AppMarket[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AppMarket.exe
Size

5.7MB
MD5

fd4db8a6ccd1343399d68b98d4dbde67
SHA1

bd1f1340df19b234dec37c6102b777d452f5ff93
SHA256

6697931a58e42aaca409abc3e44f69bc6b7accd866e1c5e3e0e4d1330cbb2aa3
SHA512

df3a2c0336825cb7057ebc84e560a75204d35eebf7877e9ad1db3cf29a3159132e67893fe2f423e2f82b4c2f55d36537236d41accae63577435d17fa44a85236
SSDEEP

98304:Dm3eiwQ7ZD+PUcDV9Fd4uCBiybiklzakDTbgW0OT3TRlecG3c:OW8ZQ9FeuCBi6lVXbXTR4hc

Score

1^/10

Malware Config

Signatures

Files

AppMarket.exe
.exe windows:6 windows x86 arch:x86

9739a3cd9515456f371098fafba6348d

Code Sign

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/11/2020, 00:00

Not After

22/02/2024, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:a3:3f:e6:39:8f:c4:bb:72:92:f7:2c:3d:45:4e:9c:a1:67:a2:8e:e7:c7:ae:e9:63:15:5d:6f:06:30:76:eb
Signer

Actual PE Digest

32:a3:3f:e6:39:8f:c4:bb:72:92:f7:2c:3d:45:4e:9c:a1:67:a2:8e:e7:c7:ae:e9:63:15:5d:6f:06:30:76:eb

Digest Algorithm

sha256

PE Digest Matches

true

93:24:11:27:04:c4:12:60:ba:88:e0:9d:47:0c:3d:e3:ee:71:19:06
Signer

Actual PE Digest

93:24:11:27:04:c4:12:60:ba:88:e0:9d:47:0c:3d:e3:ee:71:19:06

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\WorkPlace\AndroidEmulator\7KMarket_Git_Branch_Packet\Basic\Client\Output\Binfinal\AppMarket\AppMarket.pdb

Imports

caterpillar_sdk

?OnTaskFail@ChainedTask@@MAEXXZ
?OnTaskStop@ChainedTask@@MAEXXZ
?OnTaskSuccess@ChainedTask@@MAEXXZ
?shared_from_this@?$enable_shared_from_this@VChainedTask@@@std@@QAE?AV?$shared_ptr@VChainedTask@@@2@XZ
?TaskExternalLog@ChainedTask@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HH0@Z
?WaitForDone@ChainedTask@@QAEXV?$duration@_JU?$ratio@$00$0DOI@@std@@@chrono@std@@@Z
?last_error_message@ChainedTask@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?OnActionSuccess@ChainedTask@@MAEXXZ
?action_duration@ChainedTask@@QBE?AV?$duration@_JU?$ratio@$00$0PECEA@@std@@@chrono@std@@XZ
?InitSDK@CaterpillarClient@@SAXXZ
?Connect@ChainedTask@@UAEX$$QBUAction@@@Z
?Start@ChainedTask@@QAEXXZ
?CurrentActionName@ChainedTask@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?set_queue@ChainedTask@@QAEX_N@Z
?set_value@TaskData@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?StopTask@CaterpillarClient@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Stop@ChainedTask@@UAEX_N@Z
?OnActionStop@ChainedTask@@MAEXXZ
?data@ChainedTask@@QBE?AV?$shared_ptr@VTaskData@@@std@@XZ
?NotifyDone@ChainedTask@@QAEXXZ
?TaskDone@ChainedTask@@MAEXXZ
?set_last_error_message@ChainedTask@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1ChainedTask@@UAE@XZ
??0ChainedTask@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@2@0V?$function@$$A6AXV?$shared_ptr@VChainedTask@@@std@@W4TaskState@@@Z@2@@Z
??1Action@@QAE@XZ
?value@TaskData@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV23@@Z
??0Action@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A_NV?$shared_ptr@VChainedTask@@@std@@@Z@2@V?$function@$$A6AXV?$shared_ptr@VChainedTask@@@std@@W4ActionResult@@@Z@2@@Z
?UninitSDK@CaterpillarClient@@SAXXZ
?OnActionFail@ChainedTask@@MAEXXZ

