207af6c7fe675ee4d6b0be1c1b6d6709_JaffaCakes118

resource	yara_rule
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/pcmasterdata.dll	acprotect
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/softmastergreen.dll	acprotect
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/winguard.dll	acprotect
static1/unpack001/$PLUGINSDIR/MPlugin_NSIS.dll	acprotect

resource	yara_rule
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/boostmaster.exe	upx
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/cleanmaster.exe	upx
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/ithome.exe	upx
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/mydesk.exe	upx
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/pcmaster.exe	upx
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/pcmasterdata.dll	upx
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/softmastergreen.dll	upx
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/virtualdrivemaster.exe	upx
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/visualmaster.exe	upx
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/winguard.dll	upx
static1/unpack001/$APPDATA/Microsoft/Internet Explorer/Quick Launch/winmaster.exe	upx
static1/unpack001/$PLUGINSDIR/MPlugin_NSIS.dll	upx

resource
unpack002/out.upx
unpack003/out.upx
unpack004/out.upx
unpack005/out.upx
unpack006/out.upx
unpack007/out.upx
unpack008/out.upx
unpack009/out.upx
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

IMPHASH 377a97652fdf5740d8cc11d5ce124fed
SHA256 e197e28bd08c56c2ab5abc663ce11d56221bacdda99305e1cdb614300340d5e3
MD5 207af6c7fe675ee4d6b0be1c1b6d6709
SHA1 6e3c59bd75c091d79fbe3381a5617d6e62a73238
SHA512 8a455d0e25bd2364b9b1867918aa72c7554883132d98520eda95ede03c3f3dfa96e4710ae8bc8f0ca45d5a8c334b4383f85c6367e11a3b290fc1b7e2b8fd2772
SSDEEP 786432:6UUe68MlS+Q0++07l3sHnXkkezz5ATAzREx:6UUUkxQ0+RSnXkkizUURq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

24:8f:42:dc:27:e3:85:13:b1:42:50:db:a3:f5:90:2d:36:cb:51:76:81:7f:1f:a3:54:f6:ee:a9:63:b3:69:8e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Jun 12, 2020

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

38:38:9f:dd:c5:6d:f9:7b:dd:e5:24:f2:d7:66:ec:31

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 8, 2017 - Oct 6, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

5

Entry point

14876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess ExitProcess CopyFileW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetFileTime lstrcpynA lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW LoadLibraryW GetSystemDirectoryW GetProcAddress OpenProcess lstrcpyW LoadLibraryA GetVersionExW lstrcpyA RemoveDirectoryW lstrcmpA CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW SetErrorMode

user32

IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW GetAsyncKeyState CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wvsprintfW wsprintfA ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW CheckDlgButton LoadCursorW SetCursor GetWindowLongW GetSysColor GetClassInfoW CharNextW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint SendMessageTimeoutW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegOpenKeyExW RegEnumValueW RegEnumKeyW RegCloseKey SetFileSecurityW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegDeleteKeyW RegQueryValueExW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$APPDATA/Microsoft/Internet Explorer/Quick Launch/boostmaster.exe

SHA256 bd6b83ce42688b444226e9eb7f562287060ffea9d4e08c69402bfe376694d841
MD5 aaa065c5bdf547c2ac0c8e752f0e3832
SHA1 a6ca04ee56cf82f8eaff1f43980d8794fc82e256
SHA512 161810a01cbe1c446d56f1fcbaa9e7a9e613b5b3cfb8ec210dbadad40d11a4846738728c7d8af33f90ecb6e34e8fe5ed90b8fff155302170b2a8b3e1df9d525b
SSDEEP 12288:Eq54MlzflFRMFvmKpdo6MkQK8Bw9sEfhBgX:dPlBFYvfdo6Mv5+sShCX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

3f:07:05:c3:da:59:c4:06:e7:14:53:27:36:70:17:a9:ea:35:c3:3c:13:11:b4:02:77:f1:60:73:dc:f3:eb:34

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Aug 1, 2018

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Minor OS version

1

Major OS version

5

Entry point

1264064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=20, id=241, version=40116,

count=174, id=243, version=40116,

count=29, id=242, version=40116,

count=9, id=264, version=24215,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=261, version=23013,

count=1, id=199, version=41118,

count=23, id=259, version=24123,

count=36, id=260, version=24123,

count=69, id=261, version=24123,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=516, id=1, productName=Unmarked objects,

count=39, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

out.upx

SHA256 3d8e1a5a1f38c197c3546127fb966a0f36de3fb1cd15715147158d3eeba1e141
MD5 9cf249e07962f0839deb90365b9cec61
SHA1 861deaf4d3c97e0b3bacaf0584b4830f785aa1ea
SHA512 2c503535367fac5c2b9cbfa68939e8503b0f7cb13b33e064eeb4f7f7abf9eee1008873c790701c931d3e7b2a6b12d6abac44fa0b5fe3defb07a7fe19dd22e853
SSDEEP 24576:1Si4vN+SHpuTY5sIuy8d6ursmvxCrTTXy:sU0sITdursc8rTzy
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

416531

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

806KB

Virtual Size

805KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

203KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=20, id=241, version=40116,

count=174, id=243, version=40116,

count=29, id=242, version=40116,

count=9, id=264, version=24215,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=261, version=23013,

count=1, id=199, version=41118,

count=23, id=259, version=24123,

count=36, id=260, version=24123,

count=69, id=261, version=24123,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=516, id=1, productName=Unmarked objects,

count=39, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

$APPDATA/Microsoft/Internet Explorer/Quick Launch/cleanmaster.exe

SHA256 19eed4402a8e24277292f0d03b9600e18d907435682479ffc85475c82f3b42a0
MD5 8e88bed1e8162ef9a6e373fbfcfaf53c
SHA1 a5ce70e309aa3e05bc44758e8eefb6c53ca1c5ae
SHA512 81b3bba3c4c5ad8df8ddb13ef82d1e044c09b28178c960daceba4f9cf49a3695e67ae73874a48755a286573b0b37ecc000a97070d71dafdfde1d4ebee94baf82
SSDEEP 12288:43as2NyCU13ZwW//HpK6dK8yUR+NmlCpZr3QAKTZfzYuRh7ts9OO4FemBnzXCvYA:cKyp1OW//HpXKOsNml4rAhVfMexvO4Fa
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

92:82:66:e6:07:0d:cf:1d:56:da:21:48:79:64:c5:cc:67:2f:e4:a8:7b:44:bc:e6:5b:78:83:b9:90:39:1c:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Dec 6, 2016

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

9e:09:93:f4:2f:0f:11:dc:14:1f:ef:5a:44:aa:99:d1:7a:1a:d1:7f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Dec 6, 2016

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

50:28:4b:e9:ab:1a:22:9c:8f:2c:9f:dd:7b:7e:4a:e4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 13, 2016 - Aug 26, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

5a:de:81:b0:3a:cc:dd:91:fa:96:e7:89:18:ad:f6:e7

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2016 - Aug 23, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Serial Number

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

1

Major OS version

5

Entry point

1775216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 f8bd52a7e9cdd85ca732b91a736ea334453fb52ce9309e16eaa3bddf90f8ecc1
MD5 92db23a115f693b61e8c65795ad8264a
SHA1 1c8b6a31ae93bf718573cf643dd45a43f2a3b851
SHA512 ca87943337c862f580c4ec726baf9e029c0ac9728f9cdfe64131bfd6ae266739a0f05cd2c3571efbb7d4432fea2bbb1e8802b5b7b807bbe684368a9395f0b5ed
SSDEEP 24576:sFFaWehiZLi3LFzJpinTMqGtM6VLTgq7o168eGGvAm8:egbhiZLi3/pNvtM6V/X7o168eGGvAm8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

742475

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

1022KB

Virtual Size

1022KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

336KB

Virtual Size

336KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/Microsoft/Internet Explorer/Quick Launch/ithome.exe

SHA256 18b7e965aeef9423a327d8e2561094b2b7b2deca3114f0279eb30344bcdb77a6
MD5 94653c958221e49644e591bdcd8b2638
SHA1 c01887f3cc0904610271bb24051b8e583fb740f1
SHA512 c9659fff1487cf42d22f6c2abde6ec4acfca74113a972f2c962b7fd550015109ee745ab90c735db727b173620ae5d7e6c598d48892479886044f1f82cd064bda
SSDEEP 12288:raQOVg0fs+uTZTXCCCCCqCCCCCCCCCCCCCCCCCCCCCCCCCCCCC50:IfkxXCCCCCqCCCCCCCCCCCCCCCCCCCCl
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

54:b5:08:a7:d4:1c:34:75:e0:d9:4b:38:8a:25:ea:c0:20:62:b1:65:12:5f:0f:42:06:18:41:6f:43:8d:14:db

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Mar 25, 2020

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

38:38:9f:dd:c5:6d:f9:7b:dd:e5:24:f2:d7:66:ec:31

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 8, 2017 - Oct 6, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

5

Entry point

772880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 2cb0c6a65f9a751342a5d4eea9609c035130b9d492ae9f4c6584e7114a5731d3
MD5 26c9b3a79e7fb2cd24d1092a436b053e
SHA1 c0315efd70cdd765a2527b71ffb48c32e95a94d1
SHA512 acd123f7ca65ce977adaac59d1455f01315d0997568fc19dcc525defd48f4cb151db0167c7be77176882562f0f550ecfe34eab38cca2cc3c5a1c4a36cc8daaf3
SSDEEP 12288:DwuOosAGnY158TGHMrRcW2TXCCCCCqCCCCCCCCCCCCCCCCCCCCCCCCCCCCC:kuOoxn6RcWwXCCCCCqCCCCCCCCCCCCCn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

18761

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

245KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

372B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

424KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/Microsoft/Internet Explorer/Quick Launch/mydesk.exe

SHA256 4dde490055881a9a2ef0d3bb98fdba5dff735b6926df17e26921cb5c6c2eae44
MD5 80ce6d708d329ccac4d47f2973097b48
SHA1 8e59ea99ed6755fefaceebe15ac6e57bb71428a6
SHA512 d56fb04b873ed18374e63ddb70032200f14953c923ab0191d4b6d4d728308e83e657b1edb6169240e8ce2ad91982a0c2689a18651e24695cd87be581a8492709
SSDEEP 24576:UtwTUc3EhMuOYDRYD0OwcCe1ZRDUpICRZgcQgqy7JMMok66z3kH8jgD8ZFQYxpKf:UbcqLpDCgOwvMZRgCWgcOyVN366zUH8y
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

3e:8b:25:b8:47:2d:ce:1f:16:44:1c:ca:40:a1:62:16:c6:70:5d:7b:cc:cf:b1:2c:92:2e:cc:5d:e7:c7:5d:69

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Dec 7, 2016

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

66:4c:13:f7:ca:9c:4e:e9:56:39:b6:cc:e0:66:e3:e0:ca:1d:e0:a4

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Dec 7, 2016

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

50:28:4b:e9:ab:1a:22:9c:8f:2c:9f:dd:7b:7e:4a:e4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 13, 2016 - Aug 26, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

5a:de:81:b0:3a:cc:dd:91:fa:96:e7:89:18:ad:f6:e7

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2016 - Aug 23, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Serial Number

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

1

Major OS version

5

Entry point

2383712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 9bc3d42b7c745f44777b86e84b973b1212c08a9c81c33c02749b5dc5ed4d9df9
MD5 9512e9bbc1a33cffc5bf5926aa240ce9
SHA1 fdb167ed30ea7222d94cddb3e18d9f9f53b842e9
SHA512 f4e90be9a5c71b9b61b3f2fb70efc0d01675562c626266366506e2da8eecea4a17207cf65c0791e551de79582cda3b8fed1e0966cb018bcdaa532595d713b7c3
SSDEEP 49152:YjS2hSn7FURssQ5EqIXvkTJjff4LqX2kNAZs4vgSTCWh6:KS0RssnqdX/NAPgSp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

925639

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$APPDATA/Microsoft/Internet Explorer/Quick Launch/mytime.exe

IMPHASH ed7fed570c4f1b0dd3cd1f6afb5b0498
SHA256 59ecc9a2eb1ac3937f2b35cf6aa6c734d9cfc814f9512d23e45a90aaeff7f55b
MD5 348a8c1cb190f8e35131b93628e9a8a0
SHA1 e57c4eb35bc8d862f9773aa78a1c6ebf0ab391a4
SHA512 e4778faa841c23fcd084239401dc51d1da409f671777ffde01d29bda855ebc94c681b901939d5f2cb0b2719109d15c9dad59b1537c3b245dd7d6bf6be3acdcd0
SSDEEP 196608:VZefJH5NYvwxsUScT5ebMURxn368lgzhgPq+QI0ie8B:bef15NYEDon368lkgPqk0ieI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

93:fa:b2:05:b9:7e:c3:f1:08:ec:02:eb:de:a4:c0:2d:66:9c:b9:3b:94:17:af:7b:fe:39:23:c8:22:ea:fa:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

May 29, 2020

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

38:38:9f:dd:c5:6d:f9:7b:dd:e5:24:f2:d7:66:ec:31

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 8, 2017 - Oct 6, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

5

Entry point

2134738

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Magictray\MagicTray\Bin\Release\mytime.pdb

kernel32

CreateMutexW CreateProcessW GetStartupInfoW GetCommandLineW GetDriveTypeW GetSystemDirectoryW GetTempPathW GetWindowsDirectoryW GetDiskFreeSpaceExW SetFileAttributesW DeleteFileW CopyFileW MoveFileW MoveFileExW WaitNamedPipeW IsBadReadPtr IsBadCodePtr GetTickCount FileTimeToSystemTime GetTimeZoneInformation TzSpecificLocalTimeToSystemTime SystemTimeToTzSpecificLocalTime GetSystemInfo SetLocalTime GetLocalTime GetSystemTime DeviceIoControl FlushFileBuffers GetLogicalDrives Sleep EnterCriticalSection SetLastError GetCurrentThreadId CreateThread SetUnhandledExceptionFilter TerminateProcess GetCurrentProcessId SetProcessWorkingSetSize VirtualProtect LocalFree GlobalMemoryStatusEx GlobalFree GlobalUnlock GlobalLock GlobalAlloc FreeResource InterlockedDecrement InterlockedIncrement EndUpdateResourceW UpdateResourceW BeginUpdateResourceW BeginUpdateResourceA LoadLibraryExW LoadLibraryExA FreeLibrary Module32NextW Module32FirstW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetVersionExW LoadLibraryW lstrlenW lstrlenA WaitForSingleObject WriteProcessMemory CreateRemoteThread OpenProcess VirtualFreeEx VirtualAllocEx FindNextFileW FindFirstFileW GetFileAttributesW CreateFileW CreateDirectoryW DosDateTimeToFileTime FileTimeToDosDateTime LocalFileTimeToFileTime FileTimeToLocalFileTime CloseHandle SetFileTime GetFileTime FindClose ReadFile WriteFile GetFileSizeEx GetFileSize WideCharToMultiByte MultiByteToWideChar InitializeCriticalSectionAndSpinCount GetLastError DecodePointer GetFullPathNameW lstrcpyW FindResourceW GetModuleHandleW GetModuleFileNameW SizeofResource LoadResource DeleteCriticalSection LeaveCriticalSection InitializeCriticalSection RaiseException GetCurrentProcess GetProcessHeap HeapSize HeapFree SetEndOfFile GetCurrentDirectoryW SetCurrentDirectoryW WriteConsoleW SetStdHandle OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA SetConsoleCtrlHandler HeapQueryInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode LockResource GetFileType GetACP GetStdHandle GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread GetFullPathNameA InterlockedFlushSList RtlUnwind CreateFileA SetFilePointer UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent GetUserDefaultUILanguage lstrcmpW IsBadStringPtrW MulDiv SetEvent TerminateThread GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW HeapReAlloc HeapAlloc HeapDestroy GetProcAddress GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW FormatMessageW VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent GetThreadTimes GetCurrentThread QueryPerformanceFrequency QueryPerformanceCounter VirtualQuery FindResourceExW lstrcmpiW

gdi32

ExtSelectClipRgn SelectClipRgn RoundRect Rectangle LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CreateRectRgn CreatePen CombineRgn SetStretchBltMode SetBkColor GetBitmapBits CreateCompatibleBitmap CreatePatternBrush CreateSolidBrush PtInRegion OffsetRgn SetWindowOrgEx SaveDC RestoreDC CreateRoundRectRgn DeleteObject GetTextMetricsW SetDIBColorTable SelectObject CreateDIBSection CreateCompatibleDC CreateDCW StretchBlt GdiFlush TextOutW SetBitmapBits MoveToEx GetObjectW GetObjectA SetTextColor SetBkMode SelectPalette RealizePalette GetStockObject GetDIBits GetDeviceCaps DeleteDC CreateFontIndirectW BitBlt

comdlg32

GetSaveFileNameW ChooseFontW ChooseColorW GetOpenFileNameW

advapi32

FreeSid OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation SetTokenInformation AllocateAndInitializeSid GetLengthSid GetUserNameW CreateProcessAsUserW DuplicateTokenEx RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegFlushKey RegOpenKeyExW RegQueryValueExW RegSetValueExW ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle CreateServiceW OpenSCManagerW OpenServiceW StartServiceW SetEntriesInAclW SetNamedSecurityInfoW ConvertStringSidToSidW CryptGenRandom CryptReleaseContext CryptAcquireContextA

shell32

ShellExecuteExW CommandLineToArgvW SHFileOperationW SHCreateDirectoryExW SHGetFolderPathW ShellExecuteW

ole32

CreateILockBytesOnHGlobal ReleaseStgMedium OleDuplicateData OleSetContainedObject OleCreateStaticFromData StgCreateDocfileOnILockBytes StgCreateDocfile OleUninitialize OleInitialize CoInitialize CoUninitialize CoSetProxyBlanket CoCreateInstance CLSIDFromString CLSIDFromProgID OleRun CreateStreamOnHGlobal OleLockRunning

oleaut32

SysFreeString VariantCopy VariantChangeType CreateErrorInfo VarUdateFromDate VariantInit VariantTimeToSystemTime SetErrorInfo GetErrorInfo SystemTimeToVariantTime SysAllocStringByteLen SysStringByteLen SysAllocString VariantClear

shlwapi

PathFindFileNameW PathFindExtensionW PathAppendW PathFileExistsW

gdiplus

GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipCreateHBITMAPFromBitmap GdipGetFontSize GdipCreateBitmapFromScan0 GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipSaveImageToStream GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdipLoadImageFromFileICM GdipLoadImageFromFile GdipSetPenWidth GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipGetPathWorldBounds GdipAddPathString GdipDeletePath GdipTranslateWorldTransform GdipFree GdipAlloc GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetStringFormatHotkeyPrefix GdipRotateWorldTransform GdipDrawLineI GdipDrawLinesI GdipFillRectangleI GdipFillEllipseI GdipDrawImageRectI GdipDrawImageRectRectI GdipDrawPath GdipDrawRectangleI GdipSetImageAttributesColorKeys GdipSetPenDashStyle GdipAddPathArcI GdipAddPathLineI GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipGetImageEncodersSize GdipGetImageEncoders GdipDeleteFontFamily GdipCreateFontFromDC GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdiplusShutdown GdiplusStartup GdipSaveGraphics GdipDrawImageI GdipGraphicsClear GdipSetImageAttributesWrapMode GdipSetImageAttributesColorMatrix GdipDeleteFont GdipCreateFontFromLogfontA GdipGetFamily GdipCreatePath GdipGetFontStyle GdipCreateBitmapFromHBITMAP GdipGetImagePalette GdipGetImagePaletteSize GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateImageAttributes GdipDisposeImageAttributes GdipReleaseDC

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

urlmon

URLDownloadToFileW

wininet

InternetCloseHandle InternetOpenW InternetSetOptionW HttpOpenRequestA InternetConnectW InternetQueryOptionW InternetOpenUrlW InternetReadFile HttpOpenRequestW HttpSendRequestA HttpSendRequestExW HttpEndRequestW HttpQueryInfoW InternetWriteFile InternetConnectA HttpAddRequestHeadersA

iphlpapi

GetAdaptersInfo

winmm

sndPlaySoundW mciSendStringW

powrprof

SetSuspendState

sensapi

IsNetworkAlive

dbghelp

MiniDumpWriteDump

ws2_32

sendto htonl htons inet_addr ntohl recvfrom setsockopt socket WSAStartup WSACleanup

comctl32

_TrackMouseEvent ord17

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

660KB

Virtual Size

659KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7.8MB

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=27, id=241, version=40116,

count=182, id=243, version=40116,

count=33, id=242, version=40116,

count=21, id=264, version=24215,

count=2, id=199, version=41118,

count=25, id=259, version=24123,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=36, id=260, version=24123,

count=3, id=261, version=23013,

count=74, id=261, version=24123,

count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=597, id=1, productName=Unmarked objects,

count=90, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

$APPDATA/Microsoft/Internet Explorer/Quick Launch/node.dll

IMPHASH 041bf40a062d4ece122be50700635893
SHA256 725e252be7395d9d0a3dfd372c247f39c4bae4fbef94a80fa077451e4da7e783
MD5 200de56040ebbdedae7224ff7e98a1ae
SHA1 f6ee87bb989aa6e765e16ab0f80d28b17f53b8bd
SHA512 03f5aa02e0b1d05dabbcc801c53ce7e93b26e984dfcdb8961c4f5023c95bd336c6b61e7720b9b76f5c12db18475c932aeca6859aa11788c8531dfb99856cf9a6
SSDEEP 393216:LKuvzYgFeKyFCJvWiXwfssXJKHq305yLl7n:euLbeKyFCJvWiXoXQHqd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

27:5b:b8:16:25:e7:e2:f8:16:9b:24:d5:96:07:3f:5b:a7:fb:ba:ee:d1:fc:84:d5:20:6a:93:46:18:d1:62:e9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Mar 5, 2020

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Minor OS version

1

Major OS version

5

Entry point

6079

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

G:\mycode\mb\out\Release_NoNode\miniblink.pdb

winmm

timeEndPeriod timeBeginPeriod timeGetTime

ws2_32

ioctlsocket WSAStartup ntohs htons select WSAGetLastError __WSAFDIsSet WSASetLastError recv send bind closesocket connect getpeername getsockname getsockopt setsockopt socket WSAIoctl gethostname WSACleanup freeaddrinfo getaddrinfo

shlwapi

PathRemoveFileSpecW PathIsDirectoryW PathCombineW PathGetCharTypeW PathFileExistsW PathStripPathW PathFindFileNameW PathAppendW SHGetValueW

wininet

InternetSetCookieA

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

imm32

ImmAssociateContextEx ImmGetCompositionStringW ImmSetOpenStatus ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

kernel32

TlsSetValue OutputDebugStringA GlobalAlloc GlobalSize GlobalLock GlobalUnlock Sleep InterlockedIncrement InterlockedDecrement GlobalFree GetProcAddress VirtualProtect WriteProcessMemory InitializeCriticalSection EnterCriticalSection LeaveCriticalSection lstrcmpiA GetModuleHandleA DebugBreak InterlockedExchangeAdd GetTickCount OutputDebugStringW DeleteCriticalSection GetModuleFileNameW TlsAlloc GetModuleHandleW MultiByteToWideChar WideCharToMultiByte RaiseException GetCurrentThreadId GetSystemTimeAsFileTime SystemTimeToFileTime FileTimeToSystemTime QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionAndSpinCount GetSystemTime GetTimeZoneInformation FileTimeToLocalFileTime LoadLibraryW InterlockedExchange CreateThread CloseHandle GetFileAttributesW GetCurrentProcessId ReadFile FindClose ExpandEnvironmentStringsW GetSystemDirectoryW FindFirstFileW FindNextFileW FreeLibrary LoadLibraryExW SetCurrentDirectoryW TlsGetValue DeleteFileW CreateFileW GetFileAttributesExW SetEvent ResetEvent WaitForSingleObject WaitForMultipleObjects CreateEventW GetCurrentThread WriteFile GetLastError GetTempPathW QueueUserWorkItem GetFileInformationByHandle CreateDirectoryW IsDebuggerPresent GetACP VirtualAlloc VirtualFree InterlockedCompareExchange TerminateProcess GetLocalTime GetVersionExW VerSetConditionMask VerifyVersionInfoW GetCurrentProcess GetSystemInfo ReleaseSemaphore ReleaseMutex CreateMutexW CreateSemaphoreW TryEnterCriticalSection SetLastError FormatMessageA SleepEx ExpandEnvironmentStringsA GetFileAttributesA DuplicateHandle LoadLibraryA GlobalMemoryStatusEx GetNativeSystemInfo GetThreadTimes GetFileType GetStdHandle UnmapViewOfFile GetTempPathA GetTempFileNameA DeleteFileA IsWow64Process OpenThread GetThreadContext SuspendThread ResumeThread CreateSemaphoreA GetThreadPriority CreateEventA DisableThreadLibraryCalls FindNextFileA FindFirstFileA ExitProcess GetCurrentDirectoryW GetLocaleInfoW

user32

IsWindow GetClassNameW GetDoubleClickTime IsWindowVisible SetFocus GetFocus GetKeyState SetCapture ReleaseCapture GetClientRect PtInRect GetParent SystemParametersInfoW DestroyWindow CreatePopupMenu DestroyMenu GetMenuItemCount AppendMenuW TrackPopupMenuEx SetForegroundWindow MessageBoxW RegisterClassW GetActiveWindow SetTimer KillTimer EnableWindow UpdateWindow GetWindowRect SetCursor GetWindowLongW LoadIconW DestroyIcon LoadCursorW MonitorFromPoint GetMonitorInfoW CallWindowProcW SetWindowLongW DefWindowProcA MoveWindow IsWindowUnicode SetWindowRgn InvalidateRect SetWindowLongA OpenClipboard CloseClipboard GetClipboardSequenceNumber SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable RegisterWindowMessageW UnregisterClassW WindowFromDC GetSystemMetrics GetClassInfoW RemovePropW SetWindowTextW IntersectRect CharNextExA PeekMessageW GetMessageW TranslateMessage DispatchMessageW RegisterClipboardFormatW GetWindowThreadProcessId ClientToScreen GetPropW SetPropW EndPaint BeginPaint ReleaseDC GetDC GetForegroundWindow SetWindowPos ShowWindow CreateWindowExW RegisterClassExW DefWindowProcW PostMessageW ScreenToClient CreateIconIndirect GetCursorPos

gdi32

SelectClipRgn SetGraphicsMode SetPolyFillMode SetROP2 SetStretchBltMode AbortPath EndPath PathToRegion SetArcDirection PolyBezier GdiFlush CreateDIBSection SetDIBitsToDevice DeleteDC SetWorldTransform GetWorldTransform GetRgnBox TextOutW GetObjectW SetTextColor SetRectRgn SetBkMode SetBkColor SelectObject Rectangle GetTextExtentPoint32W GetCurrentObject DeleteObject CreateRectRgn CreatePen CreateFontW CreateCompatibleDC SetBrushOrgEx SetDCBrushColor SetDCPenColor CreateFontIndirectW CreateRectRgnIndirect BeginPath GetTextFaceW ExtTextOutW SetTextAlign GetOutlineTextMetricsW GetGlyphOutlineW GetFontData GetCharABCWidthsW EnumFontFamiliesExW GetTextMetricsW CreateCompatibleBitmap CreateBitmap CombineRgn BitBlt GetPixel GetDeviceCaps

