TBB_machine_fetchadd8 __TBB_machine_store8 __TBB_machine_load8 ?internal_acquire_writer@spin_rw_mutex_v3@tbb@@AAE_NXZ ?internal_acquire_reader@spin_rw_mutex_v3@tbb@@AAEXXZ ?internal_upgrade@spin_rw_mutex_v3@tbb@@AAE_NXZ ?NFS_Allocate@internal@tbb@@YAPAXIIPAX@Z ?set_fallback_allocator@internal@tbb@@YAXPAX0@Z ?NFS_Free@internal@tbb@@YAXPAX@Z ?throw_exception_v4@internal@tbb@@YAXW4exception_id@12@@Z ?internal_push_if_not_full@concurrent_queue_base_v3@internal@tbb@@IAE_NPBX@Z ?internal_pop@concurrent_queue_base_v3@internal@tbb@@IAEXPAX@Z ??1concurrent_queue_base_v3@internal@tbb@@MAE@XZ ??0concurrent_queue_base_v3@internal@tbb@@IAE@I@Z ?allocate@allocate_root_proxy@internal@tbb@@SAAAVtask@3@I@Z ?allocate@allocate_continuation_proxy@internal@tbb@@QBEAAVtask@3@I@Z ?allocate@allocate_child_proxy@internal@tbb@@QBEAAVtask@3@I@Z ?is_group_execution_cancelled@task_group_context@tbb@@QBE_NXZ ?note_affinity@task@tbb@@UAEXG@Z ?get_initial_auto_partitioner_divisor@internal@tbb@@YAIXZ ?acquire@scoped_lock@queuing_rw_mutex@tbb@@QAEXAAV23@_N@Z ?release@scoped_lock@queuing_rw_mutex@tbb@@QAEXXZ ?init@task_group_context@tbb@@IAEXXZ ?default_num_threads@task_scheduler_init@tbb@@SAHXZ ?initialize@task_scheduler_init@tbb@@QAEXHI@Z ?destroy@task_base@internal@interface5@tbb@@SAXAAVtask@4@@Z ?initialize@task_scheduler_init@tbb@@QAEXH@Z ?internal_clear@concurrent_vector_base_v3@internal@tbb@@IAEIP6AXPAXI@Z@Z ?internal_push_back@concurrent_vector_base_v3@internal@tbb@@IAEPAXIAAI@Z ?internal_capacity@concurrent_vector_base_v3@internal@tbb@@IBEIXZ ?resize@affinity_partitioner_base_v3@internal@tbb@@AAEXI@Z ??1concurrent_vector_base_v3@internal@tbb@@IAE@XZ