minicorelib

?instance@AppBase@minilib@@SAPAV12@XZ
?run@AppBase@minilib@@QAEXXZ
?quit@AppBase@minilib@@QAEXXZ
?runLoop@AppBase@minilib@@MAEXXZ
??0Path@minilib@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?setSize@File@minilib@@QAE_N_J@Z
?seek@File@minilib@@QAE_N_J@Z
?getDPIScale@DPI@Windows@@QBEMXZ
?size@File@minilib@@QBE_JXZ
??1AppBase@minilib@@UAE@XZ
??0AppBase@minilib@@QAE@XZ
?scaleY@DPI@Windows@@QBEHH@Z
?isActive@Timer@minilib@@QBE_NXZ
?fileName@Path@minilib@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?extension@Path@minilib@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?threadId@AppUI@@YA?AVid@thread@std@@XZ
??1IWindowMessageFilter@minilib@@UAE@XZ
??0IWindowMessageFilter@minilib@@QAE@XZ
?handle@Window@minilib@@QBEPAUHWND__@@XZ
?hide@Window@minilib@@QAEXXZ
?forceClose@Window@minilib@@QAEXXZ
??0TObject@minilib@@QAE@PAV01@@Z
??1TObject@minilib@@UAE@XZ
?addObj@WeakGuard@minilib@@SAXPAPAVTObject@2@@Z
?removeObj@WeakGuard@minilib@@SAXPAPAVTObject@2@@Z
?interval@Timer@minilib@@QBEHXZ
?stop@WorkerPool@minilib@@QAEXXZ
?async@WorkerPool@minilib@@SAX$$QAV?$Callback@$$A6AXXZ@2@@Z
??0File@minilib@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??1File@minilib@@QAE@XZ
?open@File@minilib@@QAE_NW4OpenMode@12@@Z
?write@File@minilib@@QAEHPBEH@Z
?readAll@File@minilib@@QAE?AVBuffer@2@XZ
?exists@File@minilib@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?applicationDirPath@Utils@minilib@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?toUtf8@Utils@minilib@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?instance@DPI@Windows@@SAPAV12@XZ
?scaleX@DPI@Windows@@QBEHH@Z
?fromUtf8@Utils@minilib@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?toUtf8@Utils@minilib@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_WH@Z
?appDataPath@Utils@minilib@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
??0Timer@minilib@@QAE@XZ
??1Timer@minilib@@QAE@XZ
?start@Timer@minilib@@QAEXH@Z
?stop@Timer@minilib@@QAEXXZ
?timeOutEvent@Timer@minilib@@QAEAAV?$Event@$$A6AXPAVTimer@minilib@@@ZVmutex@std@@@2@XZ
?writeLine@File@minilib@@QAEHABVBuffer@2@@Z
?remove@File@minilib@@SA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
??0Path@minilib@@QAE@XZ
?fullPath@Path@minilib@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?absoluteDir@Path@minilib@@QBE?AV12@XZ
??1Path@minilib@@QAE@XZ
?toLower@Ascii@@SAHH@Z
?fromUtf8@Utils@minilib@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PBDH@Z
?makeSureDirExist@Utils@minilib@@YAXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?appProcessName@Utils@minilib@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?post@AppBase@minilib@@QAEX$$QAV?$function@$$A6AXXZ@std@@@Z
?postDelayed@AppBase@minilib@@QAEX$$QAV?$function@$$A6AXXZ@std@@H@Z
?async@AppUI@@YAX$$QAV?$Callback@$$A6AXXZ@minilib@@@Z
?asyncDelayed@AppUI@@YAX$$QAV?$Callback@$$A6AXXZ@minilib@@H@Z
?static_pplScheduler@AppUI@@YA?AV?$shared_ptr@Uscheduler_interface@Concurrency@@@std@@XZ
?static_pplScheduler@concurrency_@@YAAAV?$shared_ptr@Uscheduler_interface@Concurrency@@@std@@XZ
?close@File@minilib@@QAEXXZ
?removeDir@Utils@minilib@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?pool@WorkerPool@minilib@@SAPAV12@XZ