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

SystemFunction036 RegEnumKeyExW RegOpenKeyExW RegQueryValueExW CryptGenRandom RevertToSelf ImpersonateAnonymousToken CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt RegCloseKey

shell32

DragAcceptFiles DragFinish ShellExecuteA SHCreateDirectoryExW DragQueryFileW

ole32

RegisterDragDrop RevokeDragDrop CoInitializeEx OleInitialize OleDuplicateData DoDragDrop CoCreateInstance ReleaseStgMedium CoInitialize CoUninitialize CoCreateGuid

msvcp60

??1?$basic_ofstream@DU?$char_traits@D@std@@@std@@UAE@XZ ??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ ??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z ?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IABV12@@Z ?flush@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IID@Z ?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z ?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGIABV?$allocator@G@1@@Z ??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIABV12@@Z ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB ?length@?$char_traits@D@std@@SAIPBD@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z ??0_Lockit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ _Inf ??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z ??0logic_error@std@@QAE@ABV01@@Z ??0out_of_range@std@@QAE@ABV01@@Z ??1out_of_range@std@@UAE@XZ _Nan ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z ?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z ?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHABV12@@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z _FInf _FNan ?nothrow@std@@3Unothrow_t@1@B _FDenorm ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z ??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z ?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ ??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ??1ios_base@std@@UAE@XZ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?clear@ios_base@std@@QAEXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@JW4seekdir@ios_base@2@H@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ

msvcrt

vfprintf _write _read _close _adjust_fdiv _initterm ?terminate@@YAXXZ ??2@YAPAXI@Z ??_U@YAPAXI@Z ??_V@YAXPAX@Z strncmp sprintf abort _vsnprintf _vscprintf strtod isspace memcmp memcpy memset _purecall memmove _snwprintf atoi tolower _CIfmod ceil free malloc _CIatan2 _CIsqrt _CIpow _CIsin rand floor _CIcos srand ??0exception@@QAE@ABV0@@Z _CxxThrowException ldexp _CIacos _CIasin _CIatan _CIexp _CIlog _CItan _except_handler3 _isnan qsort strncpy fclose fread fseek ftell _wfopen sscanf strchr _beginthreadex _errno strstr calloc realloc __iob_func fprintf _CIlog10 _stricmp longjmp _setjmp3 toupper printf iswctype _getcwd setvbuf _strnicmp strtol fflush fopen _wcsdup fwrite strerror strrchr _sys_nerr _wopen _open _lseeki64 _fstati64 fgets fputs strtoul _stati64 strpbrk fputc memchr _strtoi64 getenv _getpid bsearch _strdup _fpclass _stat _wstat _mkdir _beginthread _endthread _aligned_free _aligned_malloc exit raise _tzset rewind _HUGE _scalb _finite vprintf vsprintf _access _get_osfhandle isxdigit strncat _callnewh ??1type_info@@UAE@XZ __dllonexit _onexit