kernel32

VirtualQuery VirtualProtect GetSystemInfo GetTimeZoneInformation TerminateProcess GetCurrentProcess K32GetModuleBaseNameW K32EnumProcesses lstrcmpiW LoadLibraryW GetModuleHandleW OpenProcess CreateProcessW CloseHandle SetEnvironmentVariableW GetTickCount GetComputerNameA MoveFileExA GetTempPathA LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary GetCurrentThreadId Sleep GetLastError RaiseException DecodePointer GetFileAttributesA DeleteFileA CreateDirectoryA SetCurrentDirectoryA ExpandEnvironmentStringsA DeleteCriticalSection TryEnterCriticalSection InitializeCriticalSectionEx InitializeCriticalSectionAndSpinCount SystemTimeToFileTime DebugBreak GetStartupInfoW IsProcessorFeaturePresent UnhandledExceptionFilter InitializeSListHead CreateEventW WaitForSingleObjectEx OpenFileMappingA lstrcpynA lstrlenA CreateThread GetFileInformationByHandleEx CreateFileW GetPrivateProfileStringA FindResourceA SizeofResource LockResource LoadResource lstrcatA lstrcpyA LoadLibraryExW SetErrorMode GetThreadLocale GetLocaleInfoA FileTimeToSystemTime ExpandEnvironmentStringsW UnlockFileEx UnlockFile LockFileEx LockFile CreateNamedPipeA CreatePipe GetDriveTypeW GetCurrentDirectoryW SetCurrentDirectoryW GetOverlappedResult PeekNamedPipe OutputDebugStringW FormatMessageW GetModuleFileNameW TlsFree GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleInformation GetHandleInformation InitializeCriticalSection DuplicateHandle SetFilePointer SetStdHandle GetStdHandle RemoveDirectoryW RemoveDirectoryA FindNextFileW CreateDirectoryW SetFileAttributesW GetFileType GetFileAttributesW GetDriveTypeA FindFirstFileW SystemTimeToTzSpecificLocalTime SetLastError K32GetProcessImageFileNameA K32GetModuleInformation K32GetModuleFileNameExA GetTimeFormatW GetTimeFormatA GetDateFormatW GetDateFormatA IsBadCodePtr IsBadReadPtr QueryDosDeviceA GetLogicalDriveStringsA GlobalFree ReadProcessMemory GlobalAlloc GetThreadContext ExitProcess DebugActiveProcessStop DebugActiveProcess WaitForDebugEvent ContinueDebugEvent GetFullPathNameW GetFullPathNameA RtlCaptureContext ReadDirectoryChangesW GetLocalTime CreateProcessA OutputDebugStringA GetModuleHandleExA GetExitCodeProcess Thread32Next Thread32First GetUserDefaultLangID GetNumberFormatA CopyFileA SuspendThread OpenThread SetUnhandledExceptionFilter GetFileSizeEx CompareFileTime PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort K32GetModuleBaseNameA K32EnumProcessModules MultiByteToWideChar FileTimeToDosDateTime GetThreadTimes GetExitCodeThread TerminateThread GetCurrentThread HeapDestroy HeapCreate Module32Next FileTimeToLocalFileTime WideCharToMultiByte GlobalUnlock GlobalLock SwitchToThread GetProcessHeap HeapFree HeapReAlloc HeapAlloc GetModuleFileNameA SetThreadAffinityMask Module32First TlsGetValue GetVersionExA FlushInstructionCache VirtualFree VirtualAlloc LeaveCriticalSection TlsAlloc GetModuleHandleExW Process32Next Process32First CreateToolhelp32Snapshot MoveFileA GetTempFileNameA CreateFileMappingA CreateSemaphoreA FormatMessageA WaitForMultipleObjects LocalFree UnmapViewOfFile MapViewOfFile GetLogicalProcessorInformation GetSystemTimeAsFileTime GetSystemTime TlsSetValue SetThreadPriority GetCurrentProcessId GetProcessTimes CreateEventA CreateMutexA WaitForSingleObject ReleaseMutex ReleaseSemaphore ResetEvent SetEvent HeapSetInformation HeapWalk HeapUnlock HeapLock QueryPerformanceFrequency QueryPerformanceCounter IsDebuggerPresent WriteFile SetFileTime SetFilePointerEx SetFileAttributesA SetEndOfFile ReadFile GetFileTime GetFileSize GetFileInformationByHandle FindNextFileA FindFirstFileA FindClose CreateFileA GetCurrentDirectoryA SetEnvironmentVariableA GetEnvironmentVariableA EnterCriticalSection DeleteFileW FlushFileBuffers GetDiskFreeSpaceA GetDiskFreeSpaceW GetTempPathW GetVersionExW AreFileApisANSI LoadLibraryExA GetACP

user32

DefWindowProcW GetIconInfo GetDoubleClickTime DrawTextW SendMessageTimeoutA EnumWindows GetClassNameA GetWindowThreadProcessId GetKeyboardLayout GetKeyState GetKeyboardState ToAsciiEx MapVirtualKeyExA CreateDialogParamA EndDialog GetDlgItem GetProcessWindowStation GetUserObjectInformationW GetWindowLongA PostMessageA DialogBoxIndirectParamA GetMessageA DefWindowProcA RegisterClassExA CreateWindowExA DestroyWindow SetLayeredWindowAttributes MoveWindow GetDC ReleaseDC ShowScrollBar GetCursorPos GetClientRect FlashWindowEx PtInRect GetMonitorInfoA EnumDisplayMonitors GetActiveWindow GetCapture SetCursorPos SetCursor GetDesktopWindow ClientToScreen SetMenu LoadCursorA GetForegroundWindow wsprintfA GetCursor FillRect OpenClipboard CloseClipboard GetMenu SystemParametersInfoA GetClipboardData LoadBitmapA SetClipboardData EmptyClipboard TranslateMessage SetFocus EndDeferWindowPos DispatchMessageA PeekMessageA SendMessageA GetClassLongA PostQuitMessage DeferWindowPos BeginDeferWindowPos UnregisterClassA SetRect RegisterClassExW LoadImageA CreateIconIndirect CreateWindowExW ShowWindow SetWindowPos EnumDisplaySettingsA GetWindowPlacement IsIconic BringWindowToTop SetCapture ReleaseCapture TranslateAcceleratorA GetSystemMetrics UpdateWindow SwitchToThisWindow SetForegroundWindow BeginPaint GetClassInfoA GetCursorInfo GetAncestor EndPaint GetWindowRect AdjustWindowRect MessageBoxA ShowCursor ClipCursor ScreenToClient OffsetRect SetWindowLongA FindWindowW SetWindowsHookExA UnhookWindowsHookEx CallNextHookEx RegisterClassA LoadIconA SetProcessDPIAware