cef_frame

IsNameReolveError
CreateBrowser
TbsAppInstance

gmesdk

QAVSDK_AuthBuffer_GenAuthBuffer
ITMGContextGetInstance

comctl32

InitCommonControlsEx

common

?InitPlatformCoreConfig@Boot@Util@@YAHXZ
??0CTXStringW@@QAE@UtagUTF8@@PBDH@Z
??8@YA_NPB_WABVCTXBSTR@@@Z
??ICTXBSTR@@QAEPAPA_WXZ
??0CTXBSTR@@QAE@XZ
?SetAsyncCallback@TXTimer@@YAHPAUITXAsyncCallback@@I@Z
?SafeLoadLibrary@Sys@Util@@YAPAUHINSTANCE__@@PB_W@Z
?Detach@CTXBSTR@@QAEPA_WXZ
?Empty@CTXStringW@@QAEXXZ
??4CTXStringW@@QAEAAV0@PA_W@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?Utf8ToWS@Convert@Util@@YA?AVCTXStringW@@PBDH@Z
?Utf8FromWS@Convert@Util@@YA?AVCTXStringA@@PB_WH@Z
?GetString@CTXStringW@@QBEPB_WXZ
??BCTXStringA@@QBEPBDXZ
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?CreateFileW@FS@@YAHPB_WKPAPAUITXFile@@@Z
?GetBSTR@CTXStringW@@QBEPA_WXZ
?Left@CTXStringW@@QBE?AV1@H@Z
?Mid@CTXStringW@@QBE?AV1@HH@Z
?Mid@CTXStringW@@QBE?AV1@H@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
?Delete@CTXStringW@@QAEHHH@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?GetLength@CTXStringW@@QBEHXZ
??YCTXStringW@@QAEAAV0@PB_W@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
??0CTXStringW@@QAE@ABV0@@Z
?AppendFormat@CTXStringW@@QAAXPB_WZZ
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?GetBuffer@CTXStringW@@QAEPA_WXZ
?Format@CTXStringW@@QAAXPB_WZZ
??0CTXStringW@@QAE@XZ
?CreateTXArray@Data@Util@@YAHPAPAUITXArray@@@Z
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
??M@YA_NABVCTXStringA@@0@Z
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?OnUninitCom@Misc@Util@@YAXXZ
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
ord4
ord6
ord10
ord5
??1CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@PB_W@Z
??BCTXStringW@@QBEPB_WXZ
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
?TXLoadString@@YAPB_WPB_W0@Z
?TXAssert@@YAHPB_W0H@Z
??0CTXStringA@@QAE@XZ
??1CTXStringA@@QAE@XZ
?SetConfigFile@TXI18N@@YAHPB_W0@Z
?Format@CTXStringA@@QAAXPBDZZ
??0CTXStringW@@QAE@UtagEN@@PBDH@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
??7CTXStringW@@QBE_NXZ
??0CTXBSTR@@QAE@PB_W@Z
??1CTXBSTR@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
??0CTXStringW@@QAE@PA_W@Z
??H@YA?AVCTXStringW@@_WABV0@@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z

gf

?ScaleX@DPI@GF@Util@@YAHH@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@PAUITXCore@@H@Z
?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z
?ScaleRECT@DPI@GF@Util@@YAXPAUtagRECT@@@Z
?ScaleSIZE@DPI@GF@Util@@YAXPAUtagSIZE@@@Z
?UnscaleSIZE@DPI@GF@Util@@YAXPAUtagSIZE@@@Z
?UnscaleLONG@DPI@GF@Util@@YAXPAJ@Z
?IsScaleIgnore@DPI@GF@Util@@YA_NXZ
?HandleMessageScale@DPI@GF@Util@@YAXPAUtagBaseArg@@@Z
??0CDPIScaleIgnoreResetHelper@@QAE@XZ
??1CDPIScaleIgnoreResetHelper@@QAE@XZ
?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z

xgraphic32

SetColor
FillSolidRectEx
DrawEllipse

ws2_32

recv
WSASocketW
WSARecv
WSAIoctl
gethostname
WSASetLastError
WSACleanup
WSAStartup
recvfrom
sendto
listen
getsockopt
getsockname
getpeername
bind
accept
__WSAFDIsSet
freeaddrinfo
getaddrinfo
WSAGetLastError
socket
setsockopt
select
ioctlsocket
connect
closesocket
WSASend
send
ntohs
WSAAddressToStringW
htonl
htons
ntohl

comdlg32

GetOpenFileNameW

ximage

?Resample2@CxImage@@QAE_NJJW4InterpolationMethod@1@W4OverflowMethod@1@QAV1@_N@Z
?Save@CxImage@@QAE_NPB_WK@Z
?Load@CxImage@@QAE_NPB_WK@Z
?Destroy@CxImage@@QAE_NXZ
??0CxImage@@QAE@K@Z