??0ActivityControl@v8@@QAE@ABV01@@Z ??0ActivityControl@v8@@QAE@XZ ??0Allocator@ArrayBuffer@v8@@QAE@ABV012@@Z ??0Allocator@ArrayBuffer@v8@@QAE@XZ ??0AllowJavascriptExecutionScope@Isolate@v8@@QAE@PAV12@@Z ??0CachedData@ScriptCompiler@v8@@QAE@PBEHW4BufferPolicy@012@@Z ??0CachedData@ScriptCompiler@v8@@QAE@XZ ??0Contents@ArrayBuffer@v8@@QAE@XZ ??0Contents@SharedArrayBuffer@v8@@QAE@XZ ??0CpuProfileDeoptInfo@v8@@QAE@$$QAU01@@Z ??0CpuProfileDeoptInfo@v8@@QAE@ABU01@@Z ??0CpuProfileDeoptInfo@v8@@QAE@XZ ??0DisallowJavascriptExecutionScope@Isolate@v8@@QAE@PAV12@W4OnFailure@012@@Z ??0EscapableHandleScope@v8@@QAE@PAVIsolate@1@@Z ??0Extension@v8@@QAE@PBD0HPAPBDH@Z ??0ExtensionConfiguration@v8@@QAE@HQAPBD@Z ??0ExtensionConfiguration@v8@@QAE@XZ ??0ExternalOneByteStringResource@String@v8@@IAE@XZ ??0ExternalOneByteStringResourceImpl@v8@@QAE@PBDI@Z ??0ExternalOneByteStringResourceImpl@v8@@QAE@XZ ??0ExternalResourceVisitor@v8@@QAE@ABV01@@Z ??0ExternalResourceVisitor@v8@@QAE@XZ ??0ExternalSourceStream@ScriptCompiler@v8@@QAE@ABV012@@Z ??0ExternalSourceStream@ScriptCompiler@v8@@QAE@XZ ??0ExternalStringResource@String@v8@@IAE@XZ ??0ExternalStringResourceBase@String@v8@@IAE@XZ ??0HandleScope@v8@@IAE@XZ ??0HandleScope@v8@@QAE@PAVIsolate@1@@Z ??0HeapObjectStatistics@v8@@QAE@XZ ??0HeapSpaceStatistics@v8@@QAE@XZ ??0HeapStatistics@v8@@QAE@XZ ??0Locker@v8@@QAE@PAVIsolate@1@@Z ??0OutputStream@v8@@QAE@ABV01@@Z ??0OutputStream@v8@@QAE@XZ ??0PersistentHandleVisitor@v8@@QAE@ABV01@@Z ??0PersistentHandleVisitor@v8@@QAE@XZ ??0ResourceConstraints@v8@@QAE@XZ ??0RetainedObjectInfo@v8@@IAE@XZ ??0Scope@Isolate@v8@@QAE@PAV12@@Z ??0SealHandleScope@v8@@QAE@PAVIsolate@1@@Z ??0StreamedSource@ScriptCompiler@v8@@QAE@PAVExternalSourceStream@12@W4Encoding@012@@Z ??0SuppressMicrotaskExecutionScope@Isolate@v8@@QAE@PAV12@@Z ??0TryCatch@v8@@QAE@PAVIsolate@1@@Z ??0TryCatch@v8@@QAE@XZ ??0Unlocker@v8@@QAE@PAVIsolate@1@@Z ??0Utf8Value@String@v8@@QAE@PAVIsolate@2@V?$Local@VValue@v8@@@2@@Z ??0Utf8Value@String@v8@@QAE@V?$Local@VValue@v8@@@2@@Z ??0Value@String@v8@@QAE@V?$Local@VValue@v8@@@2@@Z ??1ActivityControl@v8@@UAE@XZ ??1Allocator@ArrayBuffer@v8@@UAE@XZ ??1AllowJavascriptExecutionScope@Isolate@v8@@QAE@XZ ??1CachedData@ScriptCompiler@v8@@QAE@XZ ??1CpuProfileDeoptInfo@v8@@QAE@XZ ??1DisallowJavascriptExecutionScope@Isolate@v8@@QAE@XZ ??1EscapableHandleScope@v8@@QAE@XZ ??1Extension@v8@@UAE@XZ ??1ExternalOneByteStringResource@String@v8@@UAE@XZ ??1ExternalOneByteStringResourceImpl@v8@@UAE@XZ ??1ExternalResourceVisitor@v8@@UAE@XZ ??1ExternalSourceStream@ScriptCompiler@v8@@UAE@XZ ??1ExternalStringResource@String@v8@@UAE@XZ ??1ExternalStringResourceBase@String@v8@@UAE@XZ ??1HandleScope@v8@@QAE@XZ ??1Locker@v8@@QAE@XZ ??1OutputStream@v8@@UAE@XZ ??1PersistentHandleVisitor@v8@@UAE@XZ ??1RetainedObjectInfo@v8@@MAE@XZ ??1Scope@Isolate@v8@@QAE@XZ ??1SealHandleScope@v8@@QAE@XZ ??1StreamedSource@ScriptCompiler@v8@@QAE@XZ ??1SuppressMicrotaskExecutionScope@Isolate@v8@@QAE@XZ ??1TryCatch@v8@@QAE@XZ ??1Unlocker@v8@@QAE@XZ ??1Utf8Value@String@v8@@QAE@XZ ??1Value@String@v8@@QAE@XZ ??4AccessorSignature@v8@@QAEAAV01@$$QAV01@@Z ??4AccessorSignature@v8@@QAEAAV01@ABV01@@Z ??4ActivityControl@v8@@QAEAAV01@ABV01@@Z ??4Allocator@ArrayBuffer@v8@@QAEAAV012@ABV012@@Z ??4Array@v8@@QAEAAV01@$$QAV01@@Z ??4Array@v8@@QAEAAV01@ABV01@@Z ??4ArrayBuffer@v8@@QAEAAV01@$$QAV01@@Z ??4ArrayBuffer@v8@@QAEAAV01@ABV01@@Z ??4ArrayBufferView@v8@@QAEAAV01@$$QAV01@@Z ??4ArrayBufferView@v8@@QAEAAV01@ABV01@@Z ??4Boolean@v8@@QAEAAV01@$$QAV01@@Z ??4Boolean@v8@@QAEAAV01@ABV01@@Z ??4BooleanObject@v8@@QAEAAV01@$$QAV01@@Z ??4BooleanObject@v8@@QAEAAV01@ABV01@@Z ??4Contents@ArrayBuffer@v8@@QAEAAV012@$$QAV012@@Z ??4Contents@ArrayBuffer@v8@@QAEAAV012@ABV012@@Z ??4Contents@SharedArrayBuffer@v8@@QAEAAV012@$$QAV012@@Z ??4Contents@SharedArrayBuffer@v8@@QAEAAV012@ABV012@@Z ??4Context@v8@@QAEAAV01@$$QAV01@@Z ??4Context@v8@@QAEAAV01@ABV01@@Z ??4CpuProfile@v8@@QAEAAV01@$$QAV01@@Z ??4CpuProfile@v8@@QAEAAV01@ABV01@@Z ??4CpuProfileDeoptInfo@v8@@QAEAAU01@$$QAU01@@Z ??4CpuProfileDeoptInfo@v8@@QAEAAU01@ABU01@@Z ??4CpuProfileNode@v8@@QAEAAV01@$$QAV01@@Z ??4CpuProfileNode@v8@@QAEAAV01@ABV01@@Z ??4Data@v8@@QAEAAV01@$$QAV01@@Z ??4Data@v8@@QAEAAV01@ABV01@@Z ??4DataView@v8@@QAEAAV01@$$QAV01@@Z ??4DataView@v8@@QAEAAV01@ABV01@@Z ??4Date@v8@@QAEAAV01@$$QAV01@@Z ??4Date@v8@@QAEAAV01@ABV01@@Z ??4Debug@v8@@QAEAAV01@$$QAV01@@Z ??4Debug@v8@@QAEAAV01@ABV01@@Z ??4Exception@v8@@QAEAAV01@$$QAV01@@Z ??4Exception@v8@@QAEAAV01@ABV01@@Z ??4External@v8@@QAEAAV01@$$QAV01@@Z ??4External@v8@@QAEAAV01@ABV01@@Z ??4ExternalResourceVisitor@v8@@QAEAAV01@ABV01@@Z ??4ExternalSourceStream@ScriptCompiler@v8@@QAEAAV012@ABV012@@Z ??4Float32Array@v8@@QAEAAV01@$$QAV01@@Z ??4Float32Array@v8@@QAEAAV01@ABV01@@Z ??4Float64Array@v8@@QAEAAV01@$$QAV01@@Z ??4Float64Array@v8@@QAEAAV01@ABV01@@Z ??4Function@v8@@QAEAAV01@$$QAV01@@Z ??4Function@v8@@QAEAAV01@ABV01@@Z ??4FunctionTemplate@v8@@QAEAAV01@$$QAV01@@Z ??4FunctionTemplate@v8@@QAEAAV01@ABV01@@Z ??4HeapGraphEdge@v8@@QAEAAV01@$$QAV01@@Z ??4HeapGraphEdge@v8@@QAEAAV01@ABV01@@Z ??4HeapGraphNode@v8@@QAEAAV01@$$QAV01@@Z ??4HeapGraphNode@v8@@QAEAAV01@ABV01@@Z ??4HeapObjectStatistics@v8@@QAEAAV01@$$QAV01@@Z ??4HeapObjectStatistics@v8@@QAEAAV01@ABV01@@Z ??4HeapSnapshot@v8@@QAEAAV01@$$QAV01@@Z ??4HeapSnapshot@v8@@QAEAAV01@ABV01@@Z ??4HeapSpaceStatistics@v8@@QAEAAV01@$$QAV01@@Z ??4HeapSpaceStatistics@v8@@QAEAAV01@ABV01@@Z ??4HeapStatistics@v8@@QAEAAV01@$$QAV01@@Z ??4HeapStatistics@v8@@QAEAAV01@ABV01@@Z ??4Int16Array@v8@@QAEAAV01@$$QAV01@@Z ??4Int16Array@v8@@QAEAAV01@ABV01@@Z ??4Int32@v8@@QAEAAV01@$$QAV01@@Z ??4Int32@v8@@QAEAAV01@ABV01@@Z ??4Int32Array@v8@@QAEAAV01@$$QAV01@@Z ??4Int32Array@v8@@QAEAAV01@ABV01@@Z ??4Int8Array@v8@@QAEAAV01@$$QAV01@@Z ??4Int8Array@v8@@QAEAAV01@ABV01@@Z ??4Integer@v8@@QAEAAV01@$$QAV01@@Z ??4Integer@v8@@QAEAAV01@ABV01@@Z ??4JSON@v8@@QAEAAV01@$$QAV01@@Z ??4JSON@v8@@QAEAAV01@ABV01@@Z ??4Map@v8@@QAEAAV01@$$QAV01@@Z ??4Map@v8@@QAEAAV01@ABV01@@Z ??4Message@v8@@QAEAAV01@$$QAV01@@Z ??4Message@v8@@QAEAAV01@ABV01@@Z ??4Name@v8@@QAEAAV01@$$QAV01@@Z ??4Name@v8@@QAEAAV01@ABV01@@Z ??4NativeWeakMap@v8@@QAEAAV01@$$QAV01@@Z ??4NativeWeakMap@v8@@QAEAAV01@ABV01@@Z ??4Number@v8@@QAEAAV01@$$QAV01@@Z ??4Number@v8@@QAEAAV01@ABV01@@Z ??4NumberObject@v8@@QAEAAV01@$$QAV01@@Z ??4NumberObject@v8@@QAEAAV01@ABV01@@Z ??4Object@v8@@QAEAAV01@$$QAV01@@Z ??4Object@v8@@QAEAAV01@ABV01@@Z ??4ObjectTemplate@v8@@QAEAAV01@$$QAV01@@Z ??4ObjectTemplate@v8@@QAEAAV01@ABV01@@Z ??4OutputStream@v8@@QAEAAV01@ABV01@@Z ??4PersistentHandleVisitor@v8@@QAEAAV01@ABV01@@Z ??4Primitive@v8@@QAEAAV01@$$QAV01@@Z ??4Primitive@v8@@QAEAAV01@ABV01@@Z ??4Private@v8@@QAEAAV01@$$QAV01@@Z ??4Private@v8@@QAEAAV01@ABV01@@Z ??4Promise@v8@@QAEAAV01@$$QAV01@@Z ??4Promise@v8@@QAEAAV01@ABV01@@Z ??4RegExp@v8@@QAEAAV01@$$QAV01@@Z ??4RegExp@v8@@QAEAAV01@ABV01@@Z ??4Resolver@Promise@v8@@QAEAAV012@$$QAV012@@Z ??4Resolver@Promise@v8@@QAEAAV012@ABV012@@Z ??4ResourceConstraints@v8@@QAEAAV01@$$QAV01@@Z ??4ResourceConstraints@v8@@QAEAAV01@ABV01@@Z ??4Script@v8@@QAEAAV01@$$QAV01@@Z ??4Script@v8@@QAEAAV01@ABV01@@Z ??4ScriptCompiler@v8@@QAEAAV01@$$QAV01@@Z ??4ScriptCompiler@v8@@QAEAAV01@ABV01@@Z ??4Set@v8@@QAEAAV01@$$QAV01@@Z ??4Set@v8@@QAEAAV01@ABV01@@Z ??4SharedArrayBuffer@v8@@QAEAAV01@$$QAV01@@Z ??4SharedArrayBuffer@v8@@QAEAAV01@ABV01@@Z ??4Signature@v8@@QAEAAV01@$$QAV01@@Z ??4Signature@v8@@QAEAAV01@ABV01@@Z ??4StackFrame@v8@@QAEAAV01@$$QAV01@@Z ??4StackFrame@v8@@QAEAAV01@ABV01@@Z ??4StackTrace@v8@@QAEAAV01@$$QAV01@@Z ??4StackTrace@v8@@QAEAAV01@ABV01@@Z ??4StartupData@v8@@QAEAAV01@$$QAV01@@Z ??4StartupData@v8@@QAEAAV01@ABV01@@Z ??4String@v8@@QAEAAV01@$$QAV01@@Z ??4String@v8@@QAEAAV01@ABV01@@Z ??4StringObject@v8@@QAEAAV01@$$QAV01@@Z ??4StringObject@v8@@QAEAAV01@ABV01@@Z ??4Symbol@v8@@QAEAAV01@$$QAV01@@Z ??4Symbol@v8@@QAEAAV01@ABV01@@Z ??4SymbolObject@v8@@QAEAAV01@$$QAV01@@Z ??4SymbolObject@v8@@QAEAAV01@ABV01@@Z ??4Template@v8@@QAEAAV01@$$QAV01@@Z ??4Template@v8@@QAEAAV01@ABV01@@Z ??4Testing@v8@@QAEAAV01@$$QAV01@@Z ??4Testing@v8@@QAEAAV01@ABV01@@Z ??4TypeSwitch@v8@@QAEAAV01@$$QAV01@@Z ??4TypeSwitch@v8@@QAEAAV01@ABV01@@Z ??4TypedArray@v8@@QAEAAV01@$$QAV01@@Z ??4TypedArray@v8@@QAEAAV01@ABV01@@Z ??4Uint16Array@v8@@QAEAAV01@$$QAV01@@Z ??4Uint16Array@v8@@QAEAAV01@ABV01@@Z ??4Uint32@v8@@QAEAAV01@$$QAV01@@Z ??4Uint32@v8@@QAEAAV01@ABV01@@Z ??4Uint32Array@v8@@QAEAAV01@$$QAV01@@Z ??4Uint32Array@v8@@QAEAAV01@ABV01@@Z ??4Uint8Array@v8@@QAEAAV01@$$QAV01@@Z ??4Uint8Array@v8@@QAEAAV01@ABV01@@Z ??4Uint8ClampedArray@v8@@QAEAAV01@$$QAV01@@Z ??4Uint8ClampedArray@v8@@QAEAAV01@ABV01@@Z ??4UnboundScript@v8@@QAEAAV01@$$QAV01@@Z ??4UnboundScript@v8@@QAEAAV01@ABV01@@Z ??4Unlocker@v8@@QAEAAV01@ABV01@@Z ??4V8@v8@@QAEAAV01@$$QAV01@@Z ??4V8@v8@@QAEAAV01@ABV01@@Z ??4Value@v8@@QAEAAV01@$$QAV01@@Z ??4Value@v8@@QAEAAV01@ABV01@@Z ??DUtf8Value@String@v8@@QAEPADXZ ??DUtf8Value@String@v8@@QBEPBDXZ ??DValue@String@v8@@QAEPAGXZ ??DValue@String@v8@@QBEPBGXZ ??_7ActivityControl@v8@@6B@ ??_7Allocator@ArrayBuffer@v8@@6B@ ??_7Extension@v8@@6B@ ??_7ExternalOneByteStringResource@String@v8@@6B@ ??_7ExternalOneByteStringResourceImpl@v8@@6B@ ??_7ExternalResourceVisitor@v8@@6B@ ??_7ExternalSourceStream@ScriptCompiler@v8@@6B@ ??_7ExternalStringResource@String@v8@@6B@ ??_7ExternalStringResourceBase@String@v8@@6B@ ??_7OutputStream@v8@@6B@ ??_7PersistentHandleVisitor@v8@@6B@ ??_7RetainedObjectInfo@v8@@6B@ ?Add@Set@v8@@QAE?AV?$MaybeLocal@VSet@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?AddCallCompletedCallback@Isolate@v8@@QAEXP6AXXZ@Z ?AddGCEpilogueCallback@Isolate@v8@@QAEXP6AXPAV12@W4GCType@2@W4GCCallbackFlags@2@@Z1@Z ?AddGCEpilogueCallback@V8@v8@@SAXP6AXW4GCType@2@W4GCCallbackFlags@2@@Z0@Z ?AddGCPrologueCallback@Isolate@v8@@QAEXP6AXPAV12@W4GCType@2@W4GCCallbackFlags@2@@Z1@Z ?AddGCPrologueCallback@V8@v8@@SAXP6AXW4GCType@2@W4GCCallbackFlags@2@@Z0@Z ?AddMemoryAllocationCallback@Isolate@v8@@QAEXP6AXW4ObjectSpace@2@W4AllocationAction@2@H@Z01@Z ?AddMemoryAllocationCallback@V8@v8@@SAXP6AXW4ObjectSpace@2@W4AllocationAction@2@H@Z01@Z ?AddMessageListener@Isolate@v8@@QAE_NP6AXV?$Local@VMessage@v8@@@2@V?$Local@VValue@v8@@@2@@Z1@Z ?AddMessageListener@V8@v8@@SA_NP6AXV?$Local@VMessage@v8@@@2@V?$Local@VValue@v8@@@2@@Z1@Z ?AdjustAmountOfExternalAllocatedMemory@Isolate@v8@@QAE_J_J@Z ?AllowCodeGenerationFromStrings@Context@v8@@QAEX_N@Z ?AsArray@Map@v8@@QBE?AV?$Local@VArray@v8@@@2@XZ ?AsArray@Set@v8@@QBE?AV?$Local@VArray@v8@@@2@XZ ?AsArray@StackTrace@v8@@QAE?AV?$Local@VArray@v8@@@2@XZ ?BindToCurrentContext@UnboundScript@v8@@QAE?AV?$Local@VScript@v8@@@2@XZ ?BooleanValue@Value@v8@@QBE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@@Z ?BooleanValue@Value@v8@@QBE_NPAVIsolate@2@@Z ?BooleanValue@Value@v8@@QBE_NXZ ?Buffer@ArrayBufferView@v8@@QAE?AV?$Local@VArrayBuffer@v8@@@2@XZ ?ByteLength@ArrayBuffer@v8@@QBEIXZ ?ByteLength@ArrayBufferView@v8@@QAEIXZ ?ByteLength@Contents@ArrayBuffer@v8@@QBEIXZ ?ByteLength@Contents@SharedArrayBuffer@v8@@QBEIXZ ?ByteLength@SharedArrayBuffer@v8@@QBEIXZ ?ByteOffset@ArrayBufferView@v8@@QAEIXZ ?CachedDataVersionTag@ScriptCompiler@v8@@SAIXZ ?Call@Debug@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VFunction@v8@@@2@V32@@Z ?Call@Debug@v8@@SA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VFunction@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?Call@Function@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@HQAV32@@Z ?Call@Function@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@HQAV52@@Z ?CallAsConstructor@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@HQAV32@@Z ?CallAsConstructor@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@HQAV?$Local@VValue@v8@@@2@@Z ?CallAsFunction@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@HQAV32@@Z ?CallAsFunction@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@HQAV52@@Z ?CanContinue@TryCatch@v8@@QBE_NXZ ?CanMakeExternal@String@v8@@QAE_NXZ ?CancelDebugBreak@Debug@v8@@SAXPAVIsolate@2@@Z ?CancelTerminateExecution@Isolate@v8@@QAEXXZ ?CancelTerminateExecution@V8@v8@@SAXPAVIsolate@2@@Z ?Cast@Array@v8@@SAPAV12@PAVValue@2@@Z ?Cast@ArrayBuffer@v8@@SAPAV12@PAVValue@2@@Z ?Cast@ArrayBufferView@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Boolean@v8@@SAPAV12@PAVValue@2@@Z ?Cast@BooleanObject@v8@@SAPAV12@PAVValue@2@@Z ?Cast@DataView@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Date@v8@@SAPAV12@PAVValue@2@@Z ?Cast@External@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Float32Array@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Float64Array@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Function@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Int16Array@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Int32@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Int32Array@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Int8Array@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Integer@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Map@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Name@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Number@v8@@SAPAV12@PAVValue@2@@Z ?Cast@NumberObject@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Object@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Promise@v8@@SAPAV12@PAVValue@2@@Z ?Cast@RegExp@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Resolver@Promise@v8@@SAPAV123@PAVValue@3@@Z ?Cast@Set@v8@@SAPAV12@PAVValue@2@@Z ?Cast@SharedArrayBuffer@v8@@SAPAV12@PAVValue@2@@Z ?Cast@String@v8@@SAPAV12@PAVValue@2@@Z ?Cast@StringObject@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Symbol@v8@@SAPAV12@PAVValue@2@@Z ?Cast@SymbolObject@v8@@SAPAV12@PAVValue@2@@Z ?Cast@TypedArray@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Uint16Array@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Uint32@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Uint32Array@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Uint8Array@v8@@SAPAV12@PAVValue@2@@Z ?Cast@Uint8ClampedArray@v8@@SAPAV12@PAVValue@2@@Z ?Catch@Promise@v8@@QAE?AV?$Local@VPromise@v8@@@2@V?$Local@VFunction@v8@@@2@@Z ?Catch@Promise@v8@@QAE?AV?$MaybeLocal@VPromise@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VFunction@v8@@@2@@Z ?Chain@Promise@v8@@QAE?AV?$Local@VPromise@v8@@@2@V?$Local@VFunction@v8@@@2@@Z ?Chain@Promise@v8@@QAE?AV?$MaybeLocal@VPromise@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VFunction@v8@@@2@@Z ?CheckCast@Array@v8@@CAXPAVValue@2@@Z ?CheckCast@ArrayBuffer@v8@@CAXPAVValue@2@@Z ?CheckCast@ArrayBufferView@v8@@CAXPAVValue@2@@Z ?CheckCast@Boolean@v8@@CAXPAVValue@2@@Z ?CheckCast@BooleanObject@v8@@CAXPAVValue@2@@Z ?CheckCast@DataView@v8@@CAXPAVValue@2@@Z ?CheckCast@Date@v8@@CAXPAVValue@2@@Z ?CheckCast@External@v8@@CAXPAVValue@2@@Z ?CheckCast@Float32Array@v8@@CAXPAVValue@2@@Z ?CheckCast@Float64Array@v8@@CAXPAVValue@2@@Z ?CheckCast@Function@v8@@CAXPAVValue@2@@Z ?CheckCast@Int16Array@v8@@CAXPAVValue@2@@Z ?CheckCast@Int32@v8@@CAXPAVValue@2@@Z ?CheckCast@Int32Array@v8@@CAXPAVValue@2@@Z ?CheckCast@Int8Array@v8@@CAXPAVValue@2@@Z ?CheckCast@Integer@v8@@CAXPAVValue@2@@Z ?CheckCast@Map@v8@@CAXPAVValue@2@@Z ?CheckCast@Name@v8@@CAXPAVValue@2@@Z ?CheckCast@Number@v8@@CAXPAVValue@2@@Z ?CheckCast@NumberObject@v8@@CAXPAVValue@2@@Z ?CheckCast@Object@v8@@CAXPAVValue@2@@Z ?CheckCast@Promise@v8@@CAXPAVValue@2@@Z ?CheckCast@RegExp@v8@@CAXPAVValue@2@@Z ?CheckCast@Resolver@Promise@v8@@CAXPAVValue@3@@Z ?CheckCast@Set@v8@@CAXPAVValue@2@@Z ?CheckCast@SharedArrayBuffer@v8@@CAXPAVValue@2@@Z ?CheckCast@String@v8@@CAXPAVValue@2@@Z ?CheckCast@StringObject@v8@@CAXPAVValue@2@@Z ?CheckCast@Symbol@v8@@CAXPAVValue@2@@Z ?CheckCast@SymbolObject@v8@@CAXPAVValue@2@@Z ?CheckCast@TypedArray@v8@@CAXPAVValue@2@@Z ?CheckCast@Uint16Array@v8@@CAXPAVValue@2@@Z ?CheckCast@Uint32@v8@@CAXPAVValue@2@@Z ?CheckCast@Uint32Array@v8@@CAXPAVValue@2@@Z ?CheckCast@Uint8Array@v8@@CAXPAVValue@2@@Z ?CheckCast@Uint8ClampedArray@v8@@CAXPAVValue@2@@Z ?CheckDebugBreak@Debug@v8@@SA_NPAVIsolate@2@@Z ?CheckInitializedImpl@Internals@internal@v8@@SAXPAVIsolate@3@@Z ?Clear@Map@v8@@QAEXXZ ?Clear@Set@v8@@QAEXXZ ?ClearObjectIds@HeapProfiler@v8@@QAEXXZ ?ClearWeak@V8@v8@@CAPAXPAPAVObject@internal@2@@Z ?Clone@Object@v8@@QAE?AV?$Local@VObject@v8@@@2@XZ ?CloneElementAt@Array@v8@@QAE?AV?$Local@VObject@v8@@@2@I@Z ?CloneElementAt@Array@v8@@QAE?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@I@Z ?Compile@Script@v8@@SA?AV?$Local@VScript@v8@@@2@V?$Local@VString@v8@@@2@0@Z ?Compile@Script@v8@@SA?AV?$Local@VScript@v8@@@2@V?$Local@VString@v8@@@2@PAVScriptOrigin@2@@Z ?Compile@Script@v8@@SA?AV?$MaybeLocal@VScript@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@PAVScriptOrigin@2@@Z ?Compile@ScriptCompiler@v8@@SA?AV?$Local@VScript@v8@@@2@PAVIsolate@2@PAVSource@12@W4CompileOptions@12@@Z ?Compile@ScriptCompiler@v8@@SA?AV?$Local@VScript@v8@@@2@PAVIsolate@2@PAVStreamedSource@12@V?$Local@VString@v8@@@2@ABVScriptOrigin@2@@Z ?Compile@ScriptCompiler@v8@@SA?AV?$MaybeLocal@VScript@v8@@@2@V?$Local@VContext@v8@@@2@PAVSource@12@W4CompileOptions@12@@Z ?Compile@ScriptCompiler@v8@@SA?AV?$MaybeLocal@VScript@v8@@@2@V?$Local@VContext@v8@@@2@PAVStreamedSource@12@V?$Local@VString@v8@@@2@ABVScriptOrigin@2@@Z ?CompileFunctionInContext@ScriptCompiler@v8@@SA?AV?$Local@VFunction@v8@@@2@PAVIsolate@2@PAVSource@12@V?$Local@VContext@v8@@@2@IQAV?$Local@VString@v8@@@2@IQAV?$Local@VObject@v8@@@2@@Z ?CompileFunctionInContext@ScriptCompiler@v8@@SA?AV?$MaybeLocal@VFunction@v8@@@2@V?$Local@VContext@v8@@@2@PAVSource@12@IQAV?$Local@VString@v8@@@2@IQAV?$Local@VObject@v8@@@2@@Z ?CompileModule@ScriptCompiler@v8@@SA?AV?$MaybeLocal@VScript@v8@@@2@V?$Local@VContext@v8@@@2@PAVSource@12@W4CompileOptions@12@@Z ?CompileUnbound@ScriptCompiler@v8@@SA?AV?$Local@VUnboundScript@v8@@@2@PAVIsolate@2@PAVSource@12@W4CompileOptions@12@@Z ?CompileUnboundInternal@ScriptCompiler@v8@@CA?AV?$MaybeLocal@VUnboundScript@v8@@@2@PAVIsolate@2@PAVSource@12@W4CompileOptions@12@_N@Z ?CompileUnboundScript@ScriptCompiler@v8@@SA?AV?$MaybeLocal@VUnboundScript@v8@@@2@PAVIsolate@2@PAVSource@12@W4CompileOptions@12@@Z ?Concat@String@v8@@SA?AV?$Local@VString@v8@@@2@V32@0@Z ?ConfigureDefaults@ResourceConstraints@v8@@QAEX_K0@Z ?ContainsOnlyOneByte@String@v8@@QBE_NXZ ?ContextDisposedNotification@Isolate@v8@@QAEH_N@Z ?CopyContents@ArrayBufferView@v8@@QAEIPAXI@Z ?CopyPersistent@V8@v8@@CAPAPAVObject@internal@2@PAPAV342@@Z ?CreateDataProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@IV?$Local@VValue@v8@@@2@@Z ?CreateDataProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?CreateHandle@HandleScope@v8@@CAPAPAVObject@internal@2@PAVHeapObject@42@PAV342@@Z ?CreateHandle@HandleScope@v8@@KAPAPAVObject@internal@2@PAVIsolate@42@PAV342@@Z ?CreateMessage@Exception@v8@@SA?AV?$Local@VMessage@v8@@@2@PAVIsolate@2@V?$Local@VValue@v8@@@2@@Z ?CreateMessage@Exception@v8@@SA?AV?$Local@VMessage@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?CreateSnapshotDataBlob@V8@v8@@SA?AVStartupData@2@PBD@Z ?CreationContext@Object@v8@@QAE?AV?$Local@VContext@v8@@@2@XZ ?CurrentStackTrace@StackTrace@v8@@SA?AV?$Local@VStackTrace@v8@@@2@PAVIsolate@2@HW4StackTraceOptions@12@@Z ?Data@Contents@ArrayBuffer@v8@@QBEPAXXZ ?Data@Contents@SharedArrayBuffer@v8@@QBEPAXXZ ?DateTimeConfigurationChangeNotification@Date@v8@@SAXPAVIsolate@2@@Z ?DebugBreak@Debug@v8@@SAXPAVIsolate@2@@Z ?DefineOwnProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@V?$Local@VValue@v8@@@2@W4PropertyAttribute@2@@Z ?Delete@CpuProfile@v8@@QAEXXZ ?Delete@HeapSnapshot@v8@@QAEXXZ ?Delete@Map@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?Delete@NativeWeakMap@v8@@QAE_NV?$Local@VValue@v8@@@2@@Z ?Delete@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@I@Z ?Delete@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?Delete@Object@v8@@QAE_NI@Z ?Delete@Object@v8@@QAE_NV?$Local@VValue@v8@@@2@@Z ?Delete@Set@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?DeleteAllHeapSnapshots@HeapProfiler@v8@@QAEXXZ ?DeleteHiddenValue@Object@v8@@QAE_NV?$Local@VString@v8@@@2@@Z ?DeletePrivate@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VPrivate@v8@@@2@@Z ?DeoptimizeAll@Testing@v8@@SAXXZ ?DetachGlobal@Context@v8@@QAEXXZ ?Dispose@ExternalStringResourceBase@String@v8@@MAEXXZ ?Dispose@Isolate@v8@@QAEXXZ ?Dispose@V8@v8@@SA_NXZ ?DisposeGlobal@V8@v8@@CAXPAPAVObject@internal@2@@Z ?Empty@String@v8@@SA?AV?$Local@VString@v8@@@2@PAVIsolate@2@@Z ?EnqueueMicrotask@Isolate@v8@@QAEXP6AXPAX@Z0@Z ?EnqueueMicrotask@Isolate@v8@@QAEXV?$Local@VFunction@v8@@@2@@Z ?Enter@Context@v8@@QAEXXZ ?Enter@Isolate@v8@@QAEXXZ ?Equals@Value@v8@@QBE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?Equals@Value@v8@@QBE_NV?$Local@VValue@v8@@@2@@Z ?Error@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z ?Escape@EscapableHandleScope@v8@@AAEPAPAVObject@internal@2@PAPAV342@@Z ?EstimatedSize@Context@v8@@QAEIXZ ?Eternalize@V8@v8@@CAXPAVIsolate@2@PAVValue@2@PAH@Z ?Exception@TryCatch@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ ?Exit@Context@v8@@QAEXXZ ?Exit@Isolate@v8@@QAEXXZ ?Externalize@ArrayBuffer@v8@@QAE?AVContents@12@XZ ?Externalize@SharedArrayBuffer@v8@@QAE?AVContents@12@XZ ?FindInstanceInPrototypeChain@Object@v8@@QAE?AV?$Local@VObject@v8@@@2@V?$Local@VFunctionTemplate@v8@@@2@@Z ?FindObjectById@HeapProfiler@v8@@QAE?AV?$Local@VValue@v8@@@2@I@Z ?For@Symbol@v8@@SA?AV?$Local@VSymbol@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z ?ForApi@Private@v8@@SA?AV?$Local@VPrivate@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z ?ForApi@Symbol@v8@@SA?AV?$Local@VSymbol@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z ?ForceSet@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@1W4PropertyAttribute@2@@Z ?ForceSet@Object@v8@@QAE_NV?$Local@VValue@v8@@@2@0W4PropertyAttribute@2@@Z ?FromArray@Map@v8@@SA?AV?$MaybeLocal@VMap@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VArray@v8@@@2@@Z ?FromArray@Set@v8@@SA?AV?$MaybeLocal@VSet@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VArray@v8@@@2@@Z ?FromJustIsNothing@V8@v8@@CAXXZ ?FullIsNull@Value@v8@@ABE_NXZ ?FullIsString@Value@v8@@ABE_NXZ ?FullIsUndefined@Value@v8@@ABE_NXZ ?Get@Map@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?Get@Message@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?Get@NativeWeakMap@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@@Z ?Get@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@I@Z ?Get@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@@Z ?Get@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@I@Z ?Get@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?GetAlignedPointerFromEmbedderData@Context@v8@@QAEPAXH@Z ?GetAlignedPointerFromInternalField@Object@v8@@QAEPAXH@Z ?GetAlignedPointerFromInternalField@Object@v8@@SAPAXABV?$PersistentBase@VObject@v8@@@2@H@Z ?GetBailoutReason@CpuProfileNode@v8@@QBEPBDXZ ?GetBoundFunction@Function@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ ?GetCachedData@StreamedSource@ScriptCompiler@v8@@QBEPBUCachedData@23@XZ ?GetCallUid@CpuProfileNode@v8@@QBEIXZ ?GetCallingContext@Isolate@v8@@QAE?AV?$Local@VContext@v8@@@2@XZ ?GetChild@CpuProfileNode@v8@@QBEPBV12@H@Z ?GetChild@HeapGraphNode@v8@@QBEPBVHeapGraphEdge@2@H@Z ?GetChildrenCount@CpuProfileNode@v8@@QBEHXZ ?GetChildrenCount@HeapGraphNode@v8@@QBEHXZ ?GetChunkSize@OutputStream@v8@@UAEHXZ ?GetCodeRange@Isolate@v8@@QAEXPAPAXPAI@Z ?GetColumn@StackFrame@v8@@QBEHXZ ?GetColumnNumber@CpuProfileNode@v8@@QBEHXZ ?GetConstructorName@Object@v8@@QAE?AV?$Local@VString@v8@@@2@XZ ?GetContents@ArrayBuffer@v8@@QAE?AVContents@12@XZ ?GetContents@SharedArrayBuffer@v8@@QAE?AVContents@12@XZ ?GetCpuProfiler@Isolate@v8@@QAEPAVCpuProfiler@2@XZ ?GetCurrent@Isolate@v8@@SAPAV12@XZ ?GetCurrentContext@Isolate@v8@@QAE?AV?$Local@VContext@v8@@@2@XZ ?GetData@Isolate@v8@@QAEPAXI@Z ?GetDebugContext@Debug@v8@@SA?AV?$Local@VContext@v8@@@2@PAVIsolate@2@@Z ?GetDebugContext@Debug@v8@@SA?AV?$Local@VContext@v8@@@2@XZ ?GetDeoptInfos@CpuProfileNode@v8@@QBEABV?$vector@UCpuProfileDeoptInfo@v8@@V?$allocator@UCpuProfileDeoptInfo@v8@@@std@@@std@@XZ ?GetDisplayName@Function@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ ?GetElementCount@RetainedObjectInfo@v8@@UAEHXZ ?GetEmbedderData@Context@v8@@QAE?AV?$Local@VValue@v8@@@2@H@Z ?GetEndColumn@Message@v8@@QBE?AV?$Maybe@H@2@V?$Local@VContext@v8@@@2@@Z ?GetEndColumn@Message@v8@@QBEHXZ ?GetEndPosition@Message@v8@@QBEHXZ ?GetEndTime@CpuProfile@v8@@QBE_JXZ ?GetEnteredContext@Isolate@v8@@QAE?AV?$Local@VContext@v8@@@2@XZ ?GetEternal@V8@v8@@CA?AV?$Local@VValue@v8@@@2@PAVIsolate@2@H@Z ?GetExternalOneByteStringResource@String@v8@@QBEPBVExternalOneByteStringResource@12@XZ ?GetExternalStringResource@String@v8@@QBEPAVExternalStringResource@12@XZ ?GetExternalStringResourceBase@String@v8@@QBEPAVExternalStringResourceBase@12@PAW4Encoding@12@@Z ?GetExtrasBindingObject@Context@v8@@QAE?AV?