Try VMRay Platform
Malicious
Classifications

Downloader Spyware

Threat Names

Raccoon v1.7.2 Trojan.GenericKD.33943728 Generic.Andromeda.9525175B Mal/Generic-S

Dynamic Analysis Report

Created on 2021-09-27T22:00:00

2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe

Windows Exe (x86-32)
...

Remarks

(0x0200004A): One dump of 1159 MB was skipped because it exceeded the maximum dump size of 16 MB.

Filters:
File Name Category Type Verdict Actions
C:\Users\RDhJ0CNFevzX\Desktop\2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe Sample File Binary
malicious
...
»
MIME Type application/vnd.microsoft.portable-executable
File Size 437.50 KB
MD5 e283621cd5dea00d95791a88eecda925 Copy to Clipboard
SHA1 c1fca8da67debe3d9d67cf6def926d81c8bb3350 Copy to Clipboard
SHA256 2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6 Copy to Clipboard
SSDeep 12288:BPJd+0j6UAtiX9FtdA4Jf/5mdS5Mu3RVmBqx:BPa8tdA4ZPLR Copy to Clipboard
ImpHash 006a79ea8a61231651632116bf97f2d7 Copy to Clipboard
PE Information
»
Image Base 0x400000
Entry Point 0x401b18
Size Of Code 0x57600
Size Of Initialized Data 0x9ac00
File Type FileType.executable
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2020-04-05 16:17:46+00:00
Version Information (3)
»
InternalName sajbmiamezu.ise
Copyright Copyrighz (C) 2021, fudkagat
ProductVersion 8.64.59.5
Sections (4)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x401000 0x57520 0x57600 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 7.97
.rdata 0x459000 0x31f4 0x3200 0x57a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.21
.data 0x45d000 0x8557c 0x1e00 0x5ac00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 1.33
.rsrc 0x4e3000 0x10bd0 0x10c00 0x5ca00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 6.33
Imports (2)
»
KERNEL32.dll (92)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCommandLineW - 0x459000 0x5b968 0x5a368 0x170
HeapReAlloc - 0x459004 0x5b96c 0x5a36c 0x2a4
GetLocaleInfoA - 0x459008 0x5b970 0x5a370 0x1e8
LoadResource - 0x45900c 0x5b974 0x5a374 0x2f6
InterlockedDecrement - 0x459010 0x5b978 0x5a378 0x2bc
GetEnvironmentStringsW - 0x459014 0x5b97c 0x5a37c 0x1c1
AddConsoleAliasW - 0x459018 0x5b980 0x5a380 0x6
SetEvent - 0x45901c 0x5b984 0x5a384 0x3d3
OpenSemaphoreA - 0x459020 0x5b988 0x5a388 0x335
GetSystemTimeAsFileTime - 0x459024 0x5b98c 0x5a38c 0x24f
WriteFileGather - 0x459028 0x5b990 0x5a390 0x48f
CreateActCtxW - 0x45902c 0x5b994 0x5a394 0x68
GetEnvironmentStrings - 0x459030 0x5b998 0x5a398 0x1bf
LeaveCriticalSection - 0x459034 0x5b99c 0x5a39c 0x2ef
GetFileAttributesA - 0x459038 0x5b9a0 0x5a3a0 0x1c9
FindNextVolumeW - 0x45903c 0x5b9a4 0x5a3a4 0x135
GetDevicePowerState - 0x459040 0x5b9a8 0x5a3a8 0x1b3
GetProcAddress - 0x459044 0x5b9ac 0x5a3ac 0x220
FreeUserPhysicalPages - 0x459048 0x5b9b0 0x5a3b0 0x150
VerLanguageNameW - 0x45904c 0x5b9b4 0x5a3b4 0x44e
WriteConsoleA - 0x459050 0x5b9b8 0x5a3b8 0x482
GetProcessId - 0x459054 0x5b9bc 0x5a3bc 0x225
LocalAlloc - 0x459058 0x5b9c0 0x5a3c0 0x2f9
RemoveDirectoryW - 0x45905c 0x5b9c4 0x5a3c4 0x380
WaitForMultipleObjects - 0x459060 0x5b9c8 0x5a3c8 0x462
EnumResourceTypesW - 0x459064 0x5b9cc 0x5a3cc 0xf1
GetModuleFileNameA - 0x459068 0x5b9d0 0x5a3d0 0x1f4
GetModuleHandleA - 0x45906c 0x5b9d4 0x5a3d4 0x1f6
EraseTape - 0x459070 0x5b9d8 0x5a3d8 0x102
GetStringTypeW - 0x459074 0x5b9dc 0x5a3dc 0x240
ReleaseMutex - 0x459078 0x5b9e0 0x5a3e0 0x377
EndUpdateResourceA - 0x45907c 0x5b9e4 0x5a3e4 0xd7
LocalSize - 0x459080 0x5b9e8 0x5a3e8 0x302
FindFirstVolumeW - 0x459084 0x5b9ec 0x5a3ec 0x12a
FindNextVolumeA - 0x459088 0x5b9f0 0x5a3f0 0x132
lstrcpyW - 0x45908c 0x5b9f4 0x5a3f4 0x4b0
HeapAlloc - 0x459090 0x5b9f8 0x5a3f8 0x29d
GetCommandLineA - 0x459094 0x5b9fc 0x5a3fc 0x16f
GetStartupInfoA - 0x459098 0x5ba00 0x5a400 0x239
DeleteCriticalSection - 0x45909c 0x5ba04 0x5a404 0xbe
EnterCriticalSection - 0x4590a0 0x5ba08 0x5a408 0xd9
HeapFree - 0x4590a4 0x5ba0c 0x5a40c 0x2a1
VirtualFree - 0x4590a8 0x5ba10 0x5a410 0x457
VirtualAlloc - 0x4590ac 0x5ba14 0x5a414 0x454
HeapCreate - 0x4590b0 0x5ba18 0x5a418 0x29f
GetModuleHandleW - 0x4590b4 0x5ba1c 0x5a41c 0x1f9
Sleep - 0x4590b8 0x5ba20 0x5a420 0x421
ExitProcess - 0x4590bc 0x5ba24 0x5a424 0x104
WriteFile - 0x4590c0 0x5ba28 0x5a428 0x48d
GetStdHandle - 0x4590c4 0x5ba2c 0x5a42c 0x23b
SetHandleCount - 0x4590c8 0x5ba30 0x5a430 0x3e8
GetFileType - 0x4590cc 0x5ba34 0x5a434 0x1d7
GetLastError - 0x4590d0 0x5ba38 0x5a438 0x1e6
SetFilePointer - 0x4590d4 0x5ba3c 0x5a43c 0x3df
TerminateProcess - 0x4590d8 0x5ba40 0x5a440 0x42d
GetCurrentProcess - 0x4590dc 0x5ba44 0x5a444 0x1a9
UnhandledExceptionFilter - 0x4590e0 0x5ba48 0x5a448 0x43e
SetUnhandledExceptionFilter - 0x4590e4 0x5ba4c 0x5a44c 0x415
IsDebuggerPresent - 0x4590e8 0x5ba50 0x5a450 0x2d1
FreeEnvironmentStringsA - 0x4590ec 0x5ba54 0x5a454 0x14a
FreeEnvironmentStringsW - 0x4590f0 0x5ba58 0x5a458 0x14b
WideCharToMultiByte - 0x4590f4 0x5ba5c 0x5a45c 0x47a
TlsGetValue - 0x4590f8 0x5ba60 0x5a460 0x434
TlsAlloc - 0x4590fc 0x5ba64 0x5a464 0x432
TlsSetValue - 0x459100 0x5ba68 0x5a468 0x435
TlsFree - 0x459104 0x5ba6c 0x5a46c 0x433
InterlockedIncrement - 0x459108 0x5ba70 0x5a470 0x2c0
SetLastError - 0x45910c 0x5ba74 0x5a474 0x3ec
GetCurrentThreadId - 0x459110 0x5ba78 0x5a478 0x1ad
QueryPerformanceCounter - 0x459114 0x5ba7c 0x5a47c 0x354
GetTickCount - 0x459118 0x5ba80 0x5a480 0x266
GetCurrentProcessId - 0x45911c 0x5ba84 0x5a484 0x1aa
InitializeCriticalSectionAndSpinCount - 0x459120 0x5ba88 0x5a488 0x2b5
RtlUnwind - 0x459124 0x5ba8c 0x5a48c 0x392
LoadLibraryA - 0x459128 0x5ba90 0x5a490 0x2f1
SetStdHandle - 0x45912c 0x5ba94 0x5a494 0x3fc
GetConsoleCP - 0x459130 0x5ba98 0x5a498 0x183
GetConsoleMode - 0x459134 0x5ba9c 0x5a49c 0x195
FlushFileBuffers - 0x459138 0x5baa0 0x5a4a0 0x141
GetCPInfo - 0x45913c 0x5baa4 0x5a4a4 0x15b
GetACP - 0x459140 0x5baa8 0x5a4a8 0x152
GetOEMCP - 0x459144 0x5baac 0x5a4ac 0x213
IsValidCodePage - 0x459148 0x5bab0 0x5a4b0 0x2db
HeapSize - 0x45914c 0x5bab4 0x5a4b4 0x2a6
GetConsoleOutputCP - 0x459150 0x5bab8 0x5a4b8 0x199
WriteConsoleW - 0x459154 0x5babc 0x5a4bc 0x48c
MultiByteToWideChar - 0x459158 0x5bac0 0x5a4c0 0x31a
LCMapStringA - 0x45915c 0x5bac4 0x5a4c4 0x2e1
LCMapStringW - 0x459160 0x5bac8 0x5a4c8 0x2e3
GetStringTypeA - 0x459164 0x5bacc 0x5a4cc 0x23d
CloseHandle - 0x459168 0x5bad0 0x5a4d0 0x43
CreateFileA - 0x45916c 0x5bad4 0x5a4d4 0x78
USER32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCursorPos - 0x459174 0x5badc 0x5a4dc 0x119
Exports (1)
»
Api name EAT Address Ordinal
@SetViceVariants@12 0x1000 0x1
Memory Dumps (35)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point AV YARA Actions
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Relevant Image False 32-bit 0x00403FEB False False
...
buffer 1 0x00821F48 0x008713D7 First Execution False 32-bit 0x00821F48 True False
...
buffer 1 0x006F0000 0x0077FFFF First Execution False 32-bit 0x006F0000 False True
...
buffer 1 0x006F0000 0x0077FFFF Content Changed False 32-bit 0x006F04F6 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x004407D8 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x004434CE False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x0041C889 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x004666D4 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00401000 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00406000 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00450F84 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x004340AE False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x0043385D False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x0042539D False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x0042D09F False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x004546FF False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x0043EC76 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x0040C000 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x0042A24A False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x004618FB False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x0044D298 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00455887 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00438C60 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00439C5E False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x004546FF False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x0042364B False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00461B43 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x0045AB16 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00411592 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00455887 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00432D58 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x0043D8A5 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00441550 False True
...
2becdf23ad63dfcb341ee332fa50623f0cf5e4fa5f0c6c854cd4e59ce8be3ce6.exe 1 0x00400000 0x004F3FFF Content Changed False 32-bit 0x00454A28 False True
...
buffer 1 0x006F0000 0x0077FFFF Content Changed False 32-bit 0x006F0920 False True
...
C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip Downloaded File ZIP
malicious
...
»
MIME Type application/zip
File Size 2.70 MB
MD5 1117cd347d09c43c1f2079439056ada3 Copy to Clipboard
SHA1 93c2ce5fc4924314318554e131cfbcd119f01ab6 Copy to Clipboard
SHA256 4cfada7eb51a6c0cb26283f9c86784b2b2587c59c46a5d3dc0f06cad2c55ee97 Copy to Clipboard
SSDeep 49152:tiGLaX5/cgbRETlc0EqgSVAx07XZiEi4qiefeEJGt5ygL0+6/qax:t9OX9alwJSVP1fnefekGt5CP Copy to Clipboard
ImpHash -
AV Matches (1)
»
Threat Name Verdict
Trojan.GenericKD.33943728
malicious
Archive Information
»
Number of Files 58
Number of Folders 0
Size of Packed Archive Contents 2.69 MB
Size of Unpacked Archive Contents 5.27 MB
File Format zip
Contents (58)
»
File Name Packed Size Unpacked Size Compression Is Encrypted Modify Time Severity Recursively Submitted Actions
api-ms-win-core-localization-l1-2-0.dll 10.95 KB 20.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
mozMapi32.dll 44.77 KB 81.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
mozMapi32_InUse.dll 44.77 KB 81.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
ucrtbase.dll 513.71 KB 1.09 MB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
nss3.dll 705.82 KB 1.19 MB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-rtlsupport-l1-1-0.dll 10.03 KB 17.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
nssckbi.dll 169.85 KB 328.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-timezone-l1-1-0.dll 10.15 KB 17.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
softokn3.dll 76.19 KB 141.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
ldap60.dll 71.57 KB 128.95 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-synch-l1-2-0.dll 10.33 KB 18.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
msvcp140.dll 152.47 KB 429.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
ldif60.dll 11.22 KB 19.95 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-convert-l1-1-0.dll 11.39 KB 21.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-heap-l1-1-0.dll 10.25 KB 17.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
prldap60.dll 13.49 KB 23.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-sysinfo-l1-1-0.dll 10.38 KB 18.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-locale-l1-1-0.dll 10.36 KB 18.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-synch-l1-1-0.dll 10.67 KB 19.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
IA2Marshal.dll 25.99 KB 68.95 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-private-l1-1-0.dll 24.75 KB 71.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-multibyte-l1-1-0.dll 12.35 KB 25.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-time-l1-1-0.dll 10.96 KB 20.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-string-l1-1-0.dll 11.66 KB 22.94 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-filesystem-l1-1-0.dll 10.87 KB 19.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-string-l1-1-0.dll 10.15 KB 17.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
qipcap.dll 9.26 KB 15.95 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
libEGL.dll 11.44 KB 21.95 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
lgpllibs.dll 29.37 KB 54.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
breakpadinjector.dll 65.35 KB 114.95 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-profile-l1-1-0.dll 10.02 KB 17.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-processthreads-l1-1-1.dll 10.29 KB 18.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-handle-l1-1-0.dll 10.09 KB 17.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-processenvironment-l1-1-0.dll 10.34 KB 18.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
freebl3.dll 152.76 KB 326.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-conio-l1-1-0.dll 10.43 KB 18.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-processthreads-l1-1-0.dll 10.41 KB 18.94 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
mozglue.dll 73.89 KB 133.95 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
AccessibleHandler.dll 62.49 KB 120.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-utility-l1-1-0.dll 10.39 KB 18.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-stdio-l1-1-0.dll 11.96 KB 23.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-libraryloader-l1-1-0.dll 10.32 KB 18.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-memory-l1-1-0.dll 10.27 KB 18.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
MapiProxy_InUse.dll 10.45 KB 19.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
MapiProxy.dll 10.45 KB 19.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
nssdbm3.dll 52.61 KB 90.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-math-l1-1-0.dll 13.35 KB 28.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-process-l1-1-0.dll 10.46 KB 18.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-environment-l1-1-0.dll 10.25 KB 18.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
vcruntime140.dll 45.46 KB 81.82 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-namedpipe-l1-1-0.dll 10.18 KB 17.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-file-l2-1-0.dll 10.21 KB 17.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-file-l1-2-0.dll 10.10 KB 17.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-runtime-l1-1-0.dll 11.60 KB 22.30 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
AccessibleMarshal.dll 13.13 KB 25.45 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-interlocked-l1-1-0.dll 9.78 KB 17.44 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-crt-heap-l1-1-0.dll 10.40 KB 18.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
api-ms-win-core-util-l1-1-0.dll 10.08 KB 17.80 KB Deflate False 2019-03-14 13:20 (UTC+1)
Clean
-
...
C:\Users\RDhJ0CNFevzX\AppData\LocalLow\outlook.txt Dropped File Text
clean
...
»
Also Known As outlook.txt (Embedded File)
mails/outlook.txt (Embedded File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\A6vWooljZhq.zip
MIME Type text/plain
File Size 134 Bytes
MD5 1ba637db5edcf3c8c5cc9038b41a6cfa Copy to Clipboard
SHA1 8315dd864fc0697678795a7111b1b53c897168c1 Copy to Clipboard
SHA256 33897c27a1f9608d3f7f99c801fa58039911fa834c475d9b949baa3fc2d114d8 Copy to Clipboard
SSDeep 3:7F2ADMpYqMNeSKnJnnoJQeWBJQbePFCpSAEGRy:7FnDMBMNjKlnoHYxN1my Copy to Clipboard
ImpHash -
nssdbm3.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\nssdbm3.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 90.45 KB
MD5 94919dea9c745fbb01653f3fdae59c23 Copy to Clipboard
SHA1 99181610d8c9255947d7b2134cdb4825bd5a25ff Copy to Clipboard
SHA256 be3987a6cd970ff570a916774eb3d4e1edce675e70edac1baf5e2104685610b0 Copy to Clipboard
SSDeep 1536:YvNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41Pc:+NGVOiBZbcGmxXMcBqmzoCUZoZebHPAT Copy to Clipboard
ImpHash d13d5fc7f2f1cf397f0d0cfd732db7a2 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x10011f81
Size Of Code 0x11a00
Size Of Initialized Data 0x3000
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:53:35+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename nssdbm3.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x118e4 0x11a00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.49
.rdata 0x10013000 0x1f44 0x2000 0x11e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.99
.data 0x10015000 0x3f8 0x200 0x13e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.48
.rsrc 0x10016000 0x378 0x400 0x14000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.88
.reloc 0x10017000 0x6a4 0x800 0x14400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 5.89
Imports (9)
»
nss3.dll (92)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PL_HashTableEnumerateEntries - 0x100130e4 0x141d4 0x12fd4 0x1cd
SECITEM_AllocItem_Util - 0x100130e8 0x141d8 0x12fd8 0x3a9
PR_Now - 0x100130ec 0x141dc 0x12fdc 0x322
DER_DecodeTimeChoice_Util - 0x100130f0 0x141e0 0x12fe0 0x8e
NSS_Get_SEC_AnyTemplate_Util - 0x100130f4 0x141e4 0x12fe4 0x102
NSS_Get_SEC_BitStringTemplate_Util - 0x100130f8 0x141e8 0x12fe8 0x105
NSS_Get_SEC_ObjectIDTemplate_Util - 0x100130fc 0x141ec 0x12fec 0x10d
PORT_InitCheapArena - 0x10013100 0x141f0 0x12ff0 0x20c
PORT_DestroyCheapArena - 0x10013104 0x141f4 0x12ff4 0x205
PORT_ArenaMark_Util - 0x10013108 0x141f8 0x12ff8 0x1fe
PORT_ArenaRelease_Util - 0x1001310c 0x141fc 0x12ffc 0x1ff
PORT_ArenaUnmark_Util - 0x10013110 0x14200 0x13000 0x202
PORT_ArenaStrdup_Util - 0x10013114 0x14204 0x13004 0x201
SECITEM_CompareItem_Util - 0x10013118 0x14208 0x13008 0x3ab
PR_OpenFile - 0x1001311c 0x1420c 0x1300c 0x326
PL_HashTableLookup - 0x10013120 0x14210 0x13010 0x1ce
PR_EnterMonitor - 0x10013124 0x14214 0x13014 0x27f
PR_ExitMonitor - 0x10013128 0x14218 0x13018 0x289
NSSUTIL_ArgGetParamValue - 0x1001312c 0x1421c 0x1301c 0xb1
NSSUTIL_ArgHasFlag - 0x10013130 0x14220 0x13020 0xb2
NSSUTIL_ArgReadLong - 0x10013134 0x14224 0x13024 0xb8
NSSUTIL_Quote - 0x10013138 0x14228 0x13028 0xc0
NSSUTIL_ArgParseSlotFlags - 0x1001313c 0x1422c 0x1302c 0xb6
NSSUTIL_ArgParseSlotInfo - 0x10013140 0x14230 0x13030 0xb7
NSSUTIL_MkSlotString - 0x10013144 0x14234 0x13034 0xbf
NSSUTIL_ArgParseModuleSpec - 0x10013148 0x14238 0x13038 0xb5
NSSUTIL_MkModuleSpec - 0x1001314c 0x1423c 0x1303c 0xbd
NSSUTIL_ArgParseCipherFlags - 0x10013150 0x14240 0x13040 0xb4
NSSUTIL_MkNSSString - 0x10013154 0x14244 0x13044 0xbe
PR_GetError - 0x10013158 0x14248 0x13048 0x2b1
NSSBase64_EncodeItem_Util - 0x1001315c 0x1424c 0x1304c 0xab
PL_HashTableRemove - 0x10013160 0x14250 0x13050 0x1d4
PL_HashTableAdd - 0x10013164 0x14254 0x13054 0x1ca
SECOID_Shutdown - 0x10013168 0x14258 0x13058 0x400
SECOID_Init - 0x1001316c 0x1425c 0x1305c 0x3fd
SECITEM_HashCompare - 0x10013170 0x14260 0x13060 0x3b3
PL_CompareValues - 0x10013174 0x14264 0x13064 0x1c1
PL_HashTableDestroy - 0x10013178 0x14268 0x13068 0x1cb
PL_NewHashTable - 0x1001317c 0x1426c 0x1306c 0x1d6
PR_FindSymbol - 0x10013180 0x14270 0x13070 0x29a
PR_LoadLibrary - 0x10013184 0x14274 0x13074 0x2ff
SECITEM_ItemsAreEqual_Util - 0x10013188 0x14278 0x13078 0x3b5
PORT_Realloc_Util - 0x1001318c 0x1427c 0x1307c 0x20f
DER_SetUInteger - 0x10013190 0x14280 0x13080 0x97
PR_htonl - 0x10013194 0x14284 0x13084 0x394
NSS_Get_SEC_OctetStringTemplate_Util - 0x10013198 0x14288 0x13088 0x10f
PR_ntohl - 0x1001319c 0x1428c 0x1308c 0x397
SECOID_GetAlgorithmTag_Util - 0x100131a0 0x14290 0x13090 0x3fc
SECOID_SetAlgorithmID_Util - 0x100131a4 0x14294 0x13094 0x3ff
SECOID_FindOIDByTag_Util - 0x100131a8 0x14298 0x13098 0x3f6
SECOID_FindOIDTag_Util - 0x100131ac 0x1429c 0x1309c 0x3f9
SEC_ASN1EncodeInteger_Util - 0x100131b0 0x142a0 0x130a0 0x406