wininet

InternetOpenUrlA
InternetReadFile
DeleteUrlCacheEntryW
InternetSetOptionW
InternetCloseHandle
InternetOpenW

wldap32

ord145
ord118
ord142
ord41
ord133
ord14
ord147
ord79
ord27
ord26
ord127
ord46
ord301
ord167
ord208
ord216

zlib

zlibVersion
inflateInit_

libeay32

ord4445
ord224
ord253
ord222
ord227
ord298
ord3212
ord3189
ord1802
ord52
ord109
ord89
ord66
ord1800
ord196
ord197
ord1804
ord2604
ord2949

ssleay32

ord138
ord143
ord151
ord158
ord155
ord183
ord96
ord170
ord12
ord8
ord83
ord74
ord75
ord48
ord35
ord43
ord78
ord108
ord45
ord6
ord58

msvcp140

_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Winerror_message@std@@YAKKPADK@Z
_Stat
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
_Thrd_start
_Thrd_join
_Thrd_id
_Mtx_init
_Mtx_destroy
_Cnd_init
_Cnd_destroy
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_broadcast
_Cnd_signal
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z
?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ
?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ
??0task_continuation_context@Concurrency@@AAE@XZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?setf@ios_base@std@@QAEHHH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
_Thrd_hardware_concurrency
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
_Xtime_get_ticks
_Thrd_detach
_Query_perf_counter
_Query_perf_frequency
_Mtx_current_owns
_Cnd_timedwait
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??Bios_base@std@@QBE_NXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
?classic@locale@std@@SAABV12@XZ
?toupper@?$ctype@D@std@@QBEDD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?eof@ios_base@std@@QBE_NXZ
?fail@ios_base@std@@QBE_NXZ
?bad@ios_base@std@@QBE_NXZ
?exceptions@ios_base@std@@QBEHXZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
_Thrd_sleep
?id@?$ctype@D@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
_Mtx_destroy_in_situ
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
?_Assign@_ContextCallback@details@Concurrency@@AAEXPAX@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
_To_byte
_To_wide
_Remove_dir
_Lstat
_Unlink
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
_Strcoll
_Strxfrm
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?is@?$ctype@D@std@@QBE_NFD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
_Thrd_yield
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??Bid@locale@std@@QAEIXZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xinvalid_argument@std@@YAXPBD@Z
?_XGetLastError@std@@YAXXZ
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
_Mtx_init_in_situ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z