$Local@VObject@v8@@@2@XZ ?GetFlags@RegExp@v8@@QBE?AW4Flags@12@XZ ?GetFrame@StackTrace@v8@@QBE?AV?$Local@VStackFrame@v8@@@2@I@Z ?GetFrame@StackTrace@v8@@QBE?AV?$Local@VStackFrame@v8@@@2@PAVIsolate@2@I@Z ?GetFrameCount@StackTrace@v8@@QBEHXZ ?GetFromNode@HeapGraphEdge@v8@@QBEPBVHeapGraphNode@2@XZ ?GetFunction@FunctionTemplate@v8@@QAE?AV?$Local@VFunction@v8@@@2@XZ ?GetFunction@FunctionTemplate@v8@@QAE?AV?$MaybeLocal@VFunction@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?GetFunctionName@CpuProfileNode@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?GetFunctionName@StackFrame@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?GetGroupLabel@RetainedObjectInfo@v8@@UAEPBDXZ ?GetHeapObjectStatisticsAtLastGC@Isolate@v8@@QAE_NPAVHeapObjectStatistics@2@I@Z ?GetHeapProfiler@Isolate@v8@@QAEPAVHeapProfiler@2@XZ ?GetHeapSnapshot@HeapProfiler@v8@@QAEPBVHeapSnapshot@2@H@Z ?GetHeapSpaceStatistics@Isolate@v8@@QAE_NPAVHeapSpaceStatistics@2@I@Z ?GetHeapStatistics@Isolate@v8@@QAEXPAVHeapStatistics@2@@Z ?GetHeapStats@HeapProfiler@v8@@QAEIPAVOutputStream@2@PA_J@Z ?GetHiddenValue@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z ?GetHitCount@CpuProfileNode@v8@@QBEIXZ ?GetHitLineCount@CpuProfileNode@v8@@QBEIXZ ?GetId@HeapGraphNode@v8@@QBEIXZ ?GetId@UnboundScript@v8@@QAEHXZ ?GetIdentityHash@Name@v8@@QAEHXZ ?GetIdentityHash@Object@v8@@QAEHXZ ?GetInferredName@Function@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ ?GetInternalField@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@H@Z ?GetInternalProperties@Debug@v8@@SA?AV?$MaybeLocal@VArray@v8@@@2@PAVIsolate@2@V?$Local@VValue@v8@@@2@@Z ?GetIsConcatSpreadable@Symbol@v8@@SA?AV?$Local@VSymbol@v8@@@2@PAVIsolate@2@@Z ?GetIsolate@Context@v8@@QAEPAVIsolate@2@XZ ?GetIsolate@HandleScope@v8@@QBEPAVIsolate@2@XZ ?GetIsolate@Object@v8@@QAEPAVIsolate@2@XZ ?GetIterator@Symbol@v8@@SA?AV?$Local@VSymbol@v8@@@2@PAVIsolate@2@@Z ?GetLineNumber@CpuProfileNode@v8@@QBEHXZ ?GetLineNumber@Message@v8@@QBE?AV?$Maybe@H@2@V?$Local@VContext@v8@@@2@@Z ?GetLineNumber@Message@v8@@QBEHXZ ?GetLineNumber@StackFrame@v8@@QBEHXZ ?GetLineNumber@UnboundScript@v8@@QAEHH@Z ?GetLineTicks@CpuProfileNode@v8@@QBE_NPAULineTick@12@I@Z ?GetMaxSnapshotJSObjectId@HeapSnapshot@v8@@QBEIXZ ?GetMirror@Debug@v8@@SA?AV?$Local@VValue@v8@@@2@V32@@Z ?GetMirror@Debug@v8@@SA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?GetName@Function@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ ?GetName@HeapGraphEdge@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ ?GetName@HeapGraphNode@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?GetNativeFunctionTemplate@Extension@v8@@UAE?AV?$Local@VFunctionTemplate@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z ?GetNode@HeapSnapshot@v8@@QBEPBVHeapGraphNode@2@H@Z ?GetNodeById@HeapSnapshot@v8@@QBEPBVHeapGraphNode@2@I@Z ?GetNodeId@CpuProfileNode@v8@@QBEIXZ ?GetNodesCount@HeapSnapshot@v8@@QBEHXZ ?GetNumberOfDataSlots@Isolate@v8@@SAIXZ ?GetObjectId@HeapProfiler@v8@@QAEIV?$Local@VValue@v8@@@2@@Z ?GetOwnPropertyDescriptor@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z ?GetOwnPropertyDescriptor@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@@Z ?GetOwnPropertyNames@Object@v8@@QAE?AV?$Local@VArray@v8@@@2@XZ ?GetOwnPropertyNames@Object@v8@@QAE?AV?$MaybeLocal@VArray@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?GetPrivate@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VPrivate@v8@@@2@@Z ?GetProfilerMemorySize@HeapProfiler@v8@@QAEIXZ ?GetPromise@Resolver@Promise@v8@@QAE?AV?$Local@VPromise@v8@@@3@XZ ?GetPropertyAttributes@Object@v8@@QAE?AV?$Maybe@W4PropertyAttribute@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?GetPropertyAttributes@Object@v8@@QAE?AW4PropertyAttribute@2@V?$Local@VValue@v8@@@2@@Z ?GetPropertyNames@Object@v8@@QAE?AV?$Local@VArray@v8@@@2@XZ ?GetPropertyNames@Object@v8@@QAE?AV?$MaybeLocal@VArray@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?GetPrototype@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ ?GetRealNamedProperty@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z ?GetRealNamedProperty@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@@Z ?GetRealNamedPropertyAttributes@Object@v8@@QAE?AV?$Maybe@W4PropertyAttribute@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@@Z ?GetRealNamedPropertyAttributes@Object@v8@@QAE?AV?$Maybe@W4PropertyAttribute@v8@@@2@V?$Local@VString@v8@@@2@@Z ?GetRealNamedPropertyAttributesInPrototypeChain@Object@v8@@QAE?AV?$Maybe@W4PropertyAttribute@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@@Z ?GetRealNamedPropertyAttributesInPrototypeChain@Object@v8@@QAE?AV?$Maybe@W4PropertyAttribute@v8@@@2@V?$Local@VString@v8@@@2@@Z ?GetRealNamedPropertyInPrototypeChain@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z ?GetRealNamedPropertyInPrototypeChain@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@@Z ?GetRoot@HeapSnapshot@v8@@QBEPBVHeapGraphNode@2@XZ ?GetSample@CpuProfile@v8@@QBEPBVCpuProfileNode@2@H@Z ?GetSampleTimestamp@CpuProfile@v8@@QBE_JH@Z ?GetSamplesCount@CpuProfile@v8@@QBEHXZ ?GetScriptColumnNumber@Function@v8@@QBEHXZ ?GetScriptId@CpuProfileNode@v8@@QBEHXZ ?GetScriptId@StackFrame@v8@@QBEHXZ ?GetScriptLineNumber@Function@v8@@QBEHXZ ?GetScriptName@StackFrame@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?GetScriptName@UnboundScript@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ ?GetScriptNameOrSourceURL@StackFrame@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?GetScriptOrigin@Function@v8@@QBE?AVScriptOrigin@2@XZ ?GetScriptOrigin@Message@v8@@QBE?AVScriptOrigin@2@XZ ?GetScriptResourceName@CpuProfileNode@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?GetScriptResourceName@Message@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ ?GetSecurityToken@Context@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ ?GetShallowSize@HeapGraphNode@v8@@QBEIXZ ?GetSizeInBytes@RetainedObjectInfo@v8@@UAEHXZ ?GetSnapshotCount@HeapProfiler@v8@@QAEHXZ ?GetSource@RegExp@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?GetSourceLine@Message@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?GetSourceLine@Message@v8@@QBE?AV?$MaybeLocal@VString@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?GetSourceMappingURL@UnboundScript@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ ?GetSourceURL@UnboundScript@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ ?GetStackSample@Isolate@v8@@QAEXABURegisterState@2@PAPAXIPAUSampleInfo@2@@Z ?GetStackTrace@Exception@v8@@SA?AV?$Local@VStackTrace@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?GetStackTrace@Message@v8@@QBE?AV?$Local@VStackTrace@v8@@@2@XZ ?GetStartColumn@Message@v8@@QBE?AV?$Maybe@H@2@V?$Local@VContext@v8@@@2@@Z ?GetStartColumn@Message@v8@@QBEHXZ ?GetStartPosition@Message@v8@@QBEHXZ ?GetStartTime@CpuProfile@v8@@QBE_JXZ ?GetStressRuns@Testing@v8@@SAHXZ ?GetTitle@CpuProfile@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?GetToNode@HeapGraphEdge@v8@@QBEPBVHeapGraphNode@2@XZ ?GetToStringTag@Symbol@v8@@SA?AV?$Local@VSymbol@v8@@@2@PAVIsolate@2@@Z ?GetTopDownRoot@CpuProfile@v8@@QBEPBVCpuProfileNode@2@XZ ?GetType@HeapGraphEdge@v8@@QBE?AW4Type@12@XZ ?GetType@HeapGraphNode@v8@@QBE?AW4Type@12@XZ ?GetUnboundScript@Script@v8@@QAE?AV?$Local@VUnboundScript@v8@@@2@XZ ?GetUnscopables@Symbol@v8@@SA?AV?$Local@VSymbol@v8@@@2@PAVIsolate@2@@Z ?GetVersion@V8@v8@@SAPBDXZ ?Global@Context@v8@@QAE?AV?$Local@VObject@v8@@@2@XZ ?GlobalizeReference@V8@v8@@CAPAPAVObject@internal@2@PAVIsolate@42@PAPAV342@@Z ?Has@Map@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?Has@NativeWeakMap@v8@@QAE_NV?$Local@VValue@v8@@@2@@Z ?Has@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@I@Z ?Has@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?Has@Object@v8@@QAE_NI@Z ?Has@Object@v8@@QAE_NV?$Local@VValue@v8@@@2@@Z ?Has@Set@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?HasBuffer@ArrayBufferView@v8@@QBE_NXZ ?HasCaught@TryCatch@v8@@QBE_NXZ ?HasHandler@Promise@v8@@QAE_NXZ ?HasIndexedLookupInterceptor@Object@v8@@QAE_NXZ ?HasInstance@FunctionTemplate@v8@@QAE_NV?$Local@VValue@v8@@@2@@Z ?HasNamedLookupInterceptor@Object@v8@@QAE_NXZ ?HasOwnProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@@Z ?HasOwnProperty@Object@v8@@QAE_NV?$Local@VString@v8@@@2@@Z ?HasPrivate@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VPrivate@v8@@@2@@Z ?HasRealIndexedProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@I@Z ?HasRealIndexedProperty@Object@v8@@QAE_NI@Z ?HasRealNamedCallbackProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@@Z ?HasRealNamedCallbackProperty@Object@v8@@QAE_NV?$Local@VString@v8@@@2@@Z ?HasRealNamedProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@@Z ?HasRealNamedProperty@Object@v8@@QAE_NV?$Local@VString@v8@@@2@@Z ?HasTerminated@TryCatch@v8@@QBE_NXZ ?IdleNotification@Isolate@v8@@QAE_NH@Z ?IdleNotificationDeadline@Isolate@v8@@QAE_NN@Z ?InContext@Isolate@v8@@QAE_NXZ ?Inherit@FunctionTemplate@v8@@QAEXV?$Local@VFunctionTemplate@v8@@@2@@Z ?Initialize@HandleScope@v8@@IAEXPAVIsolate@2@@Z ?Initialize@Locker@v8@@AAEXPAVIsolate@2@@Z ?Initialize@Unlocker@v8@@AAEXPAVIsolate@2@@Z ?Initialize@V8@v8@@SA_NXZ ?InitializeExternalStartupData@V8@v8@@SAXPBD0@Z ?InitializeExternalStartupData@V8@v8@@SAXPBD@Z ?InitializeICU@V8@v8@@SA_NPBD@Z ?InitializePlatform@V8@v8@@SAXPAVPlatform@2@@Z ?InstanceTemplate@FunctionTemplate@v8@@QAE?AV?$Local@VObjectTemplate@v8@@@2@XZ ?Int32Value@Value@v8@@QBE?AV?$Maybe@H@2@V?$Local@VContext@v8@@@2@@Z ?Int32Value@Value@v8@@QBEHXZ ?IntegerValue@Value@v8@@QBE?AV?$Maybe@_J@2@V?$Local@VContext@v8@@@2@@Z ?IntegerValue@Value@v8@@QBE_JXZ ?InternalFieldCount@Object@v8@@QAEHXZ ?InternalFieldCount@Object@v8@@SAHABV?$PersistentBase@VObject@v8@@@2@@Z ?InternalFieldCount@ObjectTemplate@v8@@QAEHXZ ?InternalFieldOutOfBounds@V8@v8@@CAXH@Z ?IsActive@Locker@v8@@SA_NXZ ?IsArgumentsObject@Value@v8@@QBE_NXZ ?IsArray@Value@v8@@QBE_NXZ ?IsArrayBuffer@Value@v8@@QBE_NXZ ?IsArrayBufferView@Value@v8@@QBE_NXZ ?IsBoolean@Value@v8@@QBE_NXZ ?IsBooleanObject@Value@v8@@QBE_NXZ ?IsBuiltin@Function@v8@@QBE_NXZ ?IsCallable@Object@v8@@QAE_NXZ ?IsCodeGenerationFromStringsAllowed@Context@v8@@QAE_NXZ ?IsConstructor@StackFrame@v8@@QBE_NXZ ?IsDataView@Value@v8@@QBE_NXZ ?IsDate@Value@v8@@QBE_NXZ ?IsDead@Isolate@v8@@QAE_NXZ ?IsDead@V8@v8@@SA_NXZ ?IsEval@StackFrame@v8@@QBE_NXZ ?IsExecutionTerminating@Isolate@v8@@QAE_NXZ ?IsExecutionTerminating@V8@v8@@SA_NPAVIsolate@2@@Z ?IsExternal@ArrayBuffer@v8@@QBE_NXZ ?IsExternal@SharedArrayBuffer@v8@@QBE_NXZ ?IsExternal@String@v8@@QBE_NXZ ?IsExternal@Value@v8@@QBE_NXZ ?IsExternalOneByte@String@v8@@QBE_NXZ ?IsFalse@Value@v8@@QBE_NXZ ?IsFloat32Array@Value@v8@@QBE_NXZ ?IsFloat64Array@Value@v8@@QBE_NXZ ?IsFunction@Value@v8@@QBE_NXZ ?IsGeneratorFunction@Value@v8@@QBE_NXZ ?IsGeneratorObject@Value@v8@@QBE_NXZ ?IsInt16Array@Value@v8@@QBE_NXZ ?IsInt32@Value@v8@@QBE_NXZ ?IsInt32Array@Value@v8@@QBE_NXZ ?IsInt8Array@Value@v8@@QBE_NXZ ?IsLocked@Locker@v8@@SA_NPAVIsolate@2@@Z ?IsMap@Value@v8@@QBE_NXZ ?IsMapIterator@Value@v8@@QBE_NXZ ?IsName@Value@v8@@QBE_NXZ ?IsNativeError@Value@v8@@QBE_NXZ ?IsNeuterable@ArrayBuffer@v8@@QBE_NXZ ?IsNull@Value@v8@@QBE_NXZ ?IsNumber@Value@v8@@QBE_NXZ ?IsNumberObject@Value@v8@@QBE_NXZ ?IsObject@Value@v8@@QBE_NXZ ?IsOneByte@String@v8@@QBE_NXZ ?IsOpaque@Message@v8@@QBE_NXZ ?IsPromise@Value@v8@@QBE_NXZ ?IsRegExp@Value@v8@@QBE_NXZ ?IsSet@Value@v8@@QBE_NXZ ?IsSetIterator@Value@v8@@QBE_NXZ ?IsSharedArrayBuffer@Value@v8@@QBE_NXZ ?IsSharedCrossOrigin@Message@v8@@QBE_NXZ ?IsString@Value@v8@@QBE_NXZ ?IsStringObject@Value@v8@@QBE_NXZ ?IsSymbol@Value@v8@@QBE_NXZ ?IsSymbolObject@Value@v8@@QBE_NXZ ?IsTrue@Value@v8@@QBE_NXZ ?IsTypedArray@Value@v8@@QBE_NXZ ?IsUint16Array@Value@v8@@QBE_NXZ ?IsUint32@Value@v8@@QBE_NXZ ?IsUint32Array@Value@v8@@QBE_NXZ ?IsUint8Array@Value@v8@@QBE_NXZ ?IsUint8ClampedArray@Value@v8@@QBE_NXZ ?IsUndefined@Value@v8@@QBE_NXZ ?IsWeakMap@Value@v8@@QBE_NXZ ?IsWeakSet@Value@v8@@QBE_NXZ ?IsolateInBackgroundNotification@Isolate@v8@@QAEXXZ ?IsolateInForegroundNotification@Isolate@v8@@QAEXXZ ?JSStackComparableAddress@TryCatch@v8@@SAPAXPAV12@@Z ?Length@Array@v8@@QBEIXZ ?Length@String@v8@@QBEHXZ ?Length@TypedArray@v8@@QAEIXZ ?LowMemoryNotification@Isolate@v8@@QAEXXZ ?MakeExternal@String@v8@@QAE_NPAVExternalOneByteStringResource@12@@Z ?MakeExternal@String@v8@@QAE_NPAVExternalStringResource@12@@Z ?MakeWeak@V8@v8@@CAXPAPAVObject@internal@2@PAXHHP6AXABV?$WeakCallbackInfo@X@2@@Z@Z ?MakeWeak@V8@v8@@CAXPAPAVObject@internal@2@PAXP6AXABV?$WeakCallbackData@VValue@v8@@X@2@@Z@Z ?MakeWeak@V8@v8@@CAXPAPAVObject@internal@2@PAXP6AXABV?$WeakCallbackInfo@X@2@@ZW4WeakCallbackType@2@@Z ?MarkAsUndetectable@ObjectTemplate@v8@@QAEXXZ ?Message@TryCatch@v8@@QBE?AV?$Local@VMessage@v8@@@2@XZ ?Name@Private@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ ?Name@Symbol@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ ?Neuter@ArrayBuffer@v8@@QAEXXZ ?New@AccessorSignature@v8@@SA?AV?$Local@VAccessorSignature@v8@@@2@PAVIsolate@2@V?$Local@VFunctionTemplate@v8@@@2@@Z ?New@Array@v8@@SA?AV?$Local@VArray@v8@@@2@PAVIsolate@2@H@Z ?New@ArrayBuffer@v8@@SA?AV?$Local@VArrayBuffer@v8@@@2@PAVIsolate@2@I@Z ?New@ArrayBuffer@v8@@SA?AV?$Local@VArrayBuffer@v8@@@2@PAVIsolate@2@PAXIW4ArrayBufferCreationMode@2@@Z ?New@Boolean@v8@@SA?AV?$Local@VBoolean@v8@@@2@PAVIsolate@2@_N@Z ?New@BooleanObject@v8@@SA?AV?$Local@VValue@v8@@@2@PAVIsolate@2@_N@Z ?New@BooleanObject@v8@@SA?AV?$Local@VValue@v8@@@2@_N@Z ?New@Context@v8@@SA?AV?$Local@VContext@v8@@@2@PAVIsolate@2@PAVExtensionConfiguration@2@V?$Local@VObjectTemplate@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?New@DataView@v8@@SA?AV?$Local@VDataView@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z ?New@DataView@v8@@SA?AV?$Local@VDataView@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z ?New@Date@v8@@SA?AV?$Local@VValue@v8@@@2@PAVIsolate@2@N@Z ?New@Date@v8@@SA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@N@Z ?New@External@v8@@SA?AV?$Local@VExternal@v8@@@2@PAVIsolate@2@PAX@Z ?New@Float32Array@v8@@SA?AV?$Local@VFloat32Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z ?New@Float32Array@v8@@SA?AV?$Local@VFloat32Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z ?New@Float64Array@v8@@SA?AV?$Local@VFloat64Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z ?New@Float64Array@v8@@SA?AV?$Local@VFloat64Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z ?New@Function@v8@@SA?AV?$Local@VFunction@v8@@@2@PAVIsolate@2@P6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@H@Z ?New@Function@v8@@SA?AV?$MaybeLocal@VFunction@v8@@@2@V?$Local@VContext@v8@@@2@P6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@H@Z ?New@FunctionTemplate@v8@@SA?AV?$Local@VFunctionTemplate@v8@@@2@PAVIsolate@2@P6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@V?$Local@VSignature@v8@@@2@HW4ConstructorBehavior@2@@Z ?New@Int16Array@v8@@SA?AV?$Local@VInt16Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z ?New@Int16Array@v8@@SA?AV?$Local@VInt16Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z ?New@Int32Array@v8@@SA?AV?$Local@VInt32Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z ?New@Int32Array@v8@@SA?AV?$Local@VInt32Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z ?New@Int8Array@v8@@SA?AV?$Local@VInt8Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z ?New@Int8Array@v8@@SA?AV?$Local@VInt8Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z ?New@Integer@v8@@SA?AV?$Local@VInteger@v8@@@2@PAVIsolate@2@H@Z ?New@Isolate@v8@@SAPAV12@ABUCreateParams@12@@Z ?New@Map@v8@@SA?AV?$Local@VMap@v8@@@2@PAVIsolate@2@@Z ?New@NativeWeakMap@v8@@SA?AV?$Local@VNativeWeakMap@v8@@@2@PAVIsolate@2@@Z ?New@Number@v8@@SA?AV?$Local@VNumber@v8@@@2@PAVIsolate@2@N@Z ?New@NumberObject@v8@@SA?AV?$Local@VValue@v8@@@2@PAVIsolate@2@N@Z ?New@Object@v8@@SA?AV?$Local@VObject@v8@@@2@PAVIsolate@2@@Z ?New@ObjectTemplate@v8@@CA?AV?$Local@VObjectTemplate@v8@@@2@PAVIsolate@internal@2@V?$Local@VFunctionTemplate@v8@@@2@@Z ?New@ObjectTemplate@v8@@SA?AV?$Local@VObjectTemplate@v8@@@2@PAVIsolate@2@V?$Local@VFunctionTemplate@v8@@@2@@Z ?New@ObjectTemplate@v8@@SA?AV?$Local@VObjectTemplate@v8@@@2@XZ ?New@Private@v8@@SA?AV?$Local@VPrivate@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z ?New@RegExp@v8@@SA?AV?$Local@VRegExp@v8@@@2@V?$Local@VString@v8@@@2@W4Flags@12@@Z ?New@RegExp@v8@@SA?AV?$MaybeLocal@VRegExp@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@W4Flags@12@@Z ?New@Resolver@Promise@v8@@SA?AV?$Local@VResolver@Promise@v8@@@3@PAVIsolate@3@@Z ?New@Resolver@Promise@v8@@SA?AV?$MaybeLocal@VResolver@Promise@v8@@@3@V?$Local@VContext@v8@@@3@@Z ?New@Set@v8@@SA?AV?$Local@VSet@v8@@@2@PAVIsolate@2@@Z ?New@SharedArrayBuffer@v8@@SA?AV?$Local@VSharedArrayBuffer@v8@@@2@PAVIsolate@2@I@Z ?New@SharedArrayBuffer@v8@@SA?AV?$Local@VSharedArrayBuffer@v8@@@2@PAVIsolate@2@PAXIW4ArrayBufferCreationMode@2@@Z ?New@Signature@v8@@SA?AV?$Local@VSignature@v8@@@2@PAVIsolate@2@V?$Local@VFunctionTemplate@v8@@@2@@Z ?New@StringObject@v8@@SA?AV?$Local@VValue@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z ?New@StringObject@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z ?New@Symbol@v8@@SA?AV?$Local@VSymbol@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z ?New@SymbolObject@v8@@SA?AV?$Local@VValue@v8@@@2@PAVIsolate@2@V?$Local@VSymbol@v8@@@2@@Z ?New@TypeSwitch@v8@@SA?AV?$Local@VTypeSwitch@v8@@@2@HQAV?$Local@VFunctionTemplate@v8@@@2@@Z ?New@TypeSwitch@v8@@SA?AV?$Local@VTypeSwitch@v8@@@2@V?$Local@VFunctionTemplate@v8@@@2@@Z ?New@Uint16Array@v8@@SA?AV?$Local@VUint16Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z ?New@Uint16Array@v8@@SA?AV?$Local@VUint16Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z ?New@Uint32Array@v8@@SA?AV?$Local@VUint32Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z ?New@Uint32Array@v8@@SA?AV?$Local@VUint32Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z ?New@Uint8Array@v8@@SA?AV?$Local@VUint8Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z ?New@Uint8Array@v8@@SA?AV?$Local@VUint8Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z ?New@Uint8ClampedArray@v8@@SA?AV?$Local@VUint8ClampedArray@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z ?New@Uint8ClampedArray@v8@@SA?AV?$Local@VUint8ClampedArray@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z ?NewExternal@String@v8@@SA?AV?$Local@VString@v8@@@2@PAVIsolate@2@PAVExternalOneByteStringResource@12@@Z ?NewExternal@String@v8@@SA?AV?$Local@VString@v8@@@2@PAVIsolate@2@PAVExternalStringResource@12@@Z ?NewExternalOneByte@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PAVExternalOneByteStringResource@12@@Z ?NewExternalTwoByte@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PAVExternalStringResource@12@@Z ?NewFromOneByte@String@v8@@SA?AV?$Local@VString@v8@@@2@PAVIsolate@2@PBEW4NewStringType@12@H@Z ?NewFromOneByte@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PBEW4NewStringType@2@H@Z ?NewFromTwoByte@String@v8@@SA?AV?$Local@VString@v8@@@2@PAVIsolate@2@PBGW4NewStringType@12@H@Z ?NewFromTwoByte@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PBGW4NewStringType@2@H@Z ?NewFromUnsigned@Integer@v8@@SA?AV?$Local@VInteger@v8@@@2@PAVIsolate@2@I@Z ?NewFromUtf8@String@v8@@SA?AV?$Local@VString@v8@@@2@PAVIsolate@2@PBDW4NewStringType@12@H@Z ?NewFromUtf8@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PBDW4NewStringType@2@H@Z ?NewInstance@Function@v8@@QBE?AV?$Local@VObject@v8@@@2@HQAV?$Local@VValue@v8@@@2@@Z ?NewInstance@Function@v8@@QBE?AV?$Local@VObject@v8@@@2@XZ ?NewInstance@Function@v8@@QBE?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?NewInstance@Function@v8@@QBE?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@HQAV?$Local@VValue@v8@@@2@@Z ?NewInstance@ObjectTemplate@v8@@QAE?AV?$Local@VObject@v8@@@2@XZ ?NewInstance@ObjectTemplate@v8@@QAE?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?NumberOfHandles@HandleScope@v8@@SAHPAVIsolate@2@@Z ?NumberOfHeapSpaces@Isolate@v8@@QAEIXZ ?NumberOfTrackedHeapObjectTypes@Isolate@v8@@QAEIXZ ?NumberValue@Value@v8@@QBE?AV?$Maybe@N@2@V?$Local@VContext@v8@@@2@@Z ?NumberValue@Value@v8@@QBENXZ ?ObjectProtoToString@Object@v8@@QAE?AV?$Local@VString@v8@@@2@XZ ?ObjectProtoToString@Object@v8@@QAE?AV?$MaybeLocal@VString@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?Parse@JSON@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z ?Parse@JSON@v8@@SA?AV?$MaybeLocal@VValue@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z ?PrepareStressRun@Testing@v8@@SAXH@Z ?PrintCurrentStackTrace@Message@v8@@SAXPAVIsolate@2@PAU_iobuf@@@Z ?ProcessDebugMessages@Debug@v8@@SAXXZ ?PrototypeTemplate@FunctionTemplate@v8@@QAE?AV?$Local@VObjectTemplate@v8@@@2@XZ ?QuickIsNull@Value@v8@@ABE_NXZ ?QuickIsString@Value@v8@@ABE_NXZ ?QuickIsUndefined@Value@v8@@ABE_NXZ ?RangeError@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z ?ReThrow@TryCatch@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ ?ReadOnlyPrototype@FunctionTemplate@v8@@QAEXXZ ?ReferenceError@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z ?RegisterExtension@v8@@YAXPAVExtension@1@@Z ?Reject@Resolver@Promise@v8@@QAE?AV?$Maybe@_N@3@V?$Local@VContext@v8@@@3@V?$Local@VValue@v8@@@3@@Z ?Reject@Resolver@Promise@v8@@QAEXV?$Local@VValue@v8@@@3@@Z ?RemoveCallCompletedCallback@Isolate@v8@@QAEXP6AXXZ@Z ?RemoveGCEpilogueCallback@Isolate@v8@@QAEXP6AXPAV12@W4GCType@2@W4GCCallbackFlags@2@@Z@Z ?RemoveGCEpilogueCallback@V8@v8@@SAXP6AXW4GCType@2@W4GCCallbackFlags@2@@Z@Z ?RemoveGCPrologueCallback@Isolate@v8@@QAEXP6AXPAV12@W4GCType@2@W4GCCallbackFlags@2@@Z@Z ?RemoveGCPrologueCallback@V8@v8@@SAXP6AXW4GCType@2@W4GCCallbackFlags@2@@Z@Z ?RemoveMemoryAllocationCallback@Isolate@v8@@QAEXP6AXW4ObjectSpace@2@W4AllocationAction@2@H@Z@Z ?RemoveMemoryAllocationCallback@V8@v8@@SAXP6AXW4ObjectSpace@2@W4AllocationAction@2@H@Z@Z ?RemoveMessageListeners@Isolate@v8@@QAEXP6AXV?$Local@VMessage@v8@@@2@V?$Local@VValue@v8@@@2@@Z@Z ?RemoveMessageListeners@V8@v8@@SAXP6AXV?$Local@VMessage@v8@@@2@V?$Local@VValue@v8@@@2@@Z@Z ?RemovePrototype@FunctionTemplate@v8@@QAEXXZ ?ReportExternalAllocationLimitReached@Isolate@v8@@AAEXXZ ?RequestGarbageCollectionForTesting@Isolate@v8@@QAEXW4GarbageCollectionType@12@@Z ?RequestInterrupt@Isolate@v8@@QAEXP6AXPAV12@PAX@Z1@Z ?Reset@TryCatch@v8@@QAEXXZ ?ResetInternal@TryCatch@v8@@AAEXXZ ?ResetToBookmark@ExternalSourceStream@ScriptCompiler@v8@@UAEXXZ ?Resolve@Resolver@Promise@v8@@QAE?AV?$Maybe@_N@3@V?$Local@VContext@v8@@@3@V?$Local@VValue@v8@@@3@@Z ?Resolve@Resolver@Promise@v8@@QAEXV?$Local@VValue@v8@@@3@@Z ?Run@Script@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ ?Run@Script@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?RunMicrotasks@Isolate@v8@@QAEXXZ ?SameValue@Value@v8@@QBE_NV?$Local@VValue@v8@@@2@@Z ?ScriptId@Function@v8@@QBEHXZ ?SendCommand@Debug@v8@@SAXPAVIsolate@2@PBGHPAVClientData@12@@Z ?Serialize@HeapSnapshot@v8@@QBEXPAVOutputStream@2@W4SerializationFormat@12@@Z ?Set@Map@v8@@QAE?AV?$MaybeLocal@VMap@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@1@Z ?Set@NativeWeakMap@v8@@QAEXV?$Local@VValue@v8@@@2@0@Z ?Set@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@IV?$Local@VValue@v8@@@2@@Z ?Set@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@1@Z ?Set@Object@v8@@QAE_NIV?$Local@VValue@v8@@@2@@Z ?Set@Object@v8@@QAE_NV?$Local@VValue@v8@@@2@0@Z ?Set@Template@v8@@QAEXPAVIsolate@2@PBDV?$Local@VData@v8@@@2@@Z ?Set@Template@v8@@QAEXV?$Local@VName@v8@@@2@V?$Local@VData@v8@@@2@W4PropertyAttribute@2@@Z ?SetAbortOnUncaughtExceptionCallback@Isolate@v8@@QAEXP6A_NPAV12@@Z@Z ?SetAcceptAnyReceiver@FunctionTemplate@v8@@QAEX_N@Z ?SetAccessCheckCallback@ObjectTemplate@v8@@QAEXP6A_NV?$Local@VContext@v8@@@2@V?$Local@VObject@v8@@@2@@ZV?$Local@VValue@v8@@@2@@Z ?SetAccessCheckCallbacks@ObjectTemplate@v8@@QAEXP6A_NV?$Local@VObject@v8@@@2@V?$Local@VValue@v8@@@2@W4AccessType@2@1@ZP6A_N0I21@Z1@Z ?SetAccessor@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@P6AX1ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX1V?$Local@VValue@v8@@@2@ABV?$PropertyCallbackInfo@X@2@@ZV?$MaybeLocal@VValue@v8@@@2@W4AccessControl@2@W4PropertyAttribute@2@@Z ?SetAccessor@Object@v8@@QAE_NV?$Local@VName@v8@@@2@P6AX0ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX0V?$Local@VValue@v8@@@2@ABV?$PropertyCallbackInfo@X@2@@Z3W4AccessControl@2@W4PropertyAttribute@2@@Z ?SetAccessor@Object@v8@@QAE_NV?$Local@VString@v8@@@2@P6AX0ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX0V?$Local@VValue@v8@@@2@ABV?$PropertyCallbackInfo@X@2@@Z3W4AccessControl@2@W4PropertyAttribute@2@@Z ?SetAccessor@ObjectTemplate@v8@@QAEXV?$Local@VName@v8@@@2@P6AX0ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX0V?$Local@VValue@v8@@@2@ABV?$PropertyCallbackInfo@X@2@@Z3W4AccessControl@2@W4PropertyAttribute@2@V?