SEC_ASN1EncodeItem_Util - 0x100131b4 0x142a4 0x130a4 0x408
SEC_QuickDERDecodeItem_Util - 0x100131b8 0x142a8 0x130a8 0x443
PR_Unlock - 0x100131bc 0x142ac 0x130ac 0x383
PR_Lock - 0x100131c0 0x142b0 0x130b0 0x303
PR_DestroyLock - 0x100131c4 0x142b4 0x130b4 0x26b
PR_NewLock - 0x100131c8 0x142b8 0x130b8 0x311
SECITEM_ZfreeItem_Util - 0x100131cc 0x142bc 0x130bc 0x3b8
SECITEM_FreeItem_Util - 0x100131d0 0x142c0 0x130c0 0x3b2
SECITEM_DupItem_Util - 0x100131d4 0x142c4 0x130c4 0x3b0
SECITEM_CopyItem_Util - 0x100131d8 0x142c8 0x130c8 0x3ad
PORT_ArenaZAlloc_Util - 0x100131dc 0x142cc 0x130cc 0x204
PORT_ArenaAlloc_Util - 0x100131e0 0x142d0 0x130d0 0x1fc
PORT_FreeArena_Util - 0x100131e4 0x142d4 0x130d4 0x208
PORT_NewArena_Util - 0x100131e8 0x142d8 0x130d8 0x20e
PORT_GetError_Util - 0x100131ec 0x142dc 0x130dc 0x20b
PORT_SetError_Util - 0x100131f0 0x142e0 0x130e0 0x212
PORT_Strdup_Util - 0x100131f4 0x142e4 0x130e4 0x216
NSS_Get_SECOID_AlgorithmIDTemplate_Util - 0x100131f8 0x142e8 0x130e8 0x101
PR_smprintf_free - 0x100131fc 0x142ec 0x130ec 0x39b
PR_smprintf - 0x10013200 0x142f0 0x130f0 0x39a
PR_MkDir - 0x10013204 0x142f4 0x130f4 0x30e
PR_Access - 0x10013208 0x142f8 0x130f8 0x227
PR_Delete - 0x1001320c 0x142fc 0x130fc 0x265
PR_Write - 0x10013210 0x14300 0x13100 0x38e
PR_Read - 0x10013214 0x14304 0x13104 0x340
PR_DestroyMonitor - 0x10013218 0x14308 0x13108 0x26d
PR_Close - 0x1001321c 0x1430c 0x1310c 0x24b
PORT_ZAlloc_Util - 0x10013220 0x14310 0x13110 0x21c
PR_GetDirectorySeparator - 0x10013224 0x14314 0x13114 0x2ad
PR_GetEnvSecure - 0x10013228 0x14318 0x13118 0x2b0
PR_CallOnce - 0x1001322c 0x1431c 0x1311c 0x240
PR_SetError - 0x10013230 0x14320 0x13120 0x359
PR_Free - 0x10013234 0x14324 0x13124 0x29f
PORT_Free_Util - 0x10013238 0x14328 0x13128 0x209
PORT_Alloc_Util - 0x1001323c 0x1432c 0x1312c 0x1fa
PR_GetLibraryFilePathname - 0x10013240 0x14330 0x13130 0x2bf
PR_FindFunctionSymbol - 0x10013244 0x14334 0x13134 0x294
PR_UnloadLibrary - 0x10013248 0x14338 0x13138 0x382
PR_NewMonitor - 0x1001324c 0x1433c 0x1313c 0x313
PR_LoadLibraryWithFlags - 0x10013250 0x14340 0x13140 0x300
KERNEL32.dll (13)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
InitializeSListHead - 0x10013000 0x140f0 0x12ef0 0x35a
DisableThreadLibraryCalls - 0x10013004 0x140f4 0x12ef4 0x11b
GetSystemTimeAsFileTime - 0x10013008 0x140f8 0x12ef8 0x2e2
GetCurrentThreadId - 0x1001300c 0x140fc 0x12efc 0x218
GetCurrentProcessId - 0x10013010 0x14100 0x12f00 0x214
QueryPerformanceCounter - 0x10013014 0x14104 0x12f04 0x440
IsProcessorFeaturePresent - 0x10013018 0x14108 0x12f08 0x37d
TerminateProcess - 0x1001301c 0x1410c 0x12f0c 0x57c
GetCurrentProcess - 0x10013020 0x14110 0x12f10 0x213
SetUnhandledExceptionFilter - 0x10013024 0x14114 0x12f14 0x55e
UnhandledExceptionFilter - 0x10013028 0x14118 0x12f18 0x59d
FlushFileBuffers - 0x1001302c 0x1411c 0x12f1c 0x19b
IsDebuggerPresent - 0x10013030 0x14120 0x12f20 0x376
VCRUNTIME140.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_except_handler4_common - 0x10013038 0x14128 0x12f28 0x35
memmove - 0x1001303c 0x1412c 0x12f2c 0x47
memcmp - 0x10013040 0x14130 0x12f30 0x45
memset - 0x10013044 0x14134 0x12f34 0x48
strrchr - 0x10013048 0x14138 0x12f38 0x4b
memcpy - 0x1001304c 0x1413c 0x12f3c 0x46
__std_type_info_destroy_list - 0x10013050 0x14140 0x12f40 0x25
api-ms-win-crt-runtime-l1-1-0.dll (11)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_initialize_onexit_table - 0x1001307c 0x1416c 0x12f6c 0x36
_initialize_narrow_environment - 0x10013080 0x14170 0x12f70 0x35
_configure_narrow_argv - 0x10013084 0x14174 0x12f74 0x19
_seh_filter_dll - 0x10013088 0x14178 0x12f78 0x41
_initterm - 0x1001308c 0x1417c 0x12f7c 0x38
_execute_onexit_table - 0x10013090 0x14180 0x12f80 0x24
_getpid - 0x10013094 0x14184 0x12f84 0x34
_errno - 0x10013098 0x14188 0x12f88 0x23
abort - 0x1001309c 0x1418c 0x12f8c 0x57
_cexit - 0x100130a0 0x14190 0x12f90 0x17
_initterm_e - 0x100130a4 0x14194 0x12f94 0x39
api-ms-win-crt-heap-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
calloc - 0x1001306c 0x1415c 0x12f5c 0x17
free - 0x10013070 0x14160 0x12f60 0x18
malloc - 0x10013074 0x14164 0x12f64 0x19
api-ms-win-crt-stdio-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_lseek - 0x100130ac 0x1419c 0x12f9c 0x45
_get_osfhandle - 0x100130b0 0x141a0 0x12fa0 0x37
__acrt_iob_func - 0x100130b4 0x141a4 0x12fa4 0x0
fwrite - 0x100130b8 0x141a8 0x12fa8 0x8a
_write - 0x100130bc 0x141ac 0x12fac 0x6b
_read - 0x100130c0 0x141b0 0x12fb0 0x52
_close - 0x100130c4 0x141b4 0x12fb4 0x17
_open - 0x100130c8 0x141b8 0x12fb8 0x49
api-ms-win-crt-environment-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
getenv - 0x10013058 0x14148 0x12f48 0x10
api-ms-win-crt-filesystem-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_stat64i32 - 0x10013060 0x14150 0x12f50 0x20
_unlink - 0x10013064 0x14154 0x12f54 0x23
api-ms-win-crt-string-l1-1-0.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
tolower - 0x100130d0 0x141c0 0x12fc0 0x97
isdigit - 0x100130d4 0x141c4 0x12fc4 0x68
_strdup - 0x100130d8 0x141c8 0x12fc8 0x29
strncmp - 0x100130dc 0x141cc 0x12fcc 0x8e
Exports (7)
»
Api name EAT Address Ordinal
legacy_AddSecmodDB 0x10d1b 0x1
legacy_DeleteSecmodDB 0x10dd1 0x2
legacy_Open 0xae88 0x3
legacy_ReadSecmodDB 0x10e51 0x4
legacy_ReleaseSecmodDBData 0x10fab 0x5
legacy_SetCryptFunctions 0xb556 0x6
legacy_Shutdown 0xaf93 0x7
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
prldap60.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\prldap60.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 23.45 KB
MD5 6099c438f37e949c4c541e61e88098b7 Copy to Clipboard
SHA1 0ad03a6f626385554a885bd742dfe5b59bc944f5 Copy to Clipboard
SHA256 46b005817868f91cf60baa052ee96436fc6194ce9a61e93260df5037cdfa37a5 Copy to Clipboard
SSDeep 384:TQJMOeAdiNcNUO3qgpw6MnTmJk0llEEHAnDl3vDG8A3OPLondJJs2z:KMaNqb6MTmVllEK2p/DG8MlsQ Copy to Clipboard
ImpHash 50b55c5ca7552fb1f3ee28046e71beac Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x100025e8
Size Of Code 0x2000
Size Of Initialized Data 0x2000
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:53:34+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename prldap60.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1f32 0x2000 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.27
.rdata 0x10003000 0xec0 0x1000 0x2400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.73
.data 0x10004000 0x634 0x400 0x3400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 2.68
.rsrc 0x10005000 0x378 0x400 0x3800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.88
.reloc 0x10006000 0x224 0x400 0x3c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 4.32
Imports (5)
»
LDAP60.dll (11)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
ldap_init - 0x10003034 0x381c 0x2c1c 0x8c
ldap_x_hostlist_statusfree - 0x10003038 0x3820 0x2c20 0x105
ldap_x_hostlist_next - 0x1000303c 0x3824 0x2c24 0x104
ldap_x_hostlist_first - 0x10003040 0x3828 0x2c28 0x103
ldap_set_lderrno - 0x10003044 0x382c 0x2c2c 0xd4
ldap_get_lderrno - 0x10003048 0x3830 0x2c30 0x85
ldap_memfree - 0x1000304c 0x3834 0x2c34 0x9c
ldap_get_option - 0x10003050 0x3838 0x2c38 0x86
ber_sockbuf_get_option - 0x10003054 0x383c 0x2c3c 0x2f
ldap_unbind - 0x10003058 0x3840 0x2c40 0xe6
ldap_set_option - 0x1000305c 0x3844 0x2c44 0xd5
nss3.dll (35)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PR_GetThreadPrivate - 0x1000309c 0x3884 0x2c84 0x2de
PR_SetThreadPrivate - 0x100030a0 0x3888 0x2c88 0x369
PR_NewThreadPrivateIndex - 0x100030a4 0x388c 0x2c8c 0x31b
PR_GetCurrentThread - 0x100030a8 0x3890 0x2c90 0x2aa
PR_AtomicIncrement - 0x100030ac 0x3894 0x2c94 0x230
PR_Recv - 0x100030b0 0x3898 0x2c98 0x344
PR_Lock - 0x100030b4 0x389c 0x2c9c 0x303
PR_DestroyLock - 0x100030b8 0x38a0 0x2ca0 0x26b
PR_Send - 0x100030bc 0x38a4 0x2ca4 0x350
PR_NewLock - 0x100030c0 0x38a8 0x2ca8 0x311
PR_ImportTCPSocket - 0x100030c4 0x38ac 0x2cac 0x2ed
PR_EnumerateAddrInfo - 0x100030c8 0x38b0 0x2cb0 0x280
PR_FreeAddrInfo - 0x100030cc 0x38b4 0x2cb4 0x2a0
PR_GetAddrInfoByName - 0x100030d0 0x38b8 0x2cb8 0x2a4
PR_Free - 0x100030d4 0x38bc 0x2cbc 0x29f
PR_Realloc - 0x100030d8 0x38c0 0x2cc0 0x342
PR_Calloc - 0x100030dc 0x38c4 0x2cc4 0x242
PR_Malloc - 0x100030e0 0x38c8 0x2cc8 0x309
PR_Poll - 0x100030e4 0x38cc 0x2ccc 0x32d
PR_SetSocketOption - 0x100030e8 0x38d0 0x2cd0 0x362
PR_CallOnce - 0x100030ec 0x38d4 0x2cd4 0x240
PR_Connect - 0x100030f0 0x38d8 0x2cd8 0x250
PR_OpenTCPSocket - 0x100030f4 0x38dc 0x2cdc 0x329
PR_Close - 0x100030f8 0x38e0 0x2ce0 0x24b
PR_MillisecondsToInterval - 0x100030fc 0x38e4 0x2ce4 0x30d
PR_GetOSError - 0x10003100 0x38e8 0x2ce8 0x2c6
PR_GetError - 0x10003104 0x38ec 0x2cec 0x2b1
PR_SetError - 0x10003108 0x38f0 0x2cf0 0x359
PR_htons - 0x1000310c 0x38f4 0x2cf4 0x396
PR_GetHostByAddr - 0x10003110 0x38f8 0x2cf8 0x2b8
PR_GetIPNodeByName - 0x10003114 0x38fc 0x2cfc 0x2ba
PR_NetAddrToString - 0x10003118 0x3900 0x2d00 0x30f
PR_StringToNetAddr - 0x1000311c 0x3904 0x2d04 0x373
PR_GetPeerName - 0x10003120 0x3908 0x2d08 0x2cc
PR_Unlock - 0x10003124 0x390c 0x2d0c 0x383
VCRUNTIME140.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
memcpy - 0x10003064 0x384c 0x2c4c 0x46
__std_type_info_destroy_list - 0x10003068 0x3850 0x2c50 0x25
_except_handler4_common - 0x1000306c 0x3854 0x2c54 0x35
memset - 0x10003070 0x3858 0x2c58 0x48
api-ms-win-crt-runtime-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_initialize_onexit_table - 0x10003078 0x3860 0x2c60 0x36
_configure_narrow_argv - 0x1000307c 0x3864 0x2c64 0x19
_seh_filter_dll - 0x10003080 0x3868 0x2c68 0x41
_initterm_e - 0x10003084 0x386c 0x2c6c 0x39
_execute_onexit_table - 0x10003088 0x3870 0x2c70 0x24
_cexit - 0x1000308c 0x3874 0x2c74 0x17
_initialize_narrow_environment - 0x10003090 0x3878 0x2c78 0x35
_initterm - 0x10003094 0x387c 0x2c7c 0x38
KERNEL32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SetUnhandledExceptionFilter - 0x10003000 0x37e8 0x2be8 0x55e
GetCurrentProcess - 0x10003004 0x37ec 0x2bec 0x213
TerminateProcess - 0x10003008 0x37f0 0x2bf0 0x57c
IsProcessorFeaturePresent - 0x1000300c 0x37f4 0x2bf4 0x37d
QueryPerformanceCounter - 0x10003010 0x37f8 0x2bf8 0x440
GetCurrentProcessId - 0x10003014 0x37fc 0x2bfc 0x214
GetCurrentThreadId - 0x10003018 0x3800 0x2c00 0x218
GetSystemTimeAsFileTime - 0x1000301c 0x3804 0x2c04 0x2e2
DisableThreadLibraryCalls - 0x10003020 0x3808 0x2c08 0x11b
InitializeSListHead - 0x10003024 0x380c 0x2c0c 0x35a
UnhandledExceptionFilter - 0x10003028 0x3810 0x2c10 0x59d
IsDebuggerPresent - 0x1000302c 0x3814 0x2c14 0x376
Exports (12)
»
Api name EAT Address Ordinal
prldap_get_default_socket_info 0x1a01 0x1
prldap_get_session_info 0x1a5a 0x2
prldap_get_session_option 0x1aba 0x3
prldap_get_socket_info 0x1b05 0x4
prldap_import_connection 0x1b31 0x5
prldap_init 0x1c0e 0x6
prldap_install_routines 0x1c47 0x7
prldap_is_installed 0x150a 0x8
prldap_set_default_socket_info 0x1c89 0x9
prldap_set_session_info 0x1ce5 0xa
prldap_set_session_option 0x1d42 0xb
prldap_set_socket_info 0x1d8d 0xc
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
qipcap.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\qipcap.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 15.95 KB
MD5 f3a355d0b1ab3cc8effcc90c8a7b7538 Copy to Clipboard
SHA1 1191f64692a89a04d060279c25e4779c05d8c375 Copy to Clipboard
SHA256 7a589024cf0eeb59f020f91be4fe7ee0c90694c92918a467d5277574ac25a5a2 Copy to Clipboard
SSDeep 192:aPgr1ZCb2vGJ7b20qKvFej7x0KDWpH3vUA397Ae+PjPonZwC7Qm:aYpZPGJP209F4vDG8A3OPLonZwC7X Copy to Clipboard
ImpHash f581dee044db52f8ff533657d5c81221 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x10001313
Size Of Code 0xe00
Size Of Initialized Data 0x1200
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 12:01:21+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename qipcap.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xc50 0xe00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.76
.rdata 0x10002000 0x7c4 0x800 0x1200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.46
.data 0x10003000 0x390 0x200 0x1a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.27
.rsrc 0x10004000 0x378 0x400 0x1c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.88
.reloc 0x10005000 0x120 0x200 0x2000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 4.18
Imports (3)
»
KERNEL32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
DisableThreadLibraryCalls - 0x10002000 0x250c 0x170c 0x11b
GetCurrentProcess - 0x10002004 0x2510 0x1710 0x213
IsProcessorFeaturePresent - 0x10002008 0x2514 0x1714 0x37d
SetUnhandledExceptionFilter - 0x1000200c 0x2518 0x1718 0x55e
UnhandledExceptionFilter - 0x10002010 0x251c 0x171c 0x59d
IsDebuggerPresent - 0x10002014 0x2520 0x1720 0x376
InitializeSListHead - 0x10002018 0x2524 0x1724 0x35a
GetSystemTimeAsFileTime - 0x1000201c 0x2528 0x1728 0x2e2
GetCurrentThreadId - 0x10002020 0x252c 0x172c 0x218
GetCurrentProcessId - 0x10002024 0x2530 0x1730 0x214
QueryPerformanceCounter - 0x10002028 0x2534 0x1734 0x440
TerminateProcess - 0x1000202c 0x2538 0x1738 0x57c
VCRUNTIME140.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
memset - 0x10002034 0x2540 0x1740 0x48
_except_handler4_common - 0x10002038 0x2544 0x1744 0x35
__std_type_info_destroy_list - 0x1000203c 0x2548 0x1748 0x25
api-ms-win-crt-runtime-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_initialize_onexit_table - 0x10002044 0x2550 0x1750 0x36
_execute_onexit_table - 0x10002048 0x2554 0x1754 0x24
_configure_narrow_argv - 0x1000204c 0x2558 0x1758 0x19
_seh_filter_dll - 0x10002050 0x255c 0x175c 0x41
_initterm_e - 0x10002054 0x2560 0x1760 0x39
_initterm - 0x10002058 0x2564 0x1764 0x38
_initialize_narrow_environment - 0x1000205c 0x2568 0x1768 0x35
_cexit - 0x10002060 0x256c 0x176c 0x17
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
softokn3.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\softokn3.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 141.45 KB
MD5 4e8df049f3459fa94ab6ad387f3561ac Copy to Clipboard
SHA1 06ed392bc29ad9d5fc05ee254c2625fd65925114 Copy to Clipboard
SHA256 25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871 Copy to Clipboard
SSDeep 3072:8Af6suip+I7FEk/oJz69sFaXeu9CoT2nIVFetBW3D2xkEMk:B6POsF4CoT2OeYMzMk Copy to Clipboard
ImpHash 4d153c0cea0b76890c21127ac6dbd559 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x1001bc97
Size Of Code 0x1b600
Size Of Initialized Data 0x6200
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:53:33+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename softokn3.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1b4cb 0x1b600 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.41
.rdata 0x1001d000 0x440a 0x4600 0x1ba00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.08
.data 0x10022000 0x700 0x400 0x20000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 2.71
.rsrc 0x10023000 0x378 0x400 0x20400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.89
.reloc 0x10024000 0xe60 0x1000 0x20800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.34
Imports (9)
»
nss3.dll (110)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SECITEM_HashCompare - 0x1001d0b0 0x20530 0x1ef30 0x3b3
PR_SecondsToInterval - 0x1001d0b4 0x20534 0x1ef34 0x34c
PR_NewLock - 0x1001d0b8 0x20538 0x1ef38 0x311
PR_DestroyLock - 0x1001d0bc 0x2053c 0x1ef3c 0x26b
DER_SetUInteger - 0x1001d0c0 0x20540 0x1ef40 0x97
PR_Sleep - 0x1001d0c4 0x20544 0x1ef44 0x36f
PR_smprintf_free - 0x1001d0c8 0x20548 0x1ef48 0x39b
SECOID_Init - 0x1001d0cc 0x2054c 0x1ef4c 0x3fd
SECOID_Shutdown - 0x1001d0d0 0x20550 0x1ef50 0x400
UTIL_SetForkState - 0x1001d0d4 0x20554 0x1ef54 0x489
NSSUTIL_DoModuleDBFunction - 0x1001d0d8 0x20558 0x1ef58 0xbb
_NSSUTIL_GetSecmodName - 0x1001d0dc 0x2055c 0x1ef5c 0x495
SEC_QuickDERDecodeItem_Util - 0x1001d0e0 0x20560 0x1ef60 0x443
NSS_Get_SEC_OctetStringTemplate_Util - 0x1001d0e4 0x20564 0x1ef64 0x10f
_SGN_VerifyPKCS1DigestInfo - 0x1001d0e8 0x20568 0x1ef68 0x4a4
DER_Encode_Util - 0x1001d0ec 0x2056c 0x1ef6c 0x91
SGN_CreateDigestInfo_Util - 0x1001d0f0 0x20570 0x1ef70 0x44c
SGN_DestroyDigestInfo_Util - 0x1001d0f4 0x20574 0x1ef74 0x450
SECOID_FindOIDByMechanism - 0x1001d0f8 0x20578 0x1ef78 0x3f4
PL_HashTableEnumerateEntries - 0x1001d0fc 0x2057c 0x1ef7c 0x1cd
PL_strcasecmp - 0x1001d100 0x20580 0x1ef80 0x1d9
PORT_Strdup_Util - 0x1001d104 0x20584 0x1ef84 0x216
sqlite3_close - 0x1001d108 0x20588 0x1ef88 0x4b9
sqlite3_exec - 0x1001d10c 0x2058c 0x1ef8c 0x4dd
sqlite3_busy_timeout - 0x1001d110 0x20590 0x1ef90 0x4b6
sqlite3_mprintf - 0x1001d114 0x20594 0x1ef94 0x4f0
sqlite3_free - 0x1001d118 0x20598 0x1ef98 0x4e2
sqlite3_open - 0x1001d11c 0x2059c 0x1ef9c 0x4f7
sqlite3_prepare_v2 - 0x1001d120 0x205a0 0x1efa0 0x4fe
PORT_FreeArena_Util - 0x1001d124 0x205a4 0x1efa4 0x208
sqlite3_bind_int - 0x1001d128 0x205a8 0x1efa8 0x4ac
PL_NewHashTable - 0x1001d12c 0x205ac 0x1efac 0x1d6
sqlite3_step - 0x1001d130 0x205b0 0x1efb0 0x51a
sqlite3_column_blob - 0x1001d134 0x205b4 0x1efb4 0x4bc
sqlite3_column_bytes - 0x1001d138 0x205b8 0x1efb8 0x4bd
sqlite3_column_int - 0x1001d13c 0x205bc 0x1efbc 0x4c1
sqlite3_finalize - 0x1001d140 0x205c0 0x1efc0 0x4e1
sqlite3_reset - 0x1001d144 0x205c4 0x1efc4 0x502
sqlite3_file_control - 0x1001d148 0x205c8 0x1efc8 0x4e0
PR_IntervalNow - 0x1001d14c 0x205cc 0x1efcc 0x2f5
PR_MillisecondsToInterval - 0x1001d150 0x205d0 0x1efd0 0x30d
PR_GetCurrentThread - 0x1001d154 0x205d4 0x1efd4 0x2aa
PR_Now - 0x1001d158 0x205d8 0x1efd8 0x322
PL_CompareValues - 0x1001d15c 0x205dc 0x1efdc 0x1c1
PR_NewMonitor - 0x1001d160 0x205e0 0x1efe0 0x313
PR_DestroyMonitor - 0x1001d164 0x205e4 0x1efe4 0x26d
PR_EnterMonitor - 0x1001d168 0x205e8 0x1efe8 0x27f
PR_ExitMonitor - 0x1001d16c 0x205ec 0x1efec 0x289
_NSSUTIL_UTF8ToWide - 0x1001d170 0x205f0 0x1eff0 0x496
_NSSUTIL_Access - 0x1001d174 0x205f4 0x1eff4 0x493
PR_smprintf - 0x1001d178 0x205f8 0x1eff8 0x39a
_NSSUTIL_EvaluateConfigDir - 0x1001d17c 0x205fc 0x1effc 0x494
PL_strncasecmp - 0x1001d180 0x20600 0x1f000 0x1e4
NSSUTIL_ArgFetchValue - 0x1001d184 0x20604 0x1f004 0xaf
NSSUTIL_ArgStrip - 0x1001d188 0x20608 0x1f008 0xba
NSSUTIL_ArgSkipParameter - 0x1001d18c 0x2060c 0x1f00c 0xb9
NSSUTIL_ArgGetLabel - 0x1001d190 0x20610 0x1f010 0xb0
NSSUTIL_ArgDecodeNumber - 0x1001d194 0x20614 0x1f014 0xae
NSSUTIL_ArgIsBlank - 0x1001d198 0x20618 0x1f018 0xb3
NSSUTIL_ArgHasFlag - 0x1001d19c 0x2061c 0x1f01c 0xb2
PORT_NewArena_Util - 0x1001d1a0 0x20620 0x1f020 0x20e
PORT_GetError_Util - 0x1001d1a4 0x20624 0x1f024 0x20b
PR_GetEnv - 0x1001d1a8 0x20628 0x1f028 0x2af
PORT_ArenaAlloc_Util - 0x1001d1ac 0x2062c 0x1f02c 0x1fc
PORT_ArenaGrow_Util - 0x1001d1b0 0x20630 0x1f030 0x1fd
PORT_Realloc_Util - 0x1001d1b4 0x20634 0x1f034 0x20f
SECOID_DestroyAlgorithmID_Util - 0x1001d1b8 0x20638 0x1f038 0x3f2
SECOID_GetAlgorithmTag_Util - 0x1001d1bc 0x2063c 0x1f03c 0x3fc
SECOID_CopyAlgorithmID_Util - 0x1001d1c0 0x20640 0x1f040 0x3f0
SECOID_SetAlgorithmID_Util - 0x1001d1c4 0x20644 0x1f044 0x3ff
DER_GetInteger_Util - 0x1001d1c8 0x20648 0x1f048 0x95
PL_HashTableLookupConst - 0x1001d1cc 0x2064c 0x1f04c 0x1cf
PL_HashTableLookup - 0x1001d1d0 0x20650 0x1f050 0x1ce
PL_HashTableRemove - 0x1001d1d4 0x20654 0x1f054 0x1d4
SEC_ASN1EncodeInteger_Util - 0x1001d1d8 0x20658 0x1f058 0x406
PL_HashTableAdd - 0x1001d1dc 0x2065c 0x1f05c 0x1ca
SEC_ASN1EncodeItem_Util - 0x1001d1e0 0x20660 0x1f060 0x408
SEC_ASN1DecodeItem_Util - 0x1001d1e4 0x20664 0x1f064 0x404
SECITEM_ZfreeItem_Util - 0x1001d1e8 0x20668 0x1f068 0x3b8
SECITEM_FreeItem_Util - 0x1001d1ec 0x2066c 0x1f06c 0x3b2
SECITEM_DupItem_Util - 0x1001d1f0 0x20670 0x1f070 0x3b0
SECITEM_AllocItem_Util - 0x1001d1f4 0x20674 0x1f074 0x3a9
PORT_ZFree_Util - 0x1001d1f8 0x20678 0x1f078 0x21d
PORT_ZAlloc_Util - 0x1001d1fc 0x2067c 0x1f07c 0x21c
