MortalShell2-Win64-Shipping[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MortalShell2-Win64-Shipping.exe
Size 187.4MB
Sample260926-ym7nbasvby
SHA256 c630bfdaa7c68391c88aa92ec35c62280fe2d2181ea11743bb2c902c05a1cddf
MD5 8bc1043d1821b00a171782b36def8a5c
SHA1 bb6589707d3613d93b9cae42ca532c853edea53a
SHA512 431369a7c30cf1d544c138249d8d4250acd0f22aa2332922de8debd10b67b331c0cd1c818d6d82a319320dda431705951460e1be7747a685a33ea4003325de8d
SSDEEP 1572864:oLn36oP/j+OgC0P9KXisw7JhkVFyF22H0UQx7AYvgkumRj:o3ls1vlsBx
TLSH
T104987B27B2E908D8F07EC1758A3A9506E7B17875132087DF05A14C991F7FFE0697AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MortalShell2-Win64-Shipping.exe

File Explorer

MortalShell2-Win64-Shipping.exe

.exe 187.4MB

MortalShell2-Win64-Shipping.exe

IMPHASH 777260be3a71e24c586b0e98a6d319be
SHA256 c630bfdaa7c68391c88aa92ec35c62280fe2d2181ea11743bb2c902c05a1cddf
MD5 8bc1043d1821b00a171782b36def8a5c
SHA1 bb6589707d3613d93b9cae42ca532c853edea53a
SHA512 431369a7c30cf1d544c138249d8d4250acd0f22aa2332922de8debd10b67b331c0cd1c818d6d82a319320dda431705951460e1be7747a685a33ea4003325de8d
SSDEEP 1572864:oLn36oP/j+OgC0P9KXisw7JhkVFyF22H0UQx7AYvgkumRj:o3ls1vlsBx
TLSH
T104987B27B2E908D8F07EC1758A3A9506E7B17875132087DF05A14C991F7FFE0697AB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

141291248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MortalShell2-Win64-Shipping.pdb

dxgi

CreateDXGIFactory1 CreateDXGIFactory

dsound

ord11 ord6 ord12 ord1 ord3 ord8

ws2_32

recv ntohs ntohl listen htons htonl getsockopt getsockname getpeername ioctlsocket connect closesocket bind shutdown socket gethostname WSAStartup recvfrom select send WSAGetLastError accept sendto WSAIoctl getaddrinfo freeaddrinfo getnameinfo inet_pton __WSAFDIsSet inet_addr InetNtopW WSAPoll WSASetLastError WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSASetEvent WSAWaitForMultipleEvents inet_ntop WSACleanup setsockopt

