seiya[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

seiya.exe
Size

20.9MB
MD5

29c149bf1429b4a86b542edcdbf1ad2a
SHA1

e0094b72b515443d23d6e5a108113aedaa22a4c6
SHA256

3a7ee77c657670aa9fdaaf3903f9288fb80f30464ef3d6c8bf0dacf910d04514
SHA512

3d4e1c9f894b14f857251c031bbd9139c1ad7b96f6ebf62dafa9869f3c278a940f347fe90be4f5188099c1a2365d3046c26b7f0f1410a144c78630325910e291
SSDEEP

393216:tjl0eHBUcN++6OrKTZMvRz4b7f2CvgvWWEKLbrCrbLUPeGHkXqIPJH/4kZoXy3CC:vHBExlRvHgkZLCSA38

Score

1^/10

Malware Config

Signatures

Files

seiya.exe
.exe windows:5 windows x86 arch:x86

0d438d2872b647cfade37761b235a18c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

24:d9:a6:c9:c3:25:c3:80:7b:8b:fc:94:ab:a6:37:84
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

22/04/2015, 00:00

Not After

21/05/2018, 23:59

Subject

CN=Beijing Perfect World Network Technology Co.\,Ltd.,OU=Technology Department,O=Beijing Perfect World Network Technology Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:90:40:50:03:4b:f6:e1:c2:5c:4c:3a:d9:e1:a3:d5:ab:c3:86:87
Signer

Actual PE Digest

c5:90:40:50:03:4b:f6:e1:c2:5c:4c:3a:d9:e1:a3:d5:ab:c3:86:87

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

a:\.jenkins\jobs\seiya-std\workspace\ElementClient\Release\Seiya.pdb

Imports

d3d9

Direct3DCreate9
D3DPERF_EndEvent
D3DPERF_BeginEvent

ws2_32

htons
WSAGetLastError
inet_addr
inet_ntoa
setsockopt
ioctlsocket
__WSAFDIsSet
recv
gethostbyname
connect
sendto
bind
getsockname
listen
accept
recvfrom
htonl
gethostname
getnameinfo
ntohl
select
WSACleanup
ntohs
send
WSAStartup
closesocket
getsockopt
gethostbyaddr
shutdown
getpeername
socket

d3dx9_43

D3DXSaveSurfaceToFileA
D3DXCreateEffectCompiler
D3DXGetShaderConstantTable
D3DXCompileShader
D3DXPlaneTransform
D3DXMatrixInverse
D3DXDeclaratorFromFVF
D3DXCreateVolumeTextureFromFileInMemoryEx
D3DXSaveVolumeToFileA
D3DXMatrixLookAtLH
D3DXCreateCubeTextureFromFileInMemoryEx
D3DXMatrixRotationY
D3DXMatrixRotationX
D3DXMatrixRotationZ
D3DXVec4Transform
D3DXCreateBuffer
D3DXAssembleShader
D3DXMatrixOrthoOffCenterLH
D3DXSaveTextureToFileInMemory
D3DXLoadSurfaceFromFileInMemory
D3DXMatrixPerspectiveFovLH
D3DXVec3TransformCoord
D3DXMatrixMultiply
D3DXMatrixRotationAxis
D3DXCreateTextureFromFileInMemoryEx
D3DXGetImageInfoFromFileInMemory
D3DXMatrixRotationQuaternion
D3DXQuaternionRotationMatrix
D3DXLoadSurfaceFromSurface

wininet

InternetOpenUrlW
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
HttpAddRequestHeadersA
HttpSendRequestA
InternetOpenA
HttpOpenRequestA
InternetConnectA

imm32

ImmGetCompositionStringW
ImmNotifyIME
ImmGetProperty
ImmSetCandidateWindow
ImmAssociateContext
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
ImmGetDescriptionW
ImmIsIME
ImmGetCandidateListW
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetOpenStatus
ImmGetDefaultIMEWnd
ImmGetCandidateListA
ImmGetCompositionStringA
ImmGetIMEFileNameA
ImmSetCompositionStringW