$Local@VAccessorSignature@v8@@@2@@Z ?SetAccessor@ObjectTemplate@v8@@QAEXV?$Local@VString@v8@@@2@P6AX0ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX0V?$Local@VValue@v8@@@2@ABV?$PropertyCallbackInfo@X@2@@Z3W4AccessControl@2@W4PropertyAttribute@2@V?$Local@VAccessorSignature@v8@@@2@@Z ?SetAccessorProperty@Object@v8@@QAEXV?$Local@VName@v8@@@2@V?$Local@VFunction@v8@@@2@1W4PropertyAttribute@2@W4AccessControl@2@@Z ?SetAccessorProperty@Template@v8@@QAEXV?$Local@VName@v8@@@2@V?$Local@VFunctionTemplate@v8@@@2@1W4PropertyAttribute@2@W4AccessControl@2@@Z ?SetAddHistogramSampleFunction@Isolate@v8@@QAEXP6AXPAXH@Z@Z ?SetAlignedPointerInEmbedderData@Context@v8@@QAEXHPAX@Z ?SetAlignedPointerInInternalField@Object@v8@@QAEXHPAX@Z ?SetAllowCodeGenerationFromStringsCallback@Isolate@v8@@QAEXP6A_NV?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@@Z@Z ?SetAllowCodeGenerationFromStringsCallback@V8@v8@@SAXP6A_NV?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@@Z@Z ?SetAutorunMicrotasks@Isolate@v8@@QAEX_N@Z ?SetBookmark@ExternalSourceStream@ScriptCompiler@v8@@UAE_NXZ ?SetCallAsFunctionHandler@ObjectTemplate@v8@@QAEXP6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@@Z ?SetCallHandler@FunctionTemplate@v8@@QAEXP6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@@Z ?SetCaptureMessage@TryCatch@v8@@QAEX_N@Z ?SetCaptureStackTraceForUncaughtExceptions@Isolate@v8@@QAEX_NHW4StackTraceOptions@StackTrace@2@@Z ?SetCaptureStackTraceForUncaughtExceptions@V8@v8@@SAX_NHW4StackTraceOptions@StackTrace@2@@Z ?SetClassName@FunctionTemplate@v8@@QAEXV?$Local@VString@v8@@@2@@Z ?SetCounterFunction@Isolate@v8@@QAEXP6APAHPBD@Z@Z ?SetCreateHistogramFunction@Isolate@v8@@QAEXP6APAXPBDHHI@Z@Z ?SetData@Isolate@v8@@QAEXIPAX@Z ?SetDebugEventListener@Debug@v8@@SA_NP6AXABVEventDetails@12@@ZV?$Local@VValue@v8@@@2@@Z ?SetDebugEventListener@Debug@v8@@SA_NPAVIsolate@2@P6AXABVEventDetails@12@@ZV?$Local@VValue@v8@@@2@@Z ?SetEmbedderData@Context@v8@@QAEXHV?$Local@VValue@v8@@@2@@Z ?SetEntropySource@V8@v8@@SAXP6A_NPAEI@Z@Z ?SetErrorMessageForCodeGenerationFromStrings@Context@v8@@QAEXV?$Local@VString@v8@@@2@@Z ?SetEventLogger@Isolate@v8@@QAEXP6AXPBDH@Z@Z ?SetFailedAccessCheckCallbackFunction@Isolate@v8@@QAEXP6AXV?$Local@VObject@v8@@@2@W4AccessType@2@V?$Local@VValue@v8@@@2@@Z@Z ?SetFailedAccessCheckCallbackFunction@V8@v8@@SAXP6AXV?$Local@VObject@v8@@@2@W4AccessType@2@V?$Local@VValue@v8@@@2@@Z@Z ?SetFatalErrorHandler@Isolate@v8@@QAEXP6AXPBD0@Z@Z ?SetFatalErrorHandler@V8@v8@@SAXP6AXPBD0@Z@Z ?SetFlagsFromCommandLine@V8@v8@@SAXPAHPAPAD_N@Z ?SetFlagsFromString@V8@v8@@SAXPBDH@Z ?SetHandler@ObjectTemplate@v8@@QAEXABUIndexedPropertyHandlerConfiguration@2@@Z ?SetHandler@ObjectTemplate@v8@@QAEXABUNamedPropertyHandlerConfiguration@2@@Z ?SetHiddenPrototype@FunctionTemplate@v8@@QAEX_N@Z ?SetHiddenValue@Object@v8@@QAE_NV?$Local@VString@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?SetIdle@CpuProfiler@v8@@QAEX_N@Z ?SetIndexedPropertyHandler@ObjectTemplate@v8@@QAEXP6AXIABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AXIV?$Local@VValue@v8@@@2@0@ZP6AXIABV?$PropertyCallbackInfo@VInteger@v8@@@2@@ZP6AXIABV?$PropertyCallbackInfo@VBoolean@v8@@@2@@ZP6AXABV?$PropertyCallbackInfo@VArray@v8@@@2@@Z2@Z ?SetInternalField@Object@v8@@QAEXHV?$Local@VValue@v8@@@2@@Z ?SetInternalFieldCount@ObjectTemplate@v8@@QAEXH@Z ?SetIntrinsicDataProperty@Template@v8@@QAEXV?$Local@VName@v8@@@2@W4Intrinsic@2@W4PropertyAttribute@2@@Z ?SetJitCodeEventHandler@Isolate@v8@@QAEXW4JitCodeEventOptions@2@P6AXPBUJitCodeEvent@2@@Z@Z ?SetLength@FunctionTemplate@v8@@QAEXH@Z ?SetLiveEditEnabled@Debug@v8@@SAXPAVIsolate@2@_N@Z ?SetMessageHandler@Debug@v8@@SAXP6AXABVMessage@12@@Z@Z ?SetName@Function@v8@@QAEXV?$Local@VString@v8@@@2@@Z ?SetNamedPropertyHandler@ObjectTemplate@v8@@QAEXP6AXV?$Local@VName@v8@@@2@ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX0V?$Local@VValue@v8@@@2@1@ZP6AX0ABV?$PropertyCallbackInfo@VInteger@v8@@@2@@ZP6AX0ABV?$PropertyCallbackInfo@VBoolean@v8@@@2@@ZP6AXABV?$PropertyCallbackInfo@VArray@v8@@@2@@Z3@Z ?SetNativeDataProperty@Template@v8@@QAEXV?$Local@VName@v8@@@2@P6AX0ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX0V?$Local@VValue@v8@@@2@ABV?$PropertyCallbackInfo@X@2@@Z3W4PropertyAttribute@2@V?$Local@VAccessorSignature@v8@@@2@W4AccessControl@2@@Z ?SetNativeDataProperty@Template@v8@@QAEXV?$Local@VString@v8@@@2@P6AX0ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX0V?$Local@VValue@v8@@@2@ABV?$PropertyCallbackInfo@X@2@@Z3W4PropertyAttribute@2@V?$Local@VAccessorSignature@v8@@@2@W4AccessControl@2@@Z ?SetNativesDataBlob@V8@v8@@SAXPAVStartupData@2@@Z ?SetObjectGroupId@Isolate@v8@@AAEXPAPAVObject@internal@2@VUniqueId@2@@Z ?SetPrivate@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VPrivate@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?SetPromiseRejectCallback@Isolate@v8@@QAEXP6AXVPromiseRejectMessage@2@@Z@Z ?SetPrototype@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z ?SetPrototype@Object@v8@@QAE_NV?$Local@VValue@v8@@@2@@Z ?SetReference@Isolate@v8@@AAEXPAPAVObject@internal@2@0@Z ?SetReferenceFromGroup@Isolate@v8@@AAEXVUniqueId@2@PAPAVObject@internal@2@@Z ?SetRetainedObjectInfo@HeapProfiler@v8@@QAEXVUniqueId@2@PAVRetainedObjectInfo@2@@Z ?SetReturnAddressLocationResolver@V8@v8@@SAXP6AII@Z@Z ?SetSamplingInterval@CpuProfiler@v8@@QAEXH@Z ?SetSecurityToken@Context@v8@@QAEXV?$Local@VValue@v8@@@2@@Z ?SetSnapshotDataBlob@V8@v8@@SAXPAVStartupData@2@@Z ?SetStackLimit@Isolate@v8@@QAEXI@Z ?SetStressRunType@Testing@v8@@SAXW4StressType@12@@Z ?SetUseCounterCallback@Isolate@v8@@QAEXP6AXPAV12@W4UseCounterFeature@12@@Z@Z ?SetVerbose@TryCatch@v8@@QAEX_N@Z ?SetWrapperClassInfoProvider@HeapProfiler@v8@@QAEXGP6APAVRetainedObjectInfo@2@GV?$Local@VValue@v8@@@2@@Z@Z ?ShutdownPlatform@V8@v8@@SAXXZ ?Size@Map@v8@@QBEIXZ ?Size@Set@v8@@QBEIXZ ?SlowGetAlignedPointerFromEmbedderData@Context@v8@@AAEPAXH@Z ?SlowGetAlignedPointerFromInternalField@Object@v8@@AAEPAXH@Z ?SlowGetEmbedderData@Context@v8@@AAE?AV?$Local@VValue@v8@@@2@H@Z ?SlowGetInternalField@Object@v8@@AAE?AV?$Local@VValue@v8@@@2@H@Z ?StackTrace@TryCatch@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ ?StackTrace@TryCatch@v8@@QBE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?StartProfiling@CpuProfiler@v8@@QAEXV?$Local@VString@v8@@@2@_N@Z ?StartStreamingScript@ScriptCompiler@v8@@SAPAVScriptStreamingTask@12@PAVIsolate@2@PAVStreamedSource@12@W4CompileOptions@12@@Z ?StartTrackingHeapObjects@HeapProfiler@v8@@QAEX_N@Z ?StopProfiling@CpuProfiler@v8@@QAEPAVCpuProfile@2@V?$Local@VString@v8@@@2@@Z ?StopTrackingHeapObjects@HeapProfiler@v8@@QAEXXZ ?StrictEquals@Value@v8@@QBE_NV?$Local@VValue@v8@@@2@@Z ?SyntaxError@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z ?TakeHeapSnapshot@HeapProfiler@v8@@QAEPBVHeapSnapshot@2@PAVActivityControl@2@PAVObjectNameResolver@12@@Z ?TerminateExecution@Isolate@v8@@QAEXXZ ?TerminateExecution@V8@v8@@SAXPAVIsolate@2@@Z ?Then@Promise@v8@@QAE?AV?$Local@VPromise@v8@@@2@V?$Local@VFunction@v8@@@2@@Z ?Then@Promise@v8@@QAE?AV?$MaybeLocal@VPromise@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VFunction@v8@@@2@@Z ?ThrowException@Isolate@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@@Z ?ToArrayIndex@Value@v8@@QBE?AV?$Local@VUint32@v8@@@2@XZ ?ToArrayIndex@Value@v8@@QBE?AV?$MaybeLocal@VUint32@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?ToBoolean@Value@v8@@QBE?AV?$Local@VBoolean@v8@@@2@PAVIsolate@2@@Z ?ToBoolean@Value@v8@@QBE?AV?$Local@VBoolean@v8@@@2@XZ ?ToBoolean@Value@v8@@QBE?AV?$MaybeLocal@VBoolean@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?ToDetailString@Value@v8@@QBE?AV?$Local@VString@v8@@@2@PAVIsolate@2@@Z ?ToDetailString@Value@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?ToDetailString@Value@v8@@QBE?AV?$MaybeLocal@VString@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?ToInt32@Value@v8@@QBE?AV?$Local@VInt32@v8@@@2@PAVIsolate@2@@Z ?ToInt32@Value@v8@@QBE?AV?$Local@VInt32@v8@@@2@XZ ?ToInt32@Value@v8@@QBE?AV?$MaybeLocal@VInt32@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?ToInteger@Value@v8@@QBE?AV?$Local@VInteger@v8@@@2@PAVIsolate@2@@Z ?ToInteger@Value@v8@@QBE?AV?$Local@VInteger@v8@@@2@XZ ?ToInteger@Value@v8@@QBE?AV?$MaybeLocal@VInteger@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?ToLocalEmpty@V8@v8@@CAXXZ ?ToNumber@Value@v8@@QBE?AV?$Local@VNumber@v8@@@2@PAVIsolate@2@@Z ?ToNumber@Value@v8@@QBE?AV?$Local@VNumber@v8@@@2@XZ ?ToNumber@Value@v8@@QBE?AV?$MaybeLocal@VNumber@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?ToObject@Value@v8@@QBE?AV?$Local@VObject@v8@@@2@PAVIsolate@2@@Z ?ToObject@Value@v8@@QBE?AV?$Local@VObject@v8@@@2@XZ ?ToObject@Value@v8@@QBE?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?ToString@Value@v8@@QBE?AV?$Local@VString@v8@@@2@PAVIsolate@2@@Z ?ToString@Value@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?ToString@Value@v8@@QBE?AV?$MaybeLocal@VString@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?ToUint32@Value@v8@@QBE?AV?$Local@VUint32@v8@@@2@PAVIsolate@2@@Z ?ToUint32@Value@v8@@QBE?AV?$Local@VUint32@v8@@@2@XZ ?ToUint32@Value@v8@@QBE?AV?$MaybeLocal@VUint32@v8@@@2@V?$Local@VContext@v8@@@2@@Z ?TypeError@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z ?Uint32Value@Value@v8@@QBE?AV?$Maybe@I@2@V?$Local@VContext@v8@@@2@@Z ?Uint32Value@Value@v8@@QBEIXZ ?UseDefaultSecurityToken@Context@v8@@QAEXXZ ?Utf8Length@String@v8@@QBEHPAVIsolate@2@@Z ?Utf8Length@String@v8@@QBEHXZ ?Value@Boolean@v8@@QBE_NXZ ?Value@External@v8@@QBEPAXXZ ?Value@Int32@v8@@QBEHXZ ?Value@Integer@v8@@QBE_JXZ ?Value@Number@v8@@QBENXZ ?Value@Uint32@v8@@QBEIXZ ?ValueOf@BooleanObject@v8@@QBE_NXZ ?ValueOf@Date@v8@@QBENXZ ?ValueOf@NumberObject@v8@@QBENXZ ?ValueOf@StringObject@v8@@QBE?AV?$Local@VString@v8@@@2@XZ ?ValueOf@SymbolObject@v8@@QBE?AV?$Local@VSymbol@v8@@@2@XZ ?VerifyExternalStringResource@String@v8@@ABEXPAVExternalStringResource@12@@Z ?VerifyExternalStringResourceBase@String@v8@@ABEXPAVExternalStringResourceBase@12@W4Encoding@12@@Z ?VisitExternalResources@Isolate@v8@@QAEXPAVExternalResourceVisitor@2@@Z ?VisitExternalResources@V8@v8@@SAXPAVExternalResourceVisitor@2@@Z ?VisitExternalString@ExternalResourceVisitor@v8@@UAEXV?$Local@VString@v8@@@2@@Z ?VisitHandlesForPartialDependence@Isolate@v8@@QAEXPAVPersistentHandleVisitor@2@@Z ?VisitHandlesForPartialDependence@V8@v8@@SAXPAVIsolate@2@PAVPersistentHandleVisitor@2@@Z ?VisitHandlesWithClassIds@Isolate@v8@@QAEXPAVPersistentHandleVisitor@2@@Z ?VisitHandlesWithClassIds@V8@v8@@SAXPAVIsolate@2@PAVPersistentHandleVisitor@2@@Z ?VisitHandlesWithClassIds@V8@v8@@SAXPAVPersistentHandleVisitor@2@@Z ?VisitPersistentHandle@PersistentHandleVisitor@v8@@UAEXPAV?$Persistent@VValue@v8@@V?$NonCopyablePersistentTraits@VValue@v8@@@2@@2@G@Z ?VisitWeakHandles@Isolate@v8@@QAEXPAVPersistentHandleVisitor@2@@Z ?WillAutorunMicrotasks@Isolate@v8@@QBE_NXZ ?Write@String@v8@@QBEHPAGHHH@Z ?WriteHeapStatsChunk@OutputStream@v8@@UAE?AW4WriteResult@12@PAUHeapStatsUpdate@2@H@Z ?WriteOneByte@String@v8@@QBEHPAEHHH@Z ?WriteUtf8@String@v8@@QBEHPADHPAHH@Z ?WriteUtf8@String@v8@@QBEHPAVIsolate@2@PADHPAHH@Z ?auto_enable@Extension@v8@@QAE_NXZ ?begin@ExtensionConfiguration@v8@@QBEPAPBDXZ ?code_range_size@ResourceConstraints@v8@@QBEIXZ ?data@ExternalOneByteStringResourceImpl@v8@@UBEPBDXZ ?dependencies@Extension@v8@@QAEPAPBDXZ ?dependency_count@Extension@v8@@QAEHXZ ?does_zap_garbage@HeapStatistics@v8@@QAEIXZ ?end@ExtensionConfiguration@v8@@QBEPAPBDXZ ?heap_size_limit@HeapStatistics@v8@@QAEIXZ ?impl@StreamedSource@ScriptCompiler@v8@@QBEPAU1internal@3@XZ ?kInternalFieldCount@ArrayBuffer@v8@@2HB ?kInternalFieldCount@ArrayBufferView@v8@@2HB ?kInternalFieldCount@SharedArrayBuffer@v8@@2HB ?kLineOffsetNotFound@Function@v8@@2HB ?kMaxLength@String@v8@@2HB ?kNoColumnInfo@Message@v8@@2HB ?kNoColumnNumberInfo@CpuProfileNode@v8@@2HB ?kNoLineNumberInfo@CpuProfileNode@v8@@2HB ?kNoLineNumberInfo@Message@v8@@2HB ?kNoScriptId@UnboundScript@v8@@2HB ?kNoScriptIdInfo@Message@v8@@2HB ?kPersistentHandleNoClassId@HeapProfiler@v8@@2GB ?kUnknownObjectId@HeapProfiler@v8@@2IB ?length@ExternalOneByteStringResourceImpl@v8@@UBEIXZ ?length@Utf8Value@String@v8@@QBEHXZ ?length@Value@String@v8@@QBEHXZ ?match@TypeSwitch@v8@@QAEHV?$Local@VValue@v8@@@2@@Z ?max_executable_size@ResourceConstraints@v8@@QBEHXZ ?max_old_space_size@ResourceConstraints@v8@@QBEHXZ ?max_semi_space_size@ResourceConstraints@v8@@QBEHXZ ?name@Extension@v8@@QBEPBDXZ ?object_count@HeapObjectStatistics@v8@@QAEIXZ ?object_size@HeapObjectStatistics@v8@@QAEIXZ ?object_sub_type@HeapObjectStatistics@v8@@QAEPBDXZ ?object_type@HeapObjectStatistics@v8@@QAEPBDXZ ?physical_space_size@HeapSpaceStatistics@v8@@QAEIXZ ?set_auto_enable@Extension@v8@@QAEX_N@Z ?set_code_range_size@ResourceConstraints@v8@@QAEXI@Z ?set_max_executable_size@ResourceConstraints@v8@@QAEXH@Z ?set_max_old_space_size@ResourceConstraints@v8@@QAEXH@Z ?set_max_semi_space_size@ResourceConstraints@v8@@QAEXH@Z ?set_stack_limit@ResourceConstraints@v8@@QAEXPAI@Z ?source@Extension@v8@@QBEPBVExternalOneByteStringResource@String@2@XZ ?source_length@Extension@v8@@QBEIXZ ?space_available_size@HeapSpaceStatistics@v8@@QAEIXZ ?space_name@HeapSpaceStatistics@v8@@QAEPBDXZ ?space_size@HeapSpaceStatistics@v8@@QAEIXZ ?space_used_size@HeapSpaceStatistics@v8@@QAEIXZ ?stack_limit@ResourceConstraints@v8@@QBEPAIXZ ?total_available_size@HeapStatistics@v8@@QAEIXZ ?total_heap_size@HeapStatistics@v8@@QAEIXZ ?total_heap_size_executable@HeapStatistics@v8@@QAEIXZ ?total_physical_size@HeapStatistics@v8@@QAEIXZ ?used_heap_size@HeapStatistics@v8@@QAEIXZ jsAddRef jsArg jsArgCount jsArgType jsArrayBuffer jsBindFunction jsBindGetter jsBindSetter jsBoolean jsCall jsCallGlobal jsDeleteObjectProp jsDouble jsEmptyArray jsEmptyObject jsEval jsEvalExW jsEvalW jsFalse jsFloat jsFunction jsGC jsGet jsGetArrayBuffer jsGetAt jsGetCallstack jsGetData jsGetGlobal jsGetKeys jsGetLastErrorIfException jsGetLength jsGetWebView jsGlobalObject jsInt jsIsArray jsIsBoolean jsIsFalse jsIsFunction jsIsJsValueValid jsIsNull jsIsNumber jsIsObject jsIsString jsIsTrue jsIsUndefined jsIsValidExecState jsNull jsObject jsReleaseRef jsSet jsSetAt jsSetGlobal jsSetLength jsString jsStringW jsThrowException jsToBoolean jsToDouble jsToFloat jsToInt jsToString jsToStringW jsToTempString jsToTempStringW jsToV8Value jsTrue jsTypeOf jsUndefined wkeAddDirtyArea wkeAddNpapiPlugin wkeAddPluginDirectory wkeAwaken wkeCanGoBack wkeCanGoForward wkeClearCookie wkeConfigure wkeContentsHeight wkeContentsWidth wkeContextMenuEvent wkeCookieEnabled wkeCopy wkeCreateMemBuf wkeCreateString wkeCreateStringW wkeCreateStringWithoutNullTermination wkeCreateWebCustomWindow wkeCreateWebView wkeCreateWebWindow wkeCut wkeDelete wkeDeleteString wkeDestroyWebView wkeDestroyWebWindow wkeDragTargetDragEnter wkeDragTargetDragLeave wkeDragTargetDragOver wkeDragTargetDrop wkeDragTargetEnd wkeEditorCopy wkeEditorCut wkeEditorDelete wkeEditorPaste wkeEditorRedo wkeEditorSelectAll wkeEditorUnSelect wkeEditorUndo wkeEnableWindow wkeFinalize wkeFireContextMenuEvent wkeFireKeyDownEvent wkeFireKeyPressEvent wkeFireKeyUpEvent wkeFireMouseEvent wkeFireMouseWheelEvent wkeFireWindowsMessage wkeFocus wkeFreeMemBuf wkeGC wkeGetBlinkMainThreadIsolate wkeGetCaret wkeGetCaretRect wkeGetClientHandler wkeGetContentAsMarkup wkeGetContentHeight wkeGetContentWidth wkeGetCookie wkeGetCookieW wkeGetCursorInfoType wkeGetDebugConfig wkeGetDocumentCompleteURL wkeGetFrameUrl wkeGetGlobalExecByFrame wkeGetHeight wkeGetHostHWND wkeGetMediaVolume wkeGetName wkeGetSource wkeGetString wkeGetStringLen wkeGetStringW wkeGetTempCallbackInfo wkeGetTitle wkeGetTitleW wkeGetURL wkeGetUserAgent wkeGetUserKeyValue wkeGetVersion wkeGetVersionString wkeGetViewDC wkeGetWebViewByNData wkeGetWebViewForCurrentContext wkeGetWebviewId wkeGetWidth wkeGetWindowHandle wkeGetZoomFactor wkeGlobalExec wkeGoBack wkeGoForward wkeGoToIndex wkeGoToOffset wkeHeight wkeInit wkeInitialize wkeInitializeEx wkeInsertCSSByFrame wkeIsAwake wkeIsCookieEnabled wkeIsDirty wkeIsDocumentReady wkeIsInitialize wkeIsLoadComplete wkeIsLoadFailed wkeIsLoaded wkeIsLoading wkeIsLoadingCompleted wkeIsLoadingFailed wkeIsLoadingSucceeded wkeIsMainFrame wkeIsProcessingUserGesture wkeIsTransparent wkeIsWebRemoteFrame wkeIsWebviewAlive wkeIsWebviewValid wkeJsBindFunction wkeJsBindGetter wkeJsBindSetter wkeKeyDown wkeKeyPress wkeKeyUp wkeKillFocus wkeLayoutIfNeeded wkeLoadFile wkeLoadFileW wkeLoadHTML wkeLoadHTMLW wkeLoadHtmlWithBaseUrl wkeLoadURL wkeLoadURLW wkeLoadW wkeMediaVolume wkeMouseEvent wkeMouseWheel wkeMoveToCenter wkeMoveWindow wkeNetAddHTTPHeaderFieldToUrlRequest wkeNetCancelRequest wkeNetCancelWebUrlRequest wkeNetChangeRequestUrl wkeNetContinueJob wkeNetCopyWebUrlRequest wkeNetCreatePostBodyElement wkeNetCreatePostBodyElements wkeNetCreateWebUrlRequest wkeNetCreateWebUrlRequest2 wkeNetDeleteBlinkWebURLRequestPtr wkeNetFreePostBodyElement wkeNetFreePostBodyElements wkeNetGetExpectedContentLength wkeNetGetFavicon wkeNetGetHTTPHeaderField wkeNetGetHTTPHeaderFieldFromResponse wkeNetGetHttpStatusCode wkeNetGetMIMEType wkeNetGetPostBody wkeNetGetRawHttpHead wkeNetGetRawResponseHead wkeNetGetRequestMethod wkeNetGetResponseUrl wkeNetGetUrlByJob wkeNetHoldJobToAsynCommit wkeNetHookRequest wkeNetOnResponse wkeNetSetData wkeNetSetHTTPHeaderField wkeNetSetMIMEType wkeNetStartUrlRequest wkeNodeOnCreateProcess wkeOnAlertBox wkeOnConfirmBox wkeOnConsole wkeOnContextMenuItemClick wkeOnCreateView wkeOnDidCreateScriptContext wkeOnDocumentReady wkeOnDocumentReady2 wkeOnDownload wkeOnDownload2 wkeOnDraggableRegionsChanged wkeOnLoadUrlBegin wkeOnLoadUrlEnd wkeOnLoadUrlFail wkeOnLoadingFinish wkeOnMouseOverUrlChanged wkeOnNavigation wkeOnOtherLoad wkeOnPaintBitUpdated wkeOnPaintUpdated wkeOnPluginFind wkeOnPrint wkeOnPromptBox wkeOnStartDragging wkeOnTitleChanged wkeOnURLChanged wkeOnURLChanged2 wkeOnWillMediaLoad wkeOnWillReleaseScriptContext wkeOnWindowClosing wkeOnWindowDestroy wkePaint wkePaint2 wkePaste wkePerformCookieCommand wkePluginListBuilderAddFileExtensionToLastMediaType wkePluginListBuilderAddMediaTypeToLastPlugin wkePluginListBuilderAddPlugin wkePostURL wkePostURLW wkePrintToBitmap wkeRegisterEmbedderCustomElement wkeReload wkeRepaintIfNeeded wkeResize wkeResizeWindow wkeRunJS wkeRunJSW wkeRunJsByFrame wkeRunMessageLoop wkeSaveMemoryCache wkeScreenshot wkeSelectAll wkeSetClientHandler wkeSetContextMenuEnabled wkeSetContextMenuItemShow wkeSetCookie wkeSetCookieEnabled wkeSetCookieJarFullPath wkeSetCookieJarPath wkeSetCspCheckEnable wkeSetCursorInfoType wkeSetDebugConfig wkeSetDeviceParameter wkeSetDirty wkeSetDragDropEnable wkeSetDragEnable wkeSetDragFiles wkeSetEditable wkeSetFileSystem wkeSetFocus wkeSetHandle wkeSetHandleOffset wkeSetHeadlessEnabled wkeSetLanguage wkeSetLocalStorageFullPath wkeSetMediaPlayerFactory wkeSetMediaVolume wkeSetMemoryCacheEnable wkeSetMouseEnabled wkeSetName wkeSetNavigationToNewWindowEnable wkeSetNpapiPluginsEnabled wkeSetProxy wkeSetResourceGc wkeSetString wkeSetStringW wkeSetStringWithoutNullTermination wkeSetTouchEnabled wkeSetTransparent wkeSetUIThreadCallback wkeSetUserAgent wkeSetUserAgentW wkeSetUserKeyValue wkeSetViewNetInterface wkeSetViewProxy wkeSetViewSettings wkeSetWebViewName wkeSetWindowTitle wkeSetWindowTitleW wkeSetZoomFactor wkeShowDevtools wkeShowWindow wkeShutdown wkeShutdownForDebug wkeSleep wkeStopLoading wkeTitle wkeTitleW wkeToString wkeToStringW wkeUnfocus wkeUpdate wkeUtilBase64Decode wkeUtilBase64Encode wkeUtilCreateV8Snapshot wkeUtilDecodeURLEscape wkeUtilEncodeURLEscape wkeUtilPrintToPdf wkeUtilRelasePrintPdfDatas wkeUtilSerializeToMHTML wkeUtilSetUiCallback wkeVersion wkeVersionString wkeVisitAllCookie wkeWake wkeWebFrameGetMainFrame wkeWebFrameGetMainWorldScriptContext wkeWebViewName wkeWidth wkeZoomFactor xslAddCall xslDebugStatus xslDropCall xslHandleDebugger xsltAddKey xsltAddStackElemList xsltAddTemplate xsltAllocateExtra xsltAllocateExtraCtxt xsltApplyAttributeSet xsltApplyImports xsltApplyOneTemplate xsltApplyStripSpaces xsltApplyStylesheet xsltApplyStylesheetUser xsltApplyTemplates xsltAttrListTemplateProcess xsltAttrTemplateProcess xsltAttrTemplateValueProcess xsltAttrTemplateValueProcessNode xsltAttribute xsltCalibrateAdjust xsltCallTemplate xsltCheckExtPrefix xsltCheckExtURI xsltCheckRead xsltCheckWrite xsltChoose xsltCleanupGlobals xsltCleanupTemplates xsltComment xsltCompileAttr xsltCompilePattern xsltComputeSortResult xsltCopy xsltCopyNamespace xsltCopyNamespaceList xsltCopyOf xsltCopyTextString xsltCreateRVT xsltDebug xsltDebugDumpExtensions xsltDebugGetDefaultTrace xsltDebugSetDefaultTrace xsltDecimalFormatGetByName xsltDefaultSortFunction xsltDoSortFunction xsltDocDefaultLoader xsltDocumentComp xsltDocumentElem xsltDocumentFunction xsltDocumentSortFunction xsltElement xsltElementAvailableFunction xsltEngineVersion xsltEvalAVT xsltEvalAttrValueTemplate xsltEvalGlobalVariables xsltEvalOneUserParam xsltEvalStaticAttrValueTemplate xsltEvalTemplateString xsltEvalUserParams xsltEvalXPathPredicate xsltEvalXPathString xsltEvalXPathStringNs xsltExtElementLookup xsltExtModuleElementLookup xsltExtModuleElementPreComputeLookup xsltExtModuleFunctionLookup xsltExtModuleTopLevelLookup xsltExtensionInstructionResultFinalize xsltExtensionInstructionResultRegister xsltFindDocument xsltFindElemSpaceHandling xsltFindTemplate xsltForEach xsltFormatNumberConversion xsltFormatNumberFunction xsltFreeAVTList xsltFreeAttributeSetsHashes xsltFreeCompMatchList xsltFreeCtxtExts xsltFreeDocumentKeys xsltFreeDocuments xsltFreeExts xsltFreeGlobalVariables xsltFreeKeys xsltFreeNamespaceAliasHashes xsltFreeRVTs xsltFreeSecurityPrefs xsltFreeStackElemList xsltFreeStyleDocuments xsltFreeStylePreComps xsltFreeStylesheet xsltFreeTemplateHashes xsltFreeTransformContext xsltFunctionAvailableFunction xsltFunctionNodeSet xsltGenerateIdFunction xsltGenericDebug xsltGenericDebugContext xsltGenericError xsltGenericErrorContext xsltGetCNsProp xsltGetDebuggerStatus xsltGetDefaultSecurityPrefs xsltGetExtData xsltGetExtInfo xsltGetKey xsltGetNamespace xsltGetNsProp xsltGetPlainNamespace xsltGetProfileInformation xsltGetQNameURI xsltGetQNameURI2 xsltGetSecurityPrefs xsltGetSpecialNamespace xsltGetTemplate xsltGetUTF8Char xsltGetXIncludeDefault xsltIf xsltInit xsltInitAllDocKeys xsltInitCtxtExts xsltInitCtxtKey xsltInitCtxtKeys xsltInitElemPreComp xsltInitGlobals xsltIsBlank xsltKeyFunction xsltLibxmlVersion xsltLibxsltVersion xsltLoadDocument xsltLoadStyleDocument xsltLoadStylesheetPI xsltLocalVariablePop xsltLocalVariablePush xsltMaxDepth xsltMaxVars xsltMessage xsltNamespaceAlias xsltNeedElemSpaceHandling xsltNewDocument xsltNewElemPreComp xsltNewSecurityPrefs xsltNewStyleDocument xsltNewStylesheet xsltNewTransformContext xsltNextImport xsltNormalizeCompSteps xsltNumber xsltNumberFormat xsltParseGlobalParam xsltParseGlobalVariable xsltParseStylesheetAttributeSet xsltParseStylesheetCallerParam xsltParseStylesheetDoc xsltParseStylesheetFile xsltParseStylesheetImport xsltParseStylesheetImportedDoc xsltParseStylesheetInclude xsltParseStylesheetOutput xsltParseStylesheetParam xsltParseStylesheetProcess xsltParseStylesheetVariable xsltParseTemplateContent xsltPreComputeExtModuleElement xsltPrintErrorContext xsltProcessOneNode xsltProcessingInstruction xsltProfileStylesheet xsltQuoteOneUserParam xsltQuoteUserParams xsltRegisterAllElement xsltRegisterAllExtras xsltRegisterAllFunctions xsltRegisterExtElement xsltRegisterExtFunction xsltRegisterExtModule xsltRegisterExtModuleElement xsltRegisterExtModuleFull xsltRegisterExtModuleFunction xsltRegisterExtModuleTopLevel xsltRegisterExtPrefix xsltRegisterExtras xsltRegisterLocalRVT xsltRegisterPersistRVT xsltRegisterTestModule xsltRegisterTmpRVT xsltReleaseRVT xsltResolveStylesheetAttributeSet xsltRunStylesheet xsltRunStylesheetUser xsltSaveProfiling xsltSaveResultTo xsltSaveResultToFd xsltSaveResultToFile xsltSaveResultToFilename xsltSaveResultToString xsltSecurityAllow xsltSecurityForbid xsltSetCtxtParseOptions xsltSetCtxtSecurityPrefs xsltSetCtxtSortFunc xsltSetDebuggerCallbacks xsltSetDebuggerStatus xsltSetDefaultSecurityPrefs xsltSetGenericDebugFunc xsltSetGenericErrorFunc xsltSetLoaderFunc xsltSetSecurityPrefs xsltSetSortFunc xsltSetTransformErrorFunc xsltSetXIncludeDefault xsltShutdownCtxtExts xsltShutdownExts xsltSort xsltSplitQName xsltStyleGetExtData xsltStylePreCompute xsltSystemPropertyFunction xsltTemplateProcess xsltTestCompMatchList xsltText xsltTimestamp xsltTransformError xsltUninit xsltUnparsedEntityURIFunction xsltUnregisterExtModule xsltUnregisterExtModuleElement xsltUnregisterExtModuleFunction xsltUnregisterExtModuleTopLevel xsltValueOf xsltVariableLookup xsltXPathCompile xsltXPathCompileFlags xsltXPathFunctionLookup xsltXPathGetTransformContext xsltXPathVariableLookup