winmm

timeBeginPeriod timeGetDevCaps timeEndPeriod timeGetTime

kernel32

RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointer SetFileTime GetTempPathW OutputDebugStringW CloseHandle RaiseException SetUnhandledExceptionFilter GetLastError SetLastError SetThreadErrorMode PeekNamedPipe QueryPerformanceFrequency SetEvent ResetEvent ReleaseSemaphore ReleaseMutex WaitForSingleObject CreateMutexW CreateEventW Sleep WaitForMultipleObjects CreateSemaphoreW GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess SwitchToThread CreateThread GetCurrentThread OpenThread SetThreadPriority SuspendThread ResumeThread CreateProcessW GetProcessId FlushProcessWriteBuffers GetThreadContext OpenProcess GetCurrentProcessorNumber GetThreadIdealProcessorEx GlobalMemoryStatusEx GetSystemInfo GetVersionExW GetLogicalProcessorInformationEx GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualFree CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateMemoryResourceNotification QueryMemoryResourceNotification IsProcessInJob CreateJobObjectW SetInformationJobObject QueryInformationJobObject FreeLibrary GetModuleFileNameW GetModuleHandleW GetModuleHandleExW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GetNumaNodeProcessorMaskEx GlobalAlloc GlobalUnlock GlobalLock SetProcessAffinityMask SetThreadAffinityMask FormatMessageW QueryFullProcessImageNameW GetPrivateProfileIntW GetPrivateProfileStringW FlushFileBuffers SetDllDirectoryW GetDllDirectoryW ReOpenFile MoveFileW GetComputerNameW VerifyVersionInfoW FileTimeToSystemTime SystemTimeToFileTime GetSystemPowerStatus GetNumaProcessorNodeEx GetUserPreferredUILanguages GetUserDefaultLocaleName SetConsoleCtrlHandler SetConsoleOutputCP GetConsoleWindow K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next GetProcessTimes GetThreadTimes GetSystemTime GetSystemTimeAsFileTime GetLocalTime SetThreadGroupAffinity GetEnvironmentVariableA FlsAlloc FlsSetValue FlsFree GetLargePageMinimum VirtualUnlock GetNumaHighestNodeNumber GetNumaProcessorNode GetNumaNodeProcessorMask SetWaitableTimer CreateWaitableTimerW GetProcessHandleCount GetVersion MulDiv GetLocaleInfoW AllocConsole FreeConsole AttachConsole GetConsoleScreenBufferInfo SetConsoleScreenBufferSize SetConsoleTextAttribute SetConsoleWindowInfo SetConsoleTitleW DeviceIoControl GetLongPathNameW RemoveVectoredExceptionHandler InitializeCriticalSectionAndSpinCount HeapAlloc HeapFree GetProcessHeap GetFileSize IsDebuggerPresent FlushViewOfFile CreateIoCompletionPort SetErrorMode LocalFree GlobalFree MultiByteToWideChar WideCharToMultiByte LoadLibraryExW LocalAlloc MoveFileExW OutputDebugStringA VirtualQueryEx WaitForSingleObjectEx SetFilePointerEx LoadLibraryA GetACP GetLocaleInfoEx GetDynamicTimeZoneInformation GetGeoInfoW GetUserGeoID LCIDToLocaleName LocaleNameToLCID GetNumberFormatEx GetCurrencyFormatEx ResolveLocaleName SystemTimeToTzSpecificLocalTime GetTimeZoneInformation GetTimeFormatEx GetDateFormatEx DuplicateHandle GetThreadId QueryUnbiasedInterruptTime InitializeConditionVariable SleepConditionVariableCS WakeAllConditionVariable InitOnceExecuteOnce VirtualQuery CreateFile2 FormatMessageA lstrlenA ReplaceFileW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionEx GetSystemDirectoryA GetModuleHandleA SleepEx GetTickCount MoveFileExA CompareFileTime GetModuleFileNameA K32EnumProcessModules GetSystemDirectoryW CreateProcessA CancelIoEx GetOverlappedResultEx TerminateThread WriteConsoleA SetConsoleTitleA WakeConditionVariable GetCommandLineA GetTempPathA GetTempFileNameA DebugBreak GetThreadPriority LoadLibraryExA CreateSemaphoreA GetFileTime FindNextFileW DeleteFileW CreateFileW CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW GetEnvironmentVariableW GetCommandLineW VerSetConditionMask RtlCaptureStackBackTrace ReadFile WriteFile GetOverlappedResult FindFirstFileW FindClose WriteConsoleW CreatePipe SetHandleInformation GetFileType GetStdHandle TryAcquireSRWLockExclusive K32GetModuleFileNameExW K32EnumProcessModulesEx GetCurrentProcess RtlVirtualUnwind RtlLookupFunctionEntry HeapSetInformation ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared InitializeSRWLock TryEnterCriticalSection TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentThreadId QueryPerformanceCounter DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetCriticalSectionSpinCount InitializeCriticalSection GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent GetFullPathNameW GetFinalPathNameByHandleW GetFileSizeEx GetFileAttributesExW GetFileAttributesW AddVectoredExceptionHandler UnhandledExceptionFilter RtlCaptureContext SleepConditionVariableSRW GetDiskFreeSpaceExW WritePrivateProfileStringW