winmm

timeEndPeriod
timeGetTime
timeKillEvent
timeSetEvent
timeBeginPeriod

shlwapi

PathFileExistsW
PathFindFileNameA
PathRemoveFileSpecA
PathCombineA
PathAppendW
PathIsDirectoryW
PathIsFileSpecA
PathFileExistsA
PathRemoveFileSpecW
PathCanonicalizeA

fmodex

?override3DAttributes@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@0@Z
?addGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@@Z
?getNumGroups@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAV12@@Z
?getNumChannels@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getChannel@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVChannel@2@@Z
?createChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVChannelGroup@2@@Z
?setActive@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?stop@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?remove@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setParameter@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?addDSP@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@PAPAVDSPConnection@2@@Z
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setFileSystem@System@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@PBDHPAIPAPAX2@ZP6G?AW43@PAX4@ZP6G?AW43@44I14@ZP6G?AW43@4I4@ZP6G?AW43@PAUFMOD_ASYNCREADINFO@@4@Z5H@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?getCPUUsage@System@FMOD@@QAG?AW4FMOD_RESULT@@PAM0000@Z
?createDSPByType@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PAPAVDSP@2@@Z
?getMasterChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVChannelGroup@2@@Z
?getMemoryInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@IIPAIPAUFMOD_MEMORY_USAGE_DETAILS@@@Z
FMOD_System_Create
?setVolume@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?release@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?isPlaying@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?set3DConeOrientation@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_VECTOR@@@Z
?set3DConeSettings@Channel@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?addPolygon@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@MM_NHPBUFMOD_VECTOR@@PAH@Z
?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z
?getVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?get3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAUFMOD_VECTOR@@000@Z
?release@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setPosition@Geometry@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@@Z
?release@Reverb@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?stop@Channel@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?createGeometry@System@FMOD@@QAG?AW4FMOD_RESULT@@HHPAPAVGeometry@2@@Z
?createReverb@System@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVReverb@2@@Z
?setActive@Reverb@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setProperties@Reverb@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_REVERB_PROPERTIES@@@Z
?setPaused@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setUserData@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?getMode@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?setMode@Channel@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?setCallback@Channel@FMOD@@QAG?AW4FMOD_RESULT@@P6G?AW43@PAUFMOD_CHANNEL@@W4FMOD_CHANNEL_CALLBACKTYPE@@PAX2@Z@Z
?setMute@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setLoopCount@Sound@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?release@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?set3DAttributes@Reverb@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@MM@Z
?setMode@Sound@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PAVSound@2@_NPAPAVChannel@2@@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?setSpeakerMix@Channel@FMOD@@QAG?AW4FMOD_RESULT@@MMMMMMMM@Z
?getNumParameters@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?set3DOcclusion@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?overridePan@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setPaused@Channel@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setVolume@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setChannelGroup@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAVChannelGroup@2@@Z
?set3DAttributes@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@0@Z
?set3DMinMaxDistance@Channel@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?set3DSpread@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?getUserData@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAPAX@Z
?setPitch@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@M@Z