kernel32

GetCurrencyFormatW
FormatMessageA
ExpandEnvironmentStringsA
GetStdHandle
GetFileType
SignalObjectAndWait
OpenFileMappingW
ReleaseSemaphore
CreateSemaphoreW
IsDebuggerPresent
GetNumberFormatW
FileTimeToLocalFileTime
ProcessIdToSessionId
FlushInstructionCache
SetThreadContext
GetThreadContext
ResumeThread
VirtualAlloc
GetTimeFormatW
GetDateFormatW
SwitchToThread
IsProcessorFeaturePresent
K32GetModuleFileNameExA
OpenEventW
OutputDebugStringA
SetEndOfFile
FlushFileBuffers
FreeResource
PeekNamedPipe
CreatePipe
SetHandleInformation
GetACP
QueryPerformanceFrequency
QueryPerformanceCounter
GlobalFree
K32GetProcessImageFileNameW
ReadDirectoryChangesW
CancelIoEx
Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection
CompareFileTime
ExpandEnvironmentStringsW
GetProcessTimes
GlobalAddAtomW
GlobalUnlock
GlobalLock
GlobalSize
SetEnvironmentVariableW
GetTempFileNameW
GetFileSizeEx
LoadLibraryExA
ResetEvent
CreateFileA
Module32NextW
Module32FirstW
Thread32Next
GetStartupInfoW
InitializeSListHead
Thread32First
ReadProcessMemory
VirtualAllocEx
SuspendThread
OpenThread
SetErrorMode
SetUnhandledExceptionFilter
DuplicateHandle
SearchPathW
GetFileInformationByHandle
SetFileTime
LocalFileTimeToFileTime
VerifyVersionInfoW
GetModuleHandleA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcessId
QueueUserAPC
SleepEx
InitializeCriticalSectionAndSpinCount
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
SetLastError
VerSetConditionMask
lstrcmpW
SetFileAttributesW
CreateDirectoryW
K32GetModuleFileNameExW
GetSystemTimeAsFileTime
RaiseException
EnumResourceNamesW
K32GetPerformanceInfo
GetSystemPowerStatus
GetSystemTimes
OutputDebugStringW
GetVersion
GetUserDefaultLangID
SystemTimeToTzSpecificLocalTime
MoveFileW
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
WTSGetActiveConsoleSessionId
GetSystemWindowsDirectoryW
RemoveDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
GetLocaleInfoW
GetModuleFileNameA
GetEnvironmentVariableW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
OpenProcess
GetExitCodeProcess
GetFileAttributesExA
DeleteFileA
lstrcpyW
GlobalAlloc
SystemTimeToFileTime
GetTempPathA
CreateWaitableTimerW
WaitForMultipleObjects
GetSystemTime
GlobalMemoryStatusEx
CreateProcessA
CreateThread
CancelWaitableTimer
SetWaitableTimer
GetFileAttributesExW
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetFileAttributesW
GetCommandLineW
IsWow64Process
DeviceIoControl
GetLogicalDrives
GetDiskFreeSpaceExW
CopyFileW
GetModuleFileNameW
GetTickCount
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
WaitForSingleObjectEx
UnhandledExceptionFilter
CreateProcessW
WriteFile
SetFilePointerEx
SetFilePointer
ReadFile
GetFileSize
CreateFileW
FileTimeToSystemTime
MoveFileExW
GetLocalTime
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
IsBadWritePtr
IsBadReadPtr
WritePrivateProfileStringW
GetPrivateProfileIntW
LoadLibraryW
LoadLibraryA
lstrcpynW
FormatMessageW
LocalFree
LoadLibraryExW
FreeLibrary
WriteProcessMemory
VirtualQuery
VirtualProtect
GetVersionExW
GetSystemDirectoryW
GetSystemInfo
TerminateThread
GetCurrentThreadId
GetCurrentThread
TerminateProcess
GetCurrentProcess
OpenMutexW
CreateMutexW
ReleaseMutex
GetTempPathW
GetDriveTypeW
GetSystemDefaultLangID
GetUserDefaultUILanguage
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleW
FindResourceExW
Sleep
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CloseHandle

user32

GetClassNameW
EnumThreadWindows
EqualRect
WindowFromPoint
GetClientRect
GetWindowThreadProcessId
AttachThreadInput
KillTimer
SetTimer
MonitorFromRect
PostMessageA
LoadImageW
EnumWindows
SetActiveWindow
ShowWindow
PostThreadMessageW
GetForegroundWindow
IsZoomed
IsIconic
FindWindowA
SendMessageTimeoutA
GetParent
GetKeyState
UpdateWindow
MsgWaitForMultipleObjectsEx
IsWindowVisible
MessageBoxA
SetForegroundWindow
BringWindowToTop
CreateWindowExW
RegisterClassExW
UnregisterClassW
SendMessageW
CreateWindowExA
IsWindow
DestroyWindow
EnableWindow
GetDC
ReleaseDC
SetWindowTextW
GetWindowTextW
MessageBoxW
SetCursorPos
GetCursorPos
GetWindowLongW
SetWindowLongW
FindWindowExW
wsprintfW
ExitWindowsEx
GetLastInputInfo
GetSystemMetrics
DefWindowProcW
RegisterClassExA
FindWindowW
EnumDisplaySettingsW
EnumDisplayDevicesA
EnumDisplayDevicesW
MonitorFromWindow
GetMonitorInfoW
DestroyIcon
CreateIconFromResource
GetIconInfoExW
GetDesktopWindow
MoveWindow
GetWindowRect
LoadIconW
DispatchMessageW
PeekMessageW
PostMessageW
MsgWaitForMultipleObjects
SystemParametersInfoW
SetWindowPos
SendMessageTimeoutW
CharUpperW
CharNextW
RegisterHotKey
UnregisterHotKey

advapi32

CryptEnumProvidersA
CryptGenRandom
CryptAcquireContextA
RegEnumKeyExW
RegQueryValueExA
CloseServiceHandle
ControlService
RegCloseKey
RegCreateKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
BuildExplicitAccessWithNameW
RegQueryInfoKeyW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
QueryServiceStatus
RegSetValueExA
RegOpenKeyExA
RegGetValueW
RegRenameKey
QueryServiceConfigW
CreateServiceW
ChangeServiceConfigW
RegOpenKeyA
RegSetKeyValueW
RegDeleteKeyW
OpenServiceW
OpenSCManagerW
DeleteService
ImpersonateLoggedOnUser