SECITEM_CopyItem_Util - 0x1001d200 0x20680 0x1f080 0x3ad
PORT_ArenaZAlloc_Util - 0x1001d204 0x20684 0x1f084 0x204
NSS_Get_SECOID_AlgorithmIDTemplate_Util - 0x1001d208 0x20688 0x1f088 0x101
NSS_Get_SEC_ObjectIDTemplate_Util - 0x1001d20c 0x2068c 0x1f08c 0x10d
NSS_Get_SEC_BitStringTemplate_Util - 0x1001d210 0x20690 0x1f090 0x105
NSS_Get_SEC_AnyTemplate_Util - 0x1001d214 0x20694 0x1f094 0x102
PR_Unlock - 0x1001d218 0x20698 0x1f098 0x383
PR_Access - 0x1001d21c 0x2069c 0x1f09c 0x227
PR_Lock - 0x1001d220 0x206a0 0x1f0a0 0x303
PL_HashTableDestroy - 0x1001d224 0x206a4 0x1f0a4 0x1cb
PORT_SetError_Util - 0x1001d228 0x206a8 0x1f0a8 0x212
sqlite3_bind_text - 0x1001d22c 0x206ac 0x1f0ac 0x4b2
SECITEM_CompareItem_Util - 0x1001d230 0x206b0 0x1f0b0 0x3ab
PR_snprintf - 0x1001d234 0x206b4 0x1f0b4 0x39c
PR_GetDirectorySeparator - 0x1001d238 0x206b8 0x1f0b8 0x2ad
PR_GetEnvSecure - 0x1001d23c 0x206bc 0x1f0bc 0x2b0
PR_CallOnce - 0x1001d240 0x206c0 0x1f0c0 0x240
PR_SetError - 0x1001d244 0x206c4 0x1f0c4 0x359
PR_Free - 0x1001d248 0x206c8 0x1f0c8 0x29f
PORT_Free_Util - 0x1001d24c 0x206cc 0x1f0cc 0x209
PORT_Alloc_Util - 0x1001d250 0x206d0 0x1f0d0 0x1fa
PR_GetLibraryFilePathname - 0x1001d254 0x206d4 0x1f0d4 0x2bf
PR_FindFunctionSymbol - 0x1001d258 0x206d8 0x1f0d8 0x294
PR_UnloadLibrary - 0x1001d25c 0x206dc 0x1f0dc 0x382
sqlite3_bind_blob - 0x1001d260 0x206e0 0x1f0e0 0x4aa
PR_LoadLibraryWithFlags - 0x1001d264 0x206e4 0x1f0e4 0x300
KERNEL32.dll (14)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
InitializeSListHead - 0x1001d000 0x20480 0x1ee80 0x35a
DisableThreadLibraryCalls - 0x1001d004 0x20484 0x1ee84 0x11b
GetSystemTimeAsFileTime - 0x1001d008 0x20488 0x1ee88 0x2e2
GetCurrentThreadId - 0x1001d00c 0x2048c 0x1ee8c 0x218
GetCurrentProcessId - 0x1001d010 0x20490 0x1ee90 0x214
QueryPerformanceCounter - 0x1001d014 0x20494 0x1ee94 0x440
IsProcessorFeaturePresent - 0x1001d018 0x20498 0x1ee98 0x37d
TerminateProcess - 0x1001d01c 0x2049c 0x1ee9c 0x57c
GetCurrentProcess - 0x1001d020 0x204a0 0x1eea0 0x213
SetUnhandledExceptionFilter - 0x1001d024 0x204a4 0x1eea4 0x55e
UnhandledExceptionFilter - 0x1001d028 0x204a8 0x1eea8 0x59d
WideCharToMultiByte - 0x1001d02c 0x204ac 0x1eeac 0x5f1
GetTempPathA - 0x1001d030 0x204b0 0x1eeb0 0x2ee
IsDebuggerPresent - 0x1001d034 0x204b4 0x1eeb4 0x376
VCRUNTIME140.dll (6)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strrchr - 0x1001d03c 0x204bc 0x1eebc 0x4b
_except_handler4_common - 0x1001d040 0x204c0 0x1eec0 0x35
memcpy - 0x1001d044 0x204c4 0x1eec4 0x46
memset - 0x1001d048 0x204c8 0x1eec8 0x48
memcmp - 0x1001d04c 0x204cc 0x1eecc 0x45
__std_type_info_destroy_list - 0x1001d050 0x204d0 0x1eed0 0x25
api-ms-win-crt-string-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
islower - 0x1001d0a0 0x20520 0x1ef20 0x6b
isupper - 0x1001d0a4 0x20524 0x1ef24 0x6f
isdigit - 0x1001d0a8 0x20528 0x1ef28 0x68
api-ms-win-crt-convert-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
atoi - 0x1001d058 0x204d8 0x1eed8 0x50
api-ms-win-crt-stdio-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__stdio_common_vsprintf - 0x1001d098 0x20518 0x1ef18 0xd
api-ms-win-crt-heap-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
free - 0x1001d068 0x204e8 0x1eee8 0x18
malloc - 0x1001d06c 0x204ec 0x1eeec 0x19
api-ms-win-crt-filesystem-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_wchmod - 0x1001d060 0x204e0 0x1eee0 0x28
api-ms-win-crt-runtime-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_initialize_narrow_environment - 0x1001d074 0x204f4 0x1eef4 0x35
_initterm - 0x1001d078 0x204f8 0x1eef8 0x38
_configure_narrow_argv - 0x1001d07c 0x204fc 0x1eefc 0x19
_initialize_onexit_table - 0x1001d080 0x20500 0x1ef00 0x36
_execute_onexit_table - 0x1001d084 0x20504 0x1ef04 0x24
_cexit - 0x1001d088 0x20508 0x1ef08 0x17
_seh_filter_dll - 0x1001d08c 0x2050c 0x1ef0c 0x41
_initterm_e - 0x1001d090 0x20510 0x1ef10 0x39
Exports (4)
»
Api name EAT Address Ordinal
C_GetFunctionList 0x6246 0x1
FC_GetFunctionList 0x3218 0x2
NSC_GetFunctionList 0x6246 0x3
NSC_ModuleDBFunc 0x7663 0x4
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
ucrtbase.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\ucrtbase.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 1.09 MB
MD5 d6326267ae77655f312d2287903db4d3 Copy to Clipboard
SHA1 1268bef8e2ca6ebc5fb974fdfaff13be5ba7574f Copy to Clipboard
SHA256 0bb8c77de80acf9c43de59a8fd75e611cc3eb8200c69f11e94389e8af2ceb7a9 Copy to Clipboard
SSDeep 24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb Copy to Clipboard
ImpHash 1200ab27b3dc27748d0142a31f7a47c7 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x10023df0
Size Of Code 0x105a00
Size Of Initialized Data 0xe000
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2054-02-08 16:22:31+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription Microsoft® C Runtime Library
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName ucrtbase.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename ucrtbase.dll
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x105a00 0x105a00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.73
.data 0x10107000 0x1b1c 0xe00 0x105e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 2.22
.idata 0x10109000 0x1536 0x1600 0x106c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.16
.rsrc 0x1010b000 0x410 0x600 0x108200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.47
.reloc 0x1010c000 0xa624 0xa800 0x108800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.78
Imports (25)
»
api-ms-win-core-errorhandling-l1-1-0.dll (6)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SetLastError - 0x10109048 0x1094e8 0x1070e8 0x4
UnhandledExceptionFilter - 0x1010904c 0x1094ec 0x1070ec 0x6
SetUnhandledExceptionFilter - 0x10109050 0x1094f0 0x1070f0 0x5
GetLastError - 0x10109054 0x1094f4 0x1070f4 0x1
SetErrorMode - 0x10109058 0x1094f8 0x1070f8 0x3
RaiseException - 0x1010905c 0x1094fc 0x1070fc 0x2
api-ms-win-core-heap-l1-1-0.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
HeapFree - 0x101090ec 0x10958c 0x10718c 0x6
GetProcessHeap - 0x101090f0 0x109590 0x107190 0x0
HeapAlloc - 0x101090f4 0x109594 0x107194 0x2
HeapSize - 0x101090f8 0x109598 0x107198 0xb
HeapReAlloc - 0x101090fc 0x10959c 0x10719c 0x9
HeapValidate - 0x10109100 0x1095a0 0x1071a0 0xe
HeapQueryInformation - 0x10109104 0x1095a4 0x1071a4 0x8
HeapCompact - 0x10109108 0x1095a8 0x1071a8 0x3
HeapWalk - 0x1010910c 0x1095ac 0x1071ac 0xf
api-ms-win-core-synch-l1-1-0.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
LeaveCriticalSection - 0x10109238 0x1096d8 0x1072d8 0x13
InitializeCriticalSectionAndSpinCount - 0x1010923c 0x1096dc 0x1072dc 0x10
WaitForSingleObject - 0x10109240 0x1096e0 0x1072e0 0x27
DeleteCriticalSection - 0x10109244 0x1096e4 0x1072e4 0xd
EnterCriticalSection - 0x10109248 0x1096e8 0x1072e8 0xe
api-ms-win-core-processthreads-l1-1-0.dll (17)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCurrentThreadId - 0x101091c0 0x109660 0x107260 0xd
GetCurrentProcess - 0x101091c4 0x109664 0x107264 0xa
TerminateProcess - 0x101091c8 0x109668 0x107268 0x2a
CreateThread - 0x101091cc 0x10966c 0x10726c 0x5
TlsFree - 0x101091d0 0x109670 0x107270 0x2d
ExitThread - 0x101091d4 0x109674 0x107274 0x8
GetCurrentProcessId - 0x101091d8 0x109678 0x107278 0xb
GetExitCodeProcess - 0x101091dc 0x10967c 0x10727c 0xe
GetStartupInfoW - 0x101091e0 0x109680 0x107280 0x15
ResumeThread - 0x101091e4 0x109684 0x107284 0x20
TlsGetValue - 0x101091e8 0x109688 0x107288 0x2e
ExitProcess - 0x101091ec 0x10968c 0x10728c 0x7
TlsSetValue - 0x101091f0 0x109690 0x107290 0x2f
TlsAlloc - 0x101091f4 0x109694 0x107294 0x2c
CreateProcessA - 0x101091f8 0x109698 0x107298 0x0
CreateProcessW - 0x101091fc 0x10969c 0x10729c 0x2
GetCurrentThread - 0x10109200 0x1096a0 0x1072a0 0xc
api-ms-win-core-processenvironment-l1-1-0.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCurrentDirectoryA - 0x1010918c 0x10962c 0x10722c 0x6
GetCurrentDirectoryW - 0x10109190 0x109630 0x107230 0x7
GetCommandLineW - 0x10109194 0x109634 0x107234 0x5
GetCommandLineA - 0x10109198 0x109638 0x107238 0x4
SetEnvironmentVariableA - 0x1010919c 0x10963c 0x10723c 0x11
GetStdHandle - 0x101091a0 0x109640 0x107240 0xc
SetStdHandle - 0x101091a4 0x109644 0x107244 0x13
SetCurrentDirectoryA - 0x101091a8 0x109648 0x107248 0xe
SetEnvironmentVariableW - 0x101091ac 0x10964c 0x10724c 0x12
GetEnvironmentStringsW - 0x101091b0 0x109650 0x107250 0x9
FreeEnvironmentStringsW - 0x101091b4 0x109654 0x107254 0x3
SetCurrentDirectoryW - 0x101091b8 0x109658 0x107258 0xf
api-ms-win-core-file-l1-1-0.dll (26)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SetFileTime - 0x10109064 0x109504 0x107104 0x44
CreateDirectoryW - 0x10109068 0x109508 0x107108 0x2
SetFileAttributesW - 0x1010906c 0x10950c 0x10710c 0x40
GetFileAttributesExW - 0x10109070 0x109510 0x107110 0x21
RemoveDirectoryW - 0x10109074 0x109514 0x107114 0x3d
GetDriveTypeW - 0x10109078 0x109518 0x107118 0x1e
GetFileInformationByHandle - 0x1010907c 0x10951c 0x10711c 0x23
GetFullPathNameA - 0x10109080 0x109520 0x107120 0x2a
GetFullPathNameW - 0x10109084 0x109524 0x107124 0x2b
FindFirstFileExA - 0x10109088 0x109528 0x107128 0xf
DeleteFileW - 0x1010908c 0x10952c 0x10712c 0x7
SetEndOfFile - 0x10109090 0x109530 0x107130 0x3e
FlushFileBuffers - 0x10109094 0x109534 0x107134 0x18
UnlockFileEx - 0x10109098 0x109538 0x107138 0x47
LockFileEx - 0x1010909c 0x10953c 0x10713c 0x37
WriteFile - 0x101090a0 0x109540 0x107140 0x48
SetFilePointerEx - 0x101090a4 0x109544 0x107144 0x43
FindNextFileA - 0x101090a8 0x109548 0x107148 0x14
CreateFileW - 0x101090ac 0x10954c 0x10714c 0x4
GetLogicalDrives - 0x101090b0 0x109550 0x107150 0x2d
GetDiskFreeSpaceW - 0x101090b4 0x109554 0x107154 0x1c
FindNextFileW - 0x101090b8 0x109558 0x107158 0x15
ReadFile - 0x101090bc 0x10955c 0x10715c 0x39
FindFirstFileExW - 0x101090c0 0x109560 0x107160 0x10
FindClose - 0x101090c4 0x109564 0x107164 0xa
GetFileType - 0x101090c8 0x109568 0x107168 0x27
api-ms-win-core-libraryloader-l1-1-0.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetModuleHandleExW - 0x10109120 0x1095c0 0x1071c0 0xa
GetModuleHandleW - 0x10109124 0x1095c4 0x1071c4 0xb
FreeLibraryAndExitThread - 0x10109128 0x1095c8 0x1071c8 0x4
LoadLibraryExA - 0x1010912c 0x1095cc 0x1071cc 0xd
GetModuleFileNameA - 0x10109130 0x1095d0 0x1071d0 0x6
LoadLibraryExW - 0x10109134 0x1095d4 0x1071d4 0xe
GetModuleFileNameW - 0x10109138 0x1095d8 0x1071d8 0x7
GetProcAddress - 0x1010913c 0x1095dc 0x1071dc 0xc
FreeLibrary - 0x10109140 0x1095e0 0x1071e0 0x3
api-ms-win-core-string-l1-1-0.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetStringTypeW - 0x10109224 0x1096c4 0x1072c4 0x5
WideCharToMultiByte - 0x10109228 0x1096c8 0x1072c8 0x7
MultiByteToWideChar - 0x1010922c 0x1096cc 0x1072cc 0x6
CompareStringW - 0x10109230 0x1096d0 0x1072d0 0x2
api-ms-win-core-debug-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
OutputDebugStringA - 0x10109038 0x1094d8 0x1070d8 0x2
IsDebuggerPresent - 0x1010903c 0x1094dc 0x1070dc 0x1
OutputDebugStringW - 0x10109040 0x1094e0 0x1070e0 0x3
api-ms-win-core-localization-l1-2-0.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCPInfo - 0x10109148 0x1095e8 0x1071e8 0x9
GetUserDefaultLCID - 0x1010914c 0x1095ec 0x1071ec 0x1e
GetOEMCP - 0x10109150 0x1095f0 0x1071f0 0x15
LCMapStringW - 0x10109154 0x1095f4 0x1071f4 0x2f
GetACP - 0x10109158 0x1095f8 0x1071f8 0x8
IsValidLocale - 0x1010915c 0x1095fc 0x1071fc 0x2a
IsValidCodePage - 0x10109160 0x109600 0x107200 0x28
EnumSystemLocalesW - 0x10109164 0x109604 0x107204 0x3
GetLocaleInfoW - 0x10109168 0x109608 0x107208 0x12
api-ms-win-core-datetime-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetTimeFormatW - 0x1010902c 0x1094cc 0x1070cc 0x3
GetDateFormatW - 0x10109030 0x1094d0 0x1070d0 0x1
api-ms-win-core-sysinfo-l1-1-0.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetSystemInfo - 0x10109258 0x1096f8 0x1072f8 0x7
GetLocalTime - 0x1010925c 0x1096fc 0x1072fc 0x2
GetSystemTimeAsFileTime - 0x10109260 0x109700 0x107300 0xa
SetLocalTime - 0x10109264 0x109704 0x107304 0x15
api-ms-win-core-processthreads-l1-1-1.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
IsProcessorFeaturePresent - 0x10109208 0x1096a8 0x1072a8 0x9
api-ms-win-core-console-l1-1-0.dll (10)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
ReadConsoleW - 0x10109000 0x1094a0 0x1070a0 0x9
WriteConsoleW - 0x10109004 0x1094a4 0x1070a4 0xd
SetConsoleCtrlHandler - 0x10109008 0x1094a8 0x1070a8 0xa
PeekConsoleInputA - 0x1010900c 0x1094ac 0x1070ac 0x5
GetConsoleCP - 0x10109010 0x1094b0 0x1070b0 0x1
SetConsoleMode - 0x10109014 0x1094b4 0x1070b4 0xb
GetNumberOfConsoleInputEvents - 0x10109018 0x1094b8 0x1070b8 0x4
GetConsoleMode - 0x1010901c 0x1094bc 0x1070bc 0x2
ReadConsoleInputW - 0x10109020 0x1094c0 0x1070c0 0x8
ReadConsoleInputA - 0x10109024 0x1094c4 0x1070c4 0x7
api-ms-win-core-handle-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
DuplicateHandle - 0x101090e0 0x109580 0x107180 0x2
CloseHandle - 0x101090e4 0x109584 0x107184 0x0
api-ms-win-core-file-l1-2-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetTempPathW - 0x101090d0 0x109570 0x107170 0x1
api-ms-win-core-namedpipe-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PeekNamedPipe - 0x10109180 0x109620 0x107220 0x6
CreatePipe - 0x10109184 0x109624 0x107224 0x2
api-ms-win-core-timezone-l1-1-0.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetTimeZoneInformation - 0x1010926c 0x10970c 0x10730c 0x2
SystemTimeToFileTime - 0x10109270 0x109710 0x107310 0x6
SystemTimeToTzSpecificLocalTime - 0x10109274 0x109714 0x107314 0x7
FileTimeToSystemTime - 0x10109278 0x109718 0x107318 0x0
TzSpecificLocalTimeToSystemTime - 0x1010927c 0x10971c 0x10731c 0x8
api-ms-win-core-file-l2-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
MoveFileExW - 0x101090d8 0x109578 0x107178 0x6
api-ms-win-core-synch-l1-2-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
Sleep - 0x10109250 0x1096f0 0x1072f0 0x9
api-ms-win-core-profile-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
QueryPerformanceFrequency - 0x10109210 0x1096b0 0x1072b0 0x1
QueryPerformanceCounter - 0x10109214 0x1096b4 0x1072b4 0x0
api-ms-win-core-memory-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VirtualQuery - 0x10109170 0x109610 0x107210 0xd
VirtualProtect - 0x10109174 0x109614 0x107214 0xb
VirtualAlloc - 0x10109178 0x109618 0x107218 0x7
api-ms-win-core-util-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
Beep - 0x10109284 0x109724 0x107324 0x0
EncodePointer - 0x10109288 0x109728 0x107328 0x3
DecodePointer - 0x1010928c 0x10972c 0x10732c 0x1
api-ms-win-core-rtlsupport-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RtlUnwind - 0x1010921c 0x1096bc 0x1072bc 0x2
api-ms-win-core-interlocked-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
InterlockedPushEntrySList - 0x10109114 0x1095b4 0x1071b4 0x9
InterlockedFlushSList - 0x10109118 0x1095b8 0x1071b8 0x6
Exports (2542)
»
Api name EAT Address Ordinal
_CIacos 0x40490 0x1
_CIasin 0x41070 0x2
_CIatan 0x41cb0 0x3
_CIatan2 0x3fde0 0x4
_CIcos 0x42660 0x5
_CIcosh 0x3fdfc 0x6
_CIexp 0x3fd90 0x7
_CIfmod 0x40020 0x8
_CIlog 0x43930 0x9
_CIlog10 0x432e0 0xa
_CIpow 0x440e0 0xb
_CIsin 0x45a10 0xc
_CIsinh 0x3fdf0 0xd
_CIsqrt 0x45eb0 0xe
_CItan 0x460d0 0xf
_CItanh 0x3fe04 0x10
_Cbuild 0xae810 0x11
_Cmulcc 0xae3b0 0x12
_Cmulcr 0xae450 0x13
_CreateFrameInfo 0x46910 0x14
_CxxThrowException 0x46ab0 0x15
_EH_prolog 0x52220 0x16
_Exit 0x95070 0x17
_FCbuild 0xae910 0x18
_FCmulcc 0xae5d0 0x19
_FCmulcr 0xae620 0x1a
_FindAndUnlinkFrame 0x46940 0x1b
_Getdays 0x37320 0x1c
_Getmonths 0x37450 0x1d
_Gettnames 0x34fa0 0x1e
_IsExceptionObjectToBeDestroyed 0x46bf0 0x1f
_LCbuild 0xae810 0x20
_LCmulcc 0xae3b0 0x21
_LCmulcr 0xae450 0x22
_NLG_Dispatch2 0x46f73 0x23
_NLG_Return 0x46fa7 0x24
_NLG_Return2 0x46f7d 0x25
_SetWinRTOutOfMemoryExceptionCallback 0x46c20 0x26
_Strftime 0xd6630 0x27
_W_Getdays 0x38170 0x28
_W_Getmonths 0x382f0 0x29
_W_Gettnames 0x35010 0x2a
_Wcsftime 0xd9870 0x2b
__AdjustPointer 0x46c40 0x2c
__BuildCatchObject 0x478e0 0x2d
__BuildCatchObjectHelper 0x47980 0x2e
__CxxDetectRethrow 0x47d40 0x2f
__CxxExceptionFilter 0x47da0 0x30
__CxxFrameHandler 0x46a40 0x31
__CxxFrameHandler2 0x46a40 0x32
__CxxFrameHandler3 0x46a40 0x33
__CxxLongjmpUnwind 0x46a80 0x34
__CxxQueryExceptionSize 0x47f00 0x35
__CxxRegisterExceptionObject 0x47f10 0x36
__CxxUnregisterExceptionObject 0x47fc0 0x37
__DestructExceptionObject 0x46b40 0x38
__FrameUnwindFilter 0x46c70 0x39
__GetPlatformExceptionInfo 0x46cc0 0x3a
__RTCastToVoid 0x485d0 0x3b
__RTDynamicCast 0x48640 0x3c
__RTtypeid 0x48730 0x3d
__TypeMatch 0x47ca0 0x3e
___lc_codepage_func 0x24260 0x3f
___lc_collate_cp_func 0x21fe0 0x40
___lc_locale_name_func 0x24330 0x41
___mb_cur_max_func 0x23e20 0x42
___mb_cur_max_l_func 0x90890 0x43
__acrt_iob_func 0x24000 0x44
__conio_common_vcprintf 0xbea00 0x45
__conio_common_vcprintf_p 0xbea30 0x46
__conio_common_vcprintf_s 0xbea60 0x47
__conio_common_vcscanf 0xc32e0 0x48
__conio_common_vcwprintf 0xbea90 0x49
__conio_common_vcwprintf_p 0xbeac0 0x4a
__conio_common_vcwprintf_s 0xbeaf0 0x4b
__conio_common_vcwscanf 0xc3310 0x4c
__control87_2 0x586c0 0x4d
__current_exception 0x46d20 0x4e
__current_exception_context 0x46d30 0x4f
__daylight 0xd6d40 0x50
__dcrt_get_wide_environment_from_os 0x34e70 0x51
__dcrt_initial_narrow_environment 0x1089f4 0x52
__doserrno 0x910b0 0x53
__dstbias 0xd6d60 0x54
__fpe_flt_rounds 0xb1850 0x55
__fpecode 0x91e30 0x56
__initialize_lconv_for_unsigned_char 0x3bb60 0x57
__intrinsic_abnormal_termination 0x46f2a 0x58
__intrinsic_setjmp 0x487c0 0x59
__isascii 0x3a330 0x5a
__iscsym 0x8c9e0 0x5b
__iscsymf 0x8ca10 0x5c
__iswcsym 0x8d260 0x5d
__iswcsymf 0x8d290 0x5e
__libm_sse2_acos 0x562f0 0x5f
__libm_sse2_acosf 0x55f00 0x60
__libm_sse2_asin 0x56b70 0x61
__libm_sse2_asinf 0x567a0 0x62
__libm_sse2_atan 0x57690 0x63
__libm_sse2_atan2 0x56fc0 0x64
__libm_sse2_atanf 0x574e0 0x65
__libm_sse2_cos 0x57a10 0x66
__libm_sse2_cosf 0x578b0 0x67
__libm_sse2_exp 0x57d20 0x68
__libm_sse2_expf 0x57bc0 0x69
__libm_sse2_log 0x59320 0x6a
__libm_sse2_log10 0x58f50 0x6b
__libm_sse2_log10f 0x58dd0 0x6c
__libm_sse2_logf 0x591a0 0x6d
__libm_sse2_pow 0x59c10 0x6e
__libm_sse2_powf 0x59550 0x6f
__libm_sse2_sin 0x5a7e0 0x70
__libm_sse2_sinf 0x5a690 0x71
__libm_sse2_tan 0x5ab40 0x72
__libm_sse2_tanf 0x5a9a0 0x73
__p___argc 0x21470 0x74
__p___argv 0x933d0 0x75
__p___wargv 0x3b1e0 0x76
__p__acmdln 0x933e0 0x77
__p__commode 0x218b0 0x78
__p__environ 0xd9ac0 0x79
__p__fmode 0xd2e50 0x7a
__p__mbcasemap 0x90e30 0x7b
__p__mbctype 0x90e50 0x7c
__p__pgmptr 0x933f0 0x7d
__p__wcmdln 0x93400 0x7e
__p__wenviron 0xd9ae0 0x7f
__p__wpgmptr 0x93410 0x80
__pctype_func 0x23620 0x81
__processing_throw 0x46d40 0x82
__pwctype_func 0x8f2e0 0x83
__pxcptinfoptrs 0x91e40 0x84
__report_gsfailure 0x522a0 0x85
__setusermatherr 0xb5670 0x86
__std_exception_copy 0x48800 0x87
__std_exception_destroy 0x48870 0x88
__std_terminate 0x46d50 0x89
__std_type_info_compare 0x488c0 0x8a
__std_type_info_destroy_list 0x48910 0x8b
__std_type_info_hash 0x48940 0x8c
__std_type_info_name 0x48970 0x8d
__stdio_common_vfprintf 0xa6c20 0x8e
__stdio_common_vfprintf_p 0xa6c50 0x8f
__stdio_common_vfprintf_s 0xa6c80 0x90
__stdio_common_vfscanf 0x9ec80 0x91
__stdio_common_vfwprintf 0x388e0 0x92
__stdio_common_vfwprintf_p 0xa6cb0 0x93
__stdio_common_vfwprintf_s 0xa6ce0 0x94
__stdio_common_vfwscanf 0x9ecb0 0x95
__stdio_common_vsnprintf_s 0x261b0 0x96
__stdio_common_vsnwprintf_s 0x22a10 0x97
__stdio_common_vsprintf 0x2d5b0 0x98
__stdio_common_vsprintf_p 0xa6d10 0x99
__stdio_common_vsprintf_s 0x22d00 0x9a
__stdio_common_vsscanf 0x29470 0x9b
__stdio_common_vswprintf 0x24de0 0x9c
__stdio_common_vswprintf_p 0xa6d40 0x9d
__stdio_common_vswprintf_s 0x2f290 0x9e
__stdio_common_vswscanf 0x2a0e0 0x9f
__strncnt 0x3cfe0 0xa0
__sys_errlist 0x92530 0xa1
__sys_nerr 0x92540 0xa2
__threadhandle 0x8e450 0xa3
__threadid 0x8e460 0xa4
__timezone 0xd6d80 0xa5
__toascii 0x8ca40 0xa6
__tzname 0xd6da0 0xa7
__unDName 0x4e1e0 0xa8
__unDNameEx 0x4e280 0xa9
__uncaught_exception 0x46d60 0xaa
__uncaught_exceptions 0x46d70 0xab
__wcserror 0x932b0 0xac
__wcserror_s 0x932d0 0xad
__wcsncnt 0x3eb70 0xae
_abs64 0x3bda0 0xaf