dsound

ord11

ftdriver3

?CreateFTManager@@YAPAVIFTManager@@HHH@Z

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

GetSystemTimeAsFileTime
OpenMutexW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetPrivateProfileStringW
GetTimeZoneInformation
SetErrorMode
CreateEventA
CreateSemaphoreA
InterlockedCompareExchange
GetThreadPriority
FormatMessageA
VirtualAlloc
VirtualFree
WaitForMultipleObjects
IsDBCSLeadByte
WinExec
CreateMutexA
GetVersionExA
GetLocaleInfoA
CompareStringA
ReadFile
LocalAlloc
GetFileAttributesA
IsDBCSLeadByteEx
OpenEventW
OpenFileMappingW
UnhandledExceptionFilter
WriteFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
GlobalFree
Process32NextW
Process32FirstW
QueryPerformanceFrequency
SetUnhandledExceptionFilter
lstrcpyW
FormatMessageW
CreateFileW
GetModuleFileNameA
SetCurrentDirectoryW
IsBadReadPtr
IsBadWritePtr
SystemTimeToFileTime
GetSystemTime
HeapAlloc
GetProcessHeap
HeapFree
GetSystemInfo
GlobalMemoryStatus
GetStartupInfoW
GetVersionExW
Process32Next
WaitNamedPipeW
ReadProcessMemory
VirtualQueryEx
Process32First
CreateToolhelp32Snapshot
OpenProcess
GetModuleHandleA
IsDebuggerPresent
WideCharToMultiByte
DebugBreak
InterlockedExchangeAdd
FreeConsole
AllocConsole
WriteConsoleW
SetConsoleTextAttribute
GetConsoleMode
GetStdHandle
CreateSemaphoreW
ReleaseSemaphore
OpenFile
TerminateProcess
SetLastError
QueueUserAPC
SetNamedPipeHandleState
IsProcessorFeaturePresent
CreateFileMappingW
MulDiv
lstrcmpW
FlushInstructionCache
LoadLibraryExW
lstrcmpiW
GetModuleFileNameW
GetModuleHandleW
InterlockedIncrement
lstrlenA
FindResourceW
SizeofResource
LoadResource
RaiseException
GlobalAlloc
InterlockedDecrement
FindClose
ExitThread
GetCurrentDirectoryW
CreateMutexW
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
CloseHandle
Sleep
CreateDirectoryA
FindFirstFileA
DeleteFileA
FindNextFileA
CreateProcessW
OutputDebugStringA
QueryPerformanceCounter
InitializeCriticalSection
LoadLibraryA
GetProcAddress
VirtualProtect
FreeLibrary
ExitProcess
GetCurrentThreadId
SetCurrentDirectoryA
GetCommandLineA
DeleteCriticalSection
GetCurrentProcessId
WaitForSingleObject
ResumeThread
GetTickCount
GlobalLock
GlobalUnlock
CreateThread
GetLocalTime
GetCurrentProcess
SetEvent
GetCurrentThread
CreateEventW
GetCurrentDirectoryA
SetThreadAffinityMask
DuplicateHandle
SuspendThread
GlobalMemoryStatusEx
ResetEvent
SetThreadPriority
SetThreadPriorityBoost
OutputDebugStringW
TerminateThread
InterlockedExchange
lstrlenW
LoadLibraryW
GetLastError
CreateFileA
ReleaseMutex

user32

GetQueueStatus
PostThreadMessageW
MsgWaitForMultipleObjects
CreateWindowExA
WindowFromDC
EnumThreadWindows
IsWindowUnicode
GetCaretBlinkTime
PostMessageA
SendMessageA
SetRect
IntersectRect
SetCaretPos
GetKeyboardLayout
CreateCaret
LoadCursorFromFileA
DestroyCursor
EnumDisplaySettingsW
ChangeDisplaySettingsW
UnhookWindowsHookEx
SetWindowsHookExW
IsRectEmpty
FindWindowA
PtInRect
CallNextHookEx
GetWindowTextA
GetClassNameA
GetTopWindow
UnregisterHotKey
RegisterHotKey
ToAscii
GetKeyboardState
SetClipboardData
EmptyClipboard
EnumWindows
WaitForInputIdle
CallWindowProcW
keybd_event
GetAncestor
RegisterWindowMessageW
CreateAcceleratorTableW
GetDesktopWindow
FillRect
GetFocus
DestroyAcceleratorTable
GetSysColor
GetClassInfoExW
GetClassNameW
GetDlgItem
IsChild
GetWindow
SetFocus
RedrawWindow
InvalidateRgn
GetDC
GetWindowTextLengthW
GetWindowTextW
SetWindowLongA
GetMessageW
CharNextW
MessageBoxA
GetActiveWindow
GetMenuBarInfo
EnumChildWindows
SetActiveWindow
IsZoomed
wsprintfW
GetKeyState
InvalidateRect
SetWindowLongW
PeekMessageW
ScreenToClient
GetCursorPos
GetCapture
SetCursorPos
ClientToScreen
GetMessageTime
SendMessageW
CloseClipboard
UnregisterClassA
OpenClipboard
IsClipboardFormatAvailable
SetWindowTextW
PostMessageW
DispatchMessageW
TranslateMessage
SetWindowPos
SetTimer
GetClientRect
GetWindowLongW
SystemParametersInfoW
PostQuitMessage
ChangeClipboardChain
DestroyWindow
EndPaint
BeginPaint
GetGUIThreadInfo
GetWindowThreadProcessId
IsWindow
SetClipboardViewer
GetAsyncKeyState
IsIconic
IsWindowVisible
KillTimer
SetCursor
SetForegroundWindow
GetSystemMetrics
LoadIconW
FindWindowW
DefWindowProcW
ReleaseCapture
RegisterClassExW
LoadCursorW
MessageBoxW
SetCapture
ShowWindow
UpdateWindow
ReleaseDC
GetWindowDC
GetWindowRect
MoveWindow
CreateWindowExW
GetParent
GetClipboardData