Name

.text

Size

12.1MB

Virtual Size

12.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

955KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

737KB

Virtual Size

736KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/Microsoft/Internet Explorer/Quick Launch/pcdstart.dll

IMPHASH 4e1b61525e1e60b23ce7bc7bc455b974
SHA256 5ca5dfd7495add4b0a30276dc0d0cb4f60b69cdc4e82063942af2309db12e6c0
MD5 07028efd7499c4a897580819cd541972
SHA1 62e42b1f18b9570dc217b469032643920c018e73
SHA512 a9dc9814fe7bdc9355ee5290b0fa99559a482b229e9bfbf0244b25c98cf195032f005478672278f8a7ceadb6b679ec597e512d14baef03a26621e9ff5a0e9656
SSDEEP 6144:XDfAdqYyuYq8jEiG7RX2xjJ0GQhAluytjXxW1Q3F3ahSh79HFlm4X1fAY:XcdT8jEiORX2FnQhCuWW1C3YC7lFlmI9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

28:97:ee:38:65:f5:69:9e:7e:7b:a3:17:53:fd:a3:88:8f:eb:31:03

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Nov 27, 2014

Minor OS version

1

Major OS version

5

Entry point

4698

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/Microsoft/Internet Explorer/Quick Launch/pcmaster.exe

SHA256 8a770b4d23ad9ebd4c35b4f95cc340263efcfdf0ae2b3f4e0da0e3f1bca49201
MD5 dd263a7e06da82897612f4348442703b
SHA1 43242e2fa1bdec6711601fafbb220e3e3f64974f
SHA512 f7ffdfc3a528d7a20870825f255454ad96b04c3c3a5237e5a6eded46da9b27c8f3e4bab0ea8077cfc0e304808111dd75b681df7a38d358584818477824bd3458
SSDEEP 98304:M4sDs+zhpv5+HAOpDfG6RCEa1LZWv3pFMghZyxLf8vhRPuuZgixe07uKPZMLydUY:eneAefDuLchpyJfeRPXFnSL88jlhFULt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

d5:7d:a4:57:d7:ee:a9:43:ba:72:43:e4:99:a4:7e:27:8c:08:4e:20:32:9d:a7:3e:0b:5e:f2:69:e1:ac:b5:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Jun 12, 2020

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

38:38:9f:dd:c5:6d:f9:7b:dd:e5:24:f2:d7:66:ec:31

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 8, 2017 - Oct 6, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

5

Entry point

9820752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

generic

count=22, id=241, version=40116,

count=184, id=243, version=40116,

count=30, id=242, version=40116,

count=12, id=264, version=24215,

count=3, id=199, version=41118,

count=24, id=259, version=24123,

count=36, id=260, version=24123,

count=4, id=261, version=23013,

count=75, id=261, version=24123,

count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=693, id=1, productName=Unmarked objects,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=63, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

out.upx

SHA256 93fe6fd4d1fb45b3006339de7134205e55d75dbcc92102139db60fd9ffbcd9c8
MD5 ebd7215125f5f63367b26fa72c2ec584
SHA1 baf6b609d9b108e1dd18a3dd8fc9fdf1c12c6721
SHA512 1d4164c1f51b357b699987fb500f93b726514688a1ec2e38ea23ab6c23aab1837eab2317f1d640cce22ca75e12296f8aa889f6211fa0b77c918c31ec90b1b2f7
SSDEEP 98304:8+tUTGEsdW3WCko1LruohA2XKQCWg2xGlZvVsKR4PzltBuPw0RlVPdzBBGDW5T:89XkMOiKQ9IlZWLz/D0jPDGDE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

1639284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

859KB

Virtual Size

858KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

225KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

161KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=22, id=241, version=40116,

count=184, id=243, version=40116,

count=30, id=242, version=40116,

count=12, id=264, version=24215,

count=3, id=199, version=41118,

count=24, id=259, version=24123,

count=36, id=260, version=24123,

count=4, id=261, version=23013,

count=75, id=261, version=24123,

count=3, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=693, id=1, productName=Unmarked objects,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=63, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

$APPDATA/Microsoft/Internet Explorer/Quick Launch/pcmasterdata.dll

SHA256 7d4b05f5b926fc5eff87cfbec1246a4d3af35d9233b03fb9c571e8eed3215f12
MD5 83700123f572d5eae3214e2fb632e4e9
SHA1 344f94e69b10cd44e5caba1316ed0c51242f2964
SHA512 4642da8b67163d97f291538c229eac15cfad75f794153ea11d023e91216dc51cff0bb1a0803f191f7900c1c57418398b57a789daec12e81486c102ce45adf363
SSDEEP 6144:GwWsLOj1jb7cEdk6mkZm2yoNTDrn4HLqnI1dq/L:G1kojUEdbmwhyYn42I1dq/L
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

1e:a7:a0:97:13:a9:69:c1:01:90:92:35:a1:f6:55:88:89:66:05:46

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong \ ,C=CN

Chains

Jun 26, 2014

Minor OS version

1

Major OS version

5

Entry point

634080

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

sqlite3_activate_see sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_close_v2 sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_database_name sqlite3_column_database_name16 sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_origin_name sqlite3_column_origin_name16 sqlite3_column_table_name sqlite3_column_table_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_data_directory sqlite3_db_config sqlite3_db_filename sqlite3_db_handle sqlite3_db_mutex sqlite3_db_readonly sqlite3_db_release_memory sqlite3_db_status sqlite3_declare_vtab sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_errstr sqlite3_exec sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_key sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_load_extension sqlite3_log sqlite3_malloc sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_rekey sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_value sqlite3_result_zeroblob sqlite3_rollback_hook sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_step sqlite3_stmt_busy sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_stricmp sqlite3_strnicmp sqlite3_table_column_metadata sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_transfer_bindings sqlite3_update_hook sqlite3_uri_boolean sqlite3_uri_int64 sqlite3_uri_parameter sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_vtab_config sqlite3_vtab_on_conflict sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_checkpoint_v2 sqlite3_wal_hook sqlite3_win32_mbcs_to_utf8 sqlite3_win32_set_directory sqlite3_win32_sleep sqlite3_win32_utf8_to_mbcs sqlite3_win32_write_debug

out.upx

SHA256 1cf2e3b2dd3314c27e4ceb62ef94ecd52eadda578036cfaffae7dbfee15f0427
MD5 54c62c3ef14b2d7183b113eca140a2af
SHA1 17fce8ad004e728e009f98e93cd246d7d8bb8a72
SHA512 3a7517f09743c4b7dd71585bd136930481a51cec6f007d879e43a1f62c53edded1e14389a03b6d031614c0cb8a45c6874fa96a7e0ef2e2d99dcf24c9ee43d240
SSDEEP 12288:ADdhbC+/FBzGjN5qv0X4VkSGCSQof9qTWNjwdwHqnu:A/sZ5+06kvNjH+u
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

476926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/Microsoft/Internet Explorer/Quick Launch/pcmastersvc.exe

IMPHASH b3106dacb45fa644b39f7f5e100743aa
SHA256 2fe76db967411cf5cdc8edb22d158ec5ee1b0ff38a349c87c3485420521abe13
MD5 cee91c7a623d98fa3f2663d0d2cba582
SHA1 2801c34f8f579240572398e5de1933d230f4da6f
SHA512 342a4c47ca28f9302d80b8a82ccbbf9a9af6a6638272483f65329d5dcf4251021847dc8dc1c77d143e733662f38b73051f5c22e67b1f002d76d350c29629f532
SSDEEP 3072:voH/LVYQPUnGccnx/UuctA5syLGScXk/vvzTxzKuwM3QhCNklGEMYaXonYrolxwe:gfLRYh8x//L1cXkXBTRBSx7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

f6:2b:36:b6:ac:6d:75:6f:f6:3d:71:4f:a6:cc:2e:d8:cb:24:09:55

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Aug 5, 2014

Minor OS version

1

Major OS version

5

Entry point

46403

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\RuanMei\PCMaster\bin\Release\pcmastersvc.pdb

kernel32

GetFileAttributesW ReadFile Sleep WaitNamedPipeW SetEvent lstrcmpiW GetVersionExW ConnectNamedPipe GlobalAlloc MultiByteToWideChar RaiseException FindResourceW SizeofResource LockResource LoadResource FindResourceExW GlobalLock GlobalUnlock GlobalFree CreateDirectoryW GetModuleFileNameW GetFullPathNameW FileTimeToLocalFileTime FileTimeToSystemTime GetCommandLineW CreateFileW GetFileTime CopyFileW LocalFree GetLastError lstrlenW lstrcpyW GetModuleHandleW GetProcAddress GetCurrentProcess CreateFileMappingW MapViewOfFile WTSGetActiveConsoleSessionId GetTickCount CreateEventW WaitForSingleObject CloseHandle CreateNamedPipeW UnmapViewOfFile EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID FlushFileBuffers SetEnvironmentVariableA CompareStringW WriteConsoleW SetStdHandle GetStringTypeW IsValidLocale LCMapStringW GetConsoleMode GetConsoleCP SetFilePointer GetLocaleInfoW LoadLibraryW InterlockedExchange FreeLibrary SetConsoleCtrlHandler IsValidCodePage GetOEMCP GetACP EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RtlUnwind ExitThread GetCurrentThreadId CreateThread ResumeThread HeapSetInformation GetStartupInfoW EncodePointer DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetCurrentThread WideCharToMultiByte GetTimeZoneInformation ExitProcess HeapCreate WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime FatalAppExitA GetCPInfo

advapi32

RegisterServiceCtrlHandlerExW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetServiceStatus LookupPrivilegeValueW AdjustTokenPrivileges RegQueryValueExW RegCreateKeyExW RegFlushKey RegCloseKey RegOpenKeyExW OpenProcessToken DuplicateTokenEx SetTokenInformation QueryServiceStatus ControlService DeleteService OpenSCManagerW OpenServiceW CreateServiceW CloseServiceHandle ChangeServiceConfigW ChangeServiceConfig2W StartServiceW GetTokenInformation CreateProcessAsUserW StartServiceCtrlDispatcherW

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoInitializeEx CoUninitialize

oleaut32

SysFreeString

shlwapi

PathAppendW PathFileExistsW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

userenv

CreateEnvironmentBlock

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken WTSQuerySessionInformationW

$APPDATA/Microsoft/Internet Explorer/Quick Launch/rmup.exe

IMPHASH a939ad6ddfa6b02ecc5683afa6aec7aa
SHA256 390effe54a4bbf6fb42b62610900f2a0dcc5efe20925ac867bd2b3a6c6da9532
MD5 c6df640c06bd450585c74600c5b67d4e
SHA1 31f2d96c02051c3e59c94bf25516e507827d880f
SHA512 44ce1753a80030caeb82d1f54bcfa1edc936d6c108585abce7f5f8e325463220b7f8f846ea92a89503242f00b126cc12d02ea4d25700be998aaa8d2e7cb69842
SSDEEP 12288:jWja3wh2V5bXsuxSGg0WRGXp+4H84f55eJaRa2SizE2Wx8XPEXi1k/FtnUC:jOOXTnH84f55zEeXPEXi1EFFN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

4f:1d:0c:21:af:c4:c2:dc:11:d9:49:27:82:5e:fd:1f:f1:85:4d:57:d7:4f:be:b6:32:ad:f3:57:d3:04:1b:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Apr 3, 2020

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

38:38:9f:dd:c5:6d:f9:7b:dd:e5:24:f2:d7:66:ec:31

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 8, 2017 - Oct 6, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

5

Entry point

299897

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Magictray\rmup\rmup\Release\rmup.pdb

gdiplus

GdipDisposeImageAttributes GdipSetImageAttributesWrapMode GdipCreateFromHDC GdipDeleteGraphics GdipReleaseDC GdipSetSmoothingMode GdipSetInterpolationMode GdipFillRectangleI GdipDrawImagePointRectI GdipDrawImageRectRectI GdipCloneBrush GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateSolidFill GdipDeleteBrush GdipCreateImageAttributes GdipFree GdipAlloc GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdiplusShutdown GdiplusStartup GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat

kernel32

LockResource SetLastError LoadResource SizeofResource FindClose lstrcpyW FindResourceW FindResourceExW FindFirstFileW FindNextFileW DecodePointer InitializeCriticalSectionAndSpinCount LoadLibraryExA LoadLibraryExW BeginUpdateResourceA BeginUpdateResourceW UpdateResourceW EndUpdateResourceW MultiByteToWideChar WideCharToMultiByte InterlockedIncrement InterlockedDecrement FreeResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree LocalAlloc LocalFree OpenProcess GetCurrentProcess TerminateProcess GetCurrentThreadId EnterCriticalSection LeaveCriticalSection SetEvent GetFileSizeEx ReadFile DeviceIoControl MulDiv GetTickCount lstrcmpA lstrcmpW lstrcmpiW lstrcpynW lstrlenW OpenEventW GetModuleHandleW GetTempPathW GetWindowsDirectoryW CreateDirectoryW GetFullPathNameW SetFileAttributesW GetFileAttributesW MoveFileW GetVersionExW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreatePipe CreateMutexW GetStartupInfoW GetCurrentThread GetSystemInfo InitializeCriticalSection IsBadReadPtr MoveFileExW CopyFileW DeleteFileW CreateFileW GetTempFileNameW CreateProcessW GetModuleFileNameW LoadLibraryW CreateFileMappingW lstrcatW UnmapViewOfFile MapViewOfFile CloseHandle SetFilePointer WriteFile ResumeThread Sleep WaitForSingleObject GetVersion GetProcAddress FreeLibrary GetLastError RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetCurrentDirectoryW GetCurrentDirectoryW SetStdHandle SetFilePointerEx GetConsoleCP SetEndOfFile GetTimeZoneInformation FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStringTypeW ReadConsoleW GetConsoleMode GetACP GetStdHandle GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetDriveTypeW GetFullPathNameA InterlockedFlushSList TlsFree WriteConsoleW VirtualProtect VirtualQuery IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree ResetEvent WaitForSingleObjectEx CreateEventW TlsSetValue TlsGetValue TlsAlloc SetConsoleCtrlHandler OutputDebugStringA FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter SuspendThread SetThreadPriority GetFileSize CreateThread RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId DeleteCriticalSection

gdi32

SetBkColor ExtTextOutW BitBlt ExcludeClipRect CreateRectRgnIndirect CombineRgn SetViewportOrgEx GetObjectW GetObjectA CreateDIBSection SetTextColor SetBkMode SelectObject GetStockObject GetDeviceCaps GetBitmapBits DeleteObject DeleteDC CreateSolidBrush CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap

advapi32

RegQueryInfoKeyW AdjustTokenPrivileges AllocateAndInitializeSid FreeSid LookupPrivilegeValueW RegCloseKey RegCreateKeyExW RegDeleteValueW RegFlushKey SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl IsValidSecurityDescriptor InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl GetLengthSid OpenThreadToken AccessCheck RevertToSelf ImpersonateSelf RegEnumKeyExW RegDeleteKeyW GetUserNameW SetNamedSecurityInfoW SetEntriesInAclW RegSetValueExW RegQueryValueExW RegOpenKeyExW OpenProcessToken

shell32

SHFileOperationW ShellExecuteExW SHGetFolderPathW ShellExecuteW

ole32

CoGetClassObject CoCreateInstance StringFromCLSID CLSIDFromProgID StringFromGUID2 CoTaskMemAlloc CoUninitialize OleInitialize OleUninitialize OleRun OleLockRunning CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemFree CoInitialize CLSIDFromString

oleaut32

VarUI4FromStr OleCreateFontIndirect DispCallFunc LoadRegTypeLi LoadTypeLi VariantClear VariantInit VariantTimeToSystemTime SysAllocStringByteLen SysStringByteLen SysStringLen SysFreeString SysAllocStringLen SysAllocString CreateErrorInfo GetErrorInfo VariantChangeType SetErrorInfo SystemTimeToVariantTime

shlwapi

PathFileExistsW PathAppendW

comctl32

InitCommonControlsEx _TrackMouseEvent

mprapi

MprConfigGetFriendlyName MprConfigServerConnect

iphlpapi

GetAdaptersInfo GetInterfaceInfo GetPerAdapterInfo

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpQueryHeaders WinHttpOpenRequest WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse

imagehlp

CheckSumMappedFile

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

InternetSetOptionW InternetOpenW InternetCloseHandle InternetOpenUrlW InternetReadFile HttpQueryInfoW

urlmon

ObtainUserAgentString

crypt32

CryptDecodeObject CryptMsgGetParam CertFindCertificateInStore CryptQueryObject CertGetNameStringW

wintrust

WinVerifyTrust

Name

.text

Size

635KB

Virtual Size

635KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

13B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/Microsoft/Internet Explorer/Quick Launch/softmaster.exe