gdi32

GetTextMetricsA ExtTextOutW GetTextFaceA GetTextExtentPoint32W GetDeviceCaps DeleteDC CreateDCA GetStockObject GdiFlush GetTextMetricsW SetTextColor SetBkMode SetBkColor CreateFontA GetDIBits CreateSolidBrush CreateBitmap GetCurrentObject AddFontMemResourceEx CreateDIBSection SelectObject CreateCompatibleDC BitBlt EnumFontFamiliesExA GetObjectA DeleteObject

advapi32

CloseServiceHandle ControlService CreateServiceA DeleteService OpenSCManagerA OpenServiceA QueryServiceStatusEx RegisterServiceCtrlHandlerExA ReportEventA RegisterEventSourceA CryptGenRandom CryptReleaseContext CryptAcquireContextA LookupAccountNameA LookupAccountSidA IsValidSid GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority EqualSid RegSetValueExW RegCreateKeyExW ReportEventW SetServiceStatus CreateProcessAsUserW DuplicateTokenEx ImpersonateLoggedOnUser InitializeSecurityDescriptor RevertToSelf SetSecurityDescriptorDacl LogonUserW OpenProcessToken CopySid GetLengthSid GetTokenInformation DeregisterEventSource RegisterEventSourceW ChangeServiceConfig2A RegSetValueExA RegQueryValueExA RegOpenKeyExA StartServiceCtrlDispatcherA RegEnumValueA RegDeleteValueA RegCreateKeyExA RegCloseKey AllocateAndInitializeSid FreeSid GetUserNameA RegOpenKeyExW RegQueryValueExW

shell32

SHCreateDirectoryExA SHFileOperationA SHGetFolderPathA ShellExecuteA

ole32

CoCreateGuid CoInitialize CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket PropVariantClear OleInitialize OleUninitialize OleCreate OleSetContainedObject CoTaskMemAlloc

oleaut32

VariantChangeType SetErrorInfo CreateErrorInfo VariantInit SysAllocString SysFreeString VariantClear GetErrorInfo

shlwapi

SHStrDupW PathAppendA PathCanonicalizeA PathFileExistsA SHGetValueA

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpWriteData WinHttpSetOption WinHttpReadData WinHttpSetTimeouts WinHttpOpen WinHttpCrackUrl WinHttpQueryHeaders WinHttpConnect

libcurl

curl_easy_cleanup curl_easy_escape curl_easy_init curl_easy_perform curl_easy_setopt curl_easy_strerror curl_free curl_global_init_mem curl_slist_append curl_slist_free_all

powrprof

CallNtPowerInformation

mswsock

TransmitFile

bink2w32

_BinkOpenWithOptions@12 _BinkGetKeyFrame@12 _BinkSetVolume@12 _BinkShouldSkip@4 _BinkControlBackgroundIO@8 _BinkGetTrackID@8 _BinkGetSummary@8 _BinkGetRealtime@12 _BinkGetError@0 _BinkSetSoundTrack@8 _BinkDoFrame@4 _BinkNextFrame@4 _BinkWait@4 _BinkAllocateFrameBuffers@12 _BinkUtilFree@4 _BinkUtilMalloc@8 _BinkRegisterFrameBuffers@8 _BinkGetFrameBuffersInfo@8 _BinkClose@4 _BinkPause@8 _BinkOpenXAudio2@8 _BinkSetSoundSystem2@12 _BinkGoto@12