gdi32

TextOutA
SetTextColor
CreateSolidBrush
SetBkColor
SetTextAlign
ExtTextOutW
CreateFontW
GetTextExtentPoint32W
CreateDIBSection
SetMapMode
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
BitBlt
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps
DeleteObject
GetDIBits

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
OpenThreadToken
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteKeyW
RegOpenKeyExW
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW

shell32

ShellExecuteW
SHGetFolderPathW
ShellExecuteA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CLSIDFromString
CreateStreamOnHGlobal
CoFreeUnusedLibraries
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleInitialize
OleUninitialize
CoInitializeEx
CoUninitialize
CoInitialize

oleaut32

OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
VariantCopy
DispCallFunc
VariantInit
SysAllocStringByteLen
SysStringByteLen
SysAllocString
SysAllocStringLen
SysFreeString
VarBstrCmp
VariantClear

msvcp90

?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?rend@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?rbegin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?good@ios_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
??1locale@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
??Bid@locale@std@@QAEIXZ
?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?widen@?$ctype@_W@std@@QBE_WD@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$allocator@D@std@@QAE@XZ
?allocate@?$allocator@D@std@@QAEPADI@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?fail@ios_base@std@@QBE_NXZ
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@II@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_F?$complex@M@std@@QAEXXZ
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?HM@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$?DM@std@@YA?AV?$complex@M@0@ABV10@0@Z
??$conj@M@std@@YA?AV?$complex@M@0@ABV10@@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?infinity@?$numeric_limits@N@std@@SANXZ
?quiet_NaN@?$numeric_limits@N@std@@SANXZ
?eof@ios_base@std@@QBE_NXZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIABV12@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?quiet_NaN@?$numeric_limits@M@std@@SAMXZ
?infinity@?$numeric_limits@M@std@@SAMXZ
?capacity@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBEHXZ
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?_Decref@facet@locale@std@@QAEPAV123@XZ
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?setf@ios_base@std@@QAEHH@Z
??_D?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??$getline@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@0@AAV10@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??0?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_WH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@F@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
??0?$_String_val@DV?$allocator@D@std@@@std@@IAE@V?$allocator@D@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z

