R B X 9 5[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

R B X 9 5.rar
Size

9.6MB
MD5

dd7a3dd6705772279e7b04a4b3fd65a2
SHA1

972e75b89f5960c05f08c19403299600b1f99ea5
SHA256

6be4d25bd90b841fd9693a567f1983de0d1c4155a62ee066cf5f1837e75c1b06
SHA512

bf995bcd03cd05ae9f68e83d98f80cedff2c561eedce1accf4e037374d7238bd4feafa105fbddc38ac0a6c813d279ecc952c8d08f648ff3b09e4776050a35368
SSDEEP

196608:oygvM5WtHmTsHsS9TpcJyjjwsnxrjUd79TRlIL0GV:o7MgH4sHf9TpcQwsnxcd7vlIvV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpack001/R B X 9 5/Roblox Executor.exe

resource
unpack001/R B X 9 5/Roblox Executor.exe

Files

R B X 9 5.rar
.rar

Password: 2024
R B X 9 5/Client.config
.exe windows:6 windows x86 arch:x86

Password: 2024

59bafed0fa1382619aa4b845f3f73552

Code Sign

53:22:a5:0e:e8:2e:3b:74:26:1b:03:9b:bb:27:96:f2
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

21-02-2020 00:00

Not After

21-02-2021 23:59

Subject

CN=Electronic Arts\, Inc.,OU=Contingency Studios,O=Electronic Arts\, Inc.,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

fa:54:07:ca:08:9a:e7:56:21:18:cf:45:36:1d:d4:67:2b:49:97:22
Signer

Actual PE Digest

fa:54:07:ca:08:9a:e7:56:21:18:cf:45:36:1d:d4:67:2b:49:97:22

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ClientG.pdb

Imports

imm32

ImmGetContext
ImmDisableTextFrameService
ImmGetCandidateListW
ImmGetCompositionStringW
ImmAssociateContext
ImmSetCompositionWindow
ImmReleaseContext
ImmGetVirtualKey

winmm

mmioGetInfo
timeGetDevCaps
mmioSetInfo
mmioAdvance
mmioDescend
mmioRead
mmioWrite
mmioAscend
mmioCreateChunk
mmioSeek
mmioClose
mmioOpenA
timeGetTime
timeBeginPeriod
PlaySoundA
timeEndPeriod

ws2_32

sendto
gethostbyname
WSAGetLastError
accept
closesocket
ioctlsocket
getsockname
htonl
listen
ntohs
select
ntohl
WSAAccept
WSACloseEvent
WSACreateEvent
WSAGetOverlappedResult
WSARecv
WSAResetEvent
WSASend
WSASetEvent
WSAWaitForMultipleEvents
inet_ntoa
getaddrinfo
freeaddrinfo
getsockopt
gethostbyaddr
gethostname
WSAIoctl
WSARecvFrom
WSASocketA
inet_pton
getpeername
getservbyname
WSAEventSelect
WSACleanup
connect
WSAStartup
inet_addr
recvfrom
socket
htons
shutdown
setsockopt
send
bind
__WSAFDIsSet
recv