_access 0xc5240 0xb0
_access_s 0xc5260 0xb1
_aligned_free 0x3b960 0xb2
_aligned_malloc 0x3b940 0xb3
_aligned_msize 0x8d3d0 0xb4
_aligned_offset_malloc 0x8d510 0xb5
_aligned_offset_realloc 0x8d530 0xb6
_aligned_offset_recalloc 0x8da40 0xb7
_aligned_realloc 0x8dbb0 0xb8
_aligned_recalloc 0x8dbd0 0xb9
_assert 0x94d70 0xba
_atodbl 0x875e0 0xbb
_atodbl_l 0x87600 0xbc
_atof_l 0x87620 0xbd
_atoflt 0x87640 0xbe
_atoflt_l 0x87660 0xbf
_atoi64 0x3b4f0 0xc0
_atoi64_l 0x885c0 0xc1
_atoi_l 0x885f0 0xc2
_atol_l 0x885f0 0xc3
_atoldbl 0x88500 0xc4
_atoldbl_l 0x88520 0xc5
_atoll_l 0x885c0 0xc6
_beep 0xf0790 0xc7
_beginthread 0x951d0 0xc8
_beginthreadex 0x3aea0 0xc9
_byteswap_uint64 0xa9680 0xca
_byteswap_ulong 0xa9720 0xcb
_byteswap_ushort 0xa9760 0xcc
_c_exit 0x95030 0xcd
_cabs 0xf3060 0xce
_callnewh 0x8e130 0xcf
_calloc_base 0x27800 0xd0
_cexit 0x95050 0xd1
_cgets 0xb93f0 0xd2
_cgets_s 0xb9620 0xd3
_cgetws 0xb9770 0xd4
_cgetws_s 0xb99a0 0xd5
_chdir 0xeee60 0xd6
_chdrive 0xeeec0 0xd7
_chgsign 0xf3e70 0xd8
_chgsignf 0xf3eb0 0xd9
_chkesp 0x4e370 0xda
_chmod 0xc52c0 0xdb
_chsize 0xcede0 0xdc
_chsize_s 0xcf660 0xdd
_clearfp 0x589f0 0xde
_close 0x31e60 0xdf
_commit 0x34a00 0xe0
_configthreadlocale 0x3a070 0xe1
_configure_narrow_argv 0x358a0 0xe2
_configure_wide_argv 0x359b0 0xe3
_control87 0x541b0 0xe4
_controlfp 0xf3550 0xe5
_controlfp_s 0x397a0 0xe6
_copysign 0xf3ee0 0xe7
_copysignf 0xf3f10 0xe8
_cputs 0xbeb20 0xe9
_cputws 0xbebd0 0xea
_creat 0xcfc40 0xeb
_create_locale 0x3b370 0xec
_crt_at_quick_exit 0x950f0 0xed
_crt_atexit 0x21f90 0xee
_crt_debugger_hook 0x525b0 0xef
_ctime32 0xd4cc0 0xf0
_ctime32_s 0xd4ce0 0xf1
_ctime64 0xd4d00 0xf2
_ctime64_s 0xd4d20 0xf3
_cwait 0xe4070 0xf4
_d_int 0x21650 0xf5
_dclass 0xb57e0 0xf6
_dexp 0xb0b40 0xf7
_difftime32 0xd4ec0 0xf8
_difftime64 0x3ba00 0xf9
_dlog 0x21500 0xfa
_dnorm 0xb8a10 0xfb
_dpcomp 0xb56b0 0xfc
_dpoly 0xb0600 0xfd
_dscale 0xb8c70 0xfe
_dsign 0xb5710 0xff
_dsin 0xb48f0 0x100
_dtest 0x20f10 0x101
_dunscale 0x214a0 0x102
_dup 0xcfe20 0x103
_dup2 0xd0210 0x104
_dupenv_s 0xda080 0x105
_ecvt 0x890d0 0x106
_ecvt_s 0x343f0 0x107
_endthread 0x95350 0x108
_endthreadex 0x95360 0x109
_eof 0xd0690 0x10a
_errno 0x261e0 0x10b
_except1 0xb2d40 0x10c
_except_handler2 0x4e3a8 0x10d
_except_handler3 0x4e478 0x10e
_except_handler4_common 0x4e600 0x10f
_execl 0xe0050 0x110
_execle 0xe0080 0x111
_execlp 0xe07b0 0x112
_execlpe 0xe07e0 0x113
_execute_onexit_table 0x238c0 0x114
_execv 0xe20f0 0x115
_execve 0xe2110 0x116
_execvp 0xe3280 0x117
_execvpe 0xe32a0 0x118
_exit 0x95070 0x119
_expand 0x8dc40 0x11a
_fclose_nolock 0x31cc0 0x11b
_fcloseall 0x95450 0x11c
_fcvt 0x89120 0x11d
_fcvt_s 0x891d0 0x11e
_fd_int 0x20ba0 0x11f
_fdclass 0xb5730 0x120
_fdexp 0xb0e60 0x121
_fdlog 0xb5060 0x122
_fdnorm 0xb8ba0 0x123
_fdopen 0x95780 0x124
_fdpcomp 0xb5750 0x125
_fdpoly 0xb03b0 0x126
_fdscale 0xb8ee0 0x127
_fdsign 0xb57b0 0x128
_fdsin 0xb4110 0x129
_fdtest 0xb92b0 0x12a
_fdunscale 0xb9350 0x12b
_fflush_nolock 0x33c50 0x12c
_fgetc_nolock 0x959d0 0x12d
_fgetchar 0x95af0 0x12e
_fgetwc_nolock 0x95fb0 0x12f
_fgetwchar 0x96200 0x130
_filelength 0xd0e80 0x131
_filelengthi64 0xd0ea0 0x132
_fileno 0x31450 0x133
_findclose 0xc7e50 0x134
_findfirst32 0xc7f50 0x135
_findfirst32i64 0xc7f70 0x136
_findfirst64 0xc7f90 0x137
_findfirst64i32 0xc7fb0 0x138
_findnext32 0xc7fd0 0x139
_findnext32i64 0xc8030 0x13a
_findnext64 0xc80a0 0x13b
_findnext64i32 0xc8110 0x13c
_finite 0x38970 0x13d
_flushall 0x959c0 0x13e
_fpclass 0xf3f40 0x13f
_fpieee_flt 0x57f70 0x140
_fpreset 0x58ae0 0x141
_fputc_nolock 0x96700 0x142
_fputchar 0x96880 0x143
_fputwc_nolock 0x33ca0 0x144
_fputwchar 0x96950 0x145
_fread_nolock 0x96a20 0x146
_fread_nolock_s 0x32610 0x147
_free_base 0x27e40 0x148
_free_locale 0x90bc0 0x149
_fseek_nolock 0x96df0 0x14a
_fseeki64 0x96e10 0x14b
_fseeki64_nolock 0x96e30 0x14c
_fsopen 0x340e0 0x14d
_fstat32 0xce1c0 0x14e
_fstat32i64 0xce1e0 0x14f
_fstat64 0xce200 0x150
_fstat64i32 0xce220 0x151
_ftell_nolock 0x97490 0x152
_ftelli64 0x974a0 0x153
_ftelli64_nolock 0x974b0 0x154
_ftime32 0xd5330 0x155
_ftime32_s 0xd5330 0x156
_ftime64 0xd5350 0x157
_ftime64_s 0xd5350 0x158
_ftol 0x431b0 0x159
_fullpath 0xc8610 0x15a
_futime32 0xd9140 0x15b
_futime64 0xd9160 0x15c
_fwrite_nolock 0x31860 0x15d
_gcvt 0x89380 0x15e
_gcvt_s 0x893b0 0x15f
_get_current_locale 0x90c90 0x160
_get_daylight 0xd6dc0 0x161
_get_doserrno 0x91180 0x162
_get_dstbias 0xd6ed0 0x163
_get_errno 0x396a0 0x164
_get_fmode 0x395c0 0x165
_get_heap_handle 0x3bde0 0x166
_get_initial_narrow_environment 0xd9b00 0x167
_get_initial_wide_environment 0x3b180 0x168
_get_invalid_parameter_handler 0x91680 0x169
_get_narrow_winmain_command_line 0x37590 0x16a
_get_osfhandle 0x348f0 0x16b
_get_pgmptr 0x93420 0x16c
_get_printf_count_output 0xa6d70 0x16d
_get_purecall_handler 0x4e790 0x16e
_get_stream_buffer_pointers 0x387f0 0x16f
_get_terminate 0x92550 0x170
_get_thread_local_invalid_parameter_handler 0x916b0 0x171
_get_timezone 0xd6fe0 0x172
_get_tzname 0xd70f0 0x173
_get_unexpected 0x4e820 0x174
_get_wide_winmain_command_line 0x38470 0x175
_get_wpgmptr 0x93530 0x176
_getc_nolock 0x95b10 0x177
_getch 0xc3340 0x178
_getch_nolock 0xc33a0 0x179
_getche 0xc3480 0x17a
_getche_nolock 0xc34e0 0x17b
_getcwd 0xf0600 0x17c
_getdcwd 0xf0620 0x17d
_getdiskfree 0xef2a0 0x17e
_getdllprocaddr 0xdf9e0 0x17f
_getdrive 0xef100 0x180
_getdrives 0xef290 0x181
_getmaxstdio 0xa7600 0x182
_getmbcp 0x90e70 0x183
_getpid 0x91670 0x184
_getsystime 0xf07d0 0x185
_getw 0x978a0 0x186
_getwc_nolock 0x96220 0x187
_getwch 0xc37d0 0x188
_getwch_nolock 0xc3830 0x189
_getwche 0xc3910 0x18a
_getwche_nolock 0xc3970 0x18b
_getws 0x977a0 0x18c
_getws_s 0x977c0 0x18d
_global_unwind2 0x46e40 0x18e
_gmtime32 0xd5370 0x18f
_gmtime32_s 0x37c90 0x190
_gmtime64 0x37bf0 0x191
_gmtime64_s 0x37d80 0x192
_heapchk 0xe4390 0x193
_heapmin 0xe43b0 0x194
_heapwalk 0x8dfb0 0x195
_hypot 0xf3340 0x196
_hypotf 0xf3370 0x197
_i64toa 0x8c6f0 0x198
_i64toa_s 0x8c740 0x199
_i64tow 0x8c790 0x19a
_i64tow_s 0x8c7e0 0x19b
_initialize_narrow_environment 0x3bbe0 0x19c
_initialize_onexit_table 0x23f50 0x19d
_initialize_wide_environment 0x21ea0 0x19e
_initterm 0x229a0 0x19f
_initterm_e 0x226f0 0x1a0
_invalid_parameter_noinfo 0x918c0 0x1a1
_invalid_parameter_noinfo_noreturn 0x918e0 0x1a2
_invoke_watson 0x91900 0x1a3
_is_exception_typeof 0x46d90 0x1a4
_isalnum_l 0x8ca60 0x1a5
_isalpha_l 0x8cab0 0x1a6
_isatty 0x31400 0x1a7
_isblank_l 0x8cb00 0x1a8
_iscntrl_l 0x315c0 0x1a9
_isctype 0x89780 0x1aa
_isctype_l 0x897c0 0x1ab
_isdigit_l 0x8cb50 0x1ac
_isgraph_l 0x8cba0 0x1ad
_isleadbyte_l 0x8d1f0 0x1ae
_islower_l 0x8cbf0 0x1af
_ismbbalnum 0xe4570 0x1b0
_ismbbalnum_l 0xe4590 0x1b1
_ismbbalpha 0xe45b0 0x1b2
_ismbbalpha_l 0xe45d0 0x1b3
_ismbbblank 0xe45f0 0x1b4
_ismbbblank_l 0xe4620 0x1b5
_ismbbgraph 0xe4650 0x1b6
_ismbbgraph_l 0xe4670 0x1b7
_ismbbkalnum 0xe4690 0x1b8
_ismbbkalnum_l 0xe46b0 0x1b9
_ismbbkana 0xe46d0 0x1ba
_ismbbkana_l 0xe46f0 0x1bb
_ismbbkprint 0xe4750 0x1bc
_ismbbkprint_l 0xe4770 0x1bd
_ismbbkpunct 0xe4790 0x1be
_ismbbkpunct_l 0xe47b0 0x1bf
_ismbblead 0x2b360 0x1c0
_ismbblead_l 0xe47d0 0x1c1
_ismbbprint 0xe47f0 0x1c2
_ismbbprint_l 0xe4810 0x1c3
_ismbbpunct 0xe4830 0x1c4
_ismbbpunct_l 0xe4850 0x1c5
_ismbbtrail 0xe4870 0x1c6
_ismbbtrail_l 0xe4890 0x1c7
_ismbcalnum 0xe4430 0x1c8
_ismbcalnum_l 0xe4450 0x1c9
_ismbcalpha 0xe44d0 0x1ca
_ismbcalpha_l 0xe44f0 0x1cb
_ismbcblank 0xe4cf0 0x1cc
_ismbcblank_l 0xe4d10 0x1cd
_ismbcdigit 0xe48b0 0x1ce
_ismbcdigit_l 0xe48d0 0x1cf
_ismbcgraph 0xe4930 0x1d0
_ismbcgraph_l 0xe4950 0x1d1
_ismbchira 0xe49d0 0x1d2
_ismbchira_l 0xe49f0 0x1d3
_ismbckata 0xe4a50 0x1d4
_ismbckata_l 0xe4a70 0x1d5
_ismbcl0 0xe55b0 0x1d6
_ismbcl0_l 0xe55d0 0x1d7
_ismbcl1 0xe5640 0x1d8
_ismbcl1_l 0xe5660 0x1d9
_ismbcl2 0xe56e0 0x1da
_ismbcl2_l 0xe5700 0x1db
_ismbclegal 0xe4b50 0x1dc
_ismbclegal_l 0xe4b70 0x1dd
_ismbclower 0xe4bd0 0x1de
_ismbclower_l 0xe4bf0 0x1df
_ismbcprint 0xe4c50 0x1e0
_ismbcprint_l 0xe4c70 0x1e1
_ismbcpunct 0xe4d90 0x1e2
_ismbcpunct_l 0xe4db0 0x1e3
_ismbcspace 0xe4fb0 0x1e4
_ismbcspace_l 0xe4fd0 0x1e5
_ismbcsymbol 0xe4ad0 0x1e6
_ismbcsymbol_l 0xe4af0 0x1e7
_ismbcupper 0xe5030 0x1e8
_ismbcupper_l 0xe5050 0x1e9
_ismbslead 0xe4e20 0x1ea
_ismbslead_l 0xe4e40 0x1eb
_ismbstrail 0x898c0 0x1ec
_ismbstrail_l 0x898e0 0x1ed
_isnan 0x34df0 0x1ee
_isprint_l 0x8cc40 0x1ef
_ispunct_l 0x8cc90 0x1f0
_isspace_l 0x31610 0x1f1
_isupper_l 0x8cce0 0x1f2
_iswalnum_l 0x23bb0 0x1f3
_iswalpha_l 0x21f70 0x1f4
_iswblank_l 0x8d380 0x1f5
_iswcntrl_l 0x8d240 0x1f6
_iswcsym_l 0x8d260 0x1f7
_iswcsymf_l 0x8d290 0x1f8
_iswctype_l 0x89a50 0x1f9
_iswdigit_l 0x23c90 0x1fa
_iswgraph_l 0x8d2c0 0x1fb
_iswlower_l 0x8d2e0 0x1fc
_iswprint_l 0x8d300 0x1fd
_iswpunct_l 0x8d320 0x1fe
_iswspace_l 0x8d340 0x1ff
_iswupper_l 0x8d3b0 0x200
_iswxdigit_l 0x21880 0x201
_isxdigit_l 0x8cd30 0x202
_itoa 0x8c830 0x203
_itoa_s 0x8c870 0x204
_itow 0x8c8b0 0x205
_itow_s 0x37110 0x206
_j0 0xaa7c0 0x207
_j1 0xaa920 0x208
_jn 0xaaab0 0x209
_kbhit 0xc35d0 0x20a
_ld_int 0xb9330 0x20b
_ldclass 0xb57e0 0x20c
_ldexp 0xb11b0 0x20d
_ldlog 0xb51f0 0x20e
_ldpcomp 0xb56b0 0x20f
_ldpoly 0xb0600 0x210
_ldscale 0xb9090 0x211
_ldsign 0xb5710 0x212
_ldsin 0xb48f0 0x213
_ldtest 0xb9340 0x214
_ldunscale 0xb93e0 0x215
_lfind 0xa97d0 0x216
_lfind_s 0xa9aa0 0x217
_libm_sse2_acos_precise 0x40b00 0x218
_libm_sse2_asin_precise 0x41700 0x219
_libm_sse2_atan_precise 0x42060 0x21a
_libm_sse2_cos_precise 0x42900 0x21b
_libm_sse2_exp_precise 0x42dd0 0x21c
_libm_sse2_log10_precise 0x43680 0x21d
_libm_sse2_log_precise 0x43cb0 0x21e
_libm_sse2_pow_precise 0x44e60 0x21f
_libm_sse2_sin_precise 0x45cd0 0x220
_libm_sse2_sqrt_precise 0x45f70 0x221
_libm_sse2_tan_precise 0x46420 0x222
_loaddll 0xdfa20 0x223
_local_unwind2 0x46ea6 0x224
_local_unwind4 0x4e8a0 0x225
_localtime32 0xd5b80 0x226
_localtime32_s 0xd5bb0 0x227
_localtime64 0xd5bd0 0x228
_localtime64_s 0xd5c00 0x229
_lock_file 0x3bba0 0x22a
_lock_locales 0x2c7e0 0x22b
_locking 0xd10c0 0x22c
_logb 0xf3ff0 0x22d
_longjmpex 0x4ea10 0x22e
_lrotl 0xaa2a0 0x22f
_lrotr 0xaa300 0x230
_lsearch 0xa9dc0 0x231
_lsearch_s 0xaa030 0x232
_lseek 0xd1620 0x233
_lseeki64 0x53900 0x234
_ltoa 0x24ab0 0x235
_ltoa_s 0x8c870 0x236
_ltow 0x8c8b0 0x237
_ltow_s 0x37110 0x238
_makepath 0xc8cb0 0x239
_makepath_s 0xc8ce0 0x23a
_malloc_base 0x28d70 0x23b
_mbbtombc 0xee700 0x23c
_mbbtombc_l 0xee720 0x23d
_mbbtype 0xe50b0 0x23e
_mbbtype_l 0xe50d0 0x23f
_mbcasemap 0x108378 0x240
_mbccpy 0xe5160 0x241
_mbccpy_l 0xe5180 0x242
_mbccpy_s 0xe51b0 0x243
_mbccpy_s_l 0xe51e0 0x244
_mbcjistojms 0xee3a0 0x245
_mbcjistojms_l 0xee3c0 0x246
_mbcjmstojis 0xee540 0x247
_mbcjmstojis_l 0xee560 0x248
_mbclen 0xe5530 0x249
_mbclen_l 0xe5570 0x24a
_mbctohira 0xee140 0x24b
_mbctohira_l 0xee160 0x24c
_mbctokata 0xee1a0 0x24d
_mbctokata_l 0xee1c0 0x24e
_mbctolower 0xee200 0x24f
_mbctolower_l 0xee220 0x250
_mbctombb 0xee7b0 0x251
_mbctombb_l 0xee7d0 0x252
_mbctoupper 0xee2d0 0x253
_mbctoupper_l 0xee2f0 0x254
_mblen_l 0x89a70 0x255
_mbsbtype 0xe5780 0x256
_mbsbtype_l 0xe57a0 0x257
_mbscat_s 0xe59e0 0x258
_mbscat_s_l 0xe5a00 0x259
_mbschr 0xe5f30 0x25a
_mbschr_l 0xe5f50 0x25b
_mbscmp 0xe60d0 0x25c
_mbscmp_l 0xe60f0 0x25d
_mbscoll 0xe62d0 0x25e
_mbscoll_l 0xe62f0 0x25f
_mbscpy_s 0xe6540 0x260
_mbscpy_s_l 0xe6560 0x261
_mbscspn 0xe6970 0x262
_mbscspn_l 0xe6990 0x263
_mbsdec 0xe6b40 0x264
_mbsdec_l 0xe6b60 0x265
_mbsdup 0x3c7f0 0x266
_mbsicmp 0xe6cc0 0x267
_mbsicmp_l 0xe6ce0 0x268
_mbsicoll 0xe7030 0x269
_mbsicoll_l 0xe7050 0x26a
_mbsinc 0xe72a0 0x26b
_mbsinc_l 0xe73c0 0x26c
_mbslen 0xe73f0 0x26d
_mbslen_l 0xe7410 0x26e
_mbslwr 0xe7530 0x26f
_mbslwr_l 0xe7560 0x270
_mbslwr_s 0xe7590 0x271
_mbslwr_s_l 0xe75b0 0x272
_mbsnbcat 0xe79f0 0x273
_mbsnbcat_l 0xe7a10 0x274
_mbsnbcat_s 0xe7c10 0x275
_mbsnbcat_s_l 0xe7c40 0x276
_mbsnbcmp 0xe8270 0x277
_mbsnbcmp_l 0xe8290 0x278
_mbsnbcnt 0xe8490 0x279
_mbsnbcnt_l 0xe84b0 0x27a
_mbsnbcoll 0xe8610 0x27b
_mbsnbcoll_l 0xe8630 0x27c
_mbsnbcpy 0xe8980 0x27d
_mbsnbcpy_l 0xe89a0 0x27e
_mbsnbcpy_s 0xe8b40 0x27f
_mbsnbcpy_s_l 0xe8b70 0x280
_mbsnbicmp 0xe9060 0x281
_mbsnbicmp_l 0xe9080 0x282
_mbsnbicoll 0xe9330 0x283
_mbsnbicoll_l 0xe9350 0x284
_mbsnbset 0xe95c0 0x285
_mbsnbset_l 0xe95e0 0x286
_mbsnbset_s 0xe9880 0x287
_mbsnbset_s_l 0xe98b0 0x288
_mbsncat 0xe9d60 0x289
_mbsncat_l 0xe9d80 0x28a
_mbsncat_s 0xe9f70 0x28b
_mbsncat_s_l 0xe9fa0 0x28c
_mbsnccnt 0xea5b0 0x28d
_mbsnccnt_l 0xea5d0 0x28e
_mbsncmp 0xea730 0x28f
_mbsncmp_l 0xea750 0x290
_mbsncoll 0xea930 0x291
_mbsncoll_l 0xea950 0x292
_mbsncpy 0xeacc0 0x293
_mbsncpy_l 0xeace0 0x294
_mbsncpy_s 0xeae80 0x295
_mbsncpy_s_l 0xeaeb0 0x296
_mbsnextc 0xeb3e0 0x297
_mbsnextc_l 0xeb400 0x298
_mbsnicmp 0xeb540 0x299
_mbsnicmp_l 0xeb560 0x29a
_mbsnicoll 0xeb7f0 0x29b
_mbsnicoll_l 0xeb810 0x29c
_mbsninc 0xebb80 0x29d
_mbsninc_l 0xebba0 0x29e
_mbsnlen 0xe7480 0x29f
_mbsnlen_l 0xe74a0 0x2a0
_mbsnset 0xebbd0 0x2a1
_mbsnset_l 0xebbf0 0x2a2
_mbsnset_s 0xebf20 0x2a3
_mbsnset_s_l 0xebf50 0x2a4
_mbspbrk 0xec400 0x2a5
_mbspbrk_l 0xec420 0x2a6
_mbsrchr 0xec5e0 0x2a7
_mbsrchr_l 0xec600 0x2a8
_mbsrev 0xec780 0x2a9
_mbsrev_l 0xec7a0 0x2aa
_mbsset 0xeca00 0x2ab
_mbsset_l 0xeca20 0x2ac
_mbsset_s 0xecc90 0x2ad
_mbsset_s_l 0xeccb0 0x2ae
_mbsspn 0xed060 0x2af
_mbsspn_l 0xed080 0x2b0
_mbsspnp 0xed230 0x2b1
_mbsspnp_l 0xed250 0x2b2
_mbsstr 0xed410 0x2b3
_mbsstr_l 0xed430 0x2b4
_mbstok 0xed5f0 0x2b5
_mbstok_l 0xed6e0 0x2b6
_mbstok_s 0xed7d0 0x2b7
_mbstok_s_l 0xed7f0 0x2b8
_mbstowcs_l 0x8aaf0 0x2b9
_mbstowcs_s_l 0x292c0 0x2ba
_mbstrlen 0x8d050 0x2bb
_mbstrlen_l 0x8d090 0x2bc
_mbstrnlen 0x8d0b0 0x2bd
_mbstrnlen_l 0x8d0d0 0x2be
_mbsupr 0xedc80 0x2bf
_mbsupr_l 0xedcb0 0x2c0
_mbsupr_s 0xedce0 0x2c1
_mbsupr_s_l 0xedd00 0x2c2
_mbtowc_l 0x2c470 0x2c3
_memccpy 0x3c1e0 0x2c4
_memicmp 0x3c330 0x2c5
_memicmp_l 0x3c3a0 0x2c6
_mkdir 0xc8d70 0x2c7
_mkgmtime32 0x37a30 0x2c8
_mkgmtime64 0x37730 0x2c9
_mktemp 0xd2600 0x2ca
_mktemp_s 0xd2620 0x2cb
_mktime32 0xd60d0 0x2cc
_mktime64 0xd60f0 0x2cd
_msize 0x235f0 0x2ce
_nextafter 0xb5870 0x2cf
_o__CIacos 0x545b0 0x2d0
_o__CIasin 0x54610 0x2d1
_o__CIatan 0x54670 0x2d2
_o__CIatan2 0x544f0 0x2d3
_o__CIcos 0x53ee0 0x2d4
_o__CIcosh 0x546d0 0x2d5
_o__CIexp 0x540c0 0x2d6
_o__CIfmod 0x54730 0x2d7
_o__CIlog 0x54320 0x2d8
_o__CIlog10 0x54550 0x2d9
_o__CIpow 0x54490 0x2da
_o__CIsin 0x53fd0 0x2db
_o__CIsinh 0x54790 0x2dc
_o__CIsqrt 0x53df0 0x2dd
_o__CItan 0x54380 0x2de
_o__CItanh 0x547f0 0x2df
_o__Getdays 0x37300 0x2e0
_o__Getmonths 0x37310 0x2e1
_o__Gettnames 0x34f90 0x2e2
_o__Strftime 0x7f580 0x2e3
_o__W_Getdays 0x38150 0x2e4
_o__W_Getmonths 0x38160 0x2e5
_o__W_Gettnames 0x34fb0 0x2e6
_o__Wcsftime 0x7f5b0 0x2e7
_o____lc_codepage_func 0x2b710 0x2e8
_o____lc_collate_cp_func 0x3b150 0x2e9
_o____lc_locale_name_func 0x2b3f0 0x2ea
_o____mb_cur_max_func 0x2c460 0x2eb
_o___acrt_iob_func 0x23fa0 0x2ec
_o___conio_common_vcprintf 0x7f5e0 0x2ed
_o___conio_common_vcprintf_p 0x7f610 0x2ee
_o___conio_common_vcprintf_s 0x7f640 0x2ef
_o___conio_common_vcscanf 0x7f670 0x2f0
_o___conio_common_vcwprintf 0x7f6a0 0x2f1
_o___conio_common_vcwprintf_p 0x7f6d0 0x2f2
_o___conio_common_vcwprintf_s 0x7f700 0x2f3
_o___conio_common_vcwscanf 0x7f730 0x2f4
_o___daylight 0x7f760 0x2f5
_o___dstbias 0x7f770 0x2f6
_o___fpe_flt_rounds 0x7f780 0x2f7
_o___libm_sse2_acos 0x54850 0x2f8
_o___libm_sse2_acosf 0x54900 0x2f9
_o___libm_sse2_asin 0x549b0 0x2fa
_o___libm_sse2_asinf 0x54a60 0x2fb
_o___libm_sse2_atan 0x54b10 0x2fc
_o___libm_sse2_atan2 0x54bc0 0x2fd
_o___libm_sse2_atanf 0x54c80 0x2fe
_o___libm_sse2_cos 0x54d30 0x2ff
_o___libm_sse2_cosf 0x54de0 0x300
_o___libm_sse2_exp 0x54e90 0x301
_o___libm_sse2_expf 0x54f40 0x302
_o___libm_sse2_log 0x54ff0 0x303
_o___libm_sse2_log10 0x550a0 0x304
_o___libm_sse2_log10f 0x55150 0x305
_o___libm_sse2_logf 0x55200 0x306
_o___libm_sse2_pow 0x552b0 0x307
_o___libm_sse2_powf 0x55370 0x308
_o___libm_sse2_sin 0x55430 0x309
_o___libm_sse2_sinf 0x554e0 0x30a
_o___libm_sse2_tan 0x55590 0x30b
_o___libm_sse2_tanf 0x55640 0x30c
_o___p___argc 0x21460 0x30d
_o___p___argv 0x7f790 0x30e
_o___p___wargv 0x3b1d0 0x30f
_o___p__acmdln 0x7f7a0 0x310
_o___p__commode 0x218a0 0x311
_o___p__environ 0x7f7b0 0x312
_o___p__fmode 0x7f7c0 0x313
_o___p__mbcasemap 0x7f7d0 0x314
_o___p__mbctype 0x7f7e0 0x315
_o___p__pgmptr 0x7f7f0 0x316
_o___p__wcmdln 0x7f800 0x317
_o___p__wenviron 0x7f810 0x318
_o___p__wpgmptr 0x7f820 0x319
_o___pctype_func 0x23590 0x31a
_o___pwctype_func 0x7f830 0x31b
_o___std_exception_copy 0x39830 0x31c
_o___std_exception_destroy 0x39e60 0x31d
_o___std_type_info_destroy_list 0x38bd0 0x31e
_o___std_type_info_name 0x7f840 0x31f
_o___stdio_common_vfprintf 0x7f860 0x320
_o___stdio_common_vfprintf_p 0x7f890 0x321
_o___stdio_common_vfprintf_s 0x7f8c0 0x322
_o___stdio_common_vfscanf 0x7f8f0 0x323
_o___stdio_common_vfwprintf 0x38850 0x324
_o___stdio_common_vfwprintf_p 0x7f920 0x325
_o___stdio_common_vfwprintf_s 0x7f950 0x326
_o___stdio_common_vfwscanf 0x7f980 0x327
_o___stdio_common_vsnprintf_s 0x39fe0 0x328
_o___stdio_common_vsnwprintf_s 0x22660 0x329
_o___stdio_common_vsprintf 0x2da40 0x32a
_o___stdio_common_vsprintf_p 0x7f9b0 0x32b
_o___stdio_common_vsprintf_s 0x3a9e0 0x32c
_o___stdio_common_vsscanf 0x3b290 0x32d
_o___stdio_common_vswprintf 0x24db0 0x32e
_o___stdio_common_vswprintf_p 0x7f9e0 0x32f
_o___stdio_common_vswprintf_s 0x22630 0x330
_o___stdio_common_vswscanf 0x3a930 0x331
_o___timezone 0x7fa10 0x332
_o___tzname 0x7fa20 0x333
_o___wcserror 0x7fa30 0x334
_o__access 0x7fa50 0x335
_o__access_s 0x7fa70 0x336
_o__aligned_free 0x3bc20 0x337
_o__aligned_malloc 0x3ba90 0x338
_o__aligned_msize 0x7fa90 0x339
_o__aligned_offset_malloc 0x7fab0 0x33a
_o__aligned_offset_realloc 0x7fad0 0x33b
_o__aligned_offset_recalloc 0x7fb00 0x33c
_o__aligned_realloc 0x7fb30 0x33d
_o__aligned_recalloc 0x7fb60 0x33e
_o__atodbl 0x7fb90 0x33f
_o__atodbl_l 0x7fbb0 0x340
_o__atof_l 0x7fbd0 0x341
_o__atoflt 0x7fbf0 0x342
_o__atoflt_l 0x7fc10 0x343
_o__atoi64 0x85390 0x344
_o__atoi64_l 0x7fc30 0x345
_o__atoi_l 0x7fc50 0x346
_o__atol_l 0x7fc50 0x347
_o__atoldbl 0x7fc70 0x348
_o__atoldbl_l 0x7fc90 0x349
_o__atoll_l 0x7fc30 0x34a
_o__beep 0x7fcb0 0x34b
_o__beginthread 0x7fcd0 0x34c
_o__beginthreadex 0x3ae20 0x34d
_o__cabs 0x7fcf0 0x34e
_o__callnewh 0x7fd20 0x34f
_o__calloc_base 0x398b0 0x350
_o__cexit 0x7fd40 0x351
_o__cgets 0x7fd50 0x352
_o__cgets_s 0x7fd70 0x353
_o__cgetws 0x7fd90 0x354
_o__cgetws_s 0x7fdb0 0x355
_o__chdir 0x7fdd0 0x356
_o__chdrive 0x7fdf0 0x357
_o__chmod 0x7fe10 0x358
_o__chsize 0x7fe30 0x359
_o__chsize_s 0x7fe50 0x35a
_o__close 0x7fe70 0x35b
_o__commit 0x7fe90 0x35c
_o__configthreadlocale 0x3b560 0x35d
_o__configure_narrow_argv 0x35880 0x35e
_o__configure_wide_argv 0x35990 0x35f
_o__controlfp_s 0x39730 0x360
_o__cputs 0x7feb0 0x361
_o__cputws 0x7fed0 0x362
_o__creat 0x7fef0 0x363
_o__create_locale 0x3b310 0x364
_o__crt_atexit 0x21e40 0x365
_o__ctime32_s 0x7ff10 0x366
_o__ctime64_s 0x7ff30 0x367
_o__cwait 0x7ff50 0x368
_o__d_int 0x7ff70 0x369
_o__dclass 0x7ff90 0x36a
_o__difftime32 0x7ffb0 0x36b
_o__difftime64 0x7ffd0 0x36c
_o__dlog 0x7fff0 0x36d
_o__dnorm 0x80020 0x36e
_o__dpcomp 0x80040 0x36f
_o__dpoly 0x81990 0x370
_o__dscale 0x80070 0x371
_o__dsign 0x80090 0x372
_o__dsin 0x81a00 0x373
_o__dtest 0x800b0 0x374
_o__dunscale 0x800d0 0x375
_o__dup 0x800f0 0x376