msvcr90

wcsstr
sprintf_s
wcsncmp
isspace
swscanf
strncpy
_access
_strlwr
strstr
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
_stricmp
_stat32
_purecall
fwrite
_wtoi
_time32
_gmtime32
fopen
fclose
memmove
realloc
free
rand
_vswprintf
fread
_aligned_free
strrchr
_aligned_malloc
_mbscmp
ceil
memmove_s
strncpy_s
wcsncpy
_vsnprintf
_wfopen_s
fwprintf
vfwprintf_s
_i64toa
_gmtime32_s
_isnan
atoi
swscanf_s
_vsnwprintf
wcschr
sscanf
sprintf
strchr
strcpy_s
srand
atof
_wcsicmp
wcsftime
_localtime32
_wtoi64
strncmp
atol
wcsrchr
bsearch
_mktime32
_atoi64
malloc
_resetstkoflw
memcpy_s
wcsncpy_s
swprintf_s
_recalloc
isdigit
_snprintf
_beginthread
printf
??0bad_cast@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
clock
_wfopen
fseek
fputs
__iob_func
_vsnprintf_s
_errno
fprintf
ftell
_wstat32
_wremove
asctime
fgets
ferror
strcspn
wcstod
vsprintf
wcscpy_s
strtok
_set_purecall_handler
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_set_invalid_parameter_handler
_set_abort_behavior
signal
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
__pxcptinfoptrs
_clearfp
_controlfp_s
?terminate@@YAXXZ
?unexpected@@YAXXZ
abort
raise
memset
_CxxThrowException
__CxxFrameHandler3
_CIatan2
_CIsin
_CIsqrt
qsort
_CIacos
_CIcos
__RTDynamicCast
_CIpow
memcpy
_CItan
ldiv
floor
vsprintf_s
_mbsupr
_mbslwr
_wcslwr
_time64
_snwprintf
_fstat64i32
_fileno
fflush
_CIasin
_CIatan
_stat64i32
wcscat
strlen
strcmp
strcat
_CIlog
strcat_s
wcscat_s
sscanf_s
feof
strerror
ungetc
freopen
getc
_swprintf
strtod
strncat
strtoul
strcoll
longjmp
exit
wcsncat
remove
_CIexp
pow
toupper
isalnum
tolower
isalpha
fopen_s
_mkdir
wcscmp
abs
localeconv
iscntrl
modf
ldexp
frexp
_HUGE
memchr
ispunct
isupper
islower
strpbrk
isxdigit
fscanf
tmpfile
_pclose
_popen
setvbuf
clearerr
rename
_mktime64
_gmtime64
tmpnam
system
strftime
setlocale
_localtime64
getenv
_difftime64
calloc
_splitpath
_except_handler3
_beginthreadex
_endthreadex
_strtoui64
_CIfmod
_strnicmp
_setjmp3
_itoa_s
_wcsicoll
wcscoll
rewind
_wstat64
_ftime64
strtol
strtok_s
memcmp
mbstowcs_s
isgraph
isprint
_endthread
strerror_s
_strtoi64
strcpy
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
_except_handler4_common
_invoke_watson
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_close
_read
_write
wcslen
_itow_s
_itow
vswprintf_s
wcscpy
_local_unwind4
_CIlog10
_CItanh
_CIcosh
_ui64toa_s
_CIsinh