tbbg

?internal_size@concurrent_queue_base_v3@internal@tbb@@IBEHXZ
?internal_empty@concurrent_queue_base_v3@internal@tbb@@IBE_NXZ
?internal_set_capacity@concurrent_queue_base_v3@internal@tbb@@IAEXHI@Z
?internal_finish_clear@concurrent_queue_base_v3@internal@tbb@@IAEXXZ
?allocate@allocate_additional_child_of_proxy@internal@tbb@@QBEAAVtask@3@I@Z
?terminate@task_scheduler_init@tbb@@QAEXXZ
?allocate@allocate_root_with_context_proxy@internal@tbb@@QBEAAVtask@3@I@Z
??1task_group_context@tbb@@QAE@XZ
?reset@task_group_context@tbb@@QAEXXZ
?cancel_group_execution@task_group_context@tbb@@QAE_NXZ
?internal_pop_if_present@concurrent_queue_base_v3@internal@tbb@@IAE_NPAX@Z
__TBB_machine_cmpswp8
__TBB_machine_fetchadd8
__TBB_machine_store8
__TBB_machine_load8
?internal_acquire_writer@spin_rw_mutex_v3@tbb@@AAE_NXZ
?internal_acquire_reader@spin_rw_mutex_v3@tbb@@AAEXXZ
?internal_upgrade@spin_rw_mutex_v3@tbb@@AAE_NXZ
?NFS_Allocate@internal@tbb@@YAPAXIIPAX@Z
?set_fallback_allocator@internal@tbb@@YAXPAX0@Z
?NFS_Free@internal@tbb@@YAXPAX@Z
?throw_exception_v4@internal@tbb@@YAXW4exception_id@12@@Z
?internal_push_if_not_full@concurrent_queue_base_v3@internal@tbb@@IAE_NPBX@Z
?internal_pop@concurrent_queue_base_v3@internal@tbb@@IAEXPAX@Z
??1concurrent_queue_base_v3@internal@tbb@@MAE@XZ
??0concurrent_queue_base_v3@internal@tbb@@IAE@I@Z
?allocate@allocate_root_proxy@internal@tbb@@SAAAVtask@3@I@Z
?allocate@allocate_continuation_proxy@internal@tbb@@QBEAAVtask@3@I@Z
?allocate@allocate_child_proxy@internal@tbb@@QBEAAVtask@3@I@Z
?is_group_execution_cancelled@task_group_context@tbb@@QBE_NXZ
?note_affinity@task@tbb@@UAEXG@Z
?get_initial_auto_partitioner_divisor@internal@tbb@@YAIXZ
?acquire@scoped_lock@queuing_rw_mutex@tbb@@QAEXAAV23@_N@Z
?release@scoped_lock@queuing_rw_mutex@tbb@@QAEXXZ
?init@task_group_context@tbb@@IAEXXZ
?default_num_threads@task_scheduler_init@tbb@@SAHXZ
?initialize@task_scheduler_init@tbb@@QAEXHI@Z
?destroy@task_base@internal@interface5@tbb@@SAXAAVtask@4@@Z
?initialize@task_scheduler_init@tbb@@QAEXH@Z
?internal_clear@concurrent_vector_base_v3@internal@tbb@@IAEIP6AXPAXI@Z@Z
?internal_push_back@concurrent_vector_base_v3@internal@tbb@@IAEPAXIAAI@Z
?internal_capacity@concurrent_vector_base_v3@internal@tbb@@IBEIXZ
?resize@affinity_partitioner_base_v3@internal@tbb@@AAEXI@Z
??1concurrent_vector_base_v3@internal@tbb@@IAE@XZ

kernel32

VirtualQuery
VirtualProtect
GetSystemInfo
GetTimeZoneInformation
TerminateProcess
GetCurrentProcess
K32GetModuleBaseNameW
K32EnumProcesses
lstrcmpiW
LoadLibraryW
GetModuleHandleW
OpenProcess
CreateProcessW
CloseHandle
SetEnvironmentVariableW
GetTickCount
GetComputerNameA
MoveFileExA
GetTempPathA
LoadLibraryA
GetProcAddress
GetModuleHandleA
FreeLibrary
GetCurrentThreadId
Sleep
GetLastError
RaiseException
DecodePointer
GetFileAttributesA
DeleteFileA
CreateDirectoryA
SetCurrentDirectoryA
ExpandEnvironmentStringsA
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
SystemTimeToFileTime
DebugBreak
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
InitializeSListHead
CreateEventW
WaitForSingleObjectEx
OpenFileMappingA
lstrcpynA
lstrlenA
CreateThread
GetFileInformationByHandleEx
CreateFileW
GetPrivateProfileStringA
FindResourceA
SizeofResource
LockResource
LoadResource
lstrcatA
lstrcpyA
LoadLibraryExW
SetErrorMode
GetThreadLocale
GetLocaleInfoA
FileTimeToSystemTime
ExpandEnvironmentStringsW
UnlockFileEx
UnlockFile
LockFileEx
LockFile
CreateNamedPipeA
CreatePipe
GetDriveTypeW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetOverlappedResult
PeekNamedPipe
OutputDebugStringW
FormatMessageW
GetModuleFileNameW
TlsFree
GetCommandLineW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleInformation
GetHandleInformation
InitializeCriticalSection
DuplicateHandle
SetFilePointer
SetStdHandle
GetStdHandle
RemoveDirectoryW
RemoveDirectoryA
FindNextFileW
CreateDirectoryW
SetFileAttributesW
GetFileType
GetFileAttributesW
GetDriveTypeA
FindFirstFileW
SystemTimeToTzSpecificLocalTime
SetLastError
K32GetProcessImageFileNameA
K32GetModuleInformation
K32GetModuleFileNameExA
GetTimeFormatW
GetTimeFormatA
GetDateFormatW
GetDateFormatA
IsBadCodePtr
IsBadReadPtr
QueryDosDeviceA
GetLogicalDriveStringsA
GlobalFree
ReadProcessMemory
GlobalAlloc
GetThreadContext
ExitProcess
DebugActiveProcessStop
DebugActiveProcess
WaitForDebugEvent
ContinueDebugEvent
GetFullPathNameW
GetFullPathNameA
RtlCaptureContext
ReadDirectoryChangesW
GetLocalTime
CreateProcessA
OutputDebugStringA
GetModuleHandleExA
GetExitCodeProcess
Thread32Next
Thread32First
GetUserDefaultLangID
GetNumberFormatA
CopyFileA
SuspendThread
OpenThread
SetUnhandledExceptionFilter
GetFileSizeEx
CompareFileTime
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateIoCompletionPort
K32GetModuleBaseNameA
K32EnumProcessModules
MultiByteToWideChar
FileTimeToDosDateTime
GetThreadTimes
GetExitCodeThread
TerminateThread
GetCurrentThread
HeapDestroy
HeapCreate
Module32Next
FileTimeToLocalFileTime
WideCharToMultiByte
GlobalUnlock
GlobalLock
SwitchToThread
GetProcessHeap
HeapFree
HeapReAlloc
HeapAlloc
GetModuleFileNameA
SetThreadAffinityMask
Module32First
TlsGetValue
GetVersionExA
FlushInstructionCache
VirtualFree
VirtualAlloc
LeaveCriticalSection
TlsAlloc
GetModuleHandleExW
Process32Next
Process32First
CreateToolhelp32Snapshot
MoveFileA
GetTempFileNameA
CreateFileMappingA
CreateSemaphoreA
FormatMessageA
WaitForMultipleObjects
LocalFree
UnmapViewOfFile
MapViewOfFile
GetLogicalProcessorInformation
GetSystemTimeAsFileTime
GetSystemTime
TlsSetValue
SetThreadPriority
GetCurrentProcessId
GetProcessTimes
CreateEventA
CreateMutexA
WaitForSingleObject
ReleaseMutex
ReleaseSemaphore
ResetEvent
SetEvent
HeapSetInformation
HeapWalk
HeapUnlock
HeapLock
QueryPerformanceFrequency
QueryPerformanceCounter
IsDebuggerPresent
WriteFile
SetFileTime
SetFilePointerEx
SetFileAttributesA
SetEndOfFile
ReadFile
GetFileTime
GetFileSize
GetFileInformationByHandle
FindNextFileA
FindFirstFileA
FindClose
CreateFileA
GetCurrentDirectoryA
SetEnvironmentVariableA
GetEnvironmentVariableA
EnterCriticalSection
DeleteFileW
FlushFileBuffers
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetTempPathW
GetVersionExW
AreFileApisANSI
LoadLibraryExA
GetACP

user32

DefWindowProcW
GetIconInfo
GetDoubleClickTime
DrawTextW
SendMessageTimeoutA
EnumWindows
GetClassNameA
GetWindowThreadProcessId
GetKeyboardLayout
GetKeyState
GetKeyboardState
ToAsciiEx
MapVirtualKeyExA
CreateDialogParamA
EndDialog
GetDlgItem
GetProcessWindowStation
GetUserObjectInformationW
GetWindowLongA
PostMessageA
DialogBoxIndirectParamA
GetMessageA
DefWindowProcA
RegisterClassExA
CreateWindowExA
DestroyWindow
SetLayeredWindowAttributes
MoveWindow
GetDC
ReleaseDC
ShowScrollBar
GetCursorPos
GetClientRect
FlashWindowEx
PtInRect
GetMonitorInfoA
EnumDisplayMonitors
GetActiveWindow
GetCapture
SetCursorPos
SetCursor
GetDesktopWindow
ClientToScreen
SetMenu
LoadCursorA
GetForegroundWindow
wsprintfA
GetCursor
FillRect
OpenClipboard
CloseClipboard
GetMenu
SystemParametersInfoA
GetClipboardData
LoadBitmapA
SetClipboardData
EmptyClipboard
TranslateMessage
SetFocus
EndDeferWindowPos
DispatchMessageA
PeekMessageA
SendMessageA
GetClassLongA
PostQuitMessage
DeferWindowPos
BeginDeferWindowPos
UnregisterClassA
SetRect
RegisterClassExW
LoadImageA
CreateIconIndirect
CreateWindowExW
ShowWindow
SetWindowPos
EnumDisplaySettingsA
GetWindowPlacement
IsIconic
BringWindowToTop
SetCapture
ReleaseCapture
TranslateAcceleratorA
GetSystemMetrics
UpdateWindow
SwitchToThisWindow
SetForegroundWindow
BeginPaint
GetClassInfoA
GetCursorInfo
GetAncestor
EndPaint
GetWindowRect
AdjustWindowRect
MessageBoxA
ShowCursor
ClipCursor
ScreenToClient
OffsetRect
SetWindowLongA
FindWindowW
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
RegisterClassA
LoadIconA
SetProcessDPIAware

gdi32

GetTextMetricsA
ExtTextOutW
GetTextFaceA
GetTextExtentPoint32W
GetDeviceCaps
DeleteDC
CreateDCA
GetStockObject
GdiFlush
GetTextMetricsW
SetTextColor
SetBkMode
SetBkColor
CreateFontA
GetDIBits
CreateSolidBrush
CreateBitmap
GetCurrentObject
AddFontMemResourceEx
CreateDIBSection
SelectObject
CreateCompatibleDC
BitBlt
EnumFontFamiliesExA
GetObjectA
DeleteObject

advapi32

CloseServiceHandle
ControlService
CreateServiceA
DeleteService
OpenSCManagerA
OpenServiceA
QueryServiceStatusEx
RegisterServiceCtrlHandlerExA
ReportEventA
RegisterEventSourceA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
LookupAccountNameA
LookupAccountSidA
IsValidSid
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
EqualSid
RegSetValueExW
RegCreateKeyExW
ReportEventW
SetServiceStatus
CreateProcessAsUserW
DuplicateTokenEx
ImpersonateLoggedOnUser
InitializeSecurityDescriptor
RevertToSelf
SetSecurityDescriptorDacl
LogonUserW
OpenProcessToken
CopySid
GetLengthSid
GetTokenInformation
DeregisterEventSource
RegisterEventSourceW
ChangeServiceConfig2A
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
StartServiceCtrlDispatcherA
RegEnumValueA
RegDeleteValueA
RegCreateKeyExA
RegCloseKey
AllocateAndInitializeSid
FreeSid
GetUserNameA
RegOpenKeyExW
RegQueryValueExW

shell32

SHCreateDirectoryExA
SHFileOperationA
SHGetFolderPathA
ShellExecuteA

ole32

CoCreateGuid
CoInitialize
CoUninitialize
CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
PropVariantClear
OleInitialize
OleUninitialize
OleCreate
OleSetContainedObject
CoTaskMemAlloc

oleaut32

VariantChangeType
SetErrorInfo
CreateErrorInfo
VariantInit
SysAllocString
SysFreeString
VariantClear
GetErrorInfo

shlwapi

SHStrDupW
PathAppendA
PathCanonicalizeA
PathFileExistsA
SHGetValueA

winhttp

WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpWriteData
WinHttpSetOption
WinHttpReadData
WinHttpSetTimeouts
WinHttpOpen
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpConnect

libcurl

curl_easy_cleanup
curl_easy_escape
curl_easy_init
curl_easy_perform
curl_easy_setopt
curl_easy_strerror
curl_free
curl_global_init_mem
curl_slist_append
curl_slist_free_all

powrprof

CallNtPowerInformation

mswsock

TransmitFile

bink2w32

_BinkOpenWithOptions@12
_BinkGetKeyFrame@12
_BinkSetVolume@12
_BinkShouldSkip@4
_BinkControlBackgroundIO@8
_BinkGetTrackID@8
_BinkGetSummary@8
_BinkGetRealtime@12
_BinkGetError@0
_BinkSetSoundTrack@8
_BinkDoFrame@4
_BinkNextFrame@4
_BinkWait@4
_BinkAllocateFrameBuffers@12
_BinkUtilFree@4
_BinkUtilMalloc@8
_BinkRegisterFrameBuffers@8
_BinkGetFrameBuffersInfo@8
_BinkClose@4
_BinkPause@8
_BinkOpenXAudio2@8
_BinkSetSoundSystem2@12
_BinkGoto@12

d3dcompiler_43

D3DGetInputSignatureBlob
D3DReflect
D3DCompile
D3DCreateBlob

d3d11

D3D11CreateDevice

d3dx11_43

D3DX11SaveTextureToFileA
D3DX11CreateShaderResourceViewFromMemory
D3DX11LoadTextureFromTexture
D3DX11CreateTextureFromFileA
D3DX11GetImageInfoFromMemory
D3DX11GetImageInfoFromFileA
D3DX11FilterTexture
D3DX11SaveTextureToMemory
D3DX11CompileFromMemory

d3dx9_43

D3DXQuaternionRotationAxis
D3DXFilterTexture
D3DXSaveTextureToFileInMemory
D3DXCreateEffect
D3DXCreateEffectCompilerFromFileA
D3DXSaveSurfaceToFileA
D3DXSaveSurfaceToFileInMemory
D3DXMatrixLookAtLH
D3DXCreateSprite
D3DXMatrixInverse
D3DXMatrixOrthoOffCenterRH
D3DXCreateFontA
D3DXCreateEffectPool
D3DXVec4Normalize
D3DXVec4Transform
D3DXMatrixTranspose
D3DXGetImageInfoFromFileA
D3DXGetImageInfoFromFileInMemory
D3DXLoadSurfaceFromSurface
D3DXCreateTexture
D3DXCreateCubeTextureFromFileInMemory
D3DXMatrixPerspectiveFovRH
D3DXMatrixMultiply
D3DXCreateTextureFromFileInMemoryEx
D3DXSaveTextureToFileA

d3d9

Direct3DCreate9

avifil32

AVISaveOptions
AVIMakeCompressedStream
AVISaveOptionsFree
AVIFileCreateStreamA
AVIStreamWrite
AVIStreamSetFormat
AVIStreamRelease
AVIFileExit
AVIFileOpenA
AVIFileRelease
AVIFileInit

odbc32

ord16
ord12
ord13
ord29
ord32
ord24
ord9
ord31
ord75
ord111
ord141
ord236
ord35
ord4
ord36
ord45
ord19
ord20
ord39
ord76
ord41
ord61
ord72
ord11

mss32

_AIL_set_sample_loop_count@8
_AIL_set_sample_playback_rate@8
_AIL_end_sample@4
_AIL_start_sample@4
_AIL_set_sample_address@12
_AIL_init_sample@8
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_close_digital_driver@4
_AIL_open_digital_driver@16
_AIL_set_sample_position@8

msvcp140

?eof@ios_base@std@@QBE_NXZ
?fail@ios_base@std@@QBE_NXZ
?bad@ios_base@std@@QBE_NXZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_K@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
?widen@?$ctype@_W@std@@QBE_WD@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?_Xbad_function_call@std@@YAXXZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAM@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
_Thrd_start
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Thrd_join
_Thrd_sleep
_Thrd_id
_Mtx_init
_Mtx_destroy
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_current_owns
_Mtx_lock
_Mtx_trylock
_Mtx_unlock
_Cnd_init
_Cnd_destroy
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_timedwait
_Cnd_signal
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_yield
?_BADOFF@std@@3_JB
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?_Xinvalid_argument@std@@YAXPBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??_7_Facet_base@std@@6B@
??_7facet@locale@std@@6B@
??_7codecvt_base@std@@6B@
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAF@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAHH@Z
?_Winerror_message@std@@YAKKPADK@Z
_Open_dir
_Read_dir
_Close_dir
_Stat
_To_wide
?_Xruntime_error@std@@YAXPBD@Z
??0_Locinfo@std@@QAE@HPBD@Z
??1_Locinfo@std@@QAE@XZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?toupper@?$ctype@_W@std@@QBE_W_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
_Strcoll
_Strxfrm
??0_Locinfo@std@@QAE@PBD@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??0facet@locale@std@@IAE@I@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$collate@D@std@@2V0locale@2@A
?_Getdays@_Locinfo@std@@QBEPBDXZ
?_Getmonths@_Locinfo@std@@QBEPBDXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
??Bios_base@std@@QBE_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
_Mbrtowc
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?uncaught_exception@std@@YA_NXZ
?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z

iphlpapi

GetAdaptersAddresses

urlmon

CreateURLMoniker

vcruntime140

__std_terminate
__std_type_info_compare
__std_exception_copy
strstr
memset
strrchr
wcsstr
__RTDynamicCast
memmove
memcpy
__CxxFrameHandler3
_CxxThrowException
_purecall
__std_exception_destroy
strchr
memchr
_except_handler4_common
__std_type_info_destroy_list
wcschr
__std_type_info_name

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_seh_filter_exe
_set_app_type
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_endthreadex
__doserrno
strerror
exit
_getpid
_controlfp_s
signal
_set_invalid_parameter_handler
perror
_sleep
abort
raise
_beginthreadex
_errno
system
_invalid_parameter_noinfo
terminate
_set_new_handler
_initialize_onexit_table

api-ms-win-crt-heap-l1-1-0

_aligned_free
malloc
free
_aligned_malloc
_set_new_mode
_expand
_msize
_recalloc
realloc
calloc

api-ms-win-crt-stdio-l1-1-0

fclose
__acrt_iob_func
fgets
freopen
__stdio_common_vsprintf_s
fopen
__p__fmode
__stdio_common_vfprintf
_get_stream_buffer_pointers
fflush
fgetc
fgetpos
__stdio_common_vsprintf
fread
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
_set_fmode
putchar
__stdio_common_vswprintf_s
__stdio_common_vsscanf
__p__commode
_write
fputc
__stdio_common_vsprintf_p
__stdio_common_vfprintf_p
__stdio_common_vsnprintf_s
fputs
getc
__stdio_common_vswprintf_p
_wfopen
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
__stdio_common_vfwscanf
_setmode
_open_osfhandle
feof
__stdio_common_vfprintf_s
_get_osfhandle
_fileno
_dup2
_commit
fputws
__stdio_common_vfwprintf
fgetwc
fputwc
ungetwc
__stdio_common_vswscanf
__stdio_common_vfscanf
__stdio_common_vfwprintf_p
_close
__stdio_common_vfwprintf_s
ftell
fopen_s
ferror
fseek

api-ms-win-crt-string-l1-1-0

isalpha
isalnum
_strlwr
wcsncmp
iswctype
_wcsicmp
islower
isupper
_strupr
strtok
wcscpy_s
isdigit
toupper
isprint
isspace
strspn
towlower
strncmp
_strlwr_s
strpbrk
strcpy_s
isxdigit
wcscat_s
strncat
iswgraph
wctype
strcspn
towupper
iswalpha
isgraph
strcat_s
strcmp
strncpy_s
strtok_s
strlen
_stricmp
iswalnum
_strnicmp
strncat_s
strncpy
tolower
_strupr_s

api-ms-win-crt-utility-l1-1-0

rand
bsearch
ldiv
srand
qsort

api-ms-win-crt-convert-l1-1-0

atof
_wtoi
wcstombs_s
_strtoui64
_ultoa_s
_i64toa
_strtoi64
atol
_itoa_s
_itoa
wcstoul
strtoll
wcstol
strtoul
strtol
_wtof
atoi
strtod
_wtoi64
_atoi64

api-ms-win-crt-math-l1-1-0

_libm_sse2_log_precise
frexp
ldexp
_hypotf
_CIcosh
_CIfmod
_CIpow
tanh
sinh
cosh
_CIsinh
_CIacos
floor
modf
_except1
_CItanh
_CIasin
_fdtest
ceil
__setusermatherr
_libm_sse2_pow_precise

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_splitpath
_makepath
_unlink
_chmod
_unlock_file
_splitpath_s
_makepath_s
_wsplitpath_s
rename
_stat64i32

api-ms-win-crt-time-l1-1-0

clock
_localtime64_s
_time64
_localtime64
strftime

api-ms-win-crt-environment-l1-1-0

__p__wenviron
__p__environ
getenv

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

api-ms-win-crt-conio-l1-1-0

_getche

wininet

InternetGetConnectedState

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

psapi

EnumProcessModules
GetModuleInformation

Exports

Exports

??0MallocExtension@@QAE@ABV0@@Z
??0MallocExtension@@QAE@XZ
??0PageHeap@tcmalloc@@QAE@$$QAV01@@Z
??0PageHeap@tcmalloc@@QAE@ABV01@@Z
??0StackTraceTable@tcmalloc@@QAE@XZ
??0SysAllocator@@QAE@ABV0@@Z
??0SysAllocator@@QAE@XZ
??1StackTraceTable@tcmalloc@@QAE@XZ
??4MallocExtension@@QAEAAV0@ABV0@@Z
??4PageHeap@tcmalloc@@QAEAAV01@$$QAV01@@Z
??4PageHeap@tcmalloc@@QAEAAV01@ABV01@@Z
??4StackTraceTable@tcmalloc@@QAEAAV01@ABV01@@Z
??4SysAllocator@@QAEAAV0@ABV0@@Z
??_7MallocExtension@@6B@
??_7SysAllocator@@6B@
?AddTrace@StackTraceTable@tcmalloc@@QAEXABUStackTrace@2@@Z
?CacheSizeClass@PageHeap@tcmalloc@@QBEXII@Z
?GetAggressiveDecommit@PageHeap@tcmalloc@@QAE_NXZ
?GetDescriptor@PageHeap@tcmalloc@@QBEPAUSpan@2@I@Z
?GetSizeClassIfCached@PageHeap@tcmalloc@@QBEII@Z
?GetStackFrames@@YAHPAPAXPAHHH@Z
?GetStackFramesWithContext@@YAHPAPAXPAHHHPBX@Z
?GetStackTrace@@YAHPAPAXHH@Z
?GetStackTraceWithContext@@YAHPAPAXHHPBX@Z
?ReadStackTracesAndClear@StackTraceTable@tcmalloc@@QAEPAPAXXZ
?RecordSpan@PageHeap@tcmalloc@@AAEXPAUSpan@2@@Z
?SetAggressiveDecommit@PageHeap@tcmalloc@@QAEX_N@Z
?bucket_total@StackTraceTable@tcmalloc@@QBEHXZ
?depth_total@StackTraceTable@tcmalloc@@QBEHXZ
?kDefaultReleaseDelay@PageHeap@tcmalloc@@0HB
?kHashTableSize@StackTraceTable@tcmalloc@@0HB
?kMaxReleaseDelay@PageHeap@tcmalloc@@0HB
?kMinSystemAlloc@PageHeap@tcmalloc@@0HB
?kPageMapBigAllocationThreshold@PageHeap@tcmalloc@@0IB
?stats@PageHeap@tcmalloc@@QBE?AUStats@12@XZ
FW1CreateFactory
GetDenuvoTicketLocation
GetDenuvoTimeTicketRequest
_FW1CreateFactory@8
__swprintf_l
__vswprintf_l
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fscanf_l
_fscanf_s_l
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwscanf_l
_fwscanf_s_l
_printf_l
_printf_p
_printf_p_l
_printf_s_l
_scanf_l
_scanf_s_l
_scprintf
_scprintf_l
_scprintf_p
_scprintf_p_l
_scwprintf
_scwprintf_l
_scwprintf_p
_scwprintf_p_l
_snprintf
_snprintf_c
_snprintf_c_l
_snprintf_l
_snprintf_s
_snprintf_s_l
_snscanf
_snscanf_l
_snscanf_s
_snscanf_s_l
_snwprintf
_snwprintf_l
_snwprintf_s
_snwprintf_s_l
_snwscanf
_snwscanf_l
_snwscanf_s
_snwscanf_s_l
_sprintf_l
_sprintf_p
_sprintf_p_l
_sprintf_s_l
_sscanf_l
_sscanf_s_l
_swprintf
_swprintf_c
_swprintf_c_l
_swprintf_l
_swprintf_p
_swprintf_p_l
_swprintf_s_l
_swscanf_l
_swscanf_s_l
_vfprintf_l
_vfprintf_p
_vfprintf_p_l
_vfprintf_s_l
_vfscanf_l
_vfscanf_s_l
_vfwprintf_l
_vfwprintf_p
_vfwprintf_p_l
_vfwprintf_s_l
_vfwscanf_l
_vfwscanf_s_l
_vprintf_l
_vprintf_p
_vprintf_p_l
_vprintf_s_l
_vscanf_l
_vscanf_s_l
_vscprintf
_vscprintf_l
_vscprintf_p
_vscprintf_p_l
_vscwprintf
_vscwprintf_l
_vscwprintf_p
_vscwprintf_p_l
_vsnprintf
_vsnprintf_c
_vsnprintf_c_l
_vsnprintf_l
_vsnprintf_s
_vsnprintf_s_l
_vsnwprintf
_vsnwprintf_l
_vsnwprintf_s
_vsnwprintf_s_l
_vsnwscanf_l
_vsnwscanf_s_l
_vsprintf_l
_vsprintf_p
_vsprintf_p_l
_vsprintf_s_l
_vsscanf_l
_vsscanf_s_l
_vswprintf
_vswprintf_c
_vswprintf_c_l
_vswprintf_l
_vswprintf_p
_vswprintf_p_l
_vswprintf_s_l
_vswscanf_l
_vswscanf_s_l
_vwprintf_l
_vwprintf_p
_vwprintf_p_l
_vwprintf_s_l
_vwscanf_l
_vwscanf_s_l
_wprintf_l
_wprintf_p
_wprintf_p_l
_wprintf_s_l
_wscanf_l
_wscanf_s_l
fprintf
fprintf_s
fscanf
fscanf_s
fwprintf
fwprintf_s
fwscanf
fwscanf_s
printf
printf_s
scanf
scanf_s
snprintf
sprintf
sprintf_s
sscanf
sscanf_s
swprintf
swprintf_s
swscanf
swscanf_s
vfprintf
vfprintf_s
vfscanf
vfscanf_s
vfwprintf
vfwprintf_s
vfwscanf
vfwscanf_s
vprintf
vprintf_s
vscanf
vscanf_s
vsnprintf
vsnprintf_s
vsprintf
vsprintf_s
vsscanf
vsscanf_s
vswprintf
vswprintf_s
vswscanf
vswscanf_s
vwprintf
vwprintf_s
vwscanf
vwscanf_s
wprintf
wprintf_s
wscanf
wscanf_s

Sections

.text
Size: 23.7MB - Virtual size: 23.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 295KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
R B X 9 5/Roblox Executor.exe
.exe windows:4 windows x86 arch:x86

Password: 2024

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

We}D_
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
R B X 9 5/ai.cfg
R B X 9 5/cacert.pem
R B X 9 5/config.vdf

Sharing

General

Malware Config

Signatures

Files

Password: 2024

Password: 2024

59bafed0fa1382619aa4b845f3f73552

Code Sign

53:22:a5:0e:e8:2e:3b:74:26:1b:03:9b:bb:27:96:f2Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

fa:54:07:ca:08:9a:e7:56:21:18:cf:45:36:1d:d4:67:2b:49:97:22Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

imm32

winmm

ws2_32

tbbg

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

winhttp

libcurl

powrprof

mswsock

bink2w32

d3dcompiler_43

d3d11

d3dx11_43

d3dx9_43

d3d9

avifil32

odbc32

mss32

msvcp140

iphlpapi

urlmon

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-conio-l1-1-0

wininet

version

psapi

Exports

Exports

Sections

.text Size: 23.7MB - Virtual size: 23.7MB

.rdata Size: 3.5MB - Virtual size: 3.5MB

.data Size: 295KB - Virtual size: 1.5MB

_RDATA Size: 4KB - Virtual size: 3KB

.rsrc Size: 5.5MB - Virtual size: 5.5MB

Password: 2024

53:22:a5:0e:e8:2e:3b:74:26:1b:03:9b:bb:27:96:f2
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

fa:54:07:ca:08:9a:e7:56:21:18:cf:45:36:1d:d4:67:2b:49:97:22
Signer

.text
Size: 23.7MB - Virtual size: 23.7MB

.rdata
Size: 3.5MB - Virtual size: 3.5MB

.data
Size: 295KB - Virtual size: 1.5MB

_RDATA
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

We}D_
Size: 210KB - Virtual size: 210KB

.text
Size: 144KB - Virtual size: 144KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B