d3dcompiler_43

D3DGetInputSignatureBlob D3DReflect D3DCompile D3DCreateBlob

d3d11

D3D11CreateDevice

d3dx11_43

D3DX11SaveTextureToFileA D3DX11CreateShaderResourceViewFromMemory D3DX11LoadTextureFromTexture D3DX11CreateTextureFromFileA D3DX11GetImageInfoFromMemory D3DX11GetImageInfoFromFileA D3DX11FilterTexture D3DX11SaveTextureToMemory D3DX11CompileFromMemory

d3dx9_43

D3DXQuaternionRotationAxis D3DXFilterTexture D3DXSaveTextureToFileInMemory D3DXCreateEffect D3DXCreateEffectCompilerFromFileA D3DXSaveSurfaceToFileA D3DXSaveSurfaceToFileInMemory D3DXMatrixLookAtLH D3DXCreateSprite D3DXMatrixInverse D3DXMatrixOrthoOffCenterRH D3DXCreateFontA D3DXCreateEffectPool D3DXVec4Normalize D3DXVec4Transform D3DXMatrixTranspose D3DXGetImageInfoFromFileA D3DXGetImageInfoFromFileInMemory D3DXLoadSurfaceFromSurface D3DXCreateTexture D3DXCreateCubeTextureFromFileInMemory D3DXMatrixPerspectiveFovRH D3DXMatrixMultiply D3DXCreateTextureFromFileInMemoryEx D3DXSaveTextureToFileA

d3d9

Direct3DCreate9

avifil32

AVISaveOptions AVIMakeCompressedStream AVISaveOptionsFree AVIFileCreateStreamA AVIStreamWrite AVIStreamSetFormat AVIStreamRelease AVIFileExit AVIFileOpenA AVIFileRelease AVIFileInit

odbc32

ord16 ord12 ord13 ord29 ord32 ord24 ord9 ord31 ord75 ord111 ord141 ord236 ord35 ord4 ord36 ord45 ord19 ord20 ord39 ord76 ord41 ord61 ord72 ord11

mss32

_AIL_set_sample_loop_count@8 _AIL_set_sample_playback_rate@8 _AIL_end_sample@4 _AIL_start_sample@4 _AIL_set_sample_address@12 _AIL_init_sample@8 _AIL_release_sample_handle@4 _AIL_allocate_sample_handle@4 _AIL_close_digital_driver@4 _AIL_open_digital_driver@16 _AIL_set_sample_position@8

msvcp140

?eof@ios_base@std@@QBE_NXZ ?fail@ios_base@std@@QBE_NXZ ?bad@ios_base@std@@QBE_NXZ ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_K@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?setbase@std@@YA?AU?$_Smanip@H@1@H@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?id@?$ctype@D@std@@2V0locale@2@A ??_7ios_base@std@@6B@ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ ?widen@?$ctype@_W@std@@QBE_WD@Z ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z ?_Xbad_function_call@std@@YAXXZ ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?id@?$ctype@_W@std@@2V0locale@2@A ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z ??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAM@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _Thrd_start _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_join _Thrd_sleep _Thrd_id _Mtx_init _Mtx_destroy _Mtx_init_in_situ _Mtx_destroy_in_situ _Mtx_current_owns _Mtx_lock _Mtx_trylock _Mtx_unlock _Cnd_init _Cnd_destroy _Cnd_init_in_situ _Cnd_destroy_in_situ _Cnd_wait _Cnd_timedwait _Cnd_signal _Cnd_do_broadcast_at_thread_exit ?_Throw_C_error@std@@YAXH@Z ?_Throw_Cpp_error@std@@YAXH@Z _Thrd_yield ?_BADOFF@std@@3_JB ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z ?_Xinvalid_argument@std@@YAXPBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z ?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ ??_7_Facet_base@std@@6B@ ??_7facet@locale@std@@6B@ ??_7codecvt_base@std@@6B@ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAF@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z ?_Syserror_map@std@@YAPBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Winerror_message@std@@YAKKPADK@Z _Open_dir _Read_dir _Close_dir _Stat _To_wide ?_Xruntime_error@std@@YAXPBD@Z ??0_Locinfo@std@@QAE@HPBD@Z ??1_Locinfo@std@@QAE@XZ ?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z ?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z ?toupper@?$ctype@_W@std@@QBE_W_W@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z _Strcoll _Strxfrm ??0_Locinfo@std@@QAE@PBD@Z ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ??0facet@locale@std@@IAE@I@Z ?tolower@?$ctype@D@std@@QBEDD@Z ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Getdays@_Locinfo@std@@QBEPBDXZ ?_Getmonths@_Locinfo@std@@QBEPBDXZ ?good@ios_base@std@@QBE_NXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBE_JXZ ?width@ios_base@std@@QAE_J_J@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ??Bid@locale@std@@QAEIXZ ??Bios_base@std@@QBE_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z _Mbrtowc ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_W_Getdays@_Locinfo@std@@QBEPBGXZ ?_W_Getmonths@_Locinfo@std@@QBEPBGXZ ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?is@?$ctype@D@std@@QBE_NFD@Z ?uncaught_exception@std@@YA_NXZ ?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z