user32

CloseClipboard SetClipboardData OpenClipboard SetDlgItemTextW GetDlgItem CreateDialogParamW IsWindowVisible SetWindowPos ShowWindow EmptyClipboard LoadAcceleratorsW DestroyAcceleratorTable TranslateAcceleratorW GetSystemMetrics DrawTextW DestroyWindow IsChild PostQuitMessage SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetTouchInputInfo SetForegroundWindow MessageBoxA EnumDisplayDevicesA GetUserObjectInformationW GetProcessWindowStation SetParent VkKeyScanExW GetDesktopWindow SetWindowDisplayAffinity GetWindowDisplayAffinity ChangeDisplaySettingsExW ChangeDisplaySettingsW GetRawInputDeviceList RegisterRawInputDevices GetRawInputDeviceInfoA GetRawInputData GetWindowInfo MonitorFromRect MonitorFromPoint SystemParametersInfoW CreateIconIndirect DrawIconEx LoadImageW LoadIconW LoadCursorFromFileW LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW EnumChildWindows GetParent GetClassLongPtrW PtInRect GetSysColor ClipCursor WindowFromPoint MapWindowPoints ClientToScreen GetClipCursor GetCursorPos SetCursor SetCursorPos ShowCursor MessageBoxW AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RedrawWindow SetWindowRgn ReleaseDC GetDCEx GetDC GetForegroundWindow SetActiveWindow UpdateWindow DrawStateW InsertMenuItemW TrackPopupMenu DeleteMenu EnableMenuItem CreatePopupMenu GetSystemMenu IsWindowEnabled EnableWindow MsgWaitForMultipleObjects ReleaseCapture SetCapture GetCapture RegisterTouchWindow CloseTouchInputHandle AllowSetForegroundWindow SendInput GetAsyncKeyState GetKeyState GetFocus GetActiveWindow SetFocus AddClipboardFormatListener GetClipboardData GetDlgItemTextW IsZoomed IsIconic SetWindowPlacement GetWindowPlacement MoveWindow FlashWindowEx SetLayeredWindowAttributes PrintWindow IsWindow CreateWindowExW RegisterClassExW UnregisterClassW RegisterClassW DefWindowProcW PostMessageW GetMessageExtraInfo TrackMouseEvent DisableProcessWindowsGhosting GetKeyboardLayout GetKeyboardLayoutList ActivateKeyboardLayout MapVirtualKeyW EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow EnumDisplayDevicesW EnumDisplaySettingsW IsDialogMessageW GetWindowThreadProcessId GetTopWindow SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW FillRect GetSysColorBrush ScreenToClient GetWindowRect GetClientRect SetWindowTextW InvalidateRect EndPaint BeginPaint GetMessageW

gdi32

CreateCompatibleBitmap CreateFontIndirectW CreateFontW CreatePen CreateRectRgn CreateRoundRectRgn CreateSolidBrush DeleteDC GetDeviceCaps GetDIBits GetStockObject LineTo CombineRgn Rectangle RoundRect SetBkColor SetTextColor SetTextAlign CreateDIBSection GetObjectW MoveToEx TextOutW ExtTextOutW Polygon ChoosePixelFormat SetPixelFormat SwapBuffers SetBkMode SelectObject GetTextExtentPoint32W CreateBitmap PtInRegion DeleteObject CreateCompatibleDC

advapi32

RegEnumKeyExW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey GetUserNameW ReportEventW RegisterEventSourceW DeregisterEventSource RegCreateKeyExW RegDeleteKeyW RegDeleteValueW CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW RegCloseKey RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW AllocateLocallyUniqueId

shell32

SHGetFolderPathW SHGetKnownFolderPath CommandLineToArgvW SHGetFolderPathA ShellExecuteExW ShellExecuteW

ole32

RevokeDragDrop RegisterDragDrop OleUninitialize OleInitialize IIDFromString CoTaskMemFree CoCreateGuid StringFromGUID2 PropVariantClear CoInitializeEx CoUninitialize ReleaseStgMedium CoInitialize CoCreateInstance

oleaut32

VariantCopy SafeArrayPutElement SafeArrayCreateVector SysAllocString SysFreeString

iphlpapi

IcmpCloseHandle IcmpCreateFile GetAdaptersAddresses GetAdaptersInfo IcmpSendEcho

setupapi

SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDevicePropertyW SetupDiGetClassDevsExW SetupDiOpenDevRegKey CM_Get_Device_IDW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceRegistryPropertyW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

dwmapi

DwmFlush DwmIsCompositionEnabled DwmSetWindowAttribute DwmGetCompositionTimingInfo