ole32

CoInitialize
CreateStreamOnHGlobal
CoCreateGuid
CLSIDFromString
StringFromGUID2
CoCreateInstance
CoInitializeEx
PropVariantClear
OleInitialize
OleUninitialize
GetHGlobalFromStream
CoAddRefServerProcess
CoReleaseServerProcess
CoUninitialize

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetFolderPathW
ord155
ord190
SHGetPathFromIDListW
SHCreateDirectoryExW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHFileOperationW
SHGetMalloc
SHChangeNotify
SHGetDesktopFolder
SHBrowseForFolderW
Shell_NotifyIconW
ord165
ShellExecuteW
SHOpenFolderAndSelectItems

oleaut32

SysFreeString
SysAllocString
SysStringLen
SystemTimeToVariantTime
VariantClear
VariantInit
LoadRegTypeLi
VarBstrCmp
LoadTypeLi
VariantTimeToSystemTime

shlwapi

PathCombineW
StrStrIA
PathAppendW
PathFindFileNameW
PathFileExistsW
PathAddBackslashW
PathIsDirectoryW
PathRemoveFileSpecW
StrCpyNW
StrRChrW
StrFromTimeIntervalW
StrFormatKBSizeW
StrFormatByteSizeW
wnsprintfW
SHCopyKeyW
SHDeleteKeyW
SHGetValueW
SHStrDupW
PathRemoveBackslashW
PathRemoveFileSpecA
StrStrIW

iphlpapi

GetAdaptersInfo
GetIfEntry
GetIfTable

opengl32

glGetString
wglGetProcAddress
wglMakeCurrent
wglGetCurrentContext
wglDeleteContext
wglCreateContext

urlmon

URLDownloadToFileA
URLDownloadToFileW

psapi

GetProcessMemoryInfo

wtsapi32

WTSQueryUserToken

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

d3d9

Direct3DCreate9

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

gdi32

DeleteDC
DeleteObject
CreateFontIndirectW
GetObjectW
GetDeviceCaps
SetPixelFormat
ChoosePixelFormat
GetTextExtentPoint32W
SelectObject
CreateDCW
GetStockObject

netapi32

NetWkstaGetInfo
NetApiBufferFree

winhttp

WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpOpenRequest

vcruntime140

strchr
_except_handler4_common
__vcrt_InitializeCriticalSectionEx
__RTDynamicCast
strrchr
__std_type_info_name
_set_purecall_handler
__std_type_info_compare
wcschr
wcsrchr
strstr
memchr
memset
__std_exception_destroy
__std_exception_copy
wcsstr
memcpy
__CxxFrameHandler3
_CxxThrowException
memmove
__std_terminate
_purecall

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_exit
_initterm_e
_controlfp_s
_invalid_parameter_noinfo_noreturn
strerror
_initterm
_invalid_parameter_noinfo
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_errno
__sys_nerr
terminate
_beginthreadex
_cexit
_crt_atexit
exit
_register_onexit_function
_initialize_onexit_table
_set_invalid_parameter_handler

api-ms-win-crt-heap-l1-1-0

_recalloc
_malloc_base
malloc
_set_new_mode
_callnewh
calloc
realloc
free
_free_base

api-ms-win-crt-string-l1-1-0

wcsnlen
_strnicmp
_strdup
islower
isupper
isgraph
_wcsdup
isalpha
_wcslwr
strncat_s
strncpy_s
wmemcpy_s
isalnum
wcsncat_s
wcsncpy_s
_wcsicmp
tolower
strncmp
isspace
towlower
_wcsupr_s
isxdigit
strncpy
isdigit
strnlen
_wcslwr_s
towupper
wcscspn
wcsspn
_wcsnicmp
wcscpy_s
wcstok_s
wcscat_s
_stricmp
isprint
_wcsicoll
wcscoll
strpbrk
toupper
wcsncmp
wcsncpy
iswdigit