psapi

GetModuleFileNameExA
GetProcessMemoryInfo
GetPerformanceInfo

urlmon

URLDownloadToFileW

netapi32

Netbios

ntdll

_itoa

Exports

Exports

??0AudioObject3D@@QAE@ABV0@@Z
??0AudioObject3D@@QAE@XZ
??0AudioObjectBGM@@QAE@ABV0@@Z
??0AudioObjectBGM@@QAE@XZ
??0AudioObjectBase@@QAE@ABV0@@Z
??0AudioObjectBase@@QAE@XZ
??0AudioObjectEffect@@QAE@ABV0@@Z
??0AudioObjectEffect@@QAE@XZ
??0AudioObjectManager@@QAE@ABV0@@Z
??0AudioObjectManager@@QAE@XZ
??0AudioObjectReverb@@QAE@ABV0@@Z
??0AudioObjectReverb@@QAE@XZ
??0AudioObjectVolume@@QAE@ABV0@@Z
??0AudioObjectVolume@@QAE@XZ
??0System@Scaleform@@QAE@ABUHeapDesc@MemoryHeap@1@PAVSysAllocBase@1@@Z
??0System@Scaleform@@QAE@PAVSysAllocBase@1@@Z
??1AcquireInterface@Scaleform@@UAE@XZ
??1AudioObject3D@@UAE@XZ
??1AudioObjectBGM@@UAE@XZ
??1AudioObjectBase@@UAE@XZ
??1AudioObjectEffect@@UAE@XZ
??1AudioObjectManager@@QAE@XZ
??1AudioObjectReverb@@UAE@XZ
??1AudioObjectVolume@@UAE@XZ
??1DefaultAcquireInterface@Scaleform@@UAE@XZ
??1System@Scaleform@@QAE@XZ
??4AudioObject3D@@QAEAAV0@ABV0@@Z
??4AudioObjectBGM@@QAEAAV0@ABV0@@Z
??4AudioObjectBase@@QAEAAV0@ABV0@@Z
??4AudioObjectEffect@@QAEAAV0@ABV0@@Z
??4AudioObjectManager@@QAEAAV0@ABV0@@Z
??4AudioObjectReverb@@QAEAAV0@ABV0@@Z
??4AudioObjectVolume@@QAEAAV0@ABV0@@Z
??_7AudioObject3D@@6B@
??_7AudioObjectBGM@@6B@
??_7AudioObjectBase@@6B@
??_7AudioObjectEffect@@6B@
??_7AudioObjectManager@@6B@
??_7AudioObjectReverb@@6B@
??_7AudioObjectVolume@@6B@
??_FEvent@Scaleform@@QAEXXZ
??_FMutex@Scaleform@@QAEXXZ
??_FSemaphore@Scaleform@@QAEXXZ
??_FSysAllocPagedMalloc@Scaleform@@QAEXXZ
??_FSysAllocStatic@Scaleform@@QAEXXZ
??_FSysAllocWinAPI@Scaleform@@QAEXXZ
??_FSystem@Scaleform@@QAEXXZ
??_FThread@Scaleform@@QAEXXZ
?CreateObject@AudioObjectManager@@QAEPAVAudioObjectBase@@H@Z
?CreateReverb@AudioObjectReverb@@QAE_NXZ
?CreateZone@AudioObjectBase@@QAE_NPAUPG_POINT@@H@Z
?DestroyObject@AudioObjectManager@@QAE_NPAVAudioObjectBase@@@Z
?GetEffectDayEvent@AudioObjectEffect@@QAEPAVEvent@AudioEngine@@XZ
?GetEffectNightEvent@AudioObjectEffect@@QAEPAVEvent@AudioEngine@@XZ
?GetEnvEffect@AudioObjectBGM@@QBEPAVEventInstance@AudioEngine@@XZ
?GetEnvEffectDayEvent@AudioObjectBGM@@QAEPAVEvent@AudioEngine@@XZ
?GetEnvEffectEvent@AudioObjectBGM@@QBEPAVEvent@AudioEngine@@XZ
?GetEnvEffectNightEvent@AudioObjectBGM@@QAEPAVEvent@AudioEngine@@XZ
?GetEvent@AudioObject3D@@QAEPAVEvent@AudioEngine@@XZ
?GetFadeDistance@AudioObjectEffect@@QBEXAAM0@Z
?GetFadeTime@AudioObjectVolume@@QBEHXZ
?GetHeightRange@AudioObjectBGM@@QBEXAAM0@Z
?GetHeightRange@AudioObjectEffect@@QBEXAAM0@Z
?GetMusic@AudioObjectBGM@@QBEPAVEventInstance@AudioEngine@@XZ
?GetMusicDayEvent@AudioObjectBGM@@QAEPAVEvent@AudioEngine@@XZ
?GetMusicEvent@AudioObjectBGM@@QBEPAVEvent@AudioEngine@@XZ
?GetMusicNightEvent@AudioObjectBGM@@QAEPAVEvent@AudioEngine@@XZ
?GetPriority@AudioObjectBGM@@QBEHXZ
?GetReal3DCone@AudioObject3D@@QBEXAAM00@Z
?GetRealMinMaxDistance@AudioObject3D@@QBEXAAM0@Z
?GetType@AudioObjectBase@@QBEHXZ
?GetVolume@AudioObjectVolume@@QBEXAAM0@Z
?GetXScale@?$Matrix2x4@M@Render@Scaleform@@QBEMXZ
?GetYScale@?$Matrix2x4@M@Render@Scaleform@@QBEMXZ
?Init@AudioObjectBase@@QAE_NPAVEventSystem@AudioEngine@@@Z
?Init@AudioObjectManager@@QAE_NPAVEventSystem@AudioEngine@@@Z
?Init@System@GFx@Scaleform@@SAXPAVSysAllocBase@3@@Z
?Init@System@Scaleform@@SAXPAVSysAllocBase@2@@Z
?IsPtIn@AudioObjectBGM@@QAE_NMMM@Z
?IsPtIn@AudioObjectBase@@QAE_NABUPG_POINT@@@Z
?IsPtIn@AudioObjectBase@@QAE_NMM@Z
?IsPtIn@AudioObjectVolume@@QAE_NMMM@Z
?OnStop@AudioObject3D@@MAE_NPAVEventInstance@AudioEngine@@@Z