imm32

ImmGetDescriptionW ImmAssociateContextEx ImmSetCandidateWindow ImmSetCompositionWindow ImmNotifyIME ImmGetCompositionStringW ImmAssociateContext ImmGetContext ImmDestroyContext ImmCreateContext ImmGetProperty ImmGetIMEFileNameW ImmReleaseContext

uiautomationcore

UiaClientsAreListening UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaHostProviderFromHwnd

crypt32

CertEnumCertificatesInStore CertCloseStore CertGetNameStringW CertOpenSystemStoreW CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA

winhttp

WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser

opengl32

wglGetProcAddress wglGetCurrentDC wglGetCurrentContext wglDeleteContext wglMakeCurrent wglCreateContext

hid

HidD_GetSerialNumberString HidP_GetCaps HidP_GetValueCaps HidD_GetAttributes HidD_GetHidGuid HidD_GetPreparsedData HidD_FreePreparsedData HidD_GetFeature HidD_SetFeature HidD_GetManufacturerString HidD_GetProductString

msvcp140

?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z _Mtx_destroy_in_situ _Mtx_init_in_situ ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAF@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z _Cnd_init_in_situ _Cnd_destroy_in_situ _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z _Cnd_broadcast ?_Throw_C_error@std@@YAXH@Z ?_Syserror_map@std@@YAPEBDH@Z ??7ios_base@std@@QEBA_NXZ ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??_7ios_base@std@@6B@ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ?precision@ios_base@std@@QEAA_J_J@Z _Strcoll _Strxfrm ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ??Bios_base@std@@QEBA_NXZ ?fail@ios_base@std@@QEBA_NXZ ?swap@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??Bid@locale@std@@QEAA_KXZ ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA ?_Xlength_error@std@@YAXPEBD@Z _Thrd_yield ?classic@locale@std@@SAAEBV12@XZ ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@AEAD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?setf@ios_base@std@@QEAAHHH@Z ?eof@ios_base@std@@QEBA_NXZ ?unsetf@ios_base@std@@QEAAXH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAN@Z ?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEAD_J@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ _Unlock_shared_ptr_spin_lock _Lock_shared_ptr_spin_lock ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_wait _Mtx_unlock _Mtx_lock

bcrypt

BCryptGenRandom

uxtheme

SetWindowTheme

vcruntime140

__current_exception_context longjmp __std_terminate memchr __C_specific_handler _set_purecall_handler wcsrchr __intrinsic_setjmp wcschr strrchr strchr wcsstr strstr _purecall memset memmove memcpy __current_exception memcmp __RTDynamicCast __std_type_info_name __RTtypeid __CxxFrameHandler3 __std_exception_copy __std_type_info_compare _CxxThrowException __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

_aligned_realloc _get_heap_handle _heapchk calloc free _aligned_malloc _aligned_free malloc _set_new_mode realloc

api-ms-win-crt-convert-l1-1-0

_wcstoui64 wcstol wcstombs strtoul strtod strtoll _wtoi64 _wtoi _wcstoi64 _wtof _strtof_l _strtod_l _strtoui64 _strtol_l _strtoi64 atof wcstoul mbstowcs atoi strtol wcstod

api-ms-win-crt-math-l1-1-0

sin sinf fmod _fdopen atan2 cos logbf cosf asinf _fdsign copysign asin acosf fabs frexp acos _dtest powf ldexp fmodf _dclass _fdclass _dsign expf log floor ceil _isnan _finite exp2f __setusermatherr modf atan2f pow modff tanf tanhf trunc lroundf tan round exp sqrtf copysignf floorf ceilf cbrt hypot sqrt roundf log2 exp2 log10f logf truncf nextafterf atan sinhf atanf log2f log10

api-ms-win-crt-string-l1-1-0

wcsncpy_s _wcsicmp _wcsnicmp wcsncpy strncmp wcsncmp strncpy strcat_s wcscpy_s isspace isupper strpbrk iswalpha iswupper isxdigit iscntrl iswspace wcscat_s iswxdigit iswdigit _strdup _strnicmp wcsnlen isalnum _stricmp tolower iswlower strlen toupper isdigit strncat isalpha strcmp strncpy_s strspn strcspn strcpy_s iswalnum strnlen _wcsdup

api-ms-win-crt-stdio-l1-1-0

_dup2 _dup ferror fclose fopen fseek ftell feof _creat __stdio_common_vsscanf __stdio_common_vsnprintf_s fread fopen_s _close puts __stdio_common_vfprintf _fileno _setmode __stdio_common_vsprintf_s _set_fmode _wfopen _open_osfhandle fputs ungetc _get_stream_buffer_pointers fgetc fgetpos _isatty fputc _open fsetpos fgets _fseeki64 _lseeki64 _read __stdio_common_vswprintf __stdio_common_vsprintf fflush _getcwd __acrt_iob_func __stdio_common_vfwprintf fwrite __stdio_common_vfprintf_s setvbuf _write __stdio_common_vswprintf_s _wfsopen __p__commode

api-ms-win-crt-utility-l1-1-0

bsearch srand rand_s qsort rand div

api-ms-win-crt-runtime-l1-1-0

_set_invalid_parameter_handler abort _invalid_parameter_noinfo _wassert _beginthread exit __sys_nerr _register_thread_local_exe_atexit_callback _c_exit raise _initterm_e __sys_errlist _beginthreadex _endthreadex _exit _configure_narrow_argv _initterm strerror_s _invoke_watson _get_narrow_winmain_command_line _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _invalid_parameter_noinfo_noreturn _crt_atexit signal _errno _set_app_type _seh_filter_exe _cexit strerror terminate _getpid _endthread

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char _create_locale _configthreadlocale _free_locale setlocale

api-ms-win-crt-environment-l1-1-0

getenv_s _putenv_s getenv __p__wenviron _wgetenv_s

api-ms-win-crt-conio-l1-1-0

_cputs

api-ms-win-crt-filesystem-l1-1-0

_stat64i32 _wstat64i32 remove _unlink _waccess _fstat64 _lock_file _fullpath _unlock_file _stat64

api-ms-win-crt-time-l1-1-0

strftime _gmtime64_s _time64 _mktime64 _gmtime64 _localtime64_s _tzset __tzname __timezone

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcmp _mbspbrk

??0IAntiLag2Module@@QEAA@$$QEAV0@@Z ??0IAntiLag2Module@@QEAA@AEBV0@@Z ??0IAntiLag2Module@@QEAA@XZ ??1IAntiLag2Module@@UEAA@XZ ??4IAntiLag2Module@@QEAAAEAV0@$$QEAV0@@Z ??4IAntiLag2Module@@QEAAAEAV0@AEBV0@@Z ??_7IAntiLag2Module@@6B@ ?ffxFrameInterpolationUiComposition@@YAIPEAUffxCallbackDescFrameGenerationPresent@@PEAX@Z AmdPowerXpressRequestHighPerformance D3D12SDKPath D3D12SDKVersion INTC_D3D11_XessCreateContext INTC_D3D11_XessDestroyContext INTC_D3D11_XessExecute INTC_D3D11_XessForceLegacyScaleFactors INTC_D3D11_XessGetExposureMultiplier INTC_D3D11_XessGetInitParams INTC_D3D11_XessGetInputResolution INTC_D3D11_XessGetIntelXeFXVersion INTC_D3D11_XessGetJitterScale INTC_D3D11_XessGetOptimalInputResolution INTC_D3D11_XessGetProfilingData INTC_D3D11_XessGetVelocityScale INTC_D3D11_XessGetVersion INTC_D3D11_XessInit INTC_D3D11_XessIsOptimalDriver INTC_D3D11_XessSelectNetworkModel INTC_D3D11_XessSetExposureMultiplier INTC_D3D11_XessSetJitterScale INTC_D3D11_XessSetLoggingCallback INTC_D3D11_XessSetVelocityScale INTC_D3D12_GetApplicationInfo INTC_D3D12_GetGpuCrashDumpBufferInfo INTC_D3D12_GpuCrashDumpOnCommandListCreate INTC_D3D12_GpuCrashDumpOnCommandListDestroy INTC_D3D12_GpuCrashDumpOnDeviceDestroy INTC_D3D12_RegisterDriverCallbacks NvOptimusEnablement agsCheckDriverVersion agsDeInitialize agsDriverExtensionsDX11_BeginUAVOverlap agsDriverExtensionsDX11_CreateDevice agsDriverExtensionsDX11_CreateFromDevice agsDriverExtensionsDX11_Destroy agsDriverExtensionsDX11_DestroyDevice agsDriverExtensionsDX11_EndUAVOverlap agsDriverExtensionsDX11_GetMaxClipRects agsDriverExtensionsDX11_IASetPrimitiveTopology agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect agsDriverExtensionsDX11_MultiDrawInstancedIndirect agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect agsDriverExtensionsDX11_NumPendingAsyncCompileJobs agsDriverExtensionsDX11_SetClipRects agsDriverExtensionsDX11_SetDepthBounds agsDriverExtensionsDX11_SetDiskShaderCacheEnabled agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount agsDriverExtensionsDX11_SetViewBroadcastMasks agsDriverExtensionsDX11_WriteBreadcrumb agsDriverExtensionsDX12_CreateDevice agsDriverExtensionsDX12_CreateFromDevice agsDriverExtensionsDX12_Destroy agsDriverExtensionsDX12_DestroyDevice agsDriverExtensionsDX12_PopMarker agsDriverExtensionsDX12_PushMarker agsDriverExtensionsDX12_SetMarker agsGetVersionNumber agsInitialize agsSetDisplayMode ffxAssertReport ffxAssertSetPrintingCallback ffxGetDX12FormatFromSurfaceFormat ffxGetDX12StateFromResourceState ffxGetSurfaceFormatDX12 ffxPrintMessage ffxSafeReleaseCopyResource ffxSafeReleasePipeline ffxSafeReleaseResource ffxSetPrintMessageCallback nsvgCreateRasterizer nsvgDelete nsvgDeleteRasterizer nsvgDuplicatePath nsvgParse nsvgParseFromFile nsvgParseTransform nsvgRasterize nsvgRasterizeFull src_callback_new src_callback_read src_clone src_delete src_error src_float_to_int_array src_float_to_short_array src_get_channels src_get_description src_get_name src_get_version src_int_to_float_array src_is_valid_ratio src_new src_process src_reset src_set_ratio src_short_to_float_array src_simple src_strerror

Name

.text

Size

136.4MB

Virtual Size

136.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38.6MB

Virtual Size

38.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.0MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6.9MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

374KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=6, id=257, version=33030,

count=13, id=253, version=33030,

count=10, id=260, version=33030,

count=77, id=259, version=33030,

count=2, id=261, version=30795,

count=2, id=259, version=30795,

count=1, id=262, version=30795,

count=46, id=257, version=30795,

count=11, id=260, version=30795,

count=41, id=261, version=33030,

count=1, id=261, version=27034,

count=39, id=261, version=32215,

count=183, id=260, version=34123,

count=12, id=261, version=33140,

count=9, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=120, id=261, version=24245,

count=9, id=261, version=34444,

count=30, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=261, version=30151,

count=5, id=261, version=34436,

count=5, id=260, version=34436,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=205, id=261, version=34120,

count=7, id=261, version=27044,

count=2, id=261, version=27412,

count=2, id=257, version=27412,

count=134, id=260, version=27031,

count=1, id=260, version=27034,

count=145, id=260, version=34435,

count=562, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=34, id=260, productName=VS2019 v16.9.0 build 29910, version=29910,

count=110, id=260, version=30151,

count=38, id=260, version=33144,

count=77, id=261, version=33144,

count=1, id=261, version=33141,

count=39, id=260, version=34120,

count=3, id=257, version=33143,

count=1495, id=1, productName=Unmarked objects,

count=79, id=261, version=30156,

count=4, id=259, version=30145,

count=3, id=260, version=30145,

count=9, id=260, version=33133,

count=347, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=260, version=33145,

count=459, productName=Unmarked objects (old),

count=1615, id=261, version=33145,

count=1, id=256, version=33145,

count=1, id=255, version=33145,

count=2, id=151,

count=1, id=258, version=33145,