api-ms-win-crt-convert-l1-1-0

strtod
_i64toa_s
_wtoi
_wtol
wcstol
mbstowcs_s
_ltoa
_wtoi64
_wcstoui64
strtol
strtoull
atol
atoll
_strtoi64
atoi
_itoa
wcstoll
wcstoul
_strtoui64
_ecvt_s
_itow
strtoul
wcstod
strtoll

api-ms-win-crt-stdio-l1-1-0

_ftelli64
__acrt_iob_func
fread
fopen
fsetpos
__stdio_common_vsscanf
__stdio_common_vfprintf
fgetwc
fputwc
fgets
__stdio_common_vfwprintf_s
fclose
_wfopen
__stdio_common_vsprintf_s
_open
fputs
_get_stream_buffer_pointers
__stdio_common_vfprintf_s
ftell
fseek
fflush
fgetc
fgetpos
fputc
_lseeki64
ungetwc
__stdio_common_vswscanf
_fseeki64
fwrite
__stdio_common_vsprintf
__stdio_common_vswprintf_s
__stdio_common_vswprintf
_set_fmode
_close
_write
setvbuf
__p__commode
_read
putwchar
__stdio_common_vsnprintf_s
putchar
__stdio_common_vsnwprintf_s
ungetc
ferror

api-ms-win-crt-math-l1-1-0

_libm_sse2_pow_precise
_dtest
_finite
__setusermatherr
_CIfmod
floor
_except1
_isnan
ceil
_dsign

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv
setlocale

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand
ldiv

api-ms-win-crt-time-l1-1-0

_localtime64_s
_mktime64
strftime
_gmtime64
_time32
wcsftime
_time64

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s
_stat64
_lock_file
_waccess
_unlock_file
_fstat64

api-ms-win-crt-multibyte-l1-1-0

_mbsstr
_mbslwr_s
_mbsinc
_mbsrchr

api-ms-win-crt-environment-l1-1-0

getenv

beacon_sdk

?UninitSDK@BeaconClient@@SAXXZ
?Report@BeaconClient@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@3@W4RequestPriority@Beacon@@@Z
?set_common_params@BeaconClient@@SAXABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@Z
?set_common_param_getters@BeaconClient@@SAXABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@@std@@@2@@std@@@Z
?BeaconDeviceId@BeaconClient@@SAABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?InitSDK@BeaconClient@@SAXABUBeaconConfig@@@Z

Exports

Exports

AmdPowerXpressRequestHighPerformance
GetModuleHandle64
GetProcAddress64
NvOptimusEnablement
X64Call

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 784KB - Virtual size: 783KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 193B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 549KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tvm0
Size: 114KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 211KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9739a3cd9515456f371098fafba6348d

Code Sign

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

32:a3:3f:e6:39:8f:c4:bb:72:92:f7:2c:3d:45:4e:9c:a1:67:a2:8e:e7:c7:ae:e9:63:15:5d:6f:06:30:76:ebSigner

93:24:11:27:04:c4:12:60:ba:88:e0:9d:47:0c:3d:e3:ee:71:19:06Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

caterpillar_sdk

minicorelib

cef_frame

gmesdk

comctl32

common

gf

xgraphic32

ws2_32

comdlg32

ximage

wininet

wldap32

zlib

libeay32

ssleay32

msvcp140

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

iphlpapi

opengl32

urlmon

psapi

wtsapi32

version

d3d9

rpcrt4

gdi32

netapi32

winhttp

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

0e:33:12:30:52:5a:25:a7:f8:10:e5:34:88:b0:aa:40
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0e:a7:f6:86:bc:40:35:4a:70:f2:c2:97:c1:31:5e:f6
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

32:a3:3f:e6:39:8f:c4:bb:72:92:f7:2c:3d:45:4e:9c:a1:67:a2:8e:e7:c7:ae:e9:63:15:5d:6f:06:30:76:eb
Signer

93:24:11:27:04:c4:12:60:ba:88:e0:9d:47:0c:3d:e3:ee:71:19:06
Signer

.text
Size: 4.1MB - Virtual size: 4.1MB

.rdata
Size: 784KB - Virtual size: 783KB

.data
Size: 41KB - Virtual size: 63KB

.tls
Size: 512B - Virtual size: 193B

.gfids
Size: 512B - Virtual size: 68B

.rsrc
Size: 549KB - Virtual size: 549KB

.tvm0
Size: 114KB - Virtual size: 116KB

.reloc
Size: 211KB - Virtual size: 212KB