?OnStop@AudioObjectBGM@@MAE_NPAVEventInstance@AudioEngine@@@Z
?OnStop@AudioObjectBase@@MAE_NPAVEventInstance@AudioEngine@@@Z
?OnStop@AudioObjectEffect@@MAE_NPAVEventInstance@AudioEngine@@@Z
?OnStop@AudioObjectManager@@MAE_NPAVEventInstance@AudioEngine@@@Z
?Play@AudioObject3D@@QAE_NXZ
?Play@AudioObjectEffect@@QAE_NXZ
?PlayEnvEffect@AudioObjectBGM@@QAE_NXZ
?PlayIntercutBGM@AudioObjectManager@@QAE_NPBD@Z
?PlayMusic@AudioObjectBGM@@QAE_NXZ
?Prepend@?$Matrix2x4@M@Render@Scaleform@@QAEAAV123@ABV123@@Z
?PtDistance@AudioObjectBase@@QAEMABUPG_POINT@@@Z
?PtDistance@AudioObjectBase@@QAEMMM@Z
?Reload@AudioObject3D@@UAE_NXZ
?Reload@AudioObjectBGM@@UAE_NXZ
?Reload@AudioObjectBase@@UAE_NXZ
?Reload@AudioObjectEffect@@UAE_NXZ
?Reload@AudioObjectManager@@QAE_NXZ
?Set3DAttributes@AudioObjectReverb@@QAEXABUVECTOR@AudioEngine@@MM@Z
?Set3DCone@AudioObject3D@@QAEX_NMMM@Z
?SetDNFactor@AudioObjectBGM@@QAEXM@Z
?SetDNFactor@AudioObjectEffect@@QAEXM@Z
?SetDNFactor@AudioObjectManager@@QAEXM@Z
?SetEffectEvent@AudioObjectEffect@@QAEXPBD_N@Z
?SetEnvEffectEvent@AudioObjectBGM@@QAEXPBD_N@Z
?SetEvent@AudioObject3D@@QAEXPBD@Z
?SetFadeDistance@AudioObjectEffect@@QAEXMM@Z
?SetFadeTime@AudioObjectVolume@@QAEXH@Z
?SetHeightRange@AudioObjectBGM@@QAEXMM@Z
?SetHeightRange@AudioObjectEffect@@QAEXMM@Z
?SetHeightRange@AudioObjectVolume@@QAEXMM@Z
?SetIdentity@?$Matrix2x4@M@Render@Scaleform@@QAEXXZ
?SetIdentity@?$Matrix3x4@M@Render@Scaleform@@QAEXXZ
?SetIdentity@?$Matrix4x4@M@Render@Scaleform@@QAEXXZ
?SetListenerPos@AudioObjectBase@@QAEXABUVECTOR@AudioEngine@@@Z
?SetListenerPos@AudioObjectManager@@QAEXABUVECTOR@AudioEngine@@@Z
?SetMinMaxDistance@AudioObject3D@@QAEX_NMM@Z
?SetMusicEvent@AudioObjectBGM@@QAEXPBD_N@Z
?SetOrientation@AudioObject3D@@QAEXABUVECTOR@AudioEngine@@@Z
?SetPos@AudioObject3D@@QAEXABUVECTOR@AudioEngine@@@Z
?SetPriority@AudioObjectBGM@@QAEXH@Z
?SetReverb@AudioObjectReverb@@QAEXPBD@Z
?SetShapeCubiod@AudioObjectReverb@@QAEXABUVECTOR@AudioEngine@@MMM@Z
?SetShapePolygon@AudioObjectReverb@@QAEXPAUVECTOR@AudioEngine@@HMM@Z
?SetShapeSphere@AudioObjectReverb@@QAEXABUVECTOR@AudioEngine@@M@Z
?SetVolume@AudioObject3D@@QAEXM@Z
?SetVolume@AudioObjectBGM@@QAEXMM@Z
?SetVolume@AudioObjectEffect@@QAEXM@Z
?SetVolume@AudioObjectVolume@@QAEXMM@Z
?SetZoneListenerPos@AudioObjectManager@@QAEXABUVECTOR@AudioEngine@@@Z
?Stop@AudioObject3D@@QAE_N_N@Z
?Stop@AudioObjectEffect@@QAE_NXZ
?StopEnvEffect@AudioObjectBGM@@QAE_NXZ
?StopIntercutBGM@AudioObjectManager@@QAE_NXZ
?StopMusic@AudioObjectBGM@@QAE_NXZ
?Tick@AudioObject3D@@UAEXXZ
?Tick@AudioObjectBase@@UAEXXZ
?Tick@AudioObjectEffect@@UAEXXZ
?Tick@AudioObjectManager@@QAEXXZ
?castAudio3D@AudioObjectManager@@IAEPAVAudioObject3D@@PAVAudioObjectBase@@@Z
?castAudioBGM@AudioObjectManager@@IAEPAVAudioObjectBGM@@PAVAudioObjectBase@@@Z
?castAudioEffect@AudioObjectManager@@IAEPAVAudioObjectEffect@@PAVAudioObjectBase@@@Z
?castAudioReverb@AudioObjectManager@@IAEPAVAudioObjectReverb@@PAVAudioObjectBase@@@Z
?castAudioVolume@AudioObjectManager@@IAEPAVAudioObjectVolume@@PAVAudioObjectBase@@@Z
?getCurAudioBGM@AudioObjectManager@@QAEPAVAudioObjectBGM@@XZ
?getCurAudioVolume@AudioObjectManager@@IAEPAVAudioObjectVolume@@XZ
?release@AudioObject3D@@IAEXXZ
?release@AudioObjectBGM@@IAEXXZ
?release@AudioObjectBase@@IAEXXZ
?release@AudioObjectEffect@@IAEXXZ
?release@AudioObjectManager@@IAEXXZ
?release@AudioObjectReverb@@IAEXXZ
?releaseEventInstance@AudioObjectBase@@IAEXAAPAVEventInstance@AudioEngine@@_N@Z
?reload@AudioObjectBase@@IAE_NPAVEvent@AudioEngine@@PAVEventInstance@3@@Z
NvOptimusEnablement
luaopen_llthreads