IMPHASH f706e94efdad7891a8eeaf5af04a7c6c
SHA256 67f5fb161125e9a6d412dcfa1431bec874bfa001f0ac3645bf5bca393ff48340
MD5 896bc886d1f71a8dfaacffb4d45d381d
SHA1 d263eee85b5cf09787bce4a46069ee729ff4b571
SHA512 1d0f49f9805d329f3806fac6827a52b0a28aafc4d82f43ad28a0f82d4287855950c8976a21be8d00a2bfd490e3e83a1079f3808fa3f16935600656bcb7c36e56
SSDEEP 98304:KizXZH0pyu4HoagLht2ZEM47n+jEtLk4+7DOSOWHBN:K8Jbsk947nsuQ4+7DO0X
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

d5:a3:4f:02:a4:e0:d8:01:20:02:0a:4b:1b:0f:1f:5b:66:1e:a3:e4:3a:5a:dc:1e:a6:3d:5b:5d:ba:ab:71:2d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Jun 12, 2020

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

38:38:9f:dd:c5:6d:f9:7b:dd:e5:24:f2:d7:66:ec:31

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 8, 2017 - Oct 6, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

5

Entry point

1075772

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TFS\PCMaster\PCMaster\SoftMaster\Bin\softmaster.pdb

kernel32

GlobalMemoryStatusEx VirtualProtect GetLongPathNameW GetCurrentProcessId ExitProcess SetUnhandledExceptionFilter CreateThread GetCurrentThread GetCurrentThreadId WriteProcessMemory SuspendThread ResumeThread SetEvent GetLogicalDrives GetFileSizeEx GetFileTime SystemTimeToTzSpecificLocalTime FileTimeToLocalFileTime FileTimeToDosDateTime lstrcmpW CreateMutexW OpenEventW GetLogicalDriveStringsW LoadLibraryExW GetCommandLineW GetEnvironmentVariableW EnumResourceNamesW GetDriveTypeW GetSystemDirectoryW GetTempPathW GetTempFileNameW GetWindowsDirectoryW GetSystemWow64DirectoryW SetCurrentDirectoryW GetDiskFreeSpaceExW RemoveDirectoryW CreateFileA DeleteFileA MoveFileA MoveFileW WaitNamedPipeW IsBadReadPtr IsBadCodePtr GetLocaleInfoW GetNumberFormatW Module32FirstW Module32NextW VirtualAllocEx VirtualFreeEx CreateRemoteThread lstrlenA TerminateThread GetExitCodeThread ResetEvent ReleaseSemaphore WaitForMultipleObjects CreateSemaphoreW ReadProcessMemory FindClose DeviceIoControl SetLastError FreeResource Thread32Next Thread32First Process32NextW Process32FirstW CreateToolhelp32Snapshot GetVersionExW MoveFileExW CopyFileW GetFullPathNameW ExpandEnvironmentStringsW CreateProcessW GetModuleHandleW GetModuleFileNameW LoadLibraryW OpenFileMappingW CreateEventW lstrlenW lstrcatW lstrcpyW lstrcpynW lstrcmpiW lstrcmpA GetSystemInfo Sleep WaitForSingleObject LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetThreadTimes OpenThread GetProcessId TerminateProcess GetCurrentProcess OpenProcess LocalFree LocalAlloc GlobalFree FreeLibrary GlobalLock GlobalAlloc GetProcAddress CreateFileMappingW UnmapViewOfFile MapViewOfFile InterlockedDecrement InterlockedIncrement FindNextFileW GetTickCount FileTimeToSystemTime GetLocalTime GetFileSize GetFileInformationByHandle GetFileAttributesW CreateFileW CreateDirectoryW GetCurrentDirectoryW LocalFileTimeToFileTime SystemTimeToFileTime CloseHandle SetFileTime SetFilePointer ReadFile WriteFile WideCharToMultiByte DeleteFileW SetFileAttributesW WritePrivateProfileStringW GetPrivateProfileStringW MultiByteToWideChar FindResourceExW FindResourceW SizeofResource LoadResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException GetProcessHeap HeapSize SetEndOfFile WriteConsoleW FlushFileBuffers DecodePointer OutputDebugStringA SetConsoleCtrlHandler SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA GetTimeZoneInformation SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode GetACP GetStdHandle GetModuleFileNameA GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetFullPathNameA PeekNamedPipe GetFileType InterlockedFlushSList InterlockedPushEntrySList RtlUnwind GetUserDefaultUILanguage IsBadStringPtrW MulDiv GetStringTypeW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo EncodePointer FormatMessageW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent UnhandledExceptionFilter WaitForSingleObjectEx OutputDebugStringW IsDebuggerPresent LoadLibraryExA VirtualQuery FindFirstFileW GlobalUnlock HeapFree HeapReAlloc HeapAlloc HeapDestroy LockResource GetStartupInfoW

gdi32

TextOutW MoveToEx StretchBlt ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CreateRectRgn CombineRgn SetStretchBltMode SetBitmapBits GetStockObject GetBitmapBits CreateCompatibleBitmap CreatePatternBrush PtInRegion OffsetRgn SetWindowOrgEx SaveDC RestoreDC CreateRoundRectRgn BitBlt GetDeviceCaps GetTextMetricsW GdiFlush GetObjectW CreateDCW SetTextColor SetBkMode SetBkColor Rectangle CreateSolidBrush CreatePen CreateFontIndirectW SetDIBColorTable CreateDIBSection SelectObject GetDIBits DeleteObject DeleteDC CreateCompatibleDC

comdlg32

GetOpenFileNameW

advapi32

AllocateAndInitializeSid SetNamedSecurityInfoW SetEntriesInAclW RegSetValueExW RegQueryInfoKeyW RegEnumValueW CreateProcessAsUserW RegCloseKey RegCreateKeyExW RegFlushKey RegOpenKeyExW RegQueryValueExW SaferCreateLevel SaferCloseLevel SaferComputeTokenFromLevel OpenProcessToken GetTokenInformation SetTokenInformation AdjustTokenPrivileges ConvertStringSidToSidW FreeSid GetLengthSid LookupPrivilegeValueW GetUserNameW DuplicateTokenEx RegDeleteKeyW RegDeleteValueW RegEnumKeyExW

shell32

Shell_NotifyIconW SHGetFileInfoW SHFileOperationW SHBrowseForFolderW ExtractIconExW ExtractIconW CommandLineToArgvW ShellExecuteW DragAcceptFiles DragQueryFileW SHGetFolderPathW SHGetMalloc ShellExecuteExW SHGetPathFromIDListW

ole32

OleLockRunning CLSIDFromProgID CLSIDFromString CreateILockBytesOnHGlobal ReleaseStgMedium OleDuplicateData OleSetContainedObject OleCreateStaticFromData StgCreateDocfileOnILockBytes StgCreateDocfile OleUninitialize CoInitialize CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree OleInitialize CoTaskMemRealloc

oleaut32

SetErrorInfo VariantChangeType SysAllocString GetErrorInfo VarUdateFromDate VarUI4FromStr VariantClear VariantInit SysFreeString CreateErrorInfo

shlwapi

PathFileExistsW PathAppendW PathFindExtensionW PathFileExistsA PathFindFileNameW PathRemoveExtensionW SHDeleteKeyW

gdiplus

GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipGetImagePixelFormat GdipAlloc GdipCreateBitmapFromStreamICM GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipFree GdipGetImagePalette GdipGetImagePaletteSize GdipDeleteGraphics GdipDrawImageI GdipDrawImageRectRectI GdipGetImageEncodersSize GdipGetImageEncoders GdiplusShutdown GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdipTranslateWorldTransform GdipSetStringFormatHotkeyPrefix GdipCreateBitmapFromHICON GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipSetSmoothingMode GdipSetInterpolationMode GdipDrawImageRectI GdipSaveImageToFile GdipCreateHBITMAPFromBitmap GdipSetImageAttributesWrapMode GdipCreateBitmapFromStream GdipCreateFromHDC GdipReleaseDC GdipRotateWorldTransform GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFontFromDC GdipDrawPath GdipDrawRectangleI GdipDrawLineI GdipSetTextRenderingHint GdipSetImageAttributesColorKeys GdipSetPenDashStyle GdipDeletePen GdipGraphicsClear GdipSaveGraphics GdiplusStartup GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wininet

InternetGetLastResponseInfoW HttpOpenRequestW HttpSendRequestExW HttpEndRequestW HttpQueryInfoW InternetSetOptionW InternetWriteFile InternetReadFile InternetOpenUrlW InternetConnectW InternetCloseHandle InternetOpenW InternetCheckConnectionW

urlmon

URLDownloadToFileW ObtainUserAgentString

crypt32

CertGetNameStringW CryptQueryObject CryptMsgGetParam CryptDecodeObject CertFindCertificateInStore

wintrust

WinVerifyTrust

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpAddRequestHeaders WinHttpSetTimeouts WinHttpOpenRequest

iphlpapi

GetAdaptersInfo

dbghelp

MiniDumpWriteDump

comctl32

ord17 _TrackMouseEvent

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

609KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=23, id=241, version=40116,

count=184, id=243, version=40116,

count=31, id=242, version=40116,

count=1, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=150, version=20413,

count=25, id=259, version=24123,

count=36, id=260, version=24123,

count=2, id=261, version=23013,

count=12, id=264, version=24215,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=607, id=1, productName=Unmarked objects,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=72, id=261, version=24123,

count=56, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

$APPDATA/Microsoft/Internet Explorer/Quick Launch/softmastergreen.dll

SHA256 45a169a45936c7010852208307d0acb950042a5f4407c2f2452455e40a1a503f
MD5 fd241ac838dd9f59ab74aa2fd1c5edb7
SHA1 5b981e422b4670ff04fce3f0f6ad5d031e2a7e45
SHA512 236c7e63e4e64050dc88db946d33854e3d76f1d70a3269d3fe5b927b54997d8697e00cd8dbe4776c53a19d2d4aeadfc31c9ab4b7e51212dadc1520036470fe44
SSDEEP 1536:j9FIT1VnybWdko5tW0RGyz4Sd0mQ9+YsAVUpIoGY:j9FI/ybGqaGyzHFiGpIoR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

08:e5:f3:79:78:6e:d7:38:f3:f1:18:59:d1:6d:c2:17:34:87:da:f9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Aug 21, 2014

Minor OS version

1

Major OS version

5

Entry point

351984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 717b65f9ed26475d99ddb0667487524e322ee8d112238adb8b545fb3a50755b3
MD5 f0be5bc2980b8e31804c8a9b3beb530b
SHA1 ea361ad07f0671043a10b6806e461689bf1f22e0
SHA512 21e7013685b84d40d4b82d4adb87aac21a8031837c25d63d3c373fd134227ea2a90d029200d3100aa6e46e2bf76a5461632dc99b1bd2dd39555db3c8eb773e44
SSDEEP 3072:DArmCP8U5wXg5E9iGskVmKgPUXIrn8bxthiyLcWzUdgF8zrdEK:9UC2TUXIr+iwcTdgEE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

89903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/Microsoft/Internet Explorer/Quick Launch/virtualdrivemaster.exe

SHA256 426dd9ec1511b855367cbf868dd49f18770d15003b731a829bffb86bc1f699d9
MD5 492818f32d319fa417c4d71c8ca8b492
SHA1 4a67bda289fb9d4ac852fd8b0bc7461e99c08731
SHA512 7af838ce8872e68de91dadcddff386b322abe8dc8d88041f45f76137f6121bfe8cfe853d6f8b4b930d5400f0d7e26e60b7efe6b670241c63692b076d2fd289ac
SSDEEP 12288:rKn08qTV/XGvFYfgOdbjEdiRBe3TlRhMJaDmKf:HjV/XGvFYYks3TbGJ7G
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

d8:2b:04:42:92:79:59:1f:95:e8:dc:1a:5a:6e:a7:55:ad:e1:00:3b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Aug 11, 2015

Minor OS version

0

Major OS version

5

Entry point

933632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 1b7aaa3694e57b16e733d3dcbe2d7f81e08910cc3d576041feef22c00aba915d
MD5 c936cb777d07ad9888880ccaeaa2fc6b
SHA1 2892c79a067559d591a6639ac6fbfd04f54b7531
SHA512 3acfd89344c7c683b589d9d8d0a2881ac592faf482fd9901ca4d666a277d6f59d52c681b77b993c0a275c738fd0a7ddf451d19b5361b1dfca7a29eac1a4f2bcb
SSDEEP 12288:bd2rdJASvDX3mhjEDAAu4rAL64jND2K+laB3DmKjNvYp6kyMWSH5aeNdaLZr5:ZwXEWmZB+sUuQpktCdaLl5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

201458

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$APPDATA/Microsoft/Internet Explorer/Quick Launch/visualmaster.exe

SHA256 71add548b0684c3c16d3a46280e6dcbb8338b4c5beb86ca654dd3e43c5933c69
MD5 ef77f7b055ed80058679f0b0f36361aa
SHA1 63c0071058db2869d259b74401441e91416cafb1
SHA512 b7e1921e78cd27a2dc8113f91d3fc1efb5a55d23f3e034e6ff47a41ba1623ffc11b5c358c8d792d7daeaeafdf5340cf99544a23352942dae446ddc0f133a0f91
SSDEEP 12288:vuHV3oEYndgOgPslgw5yM3fwZGzqPxdFfUC1c5dOMTSgc+3l:2HV3udgODlLyM3f3eLhUC1c59TSL+V
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

53:2e:d9:47:db:62:87:e9:cf:b2:b3:90:85:9d:56:4b:6d:e9:f9:c5:c9:db:7a:30:d7:9f:f1:06:1c:ce:51:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Dec 6, 2016

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

27:d2:c6:72:a3:45:4d:da:5b:a8:2b:27:91:d0:e3:48:01:f7:a2:22

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Dec 6, 2016

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

50:28:4b:e9:ab:1a:22:9c:8f:2c:9f:dd:7b:7e:4a:e4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 13, 2016 - Aug 26, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

5a:de:81:b0:3a:cc:dd:91:fa:96:e7:89:18:ad:f6:e7

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2016 - Aug 23, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Serial Number

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

1

Major OS version

5

Entry point

1611760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$APPDATA/Microsoft/Internet Explorer/Quick Launch/winguard.dll

SHA256 90ad1703a8b8176119a05f2e6d2d69b7e678fc0e422d98bbe99d309b472109d0
MD5 4916e5d865b9c3f11c5cda3977aa11a3
SHA1 9f85fa22676f65e205b264dc35b5d5c7339376a1
SHA512 997271febbff2e58aac31a0de563a556122d672af8e5c591fd0b48bf660c5721e7d6b6aeb055999f7ebe25d48a35ab1facbb3c74e2a921c399be750eaf79e76a
SSDEEP 3072:YFmusSFVNfFGG6xn6THmIcvxuWqZ9dEe4Aa/kh:YhsaNfFl6x6TGQdECQK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

1c:66:e5:7f:1e:df:4a:c9:82:e9:52:f3:da:3f:a5:9d:32:2f:ce:68:78:2b:db:39:e1:f8:e0:00:4a:80:9d:6d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Jun 7, 2016

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

b3:a0:30:2e:3e:4b:a3:31:f0:d5:51:cf:df:74:ed:c6:45:18:48:25

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Jun 7, 2016

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

50:28:4b:e9:ab:1a:22:9c:8f:2c:9f:dd:7b:7e:4a:e4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 13, 2016 - Aug 26, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

5a:de:81:b0:3a:cc:dd:91:fa:96:e7:89:18:ad:f6:e7

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2016 - Aug 23, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Serial Number

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

1

Major OS version

5

Entry point

437088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/Microsoft/Internet Explorer/Quick Launch/winguard.exe

IMPHASH a396de091f536efbc4640e84087f2a0e
SHA256 26137b727156f11d56b45172b30f4d4bea69b4b6c1b141a9c27cc9abbcd53da4
MD5 e655e1bd32d748ff5a436da8b81d18e6
SHA1 d7885dd7720afc3c566ec7ba9ff8112f1008e571
SHA512 3e0b587663691e4a13a8aa2f03edaa0960a2e092b0db742b176f8bf0e29aee11c3e0147742db64fa4f0a0ead4ea62b79c415216d01a0b1870cb388085a4289ca
SSDEEP 12288:ZqHlh0/8vpGqODTPStgN0FDTK0Asbaq9QvSPupXZ:Q/AmaqTPUZ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

9d:04:af:d2:dd:df:c3:56:f4:79:d1:b4:f6:f7:33:40:d9:29:e3:4a:8f:34:00:e2:01:a8:73:ac:fb:9e:bf:03

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Jun 12, 2020

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

38:38:9f:dd:c5:6d:f9:7b:dd:e5:24:f2:d7:66:ec:31

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 8, 2017 - Oct 6, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

5

Entry point

255805

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceExW MultiByteToWideChar WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection GetLastError GetCurrentProcess GetProcAddress GetModuleHandleW CloseHandle HeapFree LocalAlloc HeapAlloc GetProcessHeap LocalFree WaitForSingleObject CreateRemoteThread GetVersionExW VirtualFreeEx LoadLibraryW WriteProcessMemory VirtualAllocEx lstrlenW OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot Module32NextW Module32FirstW lstrlenA LeaveCriticalSection DeviceIoControl CreateFileW FreeLibrary SetEvent CreateEventW EnterCriticalSection OutputDebugStringW OpenEventW InitializeCriticalSectionAndSpinCount FlushInstructionCache FindNextFileW FindClose UnmapViewOfFile MapViewOfFile CreateFileMappingW OpenFileMappingW GetCurrentThreadId InterlockedIncrement InterlockedDecrement lstrcmpiW SuspendThread lstrcpyW SetLastError CreateProcessW GetStartupInfoW ReadFile GetFileSizeEx CreateFileA LoadLibraryExW GetModuleFileNameW ExpandEnvironmentStringsW GlobalFree GlobalUnlock GlobalLock GlobalAlloc MoveFileExW MoveFileW GetTickCount DeleteFileW SetFileAttributesW FindResourceW CreateDirectoryW GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDrives GetExitCodeThread CreateThread FindFirstFileW GlobalMemoryStatusEx GetSystemDirectoryW GetWindowsDirectoryW GetFullPathNameW GetTempFileNameW WriteFile WaitNamedPipeW DeleteFileA MoveFileA CopyFileW GetLocalTime Sleep lstrcpyA RemoveDirectoryW GetComputerNameW OpenMutexW GetCommandLineW GetCurrentProcessId LoadLibraryA HeapDestroy HeapReAlloc SetEnvironmentVariableA CompareStringW SetEndOfFile GetCurrentDirectoryW WriteConsoleW FlushFileBuffers SetStdHandle QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW IsValidLocale EnumSystemLocalesA HeapSize GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation GetStringTypeW ExitProcess HeapCreate LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP SetFilePointer GetFileType SetHandleCount GetLocaleInfoW GetStdHandle InterlockedCompareExchange InterlockedPushEntrySList IsProcessorFeaturePresent VirtualFree VirtualAlloc InterlockedPopEntrySList RtlUnwind DecodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer ExitThread GetSystemTimeAsFileTime LoadResource LockResource SizeofResource GetFileAttributesW RaiseException TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter HeapSetInformation GetDateFormatW GetTimeFormatW InterlockedExchange

user32

GetMessageW PeekMessageW CharNextW DefWindowProcW RegisterClassExW CreateWindowExW TranslateMessage CallWindowProcW wsprintfW GetSystemMetrics IsWindow FindWindowW GetWindowThreadProcessId DispatchMessageW PostThreadMessageW DestroyWindow UnregisterClassA LoadCursorW SetWindowLongW GetWindowLongW GetClassInfoExW RegisterWindowMessageW

shell32

ShellExecuteW SHGetFolderPathW ShellExecuteExW CommandLineToArgvW

ole32

CoInitialize CoTaskMemRealloc CoInitializeSecurity CoTaskMemFree CoInitializeEx CoSetProxyBlanket CoUninitialize CoCreateInstance CoTaskMemAlloc

oleaut32

VarUI4FromStr VariantClear VariantInit SysAllocString VariantTimeToSystemTime SysFreeString SystemTimeToVariantTime

shlwapi

PathFileExistsA PathFileExistsW PathAppendW

mprapi

MprConfigServerConnect MprConfigGetFriendlyName

iphlpapi

GetInterfaceInfo GetNetworkParams GetAdaptersInfo GetPerAdapterInfo

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

InternetReadFile InternetOpenW InternetSetOptionW InternetOpenUrlW InternetCloseHandle InternetCheckConnectionW HttpQueryInfoW

urlmon

URLDownloadToFileW

$APPDATA/Microsoft/Internet Explorer/Quick Launch/winguard_x64.dll

IMPHASH 1021865a8b7c4865c2c6af56a2b5f276
SHA256 1b842efe2780ccf6d4e91740ef78ced806065f971e3c35f88596a69e6b0af4b3
MD5 b5228a220539fe4da97b9c6d501e50d3
SHA1 91adf63d4314b38188b7166b0b868cb3515ea166
SHA512 d8b2ef6065c4736ff36919f202c1860e0ad86e0a4de89641cc99ae13e2e9cf505f3f9890d6f4a03e605ab7087a59be3e275f3fee2fab191a9ac3910ecfbbca50
SSDEEP 6144:m9TH2FmRdW4w+6BS51sI2d5MrHygkbuftTzlkpzRrVsN58o1h23dim:2WjLJBS51sI2zc+yh76
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Digest

4a:d3:f3:b0:31:6b:68:f8:b7:d6:4c:bf:a0:cd:d2:9d:5c:54:7a:f8:95:af:c0:d7:ff:94:9f:bf:d1:1a:a9:f9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Apr 14, 2016

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

87:d5:8b:9f:a2:45:a4:fa:84:7d:e2:ec:8d:8c:e0:3f:fb:13:7d:49

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Apr 14, 2016

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

50:28:4b:e9:ab:1a:22:9c:8f:2c:9f:dd:7b:7e:4a:e4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 13, 2016 - Aug 26, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

5a:de:81:b0:3a:cc:dd:91:fa:96:e7:89:18:ad:f6:e7

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2016 - Aug 23, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Serial Number