iphlpapi

GetAdaptersAddresses

urlmon

CreateURLMoniker

vcruntime140

__std_terminate __std_type_info_compare __std_exception_copy strstr memset strrchr wcsstr __RTDynamicCast memmove memcpy __CxxFrameHandler3 _CxxThrowException _purecall __std_exception_destroy strchr memchr _except_handler4_common __std_type_info_destroy_list wcschr __std_type_info_name

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _execute_onexit_table _crt_atexit _crt_at_quick_exit _cexit _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initterm _initterm_e _exit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _endthreadex __doserrno strerror exit _getpid _controlfp_s signal _set_invalid_parameter_handler perror _sleep abort raise _beginthreadex _errno system _invalid_parameter_noinfo terminate _set_new_handler _initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

_aligned_free malloc free _aligned_malloc _set_new_mode _expand _msize _recalloc realloc calloc

api-ms-win-crt-stdio-l1-1-0

fclose __acrt_iob_func fgets freopen __stdio_common_vsprintf_s fopen __p__fmode __stdio_common_vfprintf _get_stream_buffer_pointers fflush fgetc fgetpos __stdio_common_vsprintf fread fsetpos _fseeki64 fwrite setvbuf ungetc _set_fmode putchar __stdio_common_vswprintf_s __stdio_common_vsscanf __p__commode _write fputc __stdio_common_vsprintf_p __stdio_common_vfprintf_p __stdio_common_vsnprintf_s fputs getc __stdio_common_vswprintf_p _wfopen __stdio_common_vsnwprintf_s __stdio_common_vswprintf __stdio_common_vfwscanf _setmode _open_osfhandle feof __stdio_common_vfprintf_s _get_osfhandle _fileno _dup2 _commit fputws __stdio_common_vfwprintf fgetwc fputwc ungetwc __stdio_common_vswscanf __stdio_common_vfscanf __stdio_common_vfwprintf_p _close __stdio_common_vfwprintf_s ftell fopen_s ferror fseek

api-ms-win-crt-string-l1-1-0

isalpha isalnum _strlwr wcsncmp iswctype _wcsicmp islower isupper _strupr strtok wcscpy_s isdigit toupper isprint isspace strspn towlower strncmp _strlwr_s strpbrk strcpy_s isxdigit wcscat_s strncat iswgraph wctype strcspn towupper iswalpha isgraph strcat_s strcmp strncpy_s strtok_s strlen _stricmp iswalnum _strnicmp strncat_s strncpy tolower _strupr_s

api-ms-win-crt-utility-l1-1-0

rand bsearch ldiv srand qsort

api-ms-win-crt-convert-l1-1-0

atof _wtoi wcstombs_s _strtoui64 _ultoa_s _i64toa _strtoi64 atol _itoa_s _itoa wcstoul strtoll wcstol strtoul strtol _wtof atoi strtod _wtoi64 _atoi64

api-ms-win-crt-math-l1-1-0

_libm_sse2_log_precise frexp ldexp _hypotf _CIcosh _CIfmod _CIpow tanh sinh cosh _CIsinh _CIacos floor modf _except1 _CItanh _CIasin _fdtest ceil __setusermatherr _libm_sse2_pow_precise

api-ms-win-crt-filesystem-l1-1-0

_lock_file _splitpath _makepath _unlink _chmod _unlock_file _splitpath_s _makepath_s _wsplitpath_s rename _stat64i32

api-ms-win-crt-time-l1-1-0

clock _localtime64_s _time64 _localtime64 strftime

api-ms-win-crt-environment-l1-1-0

__p__wenviron __p__environ getenv

api-ms-win-crt-locale-l1-1-0

setlocale _configthreadlocale

api-ms-win-crt-conio-l1-1-0

_getche

wininet

InternetGetConnectedState

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

psapi

EnumProcessModules GetModuleInformation

??0MallocExtension@@QAE@ABV0@@Z ??0MallocExtension@@QAE@XZ ??0PageHeap@tcmalloc@@QAE@$$QAV01@@Z ??0PageHeap@tcmalloc@@QAE@ABV01@@Z ??0StackTraceTable@tcmalloc@@QAE@XZ ??0SysAllocator@@QAE@ABV0@@Z ??0SysAllocator@@QAE@XZ ??1StackTraceTable@tcmalloc@@QAE@XZ ??4MallocExtension@@QAEAAV0@ABV0@@Z ??4PageHeap@tcmalloc@@QAEAAV01@$$QAV01@@Z ??4PageHeap@tcmalloc@@QAEAAV01@ABV01@@Z ??4StackTraceTable@tcmalloc@@QAEAAV01@ABV01@@Z ??4SysAllocator@@QAEAAV0@ABV0@@Z ??_7MallocExtension@@6B@ ??_7SysAllocator@@6B@ ?AddTrace@StackTraceTable@tcmalloc@@QAEXABUStackTrace@2@@Z ?CacheSizeClass@PageHeap@tcmalloc@@QBEXII@Z ?GetAggressiveDecommit@PageHeap@tcmalloc@@QAE_NXZ ?GetDescriptor@PageHeap@tcmalloc@@QBEPAUSpan@2@I@Z ?GetSizeClassIfCached@PageHeap@tcmalloc@@QBEII@Z ?GetStackFrames@@YAHPAPAXPAHHH@Z ?GetStackFramesWithContext@@YAHPAPAXPAHHHPBX@Z ?GetStackTrace@@YAHPAPAXHH@Z ?GetStackTraceWithContext@@YAHPAPAXHHPBX@Z ?ReadStackTracesAndClear@StackTraceTable@tcmalloc@@QAEPAPAXXZ ?RecordSpan@PageHeap@tcmalloc@@AAEXPAUSpan@2@@Z ?SetAggressiveDecommit@PageHeap@tcmalloc@@QAEX_N@Z ?bucket_total@StackTraceTable@tcmalloc@@QBEHXZ ?depth_total@StackTraceTable@tcmalloc@@QBEHXZ ?kDefaultReleaseDelay@PageHeap@tcmalloc@@0HB ?kHashTableSize@StackTraceTable@tcmalloc@@0HB ?kMaxReleaseDelay@PageHeap@tcmalloc@@0HB ?kMinSystemAlloc@PageHeap@tcmalloc@@0HB ?kPageMapBigAllocationThreshold@PageHeap@tcmalloc@@0IB ?stats@PageHeap@tcmalloc@@QBE?AUStats@12@XZ FW1CreateFactory GetDenuvoTicketLocation GetDenuvoTimeTicketRequest _FW1CreateFactory@8 __swprintf_l __vswprintf_l _fprintf_l _fprintf_p _fprintf_p_l _fprintf_s_l _fscanf_l _fscanf_s_l _fwprintf_l _fwprintf_p _fwprintf_p_l _fwprintf_s_l _fwscanf_l _fwscanf_s_l _printf_l _printf_p _printf_p_l _printf_s_l _scanf_l _scanf_s_l _scprintf _scprintf_l _scprintf_p _scprintf_p_l _scwprintf _scwprintf_l _scwprintf_p _scwprintf_p_l _snprintf _snprintf_c _snprintf_c_l _snprintf_l _snprintf_s _snprintf_s_l _snscanf _snscanf_l _snscanf_s _snscanf_s_l _snwprintf _snwprintf_l _snwprintf_s _snwprintf_s_l _snwscanf _snwscanf_l _snwscanf_s _snwscanf_s_l _sprintf_l _sprintf_p _sprintf_p_l _sprintf_s_l _sscanf_l _sscanf_s_l _swprintf _swprintf_c _swprintf_c_l _swprintf_l _swprintf_p _swprintf_p_l _swprintf_s_l _swscanf_l _swscanf_s_l _vfprintf_l _vfprintf_p _vfprintf_p_l _vfprintf_s_l _vfscanf_l _vfscanf_s_l _vfwprintf_l _vfwprintf_p _vfwprintf_p_l _vfwprintf_s_l _vfwscanf_l _vfwscanf_s_l _vprintf_l _vprintf_p _vprintf_p_l _vprintf_s_l _vscanf_l _vscanf_s_l _vscprintf _vscprintf_l _vscprintf_p _vscprintf_p_l _vscwprintf _vscwprintf_l _vscwprintf_p _vscwprintf_p_l _vsnprintf _vsnprintf_c _vsnprintf_c_l _vsnprintf_l _vsnprintf_s _vsnprintf_s_l _vsnwprintf _vsnwprintf_l _vsnwprintf_s _vsnwprintf_s_l _vsnwscanf_l _vsnwscanf_s_l _vsprintf_l _vsprintf_p _vsprintf_p_l _vsprintf_s_l _vsscanf_l _vsscanf_s_l _vswprintf _vswprintf_c _vswprintf_c_l _vswprintf_l _vswprintf_p _vswprintf_p_l _vswprintf_s_l _vswscanf_l _vswscanf_s_l _vwprintf_l _vwprintf_p _vwprintf_p_l _vwprintf_s_l _vwscanf_l _vwscanf_s_l _wprintf_l _wprintf_p _wprintf_p_l _wprintf_s_l _wscanf_l _wscanf_s_l fprintf fprintf_s fscanf fscanf_s fwprintf fwprintf_s fwscanf fwscanf_s printf printf_s scanf scanf_s snprintf sprintf sprintf_s sscanf sscanf_s swprintf swprintf_s swscanf swscanf_s vfprintf vfprintf_s vfscanf vfscanf_s vfwprintf vfwprintf_s vfwscanf vfwscanf_s vprintf vprintf_s vscanf vscanf_s vsnprintf vsnprintf_s vsprintf vsprintf_s vsscanf vsscanf_s vswprintf vswprintf_s vswscanf vswscanf_s vwprintf vwprintf_s vwscanf vwscanf_s wprintf wprintf_s wscanf wscanf_s

generic

count=4, id=199, version=41118,

count=11, id=260, version=26706,

count=23, id=259, version=26706,

count=4, id=257, version=26706,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=28, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=8, id=156, version=21202,

count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=43, id=260, version=27035,

count=1, id=209, version=65501,

count=1, id=207, version=65501,

count=12, id=206, version=65501,

count=42, id=261, version=26706,

count=13, productName=Unmarked objects (old),

count=2, id=257, productName=VS2017 v15.9.7 build 27027, version=27027,

count=265, id=261, productName=VS2017 v15.9.7 build 27027, version=27027,

count=136, id=260, productName=VS2017 v15.9.7 build 27027, version=27027,

count=2, id=208, version=65501,

count=43, id=203, version=65501,

count=1180, id=1, productName=Unmarked objects,

count=1, id=171, productName=VS2010 build 30319, version=30319,

count=35, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=122, id=261, version=27035,

count=1, id=256, version=27035,

count=1, id=255, version=27035,

count=1, id=151,

count=1, id=258, version=27035,

RBXE 90/Executor.exe

SHA256 17560f793815dfac72f1424da56aad30a14720d70e0e0f7a9b40372585a02a6f
MD5 623f9b5679a69542dc0ed25a1fa13e3d
SHA1 db89df2ac88f39ce1d982afe697586d0ce78fd39
SHA512 ededba4b10f2dad0802ddcccd2274f561d27d538b1011b5d0e1b14159f12ac77e0224290a9e7316075384338ee95324f0185b30c1419081c67f4a315bcdb952a
SSDEEP 3072:kvwpa6FMAyaF2L2onHnnKjcORbekvyN3+o13kjAB6R90wpsTLF6dx4px:2dL2oHnKjVekvZjAB6R9PU6+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

2023

Minor OS version

Major OS version

Entry point

6306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

RBXE 90.rar

RBXE 90/Client.config

imm32

winmm

ws2_32

tbbg

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

winhttp

libcurl

powrprof

mswsock

bink2w32

d3dcompiler_43

d3d11

d3dx11_43

d3dx9_43

d3d9

avifil32

odbc32

mss32

msvcp140

iphlpapi

urlmon

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-conio-l1-1-0

wininet

version

psapi

generic

RBXE 90/Executor.exe

generic

RBXE 90/Read before installing.txt

RBXE 90/ai.cfg

RBXE 90/cacert.pem

RBXE 90/config.vdf