Sections

.text
Size: 17.7MB - Virtual size: 17.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 347KB - Virtual size: 760KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d438d2872b647cfade37761b235a18c

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

24:d9:a6:c9:c3:25:c3:80:7b:8b:fc:94:ab:a6:37:84Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

c5:90:40:50:03:4b:f6:e1:c2:5c:4c:3a:d9:e1:a3:d5:ab:c3:86:87Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d9

ws2_32

d3dx9_43

wininet

imm32

winmm

shlwapi

fmodex

dsound

ftdriver3

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp90

msvcr90

psapi

urlmon

netapi32

ntdll

Exports

Exports

Sections

.text Size: 17.7MB - Virtual size: 17.7MB

.rdata Size: 2.7MB - Virtual size: 2.7MB

.data Size: 347KB - Virtual size: 760KB

.tls Size: 4KB - Virtual size: 4KB

.rsrc Size: 123KB - Virtual size: 123KB

.vmp0 Size: 44KB - Virtual size: 43KB

.reloc Size: 512B - Virtual size: 48B

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

24:d9:a6:c9:c3:25:c3:80:7b:8b:fc:94:ab:a6:37:84
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

c5:90:40:50:03:4b:f6:e1:c2:5c:4c:3a:d9:e1:a3:d5:ab:c3:86:87
Signer

.text
Size: 17.7MB - Virtual size: 17.7MB

.rdata
Size: 2.7MB - Virtual size: 2.7MB

.data
Size: 347KB - Virtual size: 760KB

.tls
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 123KB - Virtual size: 123KB

.vmp0
Size: 44KB - Virtual size: 43KB

.reloc
Size: 512B - Virtual size: 48B