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

2

Major OS version

5

Entry point

279992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalLock GlobalAlloc lstrcpyW lstrlenW RaiseException FindResourceW SizeofResource LockResource LoadResource FindResourceExW FlushInstructionCache VirtualProtectEx EnterCriticalSection InitializeCriticalSection LeaveCriticalSection VirtualAlloc VirtualQuery GetSystemInfo VirtualFree CloseHandle ResumeThread SetThreadPriority GetThreadPriority Sleep GetThreadContext SuspendThread OpenThread GetProcAddress UnmapViewOfFile MapViewOfFile OpenFileMappingW LocalFree GetLastError GetProcessId GlobalUnlock SetEvent OpenEventW FreeLibrary ExpandEnvironmentStringsW ReadProcessMemory HeapFree HeapAlloc GetProcessHeap OpenProcess GetVersionExW lstrcmpiA CreateProcessW GetCommandLineW LoadLibraryExW GetStringTypeW SetStdHandle MultiByteToWideChar SetFilePointer GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA HeapSize HeapReAlloc LCMapStringW FlsAlloc GlobalFree GetModuleHandleW WideCharToMultiByte LoadLibraryW GetCurrentProcess GetCurrentThreadId OutputDebugStringW lstrcmpW IsBadReadPtr lstrcmpiW GetModuleFileNameW DisableThreadLibraryCalls GetCurrentProcessId GetThreadSelectorEntry GetCurrentThread LocalAlloc SetLastError FlsFree FlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo HeapDestroy HeapCreate GetVersion HeapSetInformation GetStartupInfoW SetHandleCount DeleteCriticalSection InitializeCriticalSectionAndSpinCount FlushFileBuffers GetConsoleMode GetConsoleCP WriteFile ExitProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCommandLineA FlsSetValue CreateThread ExitThread GetSystemTimeAsFileTime DecodePointer WriteConsoleW GetFileType GetStdHandle RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader EncodePointer CreateFileW

user32

FindWindowW GetWindowThreadProcessId CallNextHookEx PostMessageW GetParent SendMessageW GetClassNameW IsWindow SendMessageTimeoutW RegisterWindowMessageW SetWindowTextW GetWindowTextW FindWindowExW wsprintfW UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows

advapi32

RegEnumKeyExW RegQueryInfoKeyW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW OpenProcessToken FreeSid RegQueryValueExW RegFlushKey RegOpenKeyExW RegCreateKeyExW RegCloseKey RegSetValueExW

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoInitialize CoCreateInstance CoUninitialize StringFromCLSID

oleaut32

SysAllocString VariantInit VariantClear SysFreeString

shlwapi

PathAppendW StrRStrIW StrStrIW StrStrIA

urlmon

CreateURLMoniker CreateURLMonikerEx

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

psapi

GetModuleInformation EnumProcessModules GetModuleFileNameExW

wininet

HttpQueryInfoW HttpOpenRequestW

oleacc

ObjectFromLresult

$APPDATA/Microsoft/Internet Explorer/Quick Launch/winguard_x64.exe

IMPHASH 14de142a814adb7c62708a59120cc68f
SHA256 512a6011a82b7da4e81e419643eb9e61aa42e8fa2eecb14ebc03b3c3aaa8ac9a
MD5 f95392712deb63759031791e1a994b4c
SHA1 dda7f59fb99c8c22eefde29b20a4fbaa24ad72a0
SHA512 a75ea9d3915c2b4c9fc79c083ff5186bb8257996c50a99f1c91bcf5b0eaf509ccc52b96570e6823e0b284ff596cfe09e7d6e8081f24bea06d15fdf0739be20f8
SSDEEP 6144:6GmevPOLWbPHi1f/EhPQRSf3EG8MP1tOe09pZ64zzjzFAQrVVa9zmEoOjFMoQyCQ:Qa7WEhPkAoe0RdqD0rBCPK4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Digest

a5:4a:02:3a:85:40:44:29:03:c9:14:ef:06:05:b7:f2:bc:ca:1b:bb:1a:00:03:e7:38:9c:dc:e7:e2:aa:52:52

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Jun 12, 2020

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

38:38:9f:dd:c5:6d:f9:7b:dd:e5:24:f2:d7:66:ec:31

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 8, 2017 - Oct 6, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

2

Major OS version

5

Entry point

321704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindResourceExW MultiByteToWideChar WideCharToMultiByte InitializeCriticalSection DeleteCriticalSection GetLastError CloseHandle HeapFree LocalAlloc HeapAlloc GetProcessHeap LocalFree GetCurrentProcess WaitForSingleObject CreateRemoteThread GetProcAddress GetModuleHandleW GetVersionExW VirtualFreeEx LoadLibraryW WriteProcessMemory VirtualAllocEx lstrlenW OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot Module32NextW Module32FirstW lstrlenA LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount FlushInstructionCache FindNextFileW FindClose OutputDebugStringW UnmapViewOfFile MapViewOfFile CreateFileMappingW OpenFileMappingW GetCurrentThreadId lstrcmpiW SuspendThread lstrcpyW SetLastError CreateProcessW GetStartupInfoW ReadFile GetFileSizeEx CreateFileA DeviceIoControl CreateFileW FreeLibrary LoadLibraryExW GetModuleFileNameW ExpandEnvironmentStringsW GlobalFree GlobalUnlock GlobalLock GlobalAlloc MoveFileExW MoveFileW GetTickCount DeleteFileW SetFileAttributesW GetFileAttributesW CreateDirectoryW GetDiskFreeSpaceExW GetDriveTypeW GetLogicalDrives GetExitCodeThread CreateThread FindFirstFileW FindResourceW GetSystemDirectoryW GetWindowsDirectoryW GetFullPathNameW GetTempFileNameW WriteFile WaitNamedPipeW DeleteFileA MoveFileA CopyFileW GetLocalTime SetEvent OpenEventW Sleep CreateEventW lstrcpyA RemoveDirectoryW GetComputerNameW OpenMutexW GetCommandLineW GetCurrentProcessId HeapReAlloc HeapDestroy LoadLibraryA SetEnvironmentVariableA CompareStringW SetEndOfFile GetCurrentDirectoryW WriteConsoleW FlushFileBuffers SetStdHandle QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation GetStringTypeW InterlockedPushEntrySList ExitProcess HeapCreate GetVersion HeapSetInformation LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP SetFilePointer GetFileType SetHandleCount VirtualFree VirtualAlloc InterlockedPopEntrySList RtlLookupFunctionEntry RtlUnwindEx DecodePointer EncodePointer RtlPcToFileHeader GetLocaleInfoW GetStdHandle FlsAlloc GetSystemTimeAsFileTime GetDateFormatW GetTimeFormatW LoadResource LockResource SizeofResource GlobalMemoryStatusEx RaiseException FlsFree FlsSetValue FlsGetValue TerminateProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ExitThread HeapSize

user32

PeekMessageW CharNextW DefWindowProcW RegisterClassExW SetWindowLongPtrW CreateWindowExW GetMessageW DestroyWindow wsprintfW GetSystemMetrics RegisterWindowMessageW IsWindow FindWindowW TranslateMessage DispatchMessageW CallWindowProcW PostThreadMessageW GetWindowThreadProcessId UnregisterClassA MessageBoxW GetClassInfoExW LoadCursorW GetWindowLongPtrW

shell32

ShellExecuteExW CommandLineToArgvW ShellExecuteW SHGetFolderPathW

ole32

CoInitialize CoTaskMemRealloc CoInitializeSecurity CoTaskMemFree CoInitializeEx CoSetProxyBlanket CoUninitialize CoCreateInstance CoTaskMemAlloc

oleaut32

VarUI4FromStr VariantClear VariantInit SysAllocString VariantTimeToSystemTime SysFreeString SystemTimeToVariantTime

shlwapi

PathFileExistsA PathFileExistsW PathAppendW

mprapi

MprConfigServerConnect MprConfigGetFriendlyName

iphlpapi

GetInterfaceInfo GetNetworkParams GetAdaptersInfo GetPerAdapterInfo

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

InternetReadFile InternetOpenW InternetSetOptionW InternetOpenUrlW InternetCloseHandle InternetCheckConnectionW HttpQueryInfoW

urlmon

URLDownloadToFileW

$APPDATA/Microsoft/Internet Explorer/Quick Launch/winmaster.exe

SHA256 4657950fe60ef10276612639f84e1b9ecab951e778c71d02535dfa2dd3f593b1
MD5 9ab4225a119d958cd7b507af3d73fa3a
SHA1 8899144cc67f6507b65e84ff8bc57e43406c3a91
SHA512 df8aa7aec95d305fc3baa6f82df19bf17c8257ee41aaff6b2e9bc43f9eb13e753af436a3c590d1769b980906d4a907b86659beea0a8887962269a68869c96797
SSDEEP 12288:ynVuj9cCK5x/3SNSv2GGfaLZG3lteFlDhkE7WokScwwDwtnVq:KWqn5xaNSet6g3lgnWo5ywtnA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

d6:80:da:80:05:80:c2:e0:11:45:41:cf:8a:ef:34:82:cc:27:9a:d0:7a:77:28:29:f2:8e:81:07:bb:2a:83:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Mar 31, 2020

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Serial Number

38:38:9f:dd:c5:6d:f9:7b:dd:e5:24:f2:d7:66:ec:31

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 8, 2017 - Oct 6, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Sectigo RSA Time Stamping Signer #1,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

3d:1a:35:72:30:15:82:63:30:d0:13:71:7e:82:41:08

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Aug 1, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

1

Major OS version

5

Entry point

2809344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$APPDATA/Microsoft/Internet Explorer/Quick Launch/读我.txt

SHA256 725832c5f68535d0e3e3f4e61c369ae1e3ecf8dbd98d0273dd3e67b3840a5ce1
MD5 6c489bf06a9fb9ce84eea722815af992
SHA1 962ddaffbee9315c7fcb8dd371ed1841d72a7525
SHA512 0f971897c9e0892f18c6c13386a71645c4a842b9ceaae1376f9fcb8e778e64967d6532b16060d88b8c2a4d805ac57d91450f8df41abf72cab4b067cb773f3664
MD5 SHA1 SHA512

$PLUGINSDIR/MPlugin_NSIS.dll

SHA256 aff4ad05560e008405701fa96429534df248583f6cb08ffbd176308ab138f3c0
MD5 0d2f4fed90514e377396c288eb8a6431
SHA1 3746135d80eb281e5e17e182f984d94cb9d252d5
SHA512 68632616b78d8c5f456f5a56788f790e65413aec03f8e4ac4d0121d5e7d822ff9f833a938ea65a6286fb3065f6e7af1b28c8d9c59a6298b6956427f479f59cc7
SSDEEP 3072:tHMj00cvtv/RfRoa2MU2ycWlediMtabh1o2:B50c1v/hRKt2jWXSat1B
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

9e:00:a3:8c:79:de:1b:de:f7:74:6a:57:2d:6c:d7:ad:a9:1a:5b:58

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Qingdao Ruanmei Network Technology Co.\,Ltd.,OU=IT,O=Qingdao Ruanmei Network Technology Co.\,Ltd.,L=Qingdao,ST=Shandong,C=CN

Chains

Aug 24, 2015

Minor OS version

1

Major OS version

5

Entry point

342512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5
MD5 41a3c964232edd2d7d5edea53e8245cd
SHA1 76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206
SHA512 fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1
SSDEEP 192:s/er7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4SyIXe:sQ7Xws4FVWig86/5eCBqSyIXe
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/img/6.png

SHA256 3204cee51b270fb67b0f2e93adb839ced6d0499255ab80e453012738c9b0de50
MD5 60631d5c7b1692ea54c1d35e58bc0a45
SHA1 fc153d10dcb7b264b94ff64e5da3dc59cb5b9f1c
SHA512 bf13e32698e5c07bfa422f10602190192448acd4c332b86b32f63f947ea14d3badbb130f861f2fb7926e5f8202bc65811549d621c5aa477462420354db79b0cd
MD5 SHA1 SHA512

$PLUGINSDIR/img/blue-bg.png

SHA256 fd6e7038c504c3e3dd9040dc041adb05e38e3b0b6d481c8034e0b7ab23a0558a
MD5 fa8ddec84fbe181828a75af339dd51bc
SHA1 6afc626594df513d07a1859a1231d9d5b0fdcfc2
SHA512 267a48464efd7ad4393bf885fcdcfd27eb38862fc417a3d23e07611b2bb8006173c3ad264db8d93353bae9dae3051f98f135b72ec585854f801df01d49b97615
MD5 SHA1 SHA512

$PLUGINSDIR/img/browse_button_down.png

SHA256 3baa23d1b2aff48899c5cb5b97f8710cb3724cc30f5ebce20b4877810168cc69
MD5 0fdfa384280d3b7160d11c1bc939e819
SHA1 8153bb45ee6fac98c6225f6b56c3f448ca0db6e8
SHA512 483690fc6b544ec5f60eda1f4d5f729ee571b4d140e6e81b7551065a9fe65b74956a454bcd779534440a8949e14b8be9ec481aa2565f19a185dbefa9ec8d4644
MD5 SHA1 SHA512

$PLUGINSDIR/img/browse_button_normal.png

SHA256 53a2973c6bbf7ad3839480a3d3a268adda1ffee2719705cd7ea09091dd6dd72f
MD5 b1656e0a8b3b0671e44f3e605931abde
SHA1 3906676a57081d0acdcae91274605c7645c5413d
SHA512 5cc74a224bc302058ad538c905185dbcd483dfcc17e781f9cc215a293057d5b2fce574371b7d891e50b063467e48a2b1093546e4a8dcb3b9bf52349963717df3
MD5 SHA1 SHA512

$PLUGINSDIR/img/browse_button_over.png

SHA256 9d160a9e41d7c2682c5e4c9e86f5731228448bb397578c17fd6858963c7e4cae
MD5 1b4e820c15117bf99d94fcff94701ec5
SHA1 bfcb09fb1caf798d9dc33654775ac6407a5d4fd4
SHA512 3ac24443cb407295421fc122717d2291455d39e72755500a8abe887851d1d44284856eff16db25116be02f2183852fcc0d19c638548393cea359098ef5748bbd
MD5 SHA1 SHA512

$PLUGINSDIR/img/chkbox_normal.png

SHA256 b261fb4553c461508557703f22367a24415e70cfc55af28e64159091e1ce96da
MD5 ff4864abbfce6d44fa98268a48491229
SHA1 a1c4679f55277244ae6b77bd38b2b17d246d830a
SHA512 77842b0b50e45c40e094f598bce44871b1f4d5ee688186a73fe4629d5df93d39341c7df3aa362cfa1910a1da4ed4c4914c42909ca2aca590ad0233c49ad2f97b
MD5 SHA1 SHA512

$PLUGINSDIR/img/chkbox_normal_checked.png

SHA256 60b8bf73246600762a60526f77c5d83c56d28ee14da8efb9edb464d6e4cd309f
MD5 876751030e3935e5b1d5ccc64fe76fd1
SHA1 07bea0efc3372ab77911941608fe855235905a20
SHA512 8b8b8caac5346e43f2fccfe0ac41268b0fee77e128ef85b3aacfbaddee6bf41482e3c9e92f16fb513c4ed11ae0e6a97ef705ef857714ee844e2e754154e919c2
MD5 SHA1 SHA512

$PLUGINSDIR/img/chkbox_over.png

SHA256 28a9ef4367a69c4477574663240041bb8f8b4f6995ac3d3fd2ab1352a4798846
MD5 d82e33ceae2dbc642842857203f8821f
SHA1 0d43df7801e5563ca0634eaa6781035c3ba72423
SHA512 b8f898fe0558d6ec098f0c392b78bb4f0e9bc9ce2abff51be26087a14b6d83e13a697f32baa566ca1226700a55ca233e1551a1ff5e789f3352e09bb5fff4c4e3
MD5 SHA1 SHA512

$PLUGINSDIR/img/chkbox_over_checked.png

SHA256 f638b248d356d2c2ba51232a7a6293f250667c9fecd4e5d6a60ecbf707f4fa38
MD5 5b426298458fdaca51494861f6a30130
SHA1 05fbc53fcb9c1d197cc5072ce310a0beffd6226e
SHA512 66bed13db5b82709031c813b3e52ced5b960f33d32b552e91dd7f5ee9276bf63e1b217f976deb45bbba842f097ea7162a3ed253fa028388a59a2bd0b40864da2
MD5 SHA1 SHA512

$PLUGINSDIR/img/close_button_down.png

SHA256 8b32db4f5c3b010aa82ebfe2c66c6e1ac515d12b18a1007733e21c519b2d869f
MD5 397c65c57251ede787166f22a0ede873
SHA1 f03d1e31cb84208c8e9055d8889f694b1ee95e1b
SHA512 c2c7d0b0d1ec692eac31fa9d9e0724acb72c922d79d32de72ed51043cc6c14644f2390b03878a2288f6c21fff3e4fbc8761943f17064b1ffd592781eb74fc889
MD5 SHA1 SHA512

$PLUGINSDIR/img/close_button_normal.png

SHA256 234cd3643d486708be8ab83cbbe93a4f01f40cc4907eab212e1900b7e11da6c0
MD5 d4d9bc9ed1e5515093876f6d0cf2e153
SHA1 e3894f7f22761226ed203057135fceae6ff15f9c
SHA512 3c19dd6f423bc68c4d90ec700b0b8c27a1f55d3afff00172706c581b6b7bd38863fd435b14abe35da4bee6a4acf36bfedac4e5c8fd5042841f92190a55f400aa
MD5 SHA1 SHA512

$PLUGINSDIR/img/close_button_over.png

SHA256 e4b860f6bd15d9de9ea27e241ae6af57c7b3fe0da7c6bd2d6fb7e23a14178238
MD5 093d17efe780c343e9143e45a8bbcd84
SHA1 8dd1d882da03d37dd6358e03d56e10d002ac56bf
SHA512 adf2882eff37ca26415e33467104d0d26af64ba0bc8f2746a1f8656f18dc10d55c8d20b4c6391b08bc41fc8821f3a5468d77dae91333269e0cb77ba212efb61d
MD5 SHA1 SHA512

$PLUGINSDIR/img/dlg_shadow.png

SHA256 2333cebdea3fb37a69902c1219e33c2c7d2edc1cd7123b93cef0b6e17a0ab950
MD5 f6a04a809490164e01b626072768a0e2
SHA1 4d9216865dababa1dda55431930c752d305e1cde
SHA512 52a31e3d7cf5f4325193a022dbdc1ce5148459a53d0882fc3047806af42cd31911f3723d629003434dce89d38fe7923d794d62f77037047fd71425e2dc1dd133
MD5 SHA1 SHA512

$PLUGINSDIR/img/inst_button_down.png

SHA256 6a3d75aba0c98be928948dd13b41cfa8622a846af6784b1f0905fc55252a95e1
MD5 367ce553ee830ad8858b9fbd5a1f2810
SHA1 ef850e0bc8dca0c92dd7df8f9a4468a6fa05e36a
SHA512 d396f79c5efad8a2e689976eddbb7b710bf99595029914eb880f12c29c9d9b0b03b86e6b55b0825cbfdec96ceeb57d946374b235bb4496e5b3e7bad6d75ed225
MD5 SHA1 SHA512

$PLUGINSDIR/img/inst_button_normal.png

SHA256 68def8719002f8e2436d1dae496a382912da3ef6618484d30ab2351ae181ff26
MD5 20c733a8fd2d9ac132e19ba0b0755f91
SHA1 a2fa02cd59670d9b8fe927f22497cb095c643816
SHA512 202b730f2ab4e207210eee6224937a17ddf218e790da363669a5c735917545b0492a41fd017f7ffc381fbeede3be8ab32f845560c17f3ca4d86c8f5eda5c3c1d
MD5 SHA1 SHA512

$PLUGINSDIR/img/inst_button_over.png

SHA256 4d7ceac1b4f0a1430165df0963e15bec8318871c9700eed16aae6092721a3d9b
MD5 143e85b7bb834788ccf1155d334350a3
SHA1 0788e2df483d54cabe9f5c43e8b4126dc0442696
SHA512 e558e922858364e379853f9d3e18d4f30cfa8ffb4a2cc1cdb56113037e073c46355f2b3bf19a2803a6d4623b983a5d17e8e865c115e874827087d5facb95d351
MD5 SHA1 SHA512

$PLUGINSDIR/img/logo.png

SHA256 2c87e57b2d502cdad9d5188d76dfe68e64375315e91d906fdcd36e597d33642c
MD5 4e8fb96153d761faff26a09f0f9c4b4f
SHA1 30b3d81c758c538fa72f06794171c6ba7259c2a5
SHA512 5a4f29ccdf0a9f5384d8adcaff654e07d8deaa1acff39814268de5a7982229112e0286bc5d13e91ee46b3c2c4b926df0f00a235c846569abb9e982e6863d964b
MD5 SHA1 SHA512

$PLUGINSDIR/img/logobig.png

SHA256 5499d5fcb1dc2800bf0cd9a016a1f7315929e6347fcde2af5a13055c9a4713a6
MD5 eba9e0e47c765e2c68170b27dfe60994
SHA1 f4f491f2de45ab46826de0770dc4b3c7e48eb5df
SHA512 ea1728efd5343f3cbdb1a09b9e008a271070df73866700ca2de2f3d2a8cc8ca8be0fbfa0dc3455f4d323042427f79b43e50383a703fe2cfb55d3d062f2e62521
MD5 SHA1 SHA512

$PLUGINSDIR/img/min_button_down.png

SHA256 83e01d1ad24839405200f62cc4648afae13c8f7a9d0870c5abe7771548ea7766
MD5 e96d3e4e40ca09f0d296cc6d9b3c1e7e
SHA1 56267f7459fbf5ce1ac8238c4ce2c1cee6d3de64
SHA512 50a41807dba142ff0e450be46c4efccbbe732af4bcb80e006fbee17746b27330983926b8795a60d88797a2c5b14eb443702553948ea11d44b53c0cc9a61e9298
MD5 SHA1 SHA512

$PLUGINSDIR/img/min_button_normal.png

SHA256 acea75d501fc62a16032e306a867df6a1222f4f1b24387a79e82145f7769d1bb
MD5 f6bfe01967521e46df83fcbc3a43577e
SHA1 cc531a4748223ce30c83962555be168a92c06a48
SHA512 b7b3e7d30acac8c639f68eeaf3909fdb1b7a59e9ee5c2bf22f43f1632ca870a3d4352fea06e12a010b4fd6be35fc693fd2d8ea800defb24e70be362507acecf8
MD5 SHA1 SHA512

$PLUGINSDIR/img/min_button_over.png

SHA256 76718b5dd8b61f24a89b0b3a39d4bd19e7e1f3d6fc5e07f7bd20739e7c0623cf
MD5 d4972135c2331dc131d1dd57eea99153
SHA1 c24aa8e8cbff22b2de3241c36c9e03d1bc4f47fa
SHA512 5f8aeaef9c5e8beac4b5bf035d251de3004a8c8a6679d14418f8db99185528ad6376ef1fb1dbd88973302cdf92d6246f38f11497ae344fab31d7432eb5d12756
MD5 SHA1 SHA512

$PLUGINSDIR/img/path_input_bg.png

SHA256 eb96af993cc6c6b82d07cd28f766cf806360e69eb19a36e530df2ad1162567f1
MD5 5756e879663218535015bfa140457c0d
SHA1 d4bfb16d3a802434a60f786edf9bbd819a72798b
SHA512 3d71c7d598719156d39577f5e57a40ef328b96c8a11f6ae726f0f1addf6fbf441b4b0fe8979f9ff6cf9f04a05bd11bc78e603078d5dd4f81d7c8b45b155f702d
MD5 SHA1 SHA512

$PLUGINSDIR/img/progress_bkgnd.png

SHA256 b8c60a9a186683c55de4c7d6299752b32e894391ae8c7868012a7d65d1db2c80
MD5 b1bdd1309b84bccc76e7018b63cb7b64
SHA1 2187db49968f273259df91a2f9ec31628d2b58fa
SHA512 3dbfb5dad0d1edde75a041a1e4d4ed8963f2a24dfecb6c1ecb36f27cd88a6561367711d2b049b20689b59cfee774f80d461cfa7a8bfb52d3896beafad8e6cf65
MD5 SHA1 SHA512

$PLUGINSDIR/img/progress_forgndmid.png

SHA256 9bc9b8f19777dd02c9ad1cd39371025fd9efac6abb2273920aa2954a84ee72a1
MD5 169f286e52ee1b2c4d52dae2d57477d2
SHA1 a165c2e3dfc79e044271cc3ef8f20957ef5c29cc
SHA512 857c59c07c51f8d38486389546c51d8cd2cfd9e4eceec73234b9bdd1f4912bf2f30f15bd129e847955264f757020463ba34a37aee83f94aff5b87d011c9e4937
MD5 SHA1 SHA512

$PLUGINSDIR/img/windowBk.png

SHA256 eae728483460ed0810d211193d6fdb4a2f702bf62f95f2288a16b25182b412b4
MD5 78a1735e3a6303e6ef0ec568ed163dcb
SHA1 9c19f323f97d62ac88da688b23fb93210dcd3620
SHA512 2f5b5b3ca195ccd0396706fae7789bf928b420f84280eda2ab1ade95ab65c17e865c7dc362cdf8ec9157db41f177926a8176d73165765142bb538326a0d225c3
MD5 SHA1 SHA512

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d
MD5 2aba8f16eca82517460013a3de7cbf67
SHA1 3812192fa7b873f426c4b0d0d822b3c9d51aa164
SHA512 4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0
SSDEEP 192:zGdYhqlJcsISwqIioU3MSfSLF/+nhHUXgECs3:zGGhGKuwqDoWcFGBUwECs3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_39_/$_39_/uninstall_pcmaster.exe.nsis

SHA256 055e28a7484cba1060a0dae573ce05e4fa71debef43477c19a7e723366489eeb
MD5 971078e055e1189db6d5aef8bf99d411
SHA1 54a0d349c4f47bc5fe0d152014b5d3dde0e3d05f
SHA512 38725542b5ce7646a406a00075e14fd2d926238f2e5a8c5e771e6c685edd64e03b3fcbe35b2d8b894efbab0eac9d8ec59e9dd0422b4a62c28a27a424ec9e880f
SSDEEP 3072:AQSN/728kI7V5TpArGRC9Ecd73i9OygtO1IDheUDfK:AQQ/SFI7VFpqZEOcMDDhO
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer