Rose[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Rose.zip
Size 23.8MB
Sample260928-2fkrrawtbz
SHA256 4bb3cddcf7d163869cee469f98f1a9620c119a18bf2659b7aac94d8a551e568d
MD5 976b8970d9d2336f5fe500b0e4a60246
SHA1 95cad95e65f771fa77e2cc948493d771e5c18c63
SHA512 2fedf176fba696801bfcf2c9d1bd7949a0bb08a5bb95a5f88b0c8416fb6f20f14f15bb8ecb38f6646a38a3dfbf080678acc349cffa9c2bf14845c13705b5aa45
SSDEEP 393216:KjugvCcyNxN5gsKMfm6PdLCj6nh/wXh8r3F+E9BaO8aq7AetJsVqQGEA7QGmnMXq:KdvCndKkdLbnxwRu3F+ELtq7A2uI8GmZ
TLSH
T14E473398B05E8C33F17EC91821A37C695FA971B9CEABCCC8DB3860325A95D351B5F205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Rose.exe

File Explorer

Rose.zip

.zip 23.8MB
Rose.exe

.exe 39.6MB

Rose.zip

SHA256 4bb3cddcf7d163869cee469f98f1a9620c119a18bf2659b7aac94d8a551e568d
MD5 976b8970d9d2336f5fe500b0e4a60246
SHA1 95cad95e65f771fa77e2cc948493d771e5c18c63
SHA512 2fedf176fba696801bfcf2c9d1bd7949a0bb08a5bb95a5f88b0c8416fb6f20f14f15bb8ecb38f6646a38a3dfbf080678acc349cffa9c2bf14845c13705b5aa45
SSDEEP 393216:KjugvCcyNxN5gsKMfm6PdLCj6nh/wXh8r3F+E9BaO8aq7AetJsVqQGEA7QGmnMXq:KdvCndKkdLbnxwRu3F+ELtq7A2uI8GmZ
TLSH
T14E473398B05E8C33F17EC91821A37C695FA971B9CEABCCC8DB3860325A95D351B5F205
MD5 SHA1 SHA512 SSDEEP TLSH

Rose.exe

IMPHASH 12276feaae2d3931886f5b9d8baaeb71
SHA256 16f5d5bd5c8f3b12f66adb4fbd63ce81c6235e85579f339c7d7e2a964f7cc16e
MD5 0e23583985047fd1e5987e8f415323f0
SHA1 4fdce6628733a4f2190b034886f7a408e5cc7c7d
SHA512 61f77bf5ec81fc98630896aeb878c3556f489df5148fb2ff39c9468958c26f1ac7d7f076f91259773cb371f820b648031642ff3ec0e3fd7edd44c7e2b88dbe09
SSDEEP 786432:fmMvKs3ZGk+pnxpb7kEgMnwuAzuQRzelzkJxFcK1N4uceRzP6:uMvKs3Zf+pTbNgCwP1tgkzzi
TLSH
T18E97BE82F242C950C85A5D3A8D63EAE543327C19BF0657673094BF1BBDB33C26E79681
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3612352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\Administrator\Downloads\1.zip_pass_123\1\1\Build\Artifacts\Rose.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmFlush DwmExtendFrameIntoClientArea

api-ms-win-core-synch-l1-2-0

Sleep InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-memory-l1-1-0

WriteProcessMemory VirtualProtect VirtualFreeEx VirtualProtectEx UnmapViewOfFile ReadProcessMemory VirtualQueryEx VirtualAllocEx MapViewOfFile

api-ms-win-core-libraryloader-l1-2-0

LockResource GetModuleHandleW GetModuleFileNameA FreeLibrary LoadLibraryExW SizeofResource GetModuleHandleA LoadResource GetModuleFileNameW LoadLibraryExA GetProcAddress

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSetOption WinHttpOpen WinHttpCloseHandle WinHttpAddRequestHeaders WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpConnect

api-ms-win-core-heap-l2-1-0

GlobalFree GlobalAlloc LocalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

d3dcompiler_47

D3DCompile

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW LoadLibraryA FindResourceW

api-ms-win-core-localization-l1-2-0

IsDBCSLeadByte FormatMessageA GetLocaleInfoEx GetLocaleInfoA FormatMessageW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError SetLastError

api-ms-win-core-heap-l1-1-0

HeapSize HeapFree GetProcessHeap HeapDestroy HeapAlloc HeapReAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive CreateEventW SetEvent LeaveCriticalSection AcquireSRWLockExclusive WaitForSingleObject EnterCriticalSection InitializeCriticalSection WaitForSingleObjectEx SleepEx

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken GetProcessId GetExitCodeProcess GetCurrentThread CreateThread GetCurrentProcess SetPriorityClass GetCurrentProcessId CreateProcessW GetCurrentThreadId ExitProcess TerminateProcess SetThreadPriority

api-ms-win-security-base-l1-1-0

GetLengthSid IsValidSid AdjustTokenPrivileges GetTokenInformation CopySid

api-ms-win-security-sddl-ansi-l1-1-0

ConvertSidToStringSidA

api-ms-win-core-file-l1-1-0

GetFileSizeEx WriteFile GetShortPathNameW CreateFileA GetFileAttributesExW DeleteFileW SetFileInformationByHandle CreateFileW FindClose ReadFile CreateDirectoryW GetFileType FindFirstFileExW FlushFileBuffers FindNextFileW FindFirstFileW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetTickCount64 GetTickCount GetLocalTime GetSystemTimeAsFileTime GetSystemDirectoryW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableA GetCommandLineW GetEnvironmentVariableW GetStdHandle

api-ms-win-security-cryptoapi-l1-1-0

CryptImportKey CryptEncrypt CryptAcquireContextW CryptAcquireContextA CryptDestroyHash CryptHashData CryptReleaseContext CryptDestroyKey CryptCreateHash CryptGetHashParam

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-core-toolhelp-l1-1-0

Process32NextW CreateToolhelp32Snapshot Process32FirstW

api-ms-win-core-console-l1-1-0

GetConsoleMode SetConsoleCtrlHandler AllocConsole SetConsoleMode

api-ms-win-core-console-l2-1-0

FillConsoleOutputAttribute FillConsoleOutputCharacterA GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleCursorPosition

ws2_32

WSASetLastError ntohs inet_pton WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getaddrinfo WSAStartup socket setsockopt send recv listen htons htonl closesocket bind accept freeaddrinfo select __WSAFDIsSet getsockopt WSAIoctl gethostname sendto getsockname getpeername connect recvfrom WSACleanup inet_ntop ioctlsocket

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics GetMonitorInfoW EnumDisplayDevicesW EnumDisplayMonitors

api-ms-win-core-console-l2-2-0

SetConsoleTitleW SetConsoleTitleA

api-ms-win-core-console-l1-2-0

FreeConsole

api-ms-win-core-console-l3-2-0

GetConsoleWindow

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-mm-time-l1-1-0

timeBeginPeriod

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent FlushInstructionCache OpenProcess

api-ms-win-core-kernel32-legacy-l1-1-2

Process32First Process32Next

api-ms-win-core-debug-l1-1-1

CheckRemoteDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegDeleteTreeA RegQueryValueExW RegOpenKeyExW RegCloseKey

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyA

api-ms-win-core-psapi-l1-1-0

K32GetModuleBaseNameW QueryFullProcessImageNameW

api-ms-win-core-com-l1-1-0

CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree CoCreateFreeThreadedMarshaler

mmdevapi

ord17

crypt32

CryptDecodeObjectEx CertGetNameStringW CryptQueryObject CertFreeCertificateContext CertFindCertificateInStore CertAddCertificateContextToStore CertCloseStore CertOpenStore CertCreateCertificateChainEngine CertFreeCertificateChainEngine CryptStringToBinaryW CertEnumCertificatesInStore CertFindExtension CryptUnprotectData CryptStringToBinaryA PFXImportCertStore CertFreeCertificateChain CertGetCertificateChain

api-ms-win-core-kernel32-legacy-l1-1-0

CreateFileMappingA

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx MoveFileExW

bcrypt

BCryptGenRandom

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

kernel32

Module32Next Module32FirstW Module32NextW K32EnumProcessModules WinExec Module32First

user32

GetAsyncKeyState LoadIconA SetProcessDPIAware MonitorFromWindow LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor MessageBoxA GetWindowRect EndPaint BeginPaint UpdateWindow SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode BringWindowToTop SetLayeredWindowAttributes DestroyWindow CreateWindowExA RegisterClassExA PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage MonitorFromPoint ReleaseCapture SetCapture GetCapture GetKeyState DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard FindWindowW keybd_event mouse_event GetWindowTextA FindWindowA SetWindowLongA SetForegroundWindow SetWindowPos ShowWindow SendInput SetWindowTextW SetWindowDisplayAffinity EnumWindows IsWindowVisible IsWindow GetWindowThreadProcessId

gdi32

GetStockObject

comdlg32

GetOpenFileNameA

shell32

ShellExecuteA ShellExecuteW SHGetFolderPathA

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Random_device@std@@YAIXZ ?id@?$numpunct@D@std@@2V0locale@2@A ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Query_perf_frequency _Query_perf_counter ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?unsetf@ios_base@std@@QEAAXH@Z ?setf@ios_base@std@@QEAAHHH@Z ?setf@ios_base@std@@QEAAHH@Z _Xtime_get_ticks ?_Xinvalid_argument@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Xbad_function_call@std@@YAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?rdstate@ios_base@std@@QEBAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_unlock _Mtx_lock ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ _Cnd_wait ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A _Cnd_broadcast _Cnd_signal _Thrd_join _Thrd_id ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ _Thrd_hardware_concurrency _Thrd_yield _Mtx_trylock ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??Bios_base@std@@QEBA_NXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

msvcp140_atomic_wait

__std_atomic_notify_all_direct __std_atomic_wait_direct

imm32

ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow ImmGetContext

userenv

UnloadUserProfile

winmm

mciSendStringA waveOutSetVolume PlaySoundA

vcruntime140

__intrinsic_setjmp __std_terminate __current_exception_context __current_exception wcschr longjmp __C_specific_handler strrchr wcsstr wcsrchr strstr strchr memcmp memchr __std_exception_copy __std_exception_destroy memset memmove memcpy _CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate _c_exit abort _cexit exit __p___argv _exit __sys_errlist __sys_nerr _invoke_watson __p___argc _seh_filter_exe _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit strerror _configure_narrow_argv system _resetstkoflw _initialize_narrow_environment _errno _invalid_parameter_noinfo _get_initial_narrow_environment _initterm _initterm_e _register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

log10 powf pow logf log atan2f tan frexp fmod asin _fdopen _dclass ldexp sinf cosf _dsign _ldsign _fdsign __setusermatherr _fdclass _ldclass atan2 acos round tanf roundf acosf asinf expf lround lroundf nearbyint fmodf cos sin exp

api-ms-win-crt-heap-l1-1-0

free malloc calloc _callnewh _set_new_mode realloc

api-ms-win-crt-string-l1-1-0

wcsncmp wcspbrk strcspn _wcsdup strcoll iscntrl isgraph ispunct islower isupper wcslen strlen strncpy strcmp strncmp _strdup strcpy strpbrk isxdigit strspn wcscmp isalpha towupper _wcsicmp isspace strcpy_s wcsncpy isdigit tolower iswspace _stricmp toupper wcsncpy_s wcscpy_s towlower isalnum strncpy_s

api-ms-win-crt-stdio-l1-1-0

_popen _pclose _ftelli64 _read clearerr _write fgets getc freopen fopen __stdio_common_vfprintf _fileno ferror feof tmpnam fopen_s __stdio_common_vswprintf_s __p__commode __stdio_common_vsprintf_s tmpfile freopen_s __stdio_common_vsprintf fputs __acrt_iob_func _wfopen _wopen fclose fflush fread ungetc setvbuf _fseeki64 _lseeki64 _set_fmode fsetpos fputc fgetpos fgetc _get_stream_buffer_pointers fseek ftell fwrite __stdio_common_vsscanf _close

api-ms-win-crt-convert-l1-1-0

strtoll strtol wcstombs atof strtoull strtoul strtof strtod atoi

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-time-l1-1-0

_mktime64 _localtime64_s _localtime64 strftime clock _time64 _difftime64 _gmtime64

api-ms-win-crt-filesystem-l1-1-0

_unlink _fstat64 rename _wstat64 _lock_file remove _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func setlocale _configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

674KB

Virtual Size

765KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

31.2MB

Virtual Size

31.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