_o__dup2 0x80110 0x377
_o__dupenv_s 0x80130 0x378
_o__ecvt 0x80150 0x379
_o__ecvt_s 0x80180 0x37a
_o__endthread 0x801b0 0x37b
_o__endthreadex 0x801c0 0x37c
_o__eof 0x801e0 0x37d
_o__errno 0x23b20 0x37e
_o__except1 0x80200 0x37f
_o__execute_onexit_table 0x23820 0x380
_o__execv 0x80230 0x381
_o__execve 0x80250 0x382
_o__execvp 0x80280 0x383
_o__execvpe 0x802a0 0x384
_o__exit 0x802d0 0x385
_o__expand 0x802f0 0x386
_o__fclose_nolock 0x80310 0x387
_o__fcloseall 0x80330 0x388
_o__fcvt 0x80340 0x389
_o__fcvt_s 0x80370 0x38a
_o__fd_int 0x803a0 0x38b
_o__fdclass 0x803c0 0x38c
_o__fdexp 0x803e0 0x38d
_o__fdlog 0x80400 0x38e
_o__fdopen 0x80430 0x38f
_o__fdpcomp 0x80450 0x390
_o__fdpoly 0x80480 0x391
_o__fdscale 0x804a0 0x392
_o__fdsign 0x804c0 0x393
_o__fdsin 0x804e0 0x394
_o__fflush_nolock 0x80500 0x395
_o__fgetc_nolock 0x80520 0x396
_o__fgetchar 0x80540 0x397
_o__fgetwc_nolock 0x80550 0x398
_o__fgetwchar 0x80570 0x399
_o__filelength 0x80580 0x39a
_o__filelengthi64 0x805a0 0x39b
_o__fileno 0x805c0 0x39c
_o__findclose 0x805e0 0x39d
_o__findfirst32 0x80600 0x39e
_o__findfirst32i64 0x80620 0x39f
_o__findfirst64 0x80640 0x3a0
_o__findfirst64i32 0x80660 0x3a1
_o__findnext32 0x80680 0x3a2
_o__findnext32i64 0x806a0 0x3a3
_o__findnext64 0x806c0 0x3a4
_o__findnext64i32 0x806e0 0x3a5
_o__flushall 0x80700 0x3a6
_o__fpclass 0x80710 0x3a7
_o__fputc_nolock 0x80730 0x3a8
_o__fputchar 0x86300 0x3a9
_o__fputwc_nolock 0x80750 0x3aa
_o__fputwchar 0x86360 0x3ab
_o__fread_nolock 0x80770 0x3ac
_o__fread_nolock_s 0x807a0 0x3ad
_o__free_base 0x3ba70 0x3ae
_o__free_locale 0x807d0 0x3af
_o__fseek_nolock 0x807f0 0x3b0
_o__fseeki64 0x80820 0x3b1
_o__fseeki64_nolock 0x80850 0x3b2
_o__fsopen 0x34c00 0x3b3
_o__fstat32 0x80880 0x3b4
_o__fstat32i64 0x808a0 0x3b5
_o__fstat64 0x808c0 0x3b6
_o__fstat64i32 0x808e0 0x3b7
_o__ftell_nolock 0x80900 0x3b8
_o__ftelli64 0x80920 0x3b9
_o__ftelli64_nolock 0x80940 0x3ba
_o__ftime32 0x80960 0x3bb
_o__ftime32_s 0x80980 0x3bc
_o__ftime64 0x809a0 0x3bd
_o__ftime64_s 0x809c0 0x3be
_o__fullpath 0x809e0 0x3bf
_o__futime32 0x80a00 0x3c0
_o__futime64 0x80a20 0x3c1
_o__fwrite_nolock 0x80a40 0x3c2
_o__gcvt 0x80a70 0x3c3
_o__gcvt_s 0x80aa0 0x3c4
_o__get_daylight 0x80ad0 0x3c5
_o__get_doserrno 0x80af0 0x3c6
_o__get_dstbias 0x80b10 0x3c7
_o__get_errno 0x39630 0x3c8
_o__get_fmode 0x80b30 0x3c9
_o__get_heap_handle 0x80b50 0x3ca
_o__get_initial_narrow_environment 0x80b60 0x3cb
_o__get_initial_wide_environment 0x3bbf0 0x3cc
_o__get_invalid_parameter_handler 0x80b70 0x3cd
_o__get_narrow_winmain_command_line 0x372f0 0x3ce
_o__get_osfhandle 0x80b80 0x3cf
_o__get_pgmptr 0x80ba0 0x3d0
_o__get_stream_buffer_pointers 0x38780 0x3d1
_o__get_terminate 0x80bc0 0x3d2
_o__get_thread_local_invalid_parameter_handler 0x80bd0 0x3d3
_o__get_timezone 0x80be0 0x3d4
_o__get_tzname 0x80c00 0x3d5
_o__get_wide_winmain_command_line 0x38140 0x3d6
_o__get_wpgmptr 0x80c20 0x3d7
_o__getc_nolock 0x80c40 0x3d8
_o__getch 0x80c60 0x3d9
_o__getch_nolock 0x80c70 0x3da
_o__getche 0x80c80 0x3db
_o__getche_nolock 0x80c90 0x3dc
_o__getcwd 0x80ca0 0x3dd
_o__getdcwd 0x80cc0 0x3de
_o__getdiskfree 0x80cf0 0x3df
_o__getdllprocaddr 0x80d10 0x3e0
_o__getdrive 0x80d30 0x3e1
_o__getdrives 0x80d40 0x3e2
_o__getmbcp 0x80d50 0x3e3
_o__getsystime 0x80d60 0x3e4
_o__getw 0x80d80 0x3e5
_o__getwc_nolock 0x80da0 0x3e6
_o__getwch 0x80dc0 0x3e7
_o__getwch_nolock 0x80dd0 0x3e8
_o__getwche 0x80de0 0x3e9
_o__getwche_nolock 0x80df0 0x3ea
_o__getws 0x80e00 0x3eb
_o__getws_s 0x80e20 0x3ec
_o__gmtime32 0x80e40 0x3ed
_o__gmtime32_s 0x37c20 0x3ee
_o__gmtime64 0x80e60 0x3ef
_o__gmtime64_s 0x80e80 0x3f0
_o__heapchk 0x80ea0 0x3f1
_o__heapmin 0x80eb0 0x3f2
_o__hypot 0x85a60 0x3f3
_o__hypotf 0x80ec0 0x3f4
_o__i64toa 0x80ef0 0x3f5
_o__i64toa_s 0x80f10 0x3f6
_o__i64tow 0x80f40 0x3f7
_o__i64tow_s 0x80f60 0x3f8
_o__initialize_narrow_environment 0x3b9f0 0x3f9
_o__initialize_onexit_table 0x23f30 0x3fa
_o__initialize_wide_environment 0x3b930 0x3fb
_o__invalid_parameter_noinfo 0x80f90 0x3fc
_o__invalid_parameter_noinfo_noreturn 0x80fa0 0x3fd
_o__isatty 0x80fb0 0x3fe
_o__isctype 0x80fd0 0x3ff
_o__isctype_l 0x80ff0 0x400
_o__isleadbyte_l 0x81010 0x401
_o__ismbbalnum 0x81030 0x402
_o__ismbbalnum_l 0x81050 0x403
_o__ismbbalpha 0x81070 0x404
_o__ismbbalpha_l 0x81090 0x405
_o__ismbbblank 0x810b0 0x406
_o__ismbbblank_l 0x810d0 0x407
_o__ismbbgraph 0x810f0 0x408
_o__ismbbgraph_l 0x81110 0x409
_o__ismbbkalnum 0x81130 0x40a
_o__ismbbkalnum_l 0x81150 0x40b
_o__ismbbkana 0x81170 0x40c
_o__ismbbkana_l 0x81190 0x40d
_o__ismbbkprint 0x811b0 0x40e
_o__ismbbkprint_l 0x811d0 0x40f
_o__ismbbkpunct 0x811f0 0x410
_o__ismbbkpunct_l 0x81210 0x411
_o__ismbblead 0x2b380 0x412
_o__ismbblead_l 0x81230 0x413
_o__ismbbprint 0x81250 0x414
_o__ismbbprint_l 0x81270 0x415
_o__ismbbpunct 0x81290 0x416
_o__ismbbpunct_l 0x812b0 0x417
_o__ismbbtrail 0x812d0 0x418
_o__ismbbtrail_l 0x812f0 0x419
_o__ismbcalnum 0x81310 0x41a
_o__ismbcalnum_l 0x81330 0x41b
_o__ismbcalpha 0x81350 0x41c
_o__ismbcalpha_l 0x81370 0x41d
_o__ismbcblank 0x81390 0x41e
_o__ismbcblank_l 0x813b0 0x41f
_o__ismbcdigit 0x813d0 0x420
_o__ismbcdigit_l 0x813f0 0x421
_o__ismbcgraph 0x81410 0x422
_o__ismbcgraph_l 0x81430 0x423
_o__ismbchira 0x81450 0x424
_o__ismbchira_l 0x81470 0x425
_o__ismbckata 0x81490 0x426
_o__ismbckata_l 0x814b0 0x427
_o__ismbcl0 0x814d0 0x428
_o__ismbcl0_l 0x814f0 0x429
_o__ismbcl1 0x81510 0x42a
_o__ismbcl1_l 0x81530 0x42b
_o__ismbcl2 0x81550 0x42c
_o__ismbcl2_l 0x81570 0x42d
_o__ismbclegal 0x81590 0x42e
_o__ismbclegal_l 0x815b0 0x42f
_o__ismbclower 0x815d0 0x430
_o__ismbclower_l 0x815f0 0x431
_o__ismbcprint 0x81610 0x432
_o__ismbcprint_l 0x81630 0x433
_o__ismbcpunct 0x81650 0x434
_o__ismbcpunct_l 0x81670 0x435
_o__ismbcspace 0x81690 0x436
_o__ismbcspace_l 0x816b0 0x437
_o__ismbcsymbol 0x816d0 0x438
_o__ismbcsymbol_l 0x816f0 0x439
_o__ismbcupper 0x81710 0x43a
_o__ismbcupper_l 0x81730 0x43b
_o__ismbslead 0x81750 0x43c
_o__ismbslead_l 0x81770 0x43d
_o__ismbstrail 0x817a0 0x43e
_o__ismbstrail_l 0x817c0 0x43f
_o__iswctype_l 0x817f0 0x440
_o__itoa 0x81810 0x441
_o__itoa_s 0x81840 0x442
_o__itow 0x81860 0x443
_o__itow_s 0x37000 0x444
_o__j0 0x81890 0x445
_o__j1 0x818b0 0x446
_o__jn 0x818d0 0x447
_o__kbhit 0x81900 0x448
_o__ld_int 0x81910 0x449
_o__ldclass 0x7ff90 0x44a
_o__ldexp 0x81930 0x44b
_o__ldlog 0x81960 0x44c
_o__ldpcomp 0x80040 0x44d
_o__ldpoly 0x81990 0x44e
_o__ldscale 0x819c0 0x44f
_o__ldsign 0x819e0 0x450
_o__ldsin 0x81a00 0x451
_o__ldtest 0x81a20 0x452
_o__ldunscale 0x81a40 0x453
_o__lfind 0x81a60 0x454
_o__lfind_s 0x81a90 0x455
_o__libm_sse2_acos_precise 0x556f0 0x456
_o__libm_sse2_asin_precise 0x557a0 0x457
_o__libm_sse2_atan_precise 0x55850 0x458
_o__libm_sse2_cos_precise 0x55900 0x459
_o__libm_sse2_exp_precise 0x559b0 0x45a
_o__libm_sse2_log10_precise 0x55a60 0x45b
_o__libm_sse2_log_precise 0x55b10 0x45c
_o__libm_sse2_pow_precise 0x543e0 0x45d
_o__libm_sse2_sin_precise 0x55bc0 0x45e
_o__libm_sse2_sqrt_precise 0x55c70 0x45f
_o__libm_sse2_tan_precise 0x55d20 0x460
_o__loaddll 0x81ac0 0x461
_o__localtime32 0x81ae0 0x462
_o__localtime32_s 0x81b00 0x463
_o__localtime64 0x81b20 0x464
_o__localtime64_s 0x81b40 0x465
_o__lock_file 0x81b60 0x466
_o__locking 0x81b80 0x467
_o__logb 0x81ba0 0x468
_o__lsearch 0x81bc0 0x469
_o__lsearch_s 0x81bf0 0x46a
_o__lseek 0x81c20 0x46b
_o__lseeki64 0x81c40 0x46c
_o__ltoa 0x24a40 0x46d
_o__ltoa_s 0x81840 0x46e
_o__ltow 0x81c60 0x46f
_o__ltow_s 0x81c80 0x470
_o__makepath 0x81ca0 0x471
_o__makepath_s 0x81cd0 0x472
_o__malloc_base 0x81d00 0x473
_o__mbbtombc 0x81d20 0x474
_o__mbbtombc_l 0x81d40 0x475
_o__mbbtype 0x81d60 0x476
_o__mbbtype_l 0x81d80 0x477
_o__mbccpy 0x81da0 0x478
_o__mbccpy_l 0x81dc0 0x479
_o__mbccpy_s 0x81de0 0x47a
_o__mbccpy_s_l 0x81e00 0x47b
_o__mbcjistojms 0x81e30 0x47c
_o__mbcjistojms_l 0x81e50 0x47d
_o__mbcjmstojis 0x81e70 0x47e
_o__mbcjmstojis_l 0x81e90 0x47f
_o__mbclen 0x81eb0 0x480
_o__mbclen_l 0x81ed0 0x481
_o__mbctohira 0x81ef0 0x482
_o__mbctohira_l 0x81f10 0x483
_o__mbctokata 0x81f30 0x484
_o__mbctokata_l 0x81f50 0x485
_o__mbctolower 0x81f70 0x486
_o__mbctolower_l 0x81f90 0x487
_o__mbctombb 0x81fb0 0x488
_o__mbctombb_l 0x81fd0 0x489
_o__mbctoupper 0x81ff0 0x48a
_o__mbctoupper_l 0x82010 0x48b
_o__mblen_l 0x82030 0x48c
_o__mbsbtype 0x82050 0x48d
_o__mbsbtype_l 0x82070 0x48e
_o__mbscat_s 0x82090 0x48f
_o__mbscat_s_l 0x820c0 0x490
_o__mbschr 0x820f0 0x491
_o__mbschr_l 0x82110 0x492
_o__mbscmp 0x82140 0x493
_o__mbscmp_l 0x82160 0x494
_o__mbscoll 0x82190 0x495
_o__mbscoll_l 0x821b0 0x496
_o__mbscpy_s 0x821e0 0x497
_o__mbscpy_s_l 0x82210 0x498
_o__mbscspn 0x82240 0x499
_o__mbscspn_l 0x82260 0x49a
_o__mbsdec 0x82290 0x49b
_o__mbsdec_l 0x822b0 0x49c
_o__mbsicmp 0x822e0 0x49d
_o__mbsicmp_l 0x82300 0x49e
_o__mbsicoll 0x82330 0x49f
_o__mbsicoll_l 0x82350 0x4a0
_o__mbsinc 0x82380 0x4a1
_o__mbsinc_l 0x823a0 0x4a2
_o__mbslen 0x823c0 0x4a3
_o__mbslen_l 0x823e0 0x4a4
_o__mbslwr 0x82400 0x4a5
_o__mbslwr_l 0x82420 0x4a6
_o__mbslwr_s 0x82440 0x4a7
_o__mbslwr_s_l 0x82460 0x4a8
_o__mbsnbcat 0x82490 0x4a9
_o__mbsnbcat_l 0x824c0 0x4aa
_o__mbsnbcat_s 0x824f0 0x4ab
_o__mbsnbcat_s_l 0x82520 0x4ac
_o__mbsnbcmp 0x82550 0x4ad
_o__mbsnbcmp_l 0x82580 0x4ae
_o__mbsnbcnt 0x825b0 0x4af
_o__mbsnbcnt_l 0x825d0 0x4b0
_o__mbsnbcoll 0x82600 0x4b1
_o__mbsnbcoll_l 0x82630 0x4b2
_o__mbsnbcpy 0x82660 0x4b3
_o__mbsnbcpy_l 0x82690 0x4b4
_o__mbsnbcpy_s 0x826c0 0x4b5
_o__mbsnbcpy_s_l 0x826f0 0x4b6
_o__mbsnbicmp 0x82720 0x4b7
_o__mbsnbicmp_l 0x82750 0x4b8
_o__mbsnbicoll 0x82780 0x4b9
_o__mbsnbicoll_l 0x827b0 0x4ba
_o__mbsnbset 0x827e0 0x4bb
_o__mbsnbset_l 0x82810 0x4bc
_o__mbsnbset_s 0x82840 0x4bd
_o__mbsnbset_s_l 0x82870 0x4be
_o__mbsncat 0x828a0 0x4bf
_o__mbsncat_l 0x828d0 0x4c0
_o__mbsncat_s 0x82900 0x4c1
_o__mbsncat_s_l 0x82930 0x4c2
_o__mbsnccnt 0x82960 0x4c3
_o__mbsnccnt_l 0x82980 0x4c4
_o__mbsncmp 0x829b0 0x4c5
_o__mbsncmp_l 0x829e0 0x4c6
_o__mbsncoll 0x82a10 0x4c7
_o__mbsncoll_l 0x82a40 0x4c8
_o__mbsncpy 0x82a70 0x4c9
_o__mbsncpy_l 0x82aa0 0x4ca
_o__mbsncpy_s 0x82ad0 0x4cb
_o__mbsncpy_s_l 0x82b00 0x4cc
_o__mbsnextc 0x82b30 0x4cd
_o__mbsnextc_l 0x82b50 0x4ce
_o__mbsnicmp 0x82b70 0x4cf
_o__mbsnicmp_l 0x82ba0 0x4d0
_o__mbsnicoll 0x82bd0 0x4d1
_o__mbsnicoll_l 0x82c00 0x4d2
_o__mbsninc 0x82c30 0x4d3
_o__mbsninc_l 0x82c50 0x4d4
_o__mbsnlen 0x82c70 0x4d5
_o__mbsnlen_l 0x82c90 0x4d6
_o__mbsnset 0x82cc0 0x4d7
_o__mbsnset_l 0x82cf0 0x4d8
_o__mbsnset_s 0x82d20 0x4d9
_o__mbsnset_s_l 0x82d50 0x4da
_o__mbspbrk 0x82d80 0x4db
_o__mbspbrk_l 0x82da0 0x4dc
_o__mbsrchr 0x82dd0 0x4dd
_o__mbsrchr_l 0x82df0 0x4de
_o__mbsrev 0x82e20 0x4df
_o__mbsrev_l 0x82e40 0x4e0
_o__mbsset 0x82e60 0x4e1
_o__mbsset_l 0x82e80 0x4e2
_o__mbsset_s 0x82ea0 0x4e3
_o__mbsset_s_l 0x82ec0 0x4e4
_o__mbsspn 0x82ee0 0x4e5
_o__mbsspn_l 0x82f00 0x4e6
_o__mbsspnp 0x82f30 0x4e7
_o__mbsspnp_l 0x82f50 0x4e8
_o__mbsstr 0x82f80 0x4e9
_o__mbsstr_l 0x82fa0 0x4ea
_o__mbstok 0x82fd0 0x4eb
_o__mbstok_l 0x82ff0 0x4ec
_o__mbstok_s 0x83010 0x4ed
_o__mbstok_s_l 0x83030 0x4ee
_o__mbstowcs_l 0x83050 0x4ef
_o__mbstowcs_s_l 0x83070 0x4f0
_o__mbstrlen 0x830a0 0x4f1
_o__mbstrlen_l 0x830c0 0x4f2
_o__mbstrnlen 0x830e0 0x4f3
_o__mbstrnlen_l 0x83100 0x4f4
_o__mbsupr 0x83120 0x4f5
_o__mbsupr_l 0x83140 0x4f6
_o__mbsupr_s 0x83160 0x4f7
_o__mbsupr_s_l 0x83180 0x4f8
_o__mbtowc_l 0x831b0 0x4f9
_o__memicmp 0x831d0 0x4fa
_o__memicmp_l 0x831f0 0x4fb
_o__mkdir 0x83210 0x4fc
_o__mkgmtime32 0x37a10 0x4fd
_o__mkgmtime64 0x83230 0x4fe
_o__mktemp 0x83250 0x4ff
_o__mktemp_s 0x83270 0x500
_o__mktime32 0x83290 0x501
_o__mktime64 0x832b0 0x502
_o__msize 0x832d0 0x503
_o__nextafter 0x861c0 0x504
_o__open_osfhandle 0x832f0 0x505
_o__pclose 0x83310 0x506
_o__pipe 0x83330 0x507
_o__popen 0x83350 0x508
_o__purecall 0x83370 0x509
_o__putc_nolock 0x83380 0x50a
_o__putch 0x833a0 0x50b
_o__putch_nolock 0x833c0 0x50c
_o__putenv 0x833e0 0x50d
_o__putenv_s 0x83400 0x50e
_o__putw 0x83420 0x50f
_o__putwc_nolock 0x83440 0x510
_o__putwch 0x83460 0x511
_o__putwch_nolock 0x83480 0x512
_o__putws 0x834a0 0x513
_o__read 0x834c0 0x514
_o__realloc_base 0x21f50 0x515
_o__recalloc 0x22c80 0x516
_o__register_onexit_function 0x27130 0x517
_o__resetstkoflw 0x834e0 0x518
_o__rmdir 0x834f0 0x519
_o__rmtmp 0x83510 0x51a
_o__scalb 0x83520 0x51b
_o__searchenv 0x83550 0x51c
_o__searchenv_s 0x83570 0x51d
_o__seh_filter_dll 0x83590 0x51e
_o__seh_filter_exe 0x835b0 0x51f
_o__set_abort_behavior 0x835d0 0x520
_o__set_app_type 0x3ac40 0x521
_o__set_doserrno 0x835f0 0x522
_o__set_errno 0x3a730 0x523
_o__set_fmode 0x3b540 0x524
_o__set_invalid_parameter_handler 0x83610 0x525
_o__set_new_handler 0x83630 0x526
_o__set_new_mode 0x3b520 0x527
_o__set_thread_local_invalid_parameter_handler 0x83650 0x528
_o__seterrormode 0x83670 0x529
_o__setmbcp 0x83690 0x52a
_o__setmode 0x836b0 0x52b
_o__setsystime 0x836d0 0x52c
_o__sleep 0x836f0 0x52d
_o__sopen 0x83710 0x52e
_o__sopen_dispatch 0x83730 0x52f
_o__sopen_s 0x83760 0x530
_o__spawnv 0x83790 0x531
_o__spawnve 0x837c0 0x532
_o__spawnvp 0x837f0 0x533
_o__spawnvpe 0x83820 0x534
_o__splitpath 0x83850 0x535
_o__splitpath_s 0x3af60 0x536
_o__stat32 0x83880 0x537
_o__stat32i64 0x838a0 0x538
_o__stat64 0x838c0 0x539
_o__stat64i32 0x838e0 0x53a
_o__strcoll_l 0x83900 0x53b
_o__strdate 0x83930 0x53c
_o__strdate_s 0x83950 0x53d
_o__strdup 0x83970 0x53e
_o__strerror 0x83990 0x53f
_o__strerror_s 0x839b0 0x540
_o__strftime_l 0x839e0 0x541
_o__stricmp 0x38990 0x542
_o__stricmp_l 0x83a10 0x543
_o__stricoll 0x83a40 0x544
_o__stricoll_l 0x83a60 0x545
_o__strlwr 0x83a90 0x546
_o__strlwr_l 0x83ab0 0x547
_o__strlwr_s 0x83ad0 0x548
_o__strlwr_s_l 0x83af0 0x549
_o__strncoll 0x83b20 0x54a
_o__strncoll_l 0x83b50 0x54b
_o__strnicmp 0x38af0 0x54c
_o__strnicmp_l 0x83b80 0x54d
_o__strnicoll 0x83bb0 0x54e
_o__strnicoll_l 0x83be0 0x54f
_o__strnset_s 0x83c10 0x550
_o__strset_s 0x83c30 0x551
_o__strtime 0x83c60 0x552
_o__strtime_s 0x83c80 0x553
_o__strtod_l 0x83ca0 0x554
_o__strtof_l 0x83cc0 0x555
_o__strtoi64 0x83ce0 0x556
_o__strtoi64_l 0x83d10 0x557
_o__strtol_l 0x83d40 0x558
_o__strtold_l 0x83ca0 0x559
_o__strtoll_l 0x83d10 0x55a
_o__strtoui64 0x33c20 0x55b
_o__strtoui64_l 0x83d80 0x55c
_o__strtoul_l 0x83d60 0x55d
_o__strtoull_l 0x83d80 0x55e
_o__strupr 0x83db0 0x55f
_o__strupr_l 0x83dd0 0x560
_o__strupr_s 0x83df0 0x561
_o__strupr_s_l 0x83e10 0x562
_o__strxfrm_l 0x83e40 0x563
_o__swab 0x83e60 0x564
_o__tell 0x83e80 0x565
_o__telli64 0x83ea0 0x566
_o__timespec32_get 0x83ec0 0x567
_o__timespec64_get 0x83ee0 0x568
_o__tolower 0x3bcc0 0x569
_o__tolower_l 0x83f00 0x56a
_o__toupper 0x83f20 0x56b
_o__toupper_l 0x83f40 0x56c
_o__towlower_l 0x83f60 0x56d
_o__towupper_l 0x83f80 0x56e
_o__tzset 0x83fa0 0x56f
_o__ui64toa 0x83fb0 0x570
_o__ui64toa_s 0x3a420 0x571
_o__ui64tow 0x83fd0 0x572
_o__ui64tow_s 0x375a0 0x573
_o__ultoa 0x83ff0 0x574
_o__ultoa_s 0x84010 0x575
_o__ultow 0x84030 0x576
_o__ultow_s 0x37070 0x577
_o__umask 0x84050 0x578
_o__umask_s 0x84070 0x579
_o__ungetc_nolock 0x84090 0x57a
_o__ungetch 0x840b0 0x57b
_o__ungetch_nolock 0x840d0 0x57c
_o__ungetwc_nolock 0x840f0 0x57d
_o__ungetwch 0x84110 0x57e
_o__ungetwch_nolock 0x84130 0x57f
_o__unlink 0x84150 0x580
_o__unloaddll 0x84170 0x581
_o__unlock_file 0x84190 0x582
_o__utime32 0x841b0 0x583
_o__utime64 0x841d0 0x584
_o__waccess 0x841f0 0x585
_o__waccess_s 0x84210 0x586
_o__wasctime 0x84230 0x587
_o__wasctime_s 0x84250 0x588
_o__wchdir 0x84270 0x589
_o__wchmod 0x84290 0x58a
_o__wcreat 0x842b0 0x58b
_o__wcreate_locale 0x842d0 0x58c
_o__wcscoll_l 0x842f0 0x58d
_o__wcsdup 0x3b1b0 0x58e
_o__wcserror 0x84320 0x58f
_o__wcserror_s 0x84340 0x590
_o__wcsftime_l 0x84360 0x591
_o__wcsicmp 0x27850 0x592
_o__wcsicmp_l 0x84390 0x593
_o__wcsicoll 0x843c0 0x594
_o__wcsicoll_l 0x843e0 0x595
_o__wcslwr 0x84410 0x596
_o__wcslwr_l 0x84430 0x597
_o__wcslwr_s 0x395f0 0x598
_o__wcslwr_s_l 0x84450 0x599
_o__wcsncoll 0x84480 0x59a
_o__wcsncoll_l 0x844b0 0x59b
_o__wcsnicmp 0x24950 0x59c
_o__wcsnicmp_l 0x844e0 0x59d
_o__wcsnicoll 0x84510 0x59e
_o__wcsnicoll_l 0x84540 0x59f
_o__wcsnset 0x84570 0x5a0
_o__wcsnset_s 0x84590 0x5a1
_o__wcsset 0x845b0 0x5a2
_o__wcsset_s 0x845d0 0x5a3
_o__wcstod_l 0x845f0 0x5a4
_o__wcstof_l 0x84610 0x5a5
_o__wcstoi64 0x3b6a0 0x5a6
_o__wcstoi64_l 0x84650 0x5a7
_o__wcstol_l 0x84630 0x5a8
_o__wcstold_l 0x845f0 0x5a9
_o__wcstoll_l 0x84650 0x5aa
_o__wcstombs_l 0x84680 0x5ab
_o__wcstombs_s_l 0x846a0 0x5ac
_o__wcstoui64 0x3a350 0x5ad
_o__wcstoui64_l 0x846f0 0x5ae
_o__wcstoul_l 0x846d0 0x5af
_o__wcstoull_l 0x846f0 0x5b0
_o__wcsupr 0x84720 0x5b1
_o__wcsupr_l 0x84740 0x5b2
_o__wcsupr_s 0x39610 0x5b3
_o__wcsupr_s_l 0x84760 0x5b4
_o__wcsxfrm_l 0x84790 0x5b5
_o__wctime32 0x847b0 0x5b6
_o__wctime32_s 0x847d0 0x5b7
_o__wctime64 0x847f0 0x5b8
_o__wctime64_s 0x84810 0x5b9
_o__wctomb_l 0x84830 0x5ba
_o__wctomb_s_l 0x84850 0x5bb
_o__wdupenv_s 0x84880 0x5bc
_o__wexecv 0x848a0 0x5bd
_o__wexecve 0x848c0 0x5be
_o__wexecvp 0x848f0 0x5bf
_o__wexecvpe 0x84910 0x5c0
_o__wfdopen 0x84940 0x5c1
_o__wfindfirst32 0x84960 0x5c2
_o__wfindfirst32i64 0x84980 0x5c3
_o__wfindfirst64 0x849a0 0x5c4
_o__wfindfirst64i32 0x849c0 0x5c5
_o__wfindnext32 0x849e0 0x5c6
_o__wfindnext32i64 0x84a00 0x5c7
_o__wfindnext64 0x84a20 0x5c8
_o__wfindnext64i32 0x84a40 0x5c9
_o__wfopen 0x84a60 0x5ca
_o__wfopen_s 0x84a80 0x5cb
_o__wfreopen 0x84aa0 0x5cc
_o__wfreopen_s 0x84ac0 0x5cd
_o__wfsopen 0x84ae0 0x5ce
_o__wfullpath 0x84b00 0x5cf
_o__wgetcwd 0x84b20 0x5d0
_o__wgetdcwd 0x84b40 0x5d1
_o__wgetenv 0x84b70 0x5d2
_o__wgetenv_s 0x84b90 0x5d3
_o__wmakepath 0x84bb0 0x5d4
_o__wmakepath_s 0x84be0 0x5d5
_o__wmkdir 0x384d0 0x5d6
_o__wmktemp 0x84c10 0x5d7
_o__wmktemp_s 0x84c30 0x5d8
_o__wperror 0x84c50 0x5d9
_o__wpopen 0x84c70 0x5da
_o__wputenv 0x84c90 0x5db
_o__wputenv_s 0x84cb0 0x5dc
_o__wremove 0x84cd0 0x5dd
_o__wrename 0x84cf0 0x5de
_o__write 0x84d10 0x5df
_o__wrmdir 0x84d30 0x5e0
_o__wsearchenv 0x84d50 0x5e1
_o__wsearchenv_s 0x84d70 0x5e2
_o__wsetlocale 0x84d90 0x5e3
_o__wsopen_dispatch 0x84db0 0x5e4
_o__wsopen_s 0x84de0 0x5e5
_o__wspawnv 0x84e10 0x5e6
_o__wspawnve 0x84e40 0x5e7
_o__wspawnvp 0x84e70 0x5e8
_o__wspawnvpe 0x84ea0 0x5e9
_o__wsplitpath 0x84ed0 0x5ea
_o__wsplitpath_s 0x24610 0x5eb
_o__wstat32 0x84f00 0x5ec
_o__wstat32i64 0x84f20 0x5ed
_o__wstat64 0x84f40 0x5ee
_o__wstat64i32 0x84f60 0x5ef
_o__wstrdate 0x84f80 0x5f0
_o__wstrdate_s 0x84fa0 0x5f1
_o__wstrtime 0x84fc0 0x5f2
_o__wstrtime_s 0x84fe0 0x5f3
_o__wsystem 0x85000 0x5f4
_o__wtmpnam_s 0x85020 0x5f5
_o__wtof 0x22560 0x5f6
_o__wtof_l 0x85040 0x5f7
_o__wtoi 0x384f0 0x5f8
_o__wtoi64 0x2ea10 0x5f9
_o__wtoi64_l 0x85080 0x5fa
_o__wtoi_l 0x85060 0x5fb
_o__wtol 0x3b8d0 0x5fc
_o__wtol_l 0x85060 0x5fd
_o__wtoll 0x2ea10 0x5fe
_o__wtoll_l 0x85080 0x5ff
_o__wunlink 0x850a0 0x600
_o__wutime32 0x850c0 0x601
_o__wutime64 0x850e0 0x602
_o__y0 0x85100 0x603
_o__y1 0x85120 0x604
_o__yn 0x85140 0x605
_o_abort 0x85170 0x606
_o_acos 0x85180 0x607
_o_acosh 0x851a0 0x608
_o_acoshf 0x851c0 0x609
_o_acoshl 0x851e0 0x60a
_o_asctime 0x85200 0x60b
_o_asctime_s 0x85220 0x60c
_o_asin 0x85240 0x60d
_o_asinh 0x85260 0x60e
_o_asinhf 0x85280 0x60f
_o_asinhl 0x852a0 0x610
_o_atan 0x852c0 0x611
_o_atan2 0x852e0 0x612
_o_atanh 0x85310 0x613
_o_atanhf 0x85330 0x614
_o_atanhl 0x85350 0x615
_o_atof 0x85370 0x616
_o_atoi 0x3ac20 0x617
_o_atol 0x2c440 0x618
_o_atoll 0x85390 0x619
_o_bsearch 0x23670 0x61a
_o_bsearch_s 0x20db0 0x61b
_o_btowc 0x853b0 0x61c
_o_calloc 0x2b6f0 0x61d
_o_cbrt 0x853d0 0x61e
_o_cbrtf 0x853f0 0x61f
_o_ceil 0x23800 0x620
_o_clearerr 0x85410 0x621
_o_clearerr_s 0x85430 0x622
_o_cos 0x85450 0x623
_o_cosh 0x85470 0x624
_o_erf 0x85490 0x625
_o_erfc 0x854b0 0x626
_o_erfcf 0x854d0 0x627
_o_erfcl 0x854f0 0x628
_o_erff 0x85510 0x629
_o_erfl 0x85530 0x62a
_o_exit 0x21780 0x62b
_o_exp 0x85550 0x62c
_o_exp2 0x85570 0x62d
_o_exp2f 0x85590 0x62e
_o_exp2l 0x855b0 0x62f
_o_fabs 0x855d0 0x630
_o_fclose 0x34be0 0x631
_o_feof 0x855f0 0x632
_o_ferror 0x85610 0x633
_o_fflush 0x85630 0x634
_o_fgetc 0x85650 0x635
_o_fgetpos 0x85670 0x636
_o_fgets 0x85690 0x637
_o_fgetwc 0x856b0 0x638
_o_fgetws 0x856d0 0x639
_o_floor 0x24810 0x63a
_o_fma 0x856f0 0x63b
_o_fmaf 0x85720 0x63c
_o_fmal 0x856f0 0x63d
_o_fmod 0x85750 0x63e
_o_fopen 0x85780 0x63f
_o_fopen_s 0x857a0 0x640
_o_fputc 0x857c0 0x641
_o_fputs 0x857e0 0x642
_o_fputwc 0x85800 0x643
_o_fputws 0x85820 0x644
_o_fread 0x85840 0x645
_o_fread_s 0x85870 0x646
_o_free 0x27be0 0x647
_o_freopen 0x858a0 0x648
_o_freopen_s 0x858c0 0x649
_o_frexp 0x858e0 0x64a
_o_fseek 0x85900 0x64b
_o_fsetpos 0x85930 0x64c
_o_ftell 0x85950 0x64d
_o_fwrite 0x85970 0x64e
_o_getc 0x859a0 0x64f
_o_getchar 0x80540 0x650
_o_getenv 0x859c0 0x651
_o_getenv_s 0x859e0 0x652
_o_gets 0x85a00 0x653
_o_gets_s 0x85a20 0x654
_o_getwc 0x85a40 0x655
_o_getwchar 0x80570 0x656
_o_hypot 0x85a60 0x657
_o_is_wctype 0x85a90 0x658
_o_isalnum 0x85ab0 0x659
_o_isalpha 0x24b60 0x65a
_o_isblank 0x85ad0 0x65b
_o_iscntrl 0x3b080 0x65c
_o_isdigit 0x24050 0x65d
_o_isgraph 0x85af0 0x65e
_o_isleadbyte 0x85b10 0x65f
_o_islower 0x85b30 0x660
_o_isprint 0x85b50 0x661
_o_ispunct 0x85b70 0x662
_o_isspace 0x248e0 0x663
_o_isupper 0x39890 0x664
_o_iswalnum 0x23b90 0x665
_o_iswalpha 0x3b060 0x666
_o_iswascii 0x3b160 0x667
_o_iswblank 0x85b90 0x668
_o_iswcntrl 0x85bb0 0x669
_o_iswctype 0x85bd0 0x66a
_o_iswdigit 0x23c70 0x66b
_o_iswgraph 0x85bf0 0x66c
_o_iswlower 0x85c10 0x66d
_o_iswprint 0x85c30 0x66e
_o_iswpunct 0x85c50 0x66f
_o_iswspace 0x26090 0x670
_o_iswupper 0x85c70 0x671
_o_iswxdigit 0x3b8b0 0x672
_o_isxdigit 0x24020 0x673
_o_ldexp 0x85c90 0x674
_o_lgamma 0x85cc0 0x675
_o_lgammaf 0x85ce0 0x676
_o_lgammal 0x85d00 0x677
_o_llrint 0x85d20 0x678
_o_llrintf 0x85d40 0x679
_o_llrintl 0x85d60 0x67a
_o_llround 0x20e30 0x67b
_o_llroundf 0x85d80 0x67c
_o_llroundl 0x85da0 0x67d
_o_localeconv 0x22c30 0x67e
_o_log 0x85dc0 0x67f
_o_log10 0x85de0 0x680
_o_log1p 0x85e00 0x681
_o_log1pf 0x85e20 0x682
_o_log1pl 0x85e40 0x683
_o_log2 0x21480 0x684
_o_log2f 0x85e60 0x685
_o_log2l 0x85e80 0x686
_o_logb 0x85ea0 0x687
_o_logbf 0x85ec0 0x688
_o_logbl 0x85ee0 0x689
_o_lrint 0x85f00 0x68a
_o_lrintf 0x85f20 0x68b
_o_lrintl 0x85f40 0x68c
_o_lround 0x20c70 0x68d
_o_lroundf 0x85f60 0x68e
_o_lroundl 0x85f80 0x68f
_o_malloc 0x27b20 0x690
_o_mblen 0x85fa0 0x691
_o_mbrlen 0x85fc0 0x692
_o_mbrtoc16 0x85fe0 0x693
_o_mbrtoc32 0x86000 0x694
_o_mbrtowc 0x86020 0x695
_o_mbsrtowcs 0x86040 0x696
_o_mbsrtowcs_s 0x86060 0x697
_o_mbstowcs 0x3b7a0 0x698
_o_mbstowcs_s 0x3bab0 0x699
_o_mbtowc 0x86090 0x69a
_o_memcpy_s 0x24830 0x69b
_o_memset 0x27ca0 0x69c
_o_modf 0x860b0 0x69d
_o_nan 0x860d0 0x69e
_o_nanf 0x860f0 0x69f
_o_nanl 0x86110 0x6a0
_o_nearbyint 0x86130 0x6a1
_o_nearbyintf 0x86150 0x6a2
_o_nearbyintl 0x86170 0x6a3
_o_nextafter 0x861c0 0x6a4
_o_nextafterf 0x86190 0x6a5
_o_nextafterl 0x861c0 0x6a6
_o_nexttoward 0x861f0 0x6a7
_o_nexttowardf 0x86220 0x6a8
_o_nexttowardl 0x86250 0x6a9
_o_pow 0x86280 0x6aa
_o_powf 0x862b0 0x6ab
_o_putc 0x862e0 0x6ac
_o_putchar 0x86300 0x6ad
_o_puts 0x86320 0x6ae
_o_putwc 0x86340 0x6af
_o_putwchar 0x86360 0x6b0
_o_qsort 0x21810 0x6b1
_o_qsort_s 0x22010 0x6b2
_o_raise 0x86380 0x6b3
_o_rand 0x2d9c0 0x6b4
_o_rand_s 0x39ef0 0x6b5
_o_realloc 0x23910 0x6b6
_o_remainder 0x863d0 0x6b7
_o_remainderf 0x863a0 0x6b8
_o_remainderl 0x863d0 0x6b9
_o_remove 0x86400 0x6ba
_o_remquo 0x86420 0x6bb
_o_remquof 0x86450 0x6bc
_o_remquol 0x86420 0x6bd
_o_rename 0x86480 0x6be
_o_rewind 0x864a0 0x6bf
_o_rint 0x864c0 0x6c0
_o_rintf 0x864e0 0x6c1
_o_rintl 0x86500 0x6c2
_o_round 0x21440 0x6c3
_o_roundf 0x20890 0x6c4
_o_roundl 0x86520 0x6c5
_o_scalbln 0x86540 0x6c6
_o_scalblnf 0x86570 0x6c7
_o_scalblnl 0x86590 0x6c8
_o_scalbn 0x86540 0x6c9
_o_scalbnf 0x865b0 0x6ca
_o_scalbnl 0x86540 0x6cb
_o_set_terminate 0x865e0 0x6cc
_o_setbuf 0x86600 0x6cd
_o_setlocale 0x2b2f0 0x6ce
_o_setvbuf 0x86620 0x6cf
_o_sin 0x86640 0x6d0
_o_sinh 0x86660 0x6d1
_o_sqrt 0x86680 0x6d2
_o_srand 0x23410 0x6d3
_o_strcat_s 0x866a0 0x6d4
_o_strcoll 0x866d0 0x6d5
_o_strcpy_s 0x3a9b0 0x6d6
_o_strerror 0x866f0 0x6d7
_o_strerror_s 0x86710 0x6d8
_o_strftime 0x398d0 0x6d9
_o_strncat_s 0x86740 0x6da
_o_strncpy_s 0x3abd0 0x6db
_o_strtod 0x867d0 0x6dc
_o_strtof 0x86770 0x6dd
_o_strtok 0x86790 0x6de
_o_strtok_s 0x867b0 0x6df
_o_strtol 0x3a280 0x6e0
_o_strtold 0x867d0 0x6e1
_o_strtoll 0x867f0 0x6e2
_o_strtoul 0x86820 0x6e3
_o_strtoull 0x33c20 0x6e4
_o_system 0x86840 0x6e5
_o_tan 0x86860 0x6e6
_o_tanh 0x86880 0x6e7
_o_terminate 0x868a0 0x6e8
_o_tgamma 0x868b0 0x6e9
_o_tgammaf 0x868d0 0x6ea
_o_tgammal 0x868f0 0x6eb
_o_tmpfile_s 0x86910 0x6ec
_o_tmpnam_s 0x86930 0x6ed
_o_tolower 0x279f0 0x6ee
_o_toupper 0x3ac00 0x6ef
_o_towlower 0x3a630 0x6f0
_o_towupper 0x27910 0x6f1
_o_ungetc 0x86950 0x6f2
_o_ungetwc 0x86970 0x6f3
_o_wcrtomb 0x86990 0x6f4
_o_wcrtomb_s 0x869b0 0x6f5
_o_wcscat_s 0x23c40 0x6f6
_o_wcscoll 0x869e0 0x6f7
_o_wcscpy 0x86a00 0x6f8
_o_wcscpy_s 0x24300 0x6f9
_o_wcsftime 0x86a20 0x6fa
_o_wcsncat_s 0x86a40 0x6fb
_o_wcsncpy_s 0x23e70 0x6fc
_o_wcsrtombs 0x86a70 0x6fd
_o_wcsrtombs_s 0x86a90 0x6fe
_o_wcstod 0x218c0 0x6ff
_o_wcstof 0x86ac0 0x700
_o_wcstok 0x86ae0 0x701
_o_wcstok_s 0x3a900 0x702
_o_wcstol 0x3a7f0 0x703
_o_wcstold 0x86b10 0x704
_o_wcstoll 0x3b6a0 0x705
_o_wcstombs 0x3b710 0x706
_o_wcstombs_s 0x86b30 0x707
_o_wcstoul 0x38c20 0x708
_o_wcstoull 0x86b60 0x709
_o_wctob 0x86b90 0x70a
_o_wctomb 0x86bb0 0x70b
_o_wctomb_s 0x86bd0 0x70c
_o_wmemcpy_s 0x23c10 0x70d
_o_wmemmove_s 0x86bf0 0x70e
_open 0xd2830 0x70f
_open_osfhandle 0x38d40 0x710
_pclose 0xc4e80 0x711
_pipe 0xc3e00 0x712
_popen 0xc4fc0 0x713
_purecall 0x4e7b0 0x714
_putc_nolock 0x96730 0x715
_putch 0xc5060 0x716
_putch_nolock 0xc50a0 0x717
_putenv 0xdb2f0 0x718
_putenv_s 0xdb310 0x719
_putw 0xa7040 0x71a
_putwc_nolock 0x968a0 0x71b
_putwch 0xc51b0 0x71c
_putwch_nolock 0xc51f0 0x71d
_putws 0xa71b0 0x71e
_query_app_type 0x8e470 0x71f
_query_new_handler 0x8e180 0x720
_query_new_mode 0x8e280 0x721
_read 0x32430 0x722
_realloc_base 0x23d90 0x723
_recalloc 0x23d00 0x724
_register_onexit_function 0x271e0 0x725
_register_thread_local_exe_atexit_callback 0x95090 0x726
_resetstkoflw 0xf0690 0x727
_rmdir 0xc8e90 0x728
_rmtmp 0xa73d0 0x729
_rotl 0xaa2a0 0x72a
_rotl64 0xaa2c0 0x72b
_rotr 0xaa300 0x72c
_rotr64 0xaa320 0x72d
_scalb 0xf40e0 0x72e
_searchenv 0xdd880 0x72f
_searchenv_s 0xdd8b0 0x730
_seh_filter_dll 0x91410 0x731
_seh_filter_exe 0x91440 0x732
_seh_longjmp_unwind 0x4e584 0x734
_seh_longjmp_unwind4 0x4e978 0x733
_set_SSE2_enable 0xf3610 0x735
_set_abort_behavior 0x93330 0x736
_set_app_type 0x3ac90 0x737
_set_controlfp 0x58bf0 0x738
_set_doserrno 0x91270 0x739
_set_errno 0x234c0 0x73a
_set_error_mode 0x91af0 0x73b
_set_fmode 0x3a8d0 0x73c
_set_invalid_parameter_handler 0x3bce0 0x73d
_set_new_handler 0x8e1f0 0x73e
_set_new_mode 0x3a8a0 0x73f
_set_printf_count_output 0xa6d90 0x740
_set_purecall_handler 0x4e7f0 0x741
_set_se_translator 0x4ea20 0x742
_set_thread_local_invalid_parameter_handler 0x91940 0x743
_seterrormode 0xf0770 0x744
_setjmp3 0x4ea40 0x745
_setmaxstdio 0xa7630 0x746
_setmbcp 0x90ec0 0x747
_setmode 0xd2bf0 0x748
_setsystime 0xf0940 0x749
_sleep 0xf07b0 0x74a
_sopen 0xd2850 0x74b
_sopen_dispatch 0xd2890 0x74c
_sopen_s 0xd28c0 0x74d
_spawnl 0xe00b0 0x74e
_spawnle 0xe00e0 0x74f
_spawnlp 0xe0810 0x750
_spawnlpe 0xe0840 0x751
_spawnv 0xe2130 0x752
_spawnve 0xe2150 0x753
_spawnvp 0xe32c0 0x754
_spawnvpe 0xe32e0 0x755
_splitpath 0xc9800 0x756
_splitpath_s 0x3aff0 0x757
_stat32 0xce240 0x758
_stat32i64 0xce260 0x759
_stat64 0xce280 0x75a
_stat64i32 0xce2a0 0x75b
_statusfp 0x58c70 0x75c
_statusfp2 0x58d20 0x75d
_strcoll_l 0x3c660 0x75e
_strdate 0xd65b0 0x75f
_strdate_s 0xd65d0 0x760
_strdup 0x3c7f0 0x761
_strerror 0x932f0 0x762
_strerror_s 0x93310 0x763
_strftime_l 0xd6660 0x764
_stricmp 0x3c890 0x765
_stricmp_l 0x3c8e0 0x766
_stricoll 0x3c980 0x767
_stricoll_l 0x3c9b0 0x768
_strlwr 0x3cc50 0x769
_strlwr_l 0x3ccc0 0x76a
_strlwr_s 0x3cce0 0x76b
_strlwr_s_l 0x3cd00 0x76c
_strncoll 0x3d010 0x76d
_strncoll_l 0x3d090 0x76e
_strnicmp 0x3d350 0x76f
_strnicmp_l 0x3d3d0 0x770
_strnicoll 0x3d490 0x771
_strnicoll_l 0x3d4c0 0x772
_strnset 0x3d9a0 0x773
_strnset_s 0x3d9d0 0x774
_strrev 0x3da90 0x775
_strset 0x3dad0 0x776
_strset_s 0x3db00 0x777
_strtime 0xd6b20 0x778
_strtime_s 0xd6b40 0x779
_strtod_l 0x8b0f0 0x77a
_strtof_l 0x8b0d0 0x77b
_strtoi64 0x8b190 0x77c
_strtoi64_l 0x8b210 0x77d
_strtoimax_l 0x8b210 0x77e
_strtol_l 0x8b1d0 0x77f
_strtold_l 0x8b0f0 0x780
_strtoll_l 0x8b210 0x781
_strtoui64 0x30f90 0x782
_strtoui64_l 0x8b250 0x783
_strtoul_l 0x8b290 0x784
_strtoull_l 0x8b250 0x785
_strtoumax_l 0x8b250 0x786
_strupr 0x3de70 0x787
_strupr_l 0x3dee0 0x788
_strupr_s 0x3df00 0x789
_strupr_s_l 0x3df20 0x78a
_strxfrm_l 0x3df60 0x78b
_swab 0x8b410 0x78c
_tell 0xd2e00 0x78d
_telli64 0xd2e20 0x78e
_tempnam 0xa8110 0x78f
_time32 0x34c40 0x790
_time64 0x34d40 0x791
_timespec32_get 0xd6d00 0x792
_timespec64_get 0xd6d20 0x793
_tolower 0x3bd30 0x794
_tolower_l 0x8b550 0x795
_toupper 0x8b570 0x796
_toupper_l 0x8b590 0x797
_towlower_l 0x38b40 0x798
_towupper_l 0x52c50 0x799
_tzset 0xd7c10 0x79a
_ui64toa 0x8c8f0 0x79b
_ui64toa_s 0x3a4a0 0x79c
_ui64tow 0x8c920 0x79d
_ui64tow_s 0x37620 0x79e
_ultoa 0x8c950 0x79f
_ultoa_s 0x8c980 0x7a0
_ultow 0x8c9b0 0x7a1
_ultow_s 0x370e0 0x7a2
_umask 0xd2e70 0x7a3
_umask_s 0xd2ea0 0x7a4
_ungetc_nolock 0xa8e40 0x7a5
_ungetch 0xc3740 0x7a6
_ungetch_nolock 0xc37a0 0x7a7
_ungetwc_nolock 0xa9200 0x7a8
_ungetwch 0xc39c0 0x7a9
_ungetwch_nolock 0xc3a20 0x7aa
_unlink 0xce340 0x7ab
_unloaddll 0xdfa40 0x7ac
_unlock_file 0x3bbc0 0x7ad
_unlock_locales 0x38830 0x7ae
_utime32 0xd9180 0x7af
_utime64 0xd91a0 0x7b0
_waccess 0xce3a0 0x7b1
_waccess_s 0xce3c0 0x7b2
_wasctime 0xd3aa0 0x7b3
_wasctime_s 0xd3ac0 0x7b4
_wassert 0x94d90 0x7b5
_wchdir 0xeee80 0x7b6
_wchmod 0xce9b0 0x7b7
_wcreat 0xcfc80 0x7b8
_wcreate_locale 0x3b3e0 0x7b9
_wcscoll_l 0x3e1c0 0x7ba
_wcsdup 0x3e400 0x7bb
_wcserror 0x924d0 0x7bc
_wcserror_s 0x924f0 0x7bd
_wcsftime_l 0xd98a0 0x7be
_wcsicmp 0x3e470 0x7bf
_wcsicmp_l 0x3e510 0x7c0
_wcsicoll 0x3e600 0x7c1
_wcsicoll_l 0x3e6a0 0x7c2
_wcslwr 0x3e8f0 0x7c3
_wcslwr_l 0x3e960 0x7c4
_wcslwr_s 0x3e980 0x7c5
_wcslwr_s_l 0x3e9a0 0x7c6
_wcsncoll 0x3eba0 0x7c7
_wcsncoll_l 0x3ec20 0x7c8
_wcsnicmp 0x3ee00 0x7c9
_wcsnicmp_l 0x3eec0 0x7ca
_wcsnicoll 0x3efd0 0x7cb
_wcsnicoll_l 0x3f0a0 0x7cc
_wcsnset 0x3f1d0 0x7cd
_wcsnset_s 0x3f290 0x7ce
_wcsrev 0x3f2f0 0x7cf
_wcsset 0x3f330 0x7d0
_wcsset_s 0x3f360 0x7d1
_wcstod_l 0x8b110 0x7d2
_wcstof_l 0x8b130 0x7d3
_wcstoi64 0x3b6d0 0x7d4
_wcstoi64_l 0x8b310 0x7d5
_wcstoimax_l 0x8b310 0x7d6
_wcstol_l 0x8b2d0 0x7d7
_wcstold_l 0x8b110 0x7d8
_wcstoll_l 0x8b310 0x7d9
_wcstombs_l 0x8c0b0 0x7da
_wcstombs_s_l 0x2b070 0x7db
_wcstoui64 0x3a380 0x7dc
_wcstoui64_l 0x8b390 0x7dd
_wcstoul_l 0x8b350 0x7de
_wcstoull_l 0x8b390 0x7df
_wcstoumax_l 0x8b390 0x7e0
_wcsupr 0x3f6b0 0x7e1
_wcsupr_l 0x3f720 0x7e2
_wcsupr_s 0x3f740 0x7e3
_wcsupr_s_l 0x3f760 0x7e4
_wcsxfrm_l 0x3f7a0 0x7e5
_wctime32 0xd4d40 0x7e6
_wctime32_s 0xd4d60 0x7e7
_wctime64 0xd4d80 0x7e8
_wctime64_s 0xd4da0 0x7e9
_wctomb_l 0x8c0d0 0x7ea
_wctomb_s_l 0x2c4e0 0x7eb
_wctype 0x6b50 0x7ec
_wdupenv_s 0x21920 0x7ed
_wexecl 0xe0110 0x7ee
_wexecle 0xe0140 0x7ef
_wexeclp 0xe0870 0x7f0
_wexeclpe 0xe08a0 0x7f1
_wexecv 0xe2170 0x7f2
_wexecve 0xe2190 0x7f3
_wexecvp 0xe3300 0x7f4
_wexecvpe 0xe3320 0x7f5
_wfdopen 0x957a0 0x7f6
_wfindfirst32 0xc8180 0x7f7
_wfindfirst32i64 0xc81a0 0x7f8
_wfindfirst64 0xc81c0 0x7f9
_wfindfirst64i32 0xc81e0 0x7fa
_wfindnext32 0xc8200 0x7fb
_wfindnext32i64 0xc8220 0x7fc
_wfindnext64 0xc8240 0x7fd
_wfindnext64i32 0xc8260 0x7fe
_wfopen 0x34c20 0x7ff
_wfopen_s 0x966a0 0x800
_wfreopen 0x96cb0 0x801
_wfreopen_s 0x96ce0 0x802
_wfsopen 0x32500 0x803
_wfullpath 0x21360 0x804
_wgetcwd 0xf0640 0x805
_wgetdcwd 0xf0660 0x806
_wgetenv 0xda0b0 0x807
_wgetenv_s 0xda0d0 0x808
_wmakepath 0xc8d10 0x809
_wmakepath_s 0xc8d40 0x80a
_wmkdir 0x38590 0x80b
_wmktemp 0xd2640 0x80c
_wmktemp_s 0xd2660 0x80d
_wopen 0xd28f0 0x80e
_wperror 0x92780 0x80f
_wpopen 0xc4fe0 0x810
_wputenv 0xdb4e0 0x811
_wputenv_s 0xdb500 0x812
_wremove 0xcec20 0x813
_wrename 0x3bc90 0x814
_write 0x310d0 0x815
_wrmdir 0xcebf0 0x816
_wsearchenv 0xdd8d0 0x817
_wsearchenv_s 0xdd900 0x818
_wsetlocale 0x28f80 0x819
_wsopen 0xd2910 0x81a
_wsopen_dispatch 0xd2950 0x81b
_wsopen_s 0xd2980 0x81c
_wspawnl 0xe0170 0x81d
_wspawnle 0xe01a0 0x81e
_wspawnlp 0xe08d0 0x81f
_wspawnlpe 0xe0900 0x820
_wspawnv 0xe21b0 0x821
_wspawnve 0xe21d0 0x822
_wspawnvp 0xe3340 0x823
_wspawnvpe 0xe3360 0x824
_wsplitpath 0xc9830 0x825
_wsplitpath_s 0x246a0 0x826
_wstat32 0xce2c0 0x827
_wstat32i64 0xce2e0 0x828
_wstat64 0xce300 0x829
_wstat64i32 0xce320 0x82a
_wstrdate 0xd65f0 0x82b
_wstrdate_s 0xd6610 0x82c
_wstrtime 0xd6b60 0x82d
_wstrtime_s 0xd6b80 0x82e
_wsystem 0xe4030 0x82f
_wtempnam 0xa8130 0x830
_wtmpnam 0xa8b70 0x831
_wtmpnam_s 0xa8ba0 0x832
_wtof 0x225d0 0x833
_wtof_l 0x87680 0x834
_wtoi 0x38560 0x835
_wtoi64 0x2e980 0x836
_wtoi64_l 0x88620 0x837
_wtoi_l 0x88650 0x838
_wtol 0x38560 0x839
_wtol_l 0x88650 0x83a
_wtoll 0x2e980 0x83b
_wtoll_l 0x88620 0x83c
_wunlink 0xcec50 0x83d
_wutime32 0xd91c0 0x83e
_wutime64 0xd91e0 0x83f
_y0 0xaac20 0x840
_y1 0xaadf0 0x841
_yn 0xaafd0 0x842
abort 0x93360 0x843
abs 0x3bdc0 0x844
acos 0x40440 0x845
acosh 0xaa440 0x846
acoshf 0xaa360 0x847
acoshl 0xaa440 0x848
asctime 0xd3ae0 0x849
asctime_s 0xd3b00 0x84a
asin 0x41020 0x84b
asinh 0xaa5b0 0x84c
asinhf 0xaa4f0 0x84d
asinhl 0xaa5b0 0x84e
atan 0x41c50 0x84f
atan2 0x41ca0 0x850
atanh 0xaa720 0x851
atanhf 0xaa650 0x852
atanhl 0xaa720 0x853
atof 0x20d40 0x854
atoi 0x2c3d0 0x855
atol 0x2c3d0 0x856
atoll 0x3b4f0 0x857
bsearch 0x236f0 0x858
bsearch_s 0x21ab0 0x859
btowc 0x8a6b0 0x85a
c16rtomb 0x88680 0x85b
c32rtomb 0x887b0 0x85c
cabs 0xab150 0x85d
cabsf 0xab110 0x85e
cabsl 0xab150 0x85f
cacos 0xaba80 0x860
cacosf 0xab1a0 0x861
cacosh 0xab420 0x862
cacoshf 0xab7c0 0x863
cacoshl 0xab420 0x864
cacosl 0xaba80 0x865
calloc 0x24040 0x866
carg 0xabe00 0x867
cargf 0xabdc0 0x868
cargl 0xabe00 0x869
casin 0xabe50 0x86a
casinf 0xabf00 0x86b
casinh 0xabf60 0x86c
casinhf 0xac2d0 0x86d
casinhl 0xabf60 0x86e
casinl 0xabe50 0x86f
catan 0xacbc0 0x870
catanf 0xac550 0x871
catanh 0xac8e0 0x872
catanhf 0xac5b0 0x873
catanhl 0xac8e0 0x874
catanl 0xacbc0 0x875
cbrt 0xacd70 0x876
cbrtf 0xacc70 0x877
cbrtl 0xacd70 0x878
ccos 0xace80 0x879
ccosf 0xacf00 0x87a
ccosh 0xad020 0x87b
ccoshf 0xad2c0 0x87c
ccoshl 0xad530 0x87d
ccosl 0xad6f0 0x87e
ceil 0x42350 0x87f
cexp 0xad770 0x880
cexpf 0xad970 0x881
cexpl 0xadb40 0x882
cimag 0xadd80 0x883
cimagf 0xadd40 0x884
cimagl 0xadd80 0x885
clearerr 0x95380 0x886
clearerr_s 0x95390 0x887
clock 0x35770 0x888
clog 0xaddc0 0x889
clog10 0xadff0 0x88a
clog10f 0xae050 0x88b
clog10l 0xadff0 0x88c
clogf 0xae0b0 0x88d
clogl 0xaddc0 0x88e
conj 0xae300 0x88f
conjf 0xae2c0 0x890
conjl 0xae300 0x891
copysign 0xae380 0x892
copysignf 0xae350 0x893
copysignl 0xae380 0x894
cos 0x42600 0x895
cosh 0x42650 0x896
cpow 0xae4c0 0x897
cpowf 0xae660 0x898
cpowl 0xae700 0x899
cproj 0xae840 0x89a
cprojf 0xae940 0x89b
cprojl 0xae840 0x89c
creal 0xaea20 0x89d
crealf 0xae9e0 0x89e
creall 0xaea20 0x89f
csin 0xaea60 0x8a0
csinf 0xaeb10 0x8a1
csinh 0xaecb0 0x8a2
csinhf 0xaef90 0x8a3
csinhl 0xaf220 0x8a4
csinl 0xaf390 0x8a5
csqrt 0xaf5f0 0x8a6
csqrtf 0xaf9e0 0x8a7
csqrtl 0xaf5f0 0x8a8
ctan 0xafbd0 0x8a9
ctanf 0xafc80 0x8aa
ctanh 0xafce0 0x8ab
ctanhf 0xafe80 0x8ac
ctanhl 0xafce0 0x8ad
ctanl 0xafbd0 0x8ae
div 0x3b580 0x8af
erf 0xb0090 0x8b0
erfc 0xb01b0 0x8b1
erfcf 0xb03f0 0x8b2
erfcl 0xb0630 0x8b3
erff 0xb0890 0x8b4
erfl 0xb0a20 0x8b5
exit 0x21c90 0x8b6
exp 0x42ac0 0x8b7
exp2 0xb0d80 0x8b8
exp2f 0xb10c0 0x8b9
exp2l 0xb13f0 0x8ba
expm1 0xb14d0 0x8bb
expm1f 0xb15b0 0x8bc
expm1l 0xb14d0 0x8bd
fabs 0xb1680 0x8be
fclose 0x31c50 0x8bf
fdim 0xb16d0 0x8c0
fdimf 0xb1720 0x8c1
fdiml 0xb16d0 0x8c2
feclearexcept 0xb1780 0x8c3
fegetenv 0xb17e0 0x8c4
fegetexceptflag 0xb1810 0x8c5
fegetround 0xb18a0 0x8c6
feholdexcept 0xb18d0 0x8c7
feof 0x957c0 0x8c8
ferror 0x958c0 0x8c9
fesetenv 0xb1920 0x8ca
fesetexceptflag 0xb1960 0x8cb
fesetround 0xb19c0 0x8cc
fetestexcept 0xb1a30 0x8cd
fflush 0x31660 0x8ce
fgetc 0x95b30 0x8cf
fgetpos 0x349b0 0x8d0
fgets 0x95f70 0x8d1
fgetwc 0x96240 0x8d2
fgetws 0x95f90 0x8d3
floor 0x430b0 0x8d4
fma 0xb1aa0 0x8d5
fmaf 0xb2310 0x8d6
fmal 0xb1aa0 0x8d7
fmax 0xb2b60 0x8d8
fmaxf 0xb2bd0 0x8d9
fmaxl 0xb2b60 0x8da
fmin 0xb2c40 0x8db
fminf 0xb2cb0 0x8dc
fminl 0xb2c40 0x8dd
fmod 0x40010 0x8de
fopen 0x966c0 0x8df
fopen_s 0x966e0 0x8e0
fputc 0x96740 0x8e1
fputs 0x31b30 0x8e2
fputwc 0x968b0 0x8e3
fputws 0x96970 0x8e4
fread 0x327f0 0x8e5
fread_s 0x32770 0x8e6
free 0x27e10 0x8e7
freopen 0x96d10 0x8e8
freopen_s 0x96d40 0x8e9
frexp 0xb35f0 0x8ea
fseek 0x31560 0x8eb
fsetpos 0x96e50 0x8ec
ftell 0x974c0 0x8ed
fwrite 0x31760 0x8ee
getc 0x95c60 0x8ef
getchar 0x95af0 0x8f0
getenv 0x3a0c0 0x8f1
getenv_s 0x3a140 0x8f2
gets 0x977e0 0x8f3
gets_s 0x97800 0x8f4
getwc 0x962d0 0x8f5
getwchar 0x96200 0x8f6
hypot 0xf3340 0x8f7
ilogb 0xb37f0 0x8f8
ilogbf 0xb3840 0x8f9
ilogbl 0xb37f0 0x8fa
imaxabs 0x3bda0 0x8fb
imaxdiv 0xa9780 0x8fc
is_wctype 0xf0680 0x8fd
isalnum 0x38c90 0x8fe
isalpha 0x27e70 0x8ff
isblank 0x8cd80 0x900
iscntrl 0x31580 0x901
isdigit 0x286a0 0x902
isgraph 0x8cdc0 0x903
isleadbyte 0x8d360 0x904
islower 0x8ce00 0x905
isprint 0x8ce40 0x906
ispunct 0x8ce80 0x907
isspace 0x28200 0x908
isupper 0x38cc0 0x909
iswalnum 0x23bb0 0x90a
iswalpha 0x21f70 0x90b
iswascii 0x3abb0 0x90c
iswblank 0x8d380 0x90d
iswcntrl 0x8d240 0x90e
iswctype 0x23cb0 0x90f
iswdigit 0x23c90 0x910
iswgraph 0x8d2c0 0x911
iswlower 0x8d2e0 0x912
iswprint 0x8d300 0x913
iswpunct 0x8d320 0x914
iswspace 0x35840 0x915
iswupper 0x8d3b0 0x916
iswxdigit 0x21880 0x917
isxdigit 0x286d0 0x918
labs 0x3bdc0 0x919
ldexp 0xb3890 0x91a
ldiv 0x3b580 0x91b
lgamma 0xb3ac0 0x91c
lgammaf 0xb42e0 0x91d
lgammal 0xb4ae0 0x91e
llabs 0x3bda0 0x91f
lldiv 0xa9d80 0x920
llrint 0xb4d90 0x921
llrintf 0xb4d00 0x922
llrintl 0xb4d90 0x923
llround 0x20eb0 0x924
llroundf 0xb4e20 0x925
llroundl 0xb4e90 0x926
localeconv 0x22d80 0x927
log 0x43240 0x928
log10 0x43290 0x929
log1p 0xb4fc0 0x92a
log1pf 0xb4f00 0x92b
log1pl 0xb4fc0 0x92c
log2 0x21760 0x92d
log2f 0xb51d0 0x92e
log2l 0xb5380 0x92f
logb 0xb5410 0x930
logbf 0xb53a0 0x931
logbl 0xb5410 0x932
longjmp 0x4eac0 0x933
lrint 0xb5480 0x934
lrintf 0xb5510 0x935
lrintl 0xb5480 0x936
lround 0x20ce0 0x937
lroundf 0xb55a0 0x938
lroundl 0xb5610 0x939
malloc 0x28d60 0x93a
mblen 0x89b40 0x93b
mbrlen 0x8a710 0x93c
mbrtoc16 0x89b80 0x93d
mbrtoc32 0x89de0 0x93e
mbrtowc 0x8a750 0x93f
mbsrtowcs 0x8a7b0 0x940
mbsrtowcs_s 0x8a7d0 0x941
mbstowcs 0x3b810 0x942
mbstowcs_s 0x3bb30 0x943
mbtowc 0x8ab10 0x944
memchr 0x4eae0 0x945
memcmp 0x4eba0 0x946
memcpy 0x50120 0x947
memcpy_s 0x3c240 0x948
memmove 0x506a0 0x949
memmove_s 0x3c2d0 0x94a
memset 0x50c20 0x94b
modf 0x43f40 0x94c
nan 0xb5800 0x94d
nanf 0xb57d0 0x94e
nanl 0xb5800 0x94f
nearbyint 0xb5810 0x950
nearbyintf 0xb5840 0x951
nearbyintl 0xb5810 0x952
nextafter 0xb5870 0x953
nextafterf 0xb58a0 0x954
nextafterl 0xb5870 0x955
nexttoward 0xb58d0 0x956
nexttowardf 0xb5a40 0x957
nexttowardl 0xb58d0 0x958
norm 0xb5bc0 0x959
normf 0xb5b80 0x95a
norml 0xb5bc0 0x95b
perror 0x91a30 0x95c
pow 0x44090 0x95d
powf 0x86c20 0x95e
putc 0x96870 0x95f
putchar 0x96880 0x960
puts 0xa6e80 0x961
putwc 0x96940 0x962
putwchar 0x96950 0x963
qsort 0x22080 0x964
qsort_s 0x22f40 0x965
quick_exit 0x950d0 0x966
raise 0x91f20 0x967
rand 0x23490 0x968
rand_s 0x39f50 0x969
realloc 0x23d80 0x96a
remainder 0xb5da0 0x96b
remainderf 0xf4100 0x96c
remainderl 0xb5da0 0x96d
remove 0xce350 0x96e
remquo 0xb5fc0 0x96f
remquof 0xb5dd0 0x970
remquol 0xb5fc0 0x971
rename 0xc8dc0 0x972
rewind 0xa72e0 0x973
rint 0xb6460 0x974
rintf 0xb62e0 0x975
rintl 0xb6460 0x976
round 0x215f0 0x977
roundf 0x20b40 0x978
roundl 0xb64b0 0x979
scalbln 0xb6560 0x97a
scalblnf 0xb6510 0x97b
scalblnl 0xb6560 0x97c
scalbn 0xb6560 0x97d
scalbnf 0xb6510 0x97e
scalbnl 0xb6560 0x97f
set_terminate 0x92640 0x980
set_unexpected 0x4e840 0x981
setbuf 0xa7480 0x982
setlocale 0x29000 0x983
setvbuf 0xa7870 0x984
signal 0x3b5a0 0x985
sin 0x459b0 0x986
sinh 0x45a00 0x987
sqrt 0x45ea0 0x988
srand 0x23470 0x989
strcat 0x3c460 0x98a
strcat_s 0x3c550 0x98b
strchr 0x50d80 0x98c
strcmp 0x3c5c0 0x98d
strcoll 0x3c720 0x98e
strcpy 0x3c450 0x98f
strcpy_s 0x3c740 0x990
strcspn 0x3c7a0 0x991
strerror 0x3a650 0x992
strerror_s 0x92510 0x993
strftime 0x39940 0x994
strlen 0x3ca50 0x995
strncat 0x3cd40 0x996
strncat_s 0x3cf50 0x997
strncmp 0x3cf60 0x998
strncpy 0x3d160 0x999
strncpy_s 0x3d340 0x99a
strnlen 0x3d590 0x99b
strpbrk 0x3da50 0x99c
strrchr 0x50eb0 0x99d
strspn 0x3db50 0x99e
strstr 0x51000 0x99f
strtod 0x20f60 0x9a0
strtof 0x8b150 0x9a1
strtoimax 0x8b190 0x9a2
strtok 0x3dba0 0x9a3
strtok_s 0x3dcb0 0x9a4
strtol 0x3a2f0 0x9a5
strtold 0x20f60 0x9a6
strtoll 0x33be0 0x9a7
strtoul 0x39eb0 0x9a8
strtoull 0x30f90 0x9a9
strtoumax 0x8b3d0 0x9aa
strxfrm 0x3e090 0x9ab
system 0xe4050 0x9ac
tan 0x46070 0x9ad
tanh 0x460c0 0x9ae
terminate 0x92730 0x9af
tgamma 0xb6e90 0x9b0
tgammaf 0xb78e0 0x9b1
tgammal 0xb83d0 0x9b2
tmpfile 0xa8cb0 0x9b3
tmpfile_s 0xa8ce0 0x9b4
tmpnam 0xa8d00 0x9b5
tmpnam_s 0xa8d30 0x9b6
tolower 0x33f30 0x9b7
toupper 0x33e90 0x9b8
towctrans 0x8c1b0 0x9b9
towlower 0x38b20 0x9ba
towupper 0x2a980 0x9bb
trunc 0xb85d0 0x9bc
truncf 0xb85f0 0x9bd
truncl 0xb85d0 0x9be
unexpected 0x4e870 0x9bf
ungetc 0xa9010 0x9c0
ungetwc 0xa92c0 0x9c1
wcrtomb 0x8bb70 0x9c2
wcrtomb_s 0x8bbb0 0x9c3
wcscat 0x3e0b0 0x9c4
wcscat_s 0x3e0f0 0x9c5
wcschr 0x51270 0x9c6
wcscmp 0x3e170 0x9c7
wcscoll 0x3e280 0x9c8
wcscpy 0x3e300 0x9c9
wcscpy_s 0x3e330 0x9ca
wcscspn 0x3e3a0 0x9cb
wcsftime 0xd98d0 0x9cc
wcslen 0x3d6c0 0x9cd
wcsncat 0x3e9e0 0x9ce
wcsncat_s 0x3eb20 0x9cf
wcsncmp 0x3eb30 0x9d0
wcsncpy 0x3ecd0 0x9d1
wcsncpy_s 0x3edf0 0x9d2
wcsnlen 0x3d7f0 0x9d3
wcspbrk 0x3f2a0 0x9d4
wcsrchr 0x51330 0x9d5
wcsrtombs 0x8bd10 0x9d6
wcsrtombs_s 0x8bd30 0x9d7
wcsspn 0x3f3c0 0x9d8
wcsstr 0x513e0 0x9d9
wcstod 0x21bb0 0x9da
wcstof 0x8b170 0x9db
wcstoimax 0x3b6d0 0x9dc
wcstok 0x3f410 0x9dd
wcstok_s 0x3f4f0 0x9de
wcstol 0x3a860 0x9df
wcstold 0x21bb0 0x9e0
wcstoll 0x3b6d0 0x9e1
wcstombs 0x3b780 0x9e2
wcstombs_s 0x3b840 0x9e3
wcstoul 0x28b10 0x9e4
wcstoull 0x3b220 0x9e5
wcstoumax 0x3a380 0x9e6
wcsxfrm 0x3f8f0 0x9e7
wctob 0x8c050 0x9e8
wctomb 0x8c140 0x9e9
wctomb_s 0x8c180 0x9ea
wctrans 0x8c1e0 0x9eb
wctype 0x8c250 0x9ec
wmemcpy_s 0x3f910 0x9ed
wmemmove_s 0x3f9d0 0x9ee
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
vcruntime140.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\vcruntime140.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 81.82 KB
MD5 7587bf9cb4147022cd5681b015183046 Copy to Clipboard
SHA1 f2106306a8f6f0da5afb7fc765cfa0757ad5a628 Copy to Clipboard
SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d Copy to Clipboard
SSDeep 1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF Copy to Clipboard
ImpHash fa315c9bc46ab41d4bc4e3f94023067f Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x1000ae00
Size Of Code 0xea00
Size Of Initialized Data 0x2000
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2017-05-25 20:01:16+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription Microsoft® C Runtime Library
FileVersion 14.11.25325.0 built by: VCTOOLSREL
InternalName vcruntime140.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename vcruntime140.dll
ProductName Microsoft® Visual Studio® 2017
ProductVersion 14.11.25325.0
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xe9c4 0xea00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.62
.data 0x10010000 0x644 0x200 0xee00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 3.71
.idata 0x10011000 0x5b8 0x600 0xf000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.04
.rsrc 0x10012000 0x408 0x600 0xf600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.46
.reloc 0x10013000 0xa94 0xc00 0xfc00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.21
Imports (6)
»
api-ms-win-crt-runtime-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
abort - 0x1001109c 0x111e8 0xf1e8 0x57
terminate - 0x100110a0 0x111ec 0xf1ec 0x6a
api-ms-win-crt-string-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strcpy_s - 0x100110b0 0x111fc 0xf1fc 0x89
wcsncmp - 0x100110b4 0x11200 0xf200 0xa6
api-ms-win-crt-heap-l1-1-0.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
malloc - 0x10011084 0x111d0 0xf1d0 0x19
_free_base - 0x10011088 0x111d4 0xf1d4 0xb
free - 0x1001108c 0x111d8 0xf1d8 0x18
_malloc_base - 0x10011090 0x111dc 0xf1dc 0x10
_calloc_base - 0x10011094 0x111e0 0xf1e0 0x9
api-ms-win-crt-stdio-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__stdio_common_vsprintf_s - 0x100110a8 0x111f4 0xf1f4 0xf
api-ms-win-crt-convert-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
atol - 0x1001107c 0x111c8 0xf1c8 0x51
KERNEL32.dll (30)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
LeaveCriticalSection - 0x10011000 0x1114c 0xf14c 0x3a0
TerminateProcess - 0x10011004 0x11150 0xf150 0x561
GetCurrentProcess - 0x10011008 0x11154 0xf154 0x207
SetUnhandledExceptionFilter - 0x1001100c 0x11158 0xf158 0x543
UnhandledExceptionFilter - 0x10011010 0x1115c 0xf15c 0x582
GetSystemTimeAsFileTime - 0x10011014 0x11160 0xf160 0x2d4
GetCurrentThreadId - 0x10011018 0x11164 0xf164 0x20c
GetCurrentProcessId - 0x1001101c 0x11168 0xf168 0x208
QueryPerformanceCounter - 0x10011020 0x1116c 0xf16c 0x42b
IsProcessorFeaturePresent - 0x10011024 0x11170 0xf170 0x36b
GetModuleHandleW - 0x10011028 0x11174 0xf174 0x265
GetModuleFileNameW - 0x1001102c 0x11178 0xf178 0x261
LoadLibraryExW - 0x10011030 0x1117c 0xf17c 0x3a5
TlsFree - 0x10011034 0x11180 0xf180 0x574
TlsGetValue - 0x10011038 0x11184 0xf184 0x575
FreeLibrary - 0x1001103c 0x11188 0xf188 0x19c
RtlUnwind - 0x10011040 0x1118c 0xf18c 0x4ad
VirtualQuery - 0x10011044 0x11190 0xf190 0x5a3
EncodePointer - 0x10011048 0x11194 0xf194 0x11f
InterlockedFlushSList - 0x1001104c 0x11198 0xf198 0x352
InterlockedPushEntrySList - 0x10011050 0x1119c 0xf19c 0x355
RaiseException - 0x10011054 0x111a0 0xf1a0 0x43f
EnterCriticalSection - 0x10011058 0x111a4 0xf1a4 0x123
DeleteCriticalSection - 0x1001105c 0x111a8 0xf1a8 0x103
SetLastError - 0x10011060 0x111ac 0xf1ac 0x50b
GetLastError - 0x10011064 0x111b0 0xf1b0 0x24e
TlsSetValue - 0x10011068 0x111b4 0xf1b4 0x576
InitializeCriticalSectionAndSpinCount - 0x1001106c 0x111b8 0xf1b8 0x346
TlsAlloc - 0x10011070 0x111bc 0xf1bc 0x573
GetProcAddress - 0x10011074 0x111c0 0xf1c0 0x29b
Exports (81)
»
Api name EAT Address Ordinal
_CreateFrameInfo 0xe540 0x1
_CxxThrowException 0x4690 0x2
_EH_prolog 0xeb50 0x3
_FindAndUnlinkFrame 0xe570 0x4
_IsExceptionObjectToBeDestroyed 0x2ce0 0x5
_NLG_Dispatch2 0xb463 0x6
_NLG_Return 0xd0b7 0x7
_NLG_Return2 0xb46d 0x8
_SetWinRTOutOfMemoryExceptionCallback 0x2c20 0x9
__AdjustPointer 0x2ad0 0xa
__BuildCatchObject 0x3930 0xb
__BuildCatchObjectHelper 0x3800 0xc
__CxxDetectRethrow 0x3cb0 0xd
__CxxExceptionFilter 0x3ab0 0xe
__CxxFrameHandler 0xe660 0xf
__CxxFrameHandler2 0xe660 0x10
__CxxFrameHandler3 0xe660 0x11
__CxxLongjmpUnwind 0xe6a0 0x12
__CxxQueryExceptionSize 0x3e10 0x13
__CxxRegisterExceptionObject 0x3c00 0x14
__CxxUnregisterExceptionObject 0x3d00 0x15
__DestructExceptionObject 0x2c40 0x16
__FrameUnwindFilter 0x2bd0 0x17
__GetPlatformExceptionInfo 0x2b00 0x18
__RTCastToVoid 0x3e60 0x19
__RTDynamicCast 0x3f80 0x1a
__RTtypeid 0x3f00 0x1b
__TypeMatch 0x3420 0x1c
__current_exception 0x2ba0 0x1d
__current_exception_context 0x2bb0 0x1e
__intrinsic_setjmp 0xb260 0x1f
__processing_throw 0x2bc0 0x20
__report_gsfailure 0xeba0 0x21
__std_exception_copy 0x4470 0x22
__std_exception_destroy 0x44e0 0x23
__std_terminate 0x2c30 0x24
__std_type_info_compare 0x4500 0x25
__std_type_info_destroy_list 0x4660 0x26
__std_type_info_hash 0x4540 0x27
__std_type_info_name 0x4570 0x28
__telemetry_main_invoke_trigger 0x2670 0x29
__telemetry_main_return_trigger 0x2670 0x2a
__unDName 0x4d20 0x2b
__unDNameEx 0x4dc0 0x2c
__uncaught_exception 0x2b90 0x2d
__uncaught_exceptions 0x2b50 0x2e
__vcrt_GetModuleFileNameW 0x4bd0 0x2f
__vcrt_GetModuleHandleW 0x4bf0 0x30
__vcrt_InitializeCriticalSectionEx 0x4b80 0x31
__vcrt_LoadLibraryExW 0x4c00 0x32
_chkesp 0xb670 0x33
_except_handler2 0xae28 0x34
_except_handler3 0xaef8 0x35
_except_handler4_common 0xb500 0x36
_get_purecall_handler 0x4c80 0x37
_get_unexpected 0x4700 0x38
_global_unwind2 0xb330 0x39
_is_exception_typeof 0x2d10 0x3a
_local_unwind2 0xb396 0x3b
_local_unwind4 0xb030 0x3c
_longjmpex 0xb320 0x3d
_purecall 0x4c20 0x3e
_seh_longjmp_unwind 0xb004 0x40
_seh_longjmp_unwind4 0xb108 0x3f
_set_purecall_handler 0x4c40 0x41
_set_se_translator 0x4760 0x42
_setjmp3 0xb2a0 0x43
longjmp 0x26d0 0x44
memchr 0xd0e0 0x45
memcmp 0xbb10 0x46
memcpy 0xd190 0x47
memmove 0xd710 0x48
memset 0xdc90 0x49
set_unexpected 0x4720 0x4a
strchr 0xddf0 0x4b
strrchr 0xdf20 0x4c
strstr 0xe060 0x4d
unexpected 0x4740 0x4e
wcschr 0x26f0 0x4f
wcsrchr 0x2790 0x50
wcsstr 0x2840 0x51
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2016-08-18 22:17 (UTC+2)
Valid Until 2017-11-02 21:17 (UTC+1)
Algorithm sha1_rsa
Serial Number 33 00 00 01 40 96 A9 EE 70 56 FE CC 07 00 01 00 00 01 40
Thumbprint 98 ED 99 A6 78 86 D0 20 C5 64 92 3B 7D F2 5E 9A C0 19 DF 26
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
AccessibleHandler.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\AccessibleHandler.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 120.45 KB
MD5 f92586e9cc1f12223b7eeb1a8cd4323c Copy to Clipboard
SHA1 f5eb4ab2508f27613f4d85d798fa793bb0bd04b0 Copy to Clipboard
SHA256 a1a2bb03a7cfcea8944845a8fc12974482f44b44fd20be73298ffd630f65d8d0 Copy to Clipboard
SSDeep 1536:DkO/6RZFrpiS7ewflNGa35iOrjmwWTYP1KxBxZJByEJMBrsuLeLsWxcdaocACs0K:biRZFdBiussQ1MBjq2aocts03/7FE Copy to Clipboard
ImpHash 482ff01e5630e51d9cd891ddb67a1c5c Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x10006215
Size Of Code 0x11200
Size Of Initialized Data 0xb800
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:51:31+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename AccessibleHandler.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x10e37 0x11000 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.61
.orpc 0x10012000 0xd3 0x200 0x11400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 2.97
.rdata 0x10013000 0x79a2 0x7a00 0x11600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.2
.data 0x1001b000 0x130c 0xa00 0x19000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 2.33
.rsrc 0x1001d000 0x1368 0x1400 0x19a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.14
.reloc 0x1001f000 0x140c 0x1600 0x1ae00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.31
Imports (7)
»
KERNEL32.dll (77)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetLastError - 0x10013010 0x19e20 0x18420 0x25a
GetModuleFileNameW - 0x10013014 0x19e24 0x18424 0x26d
GetModuleHandleExW - 0x10013018 0x19e28 0x18428 0x270
EnterCriticalSection - 0x1001301c 0x19e2c 0x1842c 0x12e
LeaveCriticalSection - 0x10013020 0x19e30 0x18430 0x3b2
InitializeCriticalSectionEx - 0x10013024 0x19e34 0x18434 0x357
DeleteCriticalSection - 0x10013028 0x19e38 0x18438 0x10d
GetSystemDirectoryW - 0x1001302c 0x19e3c 0x1843c 0x2d9
FreeLibrary - 0x10013030 0x19e40 0x18440 0x1a7
GetProcAddress - 0x10013034 0x19e44 0x18444 0x2a7
LoadLibraryW - 0x10013038 0x19e48 0x18448 0x3b9
GetCurrentProcessId - 0x1001303c 0x19e4c 0x1844c 0x214
ReleaseActCtx - 0x10013040 0x19e50 0x18450 0x4a0
ActivateActCtx - 0x10013044 0x19e54 0x18454 0x2
DeactivateActCtx - 0x10013048 0x19e58 0x18458 0xff
CreateFileW - 0x1001304c 0x19e5c 0x1845c 0xc9
DecodePointer - 0x10013050 0x19e60 0x18460 0x106
DisableThreadLibraryCalls - 0x10013054 0x19e64 0x18464 0x11b
TerminateProcess - 0x10013058 0x19e68 0x18468 0x57c
CreateActCtxW - 0x1001305c 0x19e6c 0x1846c 0xae
GetCurrentProcess - 0x10013060 0x19e70 0x18470 0x213
SetFilePointerEx - 0x10013064 0x19e74 0x18474 0x514
GetConsoleMode - 0x10013068 0x19e78 0x18478 0x1f8
GetConsoleCP - 0x1001306c 0x19e7c 0x1847c 0x1e6
FlushFileBuffers - 0x10013070 0x19e80 0x18480 0x19b
WriteFile - 0x10013074 0x19e84 0x18484 0x605
SetStdHandle - 0x10013078 0x19e88 0x18488 0x53b
GetStringTypeW - 0x1001307c 0x19e8c 0x1848c 0x2d0
GetFileType - 0x10013080 0x19e90 0x18490 0x248
GetStdHandle - 0x10013084 0x19e94 0x18494 0x2cb
GetProcessHeap - 0x10013088 0x19e98 0x18498 0x2ad
LCMapStringW - 0x1001308c 0x19e9c 0x1849c 0x3a6
FreeEnvironmentStringsW - 0x10013090 0x19ea0 0x184a0 0x1a6
GetEnvironmentStringsW - 0x10013094 0x19ea4 0x184a4 0x231
GetCommandLineW - 0x10013098 0x19ea8 0x184a8 0x1d3
GetCommandLineA - 0x1001309c 0x19eac 0x184ac 0x1d2
GetCPInfo - 0x100130a0 0x19eb0 0x184b0 0x1bd
GetOEMCP - 0x100130a4 0x19eb4 0x184b4 0x290
GetACP - 0x100130a8 0x19eb8 0x184b8 0x1ae
IsValidCodePage - 0x100130ac 0x19ebc 0x184bc 0x382
FindNextFileA - 0x100130b0 0x19ec0 0x184c0 0x186
FindFirstFileExA - 0x100130b4 0x19ec4 0x184c4 0x176
FindClose - 0x100130b8 0x19ec8 0x184c8 0x171
HeapSize - 0x100130bc 0x19ecc 0x184cc 0x346
HeapReAlloc - 0x100130c0 0x19ed0 0x184d0 0x344
HeapAlloc - 0x100130c4 0x19ed4 0x184d4 0x33d
HeapFree - 0x100130c8 0x19ed8 0x184d8 0x341
WideCharToMultiByte - 0x100130cc 0x19edc 0x184dc 0x5f1
MultiByteToWideChar - 0x100130d0 0x19ee0 0x184e0 0x3e2
GetModuleFileNameA - 0x100130d4 0x19ee4 0x184e4 0x26c
ExitProcess - 0x100130d8 0x19ee8 0x184e8 0x15a
SetLastError - 0x100130dc 0x19eec 0x184ec 0x523
RtlUnwind - 0x100130e0 0x19ef0 0x184f0 0x4c4
InterlockedFlushSList - 0x100130e4 0x19ef4 0x184f4 0x363
RaiseException - 0x100130e8 0x19ef8 0x184f8 0x455
WriteConsoleW - 0x100130ec 0x19efc 0x184fc 0x604
LoadLibraryExW - 0x100130f0 0x19f00 0x18500 0x3b8
TlsFree - 0x100130f4 0x19f04 0x18504 0x58f
TlsSetValue - 0x100130f8 0x19f08 0x18508 0x591
TlsGetValue - 0x100130fc 0x19f0c 0x1850c 0x590
TlsAlloc - 0x10013100 0x19f10 0x18510 0x58e
InitializeCriticalSectionAndSpinCount - 0x10013104 0x19f14 0x18514 0x356
CloseHandle - 0x10013108 0x19f18 0x18518 0x85
SetEvent - 0x1001310c 0x19f1c 0x1851c 0x507
ResetEvent - 0x10013110 0x19f20 0x18520 0x4b8
WaitForSingleObjectEx - 0x10013114 0x19f24 0x18524 0x5c8
CreateEventW - 0x10013118 0x19f28 0x18528 0xbd
GetModuleHandleW - 0x1001311c 0x19f2c 0x1852c 0x271
UnhandledExceptionFilter - 0x10013120 0x19f30 0x18530 0x59d
SetUnhandledExceptionFilter - 0x10013124 0x19f34 0x18534 0x55e
IsProcessorFeaturePresent - 0x10013128 0x19f38 0x18538 0x37d
QueryPerformanceCounter - 0x1001312c 0x19f3c 0x1853c 0x440
GetCurrentThreadId - 0x10013130 0x19f40 0x18540 0x218
GetSystemTimeAsFileTime - 0x10013134 0x19f44 0x18544 0x2e2
InitializeSListHead - 0x10013138 0x19f48 0x18548 0x35a
IsDebuggerPresent - 0x1001313c 0x19f4c 0x1854c 0x376
GetStartupInfoW - 0x10013140 0x19f50 0x18550 0x2c9
USER32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
NotifyWinEvent - 0x100131fc 0x1a00c 0x1860c 0x287
ADVAPI32.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegCreateKeyExW - 0x10013000 0x19e10 0x18410 0x262
RegCloseKey - 0x10013004 0x19e14 0x18414 0x259
RegSetValueExW - 0x10013008 0x19e18 0x18418 0x2a7
ole32.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoRegisterPSClsid - 0x10013204 0x1a014 0x18614 0x77
StringFromGUID2 - 0x10013208 0x1a018 0x18618 0x1ca
CoGetStdMarshalEx - 0x1001320c 0x1a01c 0x1861c 0x56
CoTaskMemFree - 0x10013210 0x1a020 0x18620 0x89
CoGetClassObject - 0x10013214 0x1a024 0x18624 0x41
CoRevokeClassObject - 0x10013218 0x1a028 0x18628 0x7f
CoRegisterClassObject - 0x1001321c 0x1a02c 0x1862c 0x73
OLEAUT32.dll (15)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VARIANT_UserUnmarshal 0x121 0x10013148 0x19f58 0x18558 -
VARIANT_UserFree 0x122 0x1001314c 0x19f5c 0x1855c -
SysAllocStringLen 0x4 0x10013150 0x19f60 0x18560 -
SysFreeString 0x6 0x10013154 0x19f64 0x18564 -
SysStringLen 0x7 0x10013158 0x19f68 0x18568 -
VariantClear 0x9 0x1001315c 0x19f6c 0x1856c -
VariantCopy 0xa 0x10013160 0x19f70 0x18570 -
CreateStdDispatch 0x20 0x10013164 0x19f74 0x18574 -
LoadTypeLibEx 0xb7 0x10013168 0x19f78 0x18578 -
VARIANT_UserSize 0x11f 0x1001316c 0x19f7c 0x1857c -
BSTR_UserUnmarshal 0x11d 0x10013170 0x19f80 0x18580 -
BSTR_UserMarshal 0x11c 0x10013174 0x19f84 0x18584 -
BSTR_UserSize 0x11b 0x10013178 0x19f88 0x18588 -
BSTR_UserFree 0x11e 0x1001317c 0x19f8c 0x1858c -
VARIANT_UserMarshal 0x120 0x10013180 0x19f90 0x18590 -
SHLWAPI.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PathAppendW - 0x100131ec 0x19ffc 0x185fc 0x37
PathRemoveFileSpecW - 0x100131f0 0x1a000 0x18600 0x8f
SHDeleteKeyW - 0x100131f4 0x1a004 0x18604 0xb8
RPCRT4.dll (24)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CStdStubBuffer_Invoke - 0x10013188 0x19f98 0x18598 0x6
CStdStubBuffer_Disconnect - 0x1001318c 0x19f9c 0x1859c 0x5
CStdStubBuffer_Connect - 0x10013190 0x19fa0 0x185a0 0x1
CStdStubBuffer_AddRef - 0x10013194 0x19fa4 0x185a4 0x0
CStdStubBuffer_CountRefs - 0x10013198 0x19fa8 0x185a8 0x2
NdrMesTypeDecode2 - 0x1001319c 0x19fac 0x185ac 0x101
NdrMesTypeEncode2 - 0x100131a0 0x19fb0 0x185b0 0x103
CStdStubBuffer_DebugServerQueryInterface - 0x100131a4 0x19fb4 0x185b4 0x3
CStdStubBuffer_DebugServerRelease - 0x100131a8 0x19fb8 0x185b8 0x4
NdrOleAllocate - 0x100131ac 0x19fbc 0x185bc 0x110
NdrOleFree - 0x100131b0 0x19fc0 0x185c0 0x111
IUnknown_QueryInterface_Proxy - 0x100131b4 0x19fc4 0x185c4 0x10
CStdStubBuffer_IsIIDSupported - 0x100131b8 0x19fc8 0x185c8 0x7
IUnknown_AddRef_Proxy - 0x100131bc 0x19fcc 0x185cc 0xf
IUnknown_Release_Proxy - 0x100131c0 0x19fd0 0x185d0 0x11
NdrCStdStubBuffer_Release - 0x100131c4 0x19fd4 0x185d4 0x9f
NdrDllGetClassObject - 0x100131c8 0x19fd8 0x185d8 0xd6
NdrDllRegisterProxy - 0x100131cc 0x19fdc 0x185dc 0xd7
NdrDllUnregisterProxy - 0x100131d0 0x19fe0 0x185e0 0xd8
MesEncodeDynBufferHandleCreate - 0x100131d4 0x19fe4 0x185e4 0x86
MesDecodeBufferHandleCreate - 0x100131d8 0x19fe8 0x185e8 0x84
MesHandleFree - 0x100131dc 0x19fec 0x185ec 0x89
CStdStubBuffer_QueryInterface - 0x100131e0 0x19ff0 0x185f0 0x8
NdrDllCanUnloadNow - 0x100131e4 0x19ff4 0x185f4 0xd5
Exports (4)
»
Api name EAT Address Ordinal
DllCanUnloadNow 0x38f4 0x1
DllGetClassObject 0x390d 0x2
DllRegisterServer 0x3964 0x3
DllUnregisterServer 0x3978 0x4
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
AccessibleMarshal.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\AccessibleMarshal.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 25.45 KB
MD5 a7fabf3dce008915cee4ffc338fa1ce6 Copy to Clipboard
SHA1 f411fb41181c79fba0516d5674d07444e98e7c92 Copy to Clipboard
SHA256 d368eb240106f87188c4f2ae30db793a2d250d9344f0e0267d4f6a58e68152ad Copy to Clipboard
SSDeep 384:KuAjyb0Xc6JzVuLoW2XDOc3TXg1hjsvDG8A3OPLon07zS:BEygs6RV6oW2Xd38njiDG8Mj Copy to Clipboard
ImpHash 04c7830c791f96237da201cdde5adf9d Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x10001430
Size Of Code 0x1000
Size Of Initialized Data 0x3800
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:51:24+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename AccessibleMarshal.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xd66 0xe00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.04
.orpc 0x10002000 0xd3 0x200 0x1200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 2.92
.rdata 0x10003000 0x13e8 0x1400 0x1400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.74
.data 0x10005000 0x440 0x200 0x2800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 1.57
.rsrc 0x10006000 0x19f0 0x1a00 0x2a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.26
.reloc 0x10008000 0x23c 0x400 0x4400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 4.23
Imports (5)
»
KERNEL32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
DisableThreadLibraryCalls - 0x10003000 0x3ea8 0x22a8 0x11b
GetCurrentProcess - 0x10003004 0x3eac 0x22ac 0x213
IsProcessorFeaturePresent - 0x10003008 0x3eb0 0x22b0 0x37d
SetUnhandledExceptionFilter - 0x1000300c 0x3eb4 0x22b4 0x55e
UnhandledExceptionFilter - 0x10003010 0x3eb8 0x22b8 0x59d
IsDebuggerPresent - 0x10003014 0x3ebc 0x22bc 0x376
InitializeSListHead - 0x10003018 0x3ec0 0x22c0 0x35a
GetSystemTimeAsFileTime - 0x1000301c 0x3ec4 0x22c4 0x2e2
GetCurrentThreadId - 0x10003020 0x3ec8 0x22c8 0x218
GetCurrentProcessId - 0x10003024 0x3ecc 0x22cc 0x214
QueryPerformanceCounter - 0x10003028 0x3ed0 0x22d0 0x440
TerminateProcess - 0x1000302c 0x3ed4 0x22d4 0x57c
RPCRT4.dll (19)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
NdrDllRegisterProxy - 0x10003048 0x3ef0 0x22f0 0xd7
NdrDllUnregisterProxy - 0x1000304c 0x3ef4 0x22f4 0xd8
CStdStubBuffer_DebugServerQueryInterface - 0x10003050 0x3ef8 0x22f8 0x3
NdrDllGetClassObject - 0x10003054 0x3efc 0x22fc 0xd6
NdrCStdStubBuffer_Release - 0x10003058 0x3f00 0x2300 0x9f
IUnknown_Release_Proxy - 0x1000305c 0x3f04 0x2304 0x11
NdrDllCanUnloadNow - 0x10003060 0x3f08 0x2308 0xd5
CStdStubBuffer_CountRefs - 0x10003064 0x3f0c 0x230c 0x2
IUnknown_QueryInterface_Proxy - 0x10003068 0x3f10 0x2310 0x10
CStdStubBuffer_IsIIDSupported - 0x1000306c 0x3f14 0x2314 0x7
CStdStubBuffer_Invoke - 0x10003070 0x3f18 0x2318 0x6
IUnknown_AddRef_Proxy - 0x10003074 0x3f1c 0x231c 0xf
NdrOleAllocate - 0x10003078 0x3f20 0x2320 0x110
NdrOleFree - 0x1000307c 0x3f24 0x2324 0x111
CStdStubBuffer_QueryInterface - 0x10003080 0x3f28 0x2328 0x8
CStdStubBuffer_Disconnect - 0x10003084 0x3f2c 0x232c 0x5
CStdStubBuffer_AddRef - 0x10003088 0x3f30 0x2330 0x0
CStdStubBuffer_Connect - 0x1000308c 0x3f34 0x2334 0x1
CStdStubBuffer_DebugServerRelease - 0x10003090 0x3f38 0x2338 0x4
OLEAUT32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
BSTR_UserFree 0x11e 0x10003034 0x3edc 0x22dc -
BSTR_UserUnmarshal 0x11d 0x10003038 0x3ee0 0x22e0 -
BSTR_UserMarshal 0x11c 0x1000303c 0x3ee4 0x22e4 -
BSTR_UserSize 0x11b 0x10003040 0x3ee8 0x22e8 -
VCRUNTIME140.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
memcmp - 0x10003098 0x3f40 0x2340 0x45
memset - 0x1000309c 0x3f44 0x2344 0x48
_except_handler4_common - 0x100030a0 0x3f48 0x2348 0x35
__std_type_info_destroy_list - 0x100030a4 0x3f4c 0x234c 0x25
api-ms-win-crt-runtime-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_cexit - 0x100030ac 0x3f54 0x2354 0x17
_execute_onexit_table - 0x100030b0 0x3f58 0x2358 0x24
_configure_narrow_argv - 0x100030b4 0x3f5c 0x235c 0x19
_initialize_narrow_environment - 0x100030b8 0x3f60 0x2360 0x35
_seh_filter_dll - 0x100030bc 0x3f64 0x2364 0x41
_initterm_e - 0x100030c0 0x3f68 0x2368 0x39
_initterm - 0x100030c4 0x3f6c 0x236c 0x38
_initialize_onexit_table - 0x100030c8 0x3f70 0x2370 0x36
Exports (4)
»
Api name EAT Address Ordinal
DllCanUnloadNow 0x1045 0x1
DllGetClassObject 0x1051 0x2
DllRegisterServer 0x1096 0x3
DllUnregisterServer 0x10ad 0x4
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
breakpadinjector.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\breakpadinjector.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 114.95 KB
MD5 a436472b0a7b2eb2c4f53fdf512d0cf8 Copy to Clipboard
SHA1 963fe8ae9ec8819ef2a674dbf7c6a92dbb6b46a9 Copy to Clipboard
SHA256 87ed943d2f06d9ca8824789405b412e770fe84454950ec7e96105f756d858e52 Copy to Clipboard
SSDeep 3072:9b9ffsTV5n8cSQQtys6FXCVnx+IMD6eN07e:P25V/QQs6WTMex7e Copy to Clipboard
ImpHash 4a3df6697eb01df644a4f605d44d6dfc Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x10001074
Size Of Code 0x11c00
Size Of Initialized Data 0x9800
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:53:18+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename breakpadinjector.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x11a91 0x11c00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.65
.rdata 0x10013000 0x6cdc 0x6e00 0x12000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.28
.data 0x1001a000 0x12ac 0xa00 0x18e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 2.37
.rsrc 0x1001c000 0x388 0x400 0x19800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.94
.reloc 0x1001d000 0x10a8 0x1200 0x19c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.31
Imports (1)
»
KERNEL32.dll (80)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CloseHandle - 0x10013000 0x195c8 0x185c8 0x85
OpenThread - 0x10013004 0x195cc 0x185cc 0x407
VirtualQueryEx - 0x10013008 0x195d0 0x185d0 0x5bf
ReadProcessMemory - 0x1001300c 0x195d4 0x185d4 0x468
GetModuleHandleW - 0x10013010 0x195d8 0x185d8 0x271
GetProcAddress - 0x10013014 0x195dc 0x185dc 0x2a7
CreateFileW - 0x10013018 0x195e0 0x185e0 0xc9
WriteFile - 0x1001301c 0x195e4 0x185e4 0x605
GetLastError - 0x10013020 0x195e8 0x185e8 0x25a
SetNamedPipeHandleState - 0x10013024 0x195ec 0x185ec 0x52c
TransactNamedPipe - 0x10013028 0x195f0 0x185f0 0x593
WaitNamedPipeW - 0x1001302c 0x195f4 0x185f4 0x5ce
SetEvent - 0x10013030 0x195f8 0x185f8 0x507
ResetEvent - 0x10013034 0x195fc 0x185fc 0x4b8
WaitForMultipleObjects - 0x10013038 0x19600 0x18600 0x5c5
GetCurrentProcess - 0x1001303c 0x19604 0x18604 0x213
GetCurrentProcessId - 0x10013040 0x19608 0x18608 0x214
GetCurrentThreadId - 0x10013044 0x1960c 0x1860c 0x218
InitializeCriticalSection - 0x10013048 0x19610 0x18610 0x355
EnterCriticalSection - 0x1001304c 0x19614 0x18614 0x12e
LeaveCriticalSection - 0x10013050 0x19618 0x18618 0x3b2
DeleteCriticalSection - 0x10013054 0x1961c 0x1861c 0x10d
FreeLibrary - 0x10013058 0x19620 0x18620 0x1a7
LoadLibraryW - 0x1001305c 0x19624 0x18624 0x3b9
RtlCaptureContext - 0x10013060 0x19628 0x18628 0x4bf
SetUnhandledExceptionFilter - 0x10013064 0x1962c 0x1862c 0x55e
ReleaseSemaphore - 0x10013068 0x19630 0x18630 0x4a6
WaitForSingleObject - 0x1001306c 0x19634 0x18634 0x5c7
CreateSemaphoreW - 0x10013070 0x19638 0x18638 0xe9
CreateThread - 0x10013074 0x1963c 0x1863c 0xf0
GetProcessId - 0x10013078 0x19640 0x18640 0x2af
InitializeSListHead - 0x1001307c 0x19644 0x18644 0x35a
IsDebuggerPresent - 0x10013080 0x19648 0x18648 0x376
UnhandledExceptionFilter - 0x10013084 0x1964c 0x1864c 0x59d
GetStartupInfoW - 0x10013088 0x19650 0x18650 0x2c9
IsProcessorFeaturePresent - 0x1001308c 0x19654 0x18654 0x37d
TerminateProcess - 0x10013090 0x19658 0x18658 0x57c
RaiseException - 0x10013094 0x1965c 0x1865c 0x455
RtlUnwind - 0x10013098 0x19660 0x18660 0x4c4
InterlockedFlushSList - 0x1001309c 0x19664 0x18664 0x363
SetLastError - 0x100130a0 0x19668 0x18668 0x523
EncodePointer - 0x100130a4 0x1966c 0x1866c 0x12a
InitializeCriticalSectionAndSpinCount - 0x100130a8 0x19670 0x18670 0x356
TlsAlloc - 0x100130ac 0x19674 0x18674 0x58e
TlsGetValue - 0x100130b0 0x19678 0x18678 0x590
TlsSetValue - 0x100130b4 0x1967c 0x1867c 0x591
TlsFree - 0x100130b8 0x19680 0x18680 0x58f
LoadLibraryExW - 0x100130bc 0x19684 0x18684 0x3b8
ExitProcess - 0x100130c0 0x19688 0x18688 0x15a
GetModuleHandleExW - 0x100130c4 0x1968c 0x1868c 0x270
MultiByteToWideChar - 0x100130c8 0x19690 0x18690 0x3e2
WideCharToMultiByte - 0x100130cc 0x19694 0x18694 0x5f1
GetModuleFileNameA - 0x100130d0 0x19698 0x18698 0x26c
HeapFree - 0x100130d4 0x1969c 0x1869c 0x341
HeapAlloc - 0x100130d8 0x196a0 0x186a0 0x33d
LCMapStringW - 0x100130dc 0x196a4 0x186a4 0x3a6
GetStdHandle - 0x100130e0 0x196a8 0x186a8 0x2cb
GetFileType - 0x100130e4 0x196ac 0x186ac 0x248
GetACP - 0x100130e8 0x196b0 0x186b0 0x1ae
FindClose - 0x100130ec 0x196b4 0x186b4 0x171
FindFirstFileExA - 0x100130f0 0x196b8 0x186b8 0x176
FindNextFileA - 0x100130f4 0x196bc 0x186bc 0x186
IsValidCodePage - 0x100130f8 0x196c0 0x186c0 0x382
GetOEMCP - 0x100130fc 0x196c4 0x186c4 0x290
GetCPInfo - 0x10013100 0x196c8 0x186c8 0x1bd
GetCommandLineA - 0x10013104 0x196cc 0x186cc 0x1d2
GetCommandLineW - 0x10013108 0x196d0 0x186d0 0x1d3
GetEnvironmentStringsW - 0x1001310c 0x196d4 0x186d4 0x231
FreeEnvironmentStringsW - 0x10013110 0x196d8 0x186d8 0x1a6
GetProcessHeap - 0x10013114 0x196dc 0x186dc 0x2ad
GetStringTypeW - 0x10013118 0x196e0 0x186e0 0x2d0
FlushFileBuffers - 0x1001311c 0x196e4 0x186e4 0x19b
GetConsoleCP - 0x10013120 0x196e8 0x186e8 0x1e6
GetConsoleMode - 0x10013124 0x196ec 0x186ec 0x1f8
SetStdHandle - 0x10013128 0x196f0 0x186f0 0x53b
HeapSize - 0x1001312c 0x196f4 0x186f4 0x346
HeapReAlloc - 0x10013130 0x196f8 0x186f8 0x344
SetFilePointerEx - 0x10013134 0x196fc 0x186fc 0x514
WriteConsoleW - 0x10013138 0x19700 0x18700 0x604
DecodePointer - 0x1001313c 0x19704 0x18704 0x106
Exports (1)
»
Api name EAT Address Ordinal
Start 0x107a 0x1
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
freebl3.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\freebl3.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 326.45 KB
MD5 60acd24430204ad2dc7f148b8cfe9bdc Copy to Clipboard
SHA1 989f377b9117d7cb21cbe92a4117f88f9c7693d9 Copy to Clipboard
SHA256 9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97 Copy to Clipboard
SSDeep 6144:6cYBCU/bEPU6Rc5xUqc+z75nv4F0GHrIraqqDL6XPSed:67WRCB7zl4F0I4qn6R Copy to Clipboard
ImpHash 2c54251b196d9e0cc804a7061f60558c Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x1003de0e
Size Of Code 0x3d800
Size Of Initialized Data 0x16600
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:53:59+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename freebl3.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x3d764 0x3d800 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.61
.rdata 0x1003f000 0xfefc 0x10000 0x3dc00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 6.41
.data 0x1004f000 0x482c 0x400 0x4dc00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 1.28
.rsrc 0x10054000 0x378 0x400 0x4e000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.89
.reloc 0x10055000 0x16f4 0x1800 0x4e400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.56
Imports (9)
»
nss3.dll (30)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PORT_GetError_Util - 0x1003f0bc 0x4e844 0x4d444 0x20b
PR_NewLock - 0x1003f0c0 0x4e848 0x4d448 0x311
PR_DestroyLock - 0x1003f0c4 0x4e84c 0x4d44c 0x26b
PR_Lock - 0x1003f0c8 0x4e850 0x4d450 0x303
PR_Unlock - 0x1003f0cc 0x4e854 0x4d454 0x383
SECITEM_FreeItem_Util - 0x1003f0d0 0x4e858 0x4d458 0x3b2
SECITEM_ZfreeItem_Util - 0x1003f0d4 0x4e85c 0x4d45c 0x3b8
SECITEM_CopyItem_Util - 0x1003f0d8 0x4e860 0x4d460 0x3ad
PR_NotifyCondVar - 0x1003f0dc 0x4e864 0x4d464 0x321
NSS_SecureMemcmpZero - 0x1003f0e0 0x4e868 0x4d468 0x11d
PORT_ZAllocAlignedOffset_Util - 0x1003f0e4 0x4e86c 0x4d46c 0x21b
SECITEM_CompareItem_Util - 0x1003f0e8 0x4e870 0x4d470 0x3ab
PR_NewCondVar - 0x1003f0ec 0x4e874 0x4d474 0x310
PR_DestroyCondVar - 0x1003f0f0 0x4e878 0x4d478 0x269
PR_WaitCondVar - 0x1003f0f4 0x4e87c 0x4d47c 0x388
PORT_ZAlloc_Util - 0x1003f0f8 0x4e880 0x4d480 0x21c
SECITEM_AllocItem_Util - 0x1003f0fc 0x4e884 0x4d484 0x3a9
PR_NotifyAllCondVar - 0x1003f100 0x4e888 0x4d488 0x320
SECOID_FindOIDTag_Util - 0x1003f104 0x4e88c 0x4d48c 0x3f9
PORT_ArenaAlloc_Util - 0x1003f108 0x4e890 0x4d490 0x1fc
PORT_ArenaZAlloc_Util - 0x1003f10c 0x4e894 0x4d494 0x204
PORT_FreeArena_Util - 0x1003f110 0x4e898 0x4d498 0x208
PORT_NewArena_Util - 0x1003f114 0x4e89c 0x4d49c 0x20e
NSS_SecureMemcmp - 0x1003f118 0x4e8a0 0x4d4a0 0x11c
PR_GetEnvSecure - 0x1003f11c 0x4e8a4 0x4d4a4 0x2b0
PR_CallOnce - 0x1003f120 0x4e8a8 0x4d4a8 0x240
PORT_SetError_Util - 0x1003f124 0x4e8ac 0x4d4ac 0x212
PORT_ZFree_Util - 0x1003f128 0x4e8b0 0x4d4b0 0x21d
PORT_Free_Util - 0x1003f12c 0x4e8b4 0x4d4b4 0x209
PORT_Alloc_Util - 0x1003f130 0x4e8b8 0x4d4b8 0x1fa
KERNEL32.dll (18)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
IsDebuggerPresent - 0x1003f008 0x4e790 0x4d390 0x376
InitializeSListHead - 0x1003f00c 0x4e794 0x4d394 0x35a
DisableThreadLibraryCalls - 0x1003f010 0x4e798 0x4d398 0x11b
GetSystemTimeAsFileTime - 0x1003f014 0x4e79c 0x4d39c 0x2e2
IsProcessorFeaturePresent - 0x1003f018 0x4e7a0 0x4d3a0 0x37d
TerminateProcess - 0x1003f01c 0x4e7a4 0x4d3a4 0x57c
UnhandledExceptionFilter - 0x1003f020 0x4e7a8 0x4d3a8 0x59d
GetLogicalDrives - 0x1003f024 0x4e7ac 0x4d3ac 0x261
GetVolumeInformationA - 0x1003f028 0x4e7b0 0x4d3b0 0x314
QueryPerformanceCounter - 0x1003f02c 0x4e7b4 0x4d3b4 0x440
GetCurrentProcess - 0x1003f030 0x4e7b8 0x4d3b8 0x213
GetDiskFreeSpaceA - 0x1003f034 0x4e7bc 0x4d3bc 0x222
SetUnhandledExceptionFilter - 0x1003f038 0x4e7c0 0x4d3c0 0x55e
GetCurrentProcessId - 0x1003f03c 0x4e7c4 0x4d3c4 0x214
GetComputerNameA - 0x1003f040 0x4e7c8 0x4d3c8 0x1d8
GlobalMemoryStatus - 0x1003f044 0x4e7cc 0x4d3cc 0x331
GetTickCount - 0x1003f048 0x4e7d0 0x4d3d0 0x300
GetCurrentThreadId - 0x1003f04c 0x4e7d4 0x4d3d4 0x218
ADVAPI32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SystemFunction036 - 0x1003f000 0x4e788 0x4d388 0x31f
VCRUNTIME140.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
memset - 0x1003f054 0x4e7dc 0x4d3dc 0x48
__std_type_info_destroy_list - 0x1003f058 0x4e7e0 0x4d3e0 0x25
_except_handler4_common - 0x1003f05c 0x4e7e4 0x4d3e4 0x35
memcmp - 0x1003f060 0x4e7e8 0x4d3e8 0x45
memcpy - 0x1003f064 0x4e7ec 0x4d3ec 0x46
api-ms-win-crt-heap-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
calloc - 0x1003f06c 0x4e7f4 0x4d3f4 0x17
free - 0x1003f070 0x4e7f8 0x4d3f8 0x18
malloc - 0x1003f074 0x4e7fc 0x4d3fc 0x19
api-ms-win-crt-string-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_strdup - 0x1003f0a4 0x4e82c 0x4d42c 0x29
api-ms-win-crt-runtime-l1-1-0.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_cexit - 0x1003f07c 0x4e804 0x4d404 0x17
_initialize_onexit_table - 0x1003f080 0x4e808 0x4d408 0x36
_initialize_narrow_environment - 0x1003f084 0x4e80c 0x4d40c 0x35
_configure_narrow_argv - 0x1003f088 0x4e810 0x4d410 0x19
_seh_filter_dll - 0x1003f08c 0x4e814 0x4d414 0x41
_initterm_e - 0x1003f090 0x4e818 0x4d418 0x39
_initterm - 0x1003f094 0x4e81c 0x4d41c 0x38
_execute_onexit_table - 0x1003f098 0x4e820 0x4d420 0x24
abort - 0x1003f09c 0x4e824 0x4d424 0x57
api-ms-win-crt-utility-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
rand - 0x1003f0b4 0x4e83c 0x4d43c 0x1b
api-ms-win-crt-time-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_time64 - 0x1003f0ac 0x4e834 0x4d434 0x30
Exports (1)
»
Api name EAT Address Ordinal
FREEBL_GetVector 0x1eeb5 0x1
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
IA2Marshal.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\IA2Marshal.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 68.95 KB
MD5 5243f66ef4595d9d8902069eed8777e2 Copy to Clipboard
SHA1 1fb7f82cd5f1376c5378cd88f853727ab1cc439e Copy to Clipboard
SHA256 621f38bd19f62c9ce6826d492ecdf710c00bbdcf1fb4e4815883f29f1431dfda Copy to Clipboard
SSDeep 768:3n8PHF564hn4wva3AVqH5PmE0SjA6QM0avrDG8MR43:38th4wvaQVE5PRl0xs Copy to Clipboard
ImpHash dfcb01dae2deff7d099a4f9eeaf41845 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x100024ae
Size Of Code 0x1400
Size Of Initialized Data 0xde00
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:51:38+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename IA2Marshal.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.orpc 0x10001000 0x474 0x600 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.36
.text 0x10002000 0xde6 0xe00 0xa00 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.15
.rdata 0x10003000 0x518e 0x5200 0x1800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.32
.data 0x10009000 0xbb0 0xa00 0x6a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 1.94
.rsrc 0x1000a000 0x7614 0x7800 0x7400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.87
.reloc 0x10012000 0x8d8 0xa00 0xec00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 5.8
Imports (6)
»
KERNEL32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
DisableThreadLibraryCalls - 0x10003000 0x7b80 0x6380 0x11b
GetCurrentProcess - 0x10003004 0x7b84 0x6384 0x213
IsProcessorFeaturePresent - 0x10003008 0x7b88 0x6388 0x37d
SetUnhandledExceptionFilter - 0x1000300c 0x7b8c 0x638c 0x55e
UnhandledExceptionFilter - 0x10003010 0x7b90 0x6390 0x59d
IsDebuggerPresent - 0x10003014 0x7b94 0x6394 0x376
InitializeSListHead - 0x10003018 0x7b98 0x6398 0x35a
GetSystemTimeAsFileTime - 0x1000301c 0x7b9c 0x639c 0x2e2
GetCurrentThreadId - 0x10003020 0x7ba0 0x63a0 0x218
GetCurrentProcessId - 0x10003024 0x7ba4 0x63a4 0x214
QueryPerformanceCounter - 0x10003028 0x7ba8 0x63a8 0x440
TerminateProcess - 0x1000302c 0x7bac 0x63ac 0x57c
RPCRT4.dll (22)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
NdrDllUnregisterProxy - 0x10003058 0x7bd8 0x63d8 0xd8
NdrStubForwardingFunction - 0x1000305c 0x7bdc 0x63dc 0x140
NdrDllRegisterProxy - 0x10003060 0x7be0 0x63e0 0xd7
NdrOleFree - 0x10003064 0x7be4 0x63e4 0x111
NdrStubCall2 - 0x10003068 0x7be8 0x63e8 0x13f
IUnknown_QueryInterface_Proxy - 0x1000306c 0x7bec 0x63ec 0x10
NdrDllCanUnloadNow - 0x10003070 0x7bf0 0x63f0 0xd5
NdrDllGetClassObject - 0x10003074 0x7bf4 0x63f4 0xd6
NdrCStdStubBuffer2_Release - 0x10003078 0x7bf8 0x63f8 0x9e
NdrCStdStubBuffer_Release - 0x1000307c 0x7bfc 0x63fc 0x9f
CStdStubBuffer_DebugServerRelease - 0x10003080 0x7c00 0x6400 0x4
CStdStubBuffer_Invoke - 0x10003084 0x7c04 0x6404 0x6
CStdStubBuffer_DebugServerQueryInterface - 0x10003088 0x7c08 0x6408 0x3
CStdStubBuffer_CountRefs - 0x1000308c 0x7c0c 0x640c 0x2
NdrOleAllocate - 0x10003090 0x7c10 0x6410 0x110
IUnknown_AddRef_Proxy - 0x10003094 0x7c14 0x6414 0xf
IUnknown_Release_Proxy - 0x10003098 0x7c18 0x6418 0x11
CStdStubBuffer_QueryInterface - 0x1000309c 0x7c1c 0x641c 0x8
CStdStubBuffer_IsIIDSupported - 0x100030a0 0x7c20 0x6420 0x7
CStdStubBuffer_AddRef - 0x100030a4 0x7c24 0x6424 0x0
CStdStubBuffer_Connect - 0x100030a8 0x7c28 0x6428 0x1
CStdStubBuffer_Disconnect - 0x100030ac 0x7c2c 0x642c 0x5
ole32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
HWND_UserMarshal - 0x100030ec 0x7c6c 0x646c 0xfb
HWND_UserSize - 0x100030f0 0x7c70 0x6470 0xfd
HWND_UserUnmarshal - 0x100030f4 0x7c74 0x6474 0xff
HWND_UserFree - 0x100030f8 0x7c78 0x6478 0xf9
OLEAUT32.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
VARIANT_UserFree 0x122 0x10003034 0x7bb4 0x63b4 -
VARIANT_UserUnmarshal 0x121 0x10003038 0x7bb8 0x63b8 -
VARIANT_UserSize 0x11f 0x1000303c 0x7bbc 0x63bc -
BSTR_UserFree 0x11e 0x10003040 0x7bc0 0x63c0 -
BSTR_UserUnmarshal 0x11d 0x10003044 0x7bc4 0x63c4 -
BSTR_UserMarshal 0x11c 0x10003048 0x7bc8 0x63c8 -
BSTR_UserSize 0x11b 0x1000304c 0x7bcc 0x63cc -
VARIANT_UserMarshal 0x120 0x10003050 0x7bd0 0x63d0 -
VCRUNTIME140.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
memset - 0x100030b4 0x7c34 0x6434 0x48
__std_type_info_destroy_list - 0x100030b8 0x7c38 0x6438 0x25
_except_handler4_common - 0x100030bc 0x7c3c 0x643c 0x35
memcmp - 0x100030c0 0x7c40 0x6440 0x45
api-ms-win-crt-runtime-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_initialize_onexit_table - 0x100030c8 0x7c48 0x6448 0x36
_initterm_e - 0x100030cc 0x7c4c 0x644c 0x39
_initterm - 0x100030d0 0x7c50 0x6450 0x38
_execute_onexit_table - 0x100030d4 0x7c54 0x6454 0x24
_initialize_narrow_environment - 0x100030d8 0x7c58 0x6458 0x35
_configure_narrow_argv - 0x100030dc 0x7c5c 0x645c 0x19
_cexit - 0x100030e0 0x7c60 0x6460 0x17
_seh_filter_dll - 0x100030e4 0x7c64 0x6464 0x41
Exports (5)
»
Api name EAT Address Ordinal
DllCanUnloadNow 0x2028 0x1
DllGetClassObject 0x2034 0x2
DllRegisterServer 0x2089 0x3
DllUnregisterServer 0x20b0 0x4
GetProxyDllInfo 0x20d7 0x5
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
ldap60.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\ldap60.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 128.95 KB
MD5 5a49ebf1da3d5971b62a4fd295a71ecf Copy to Clipboard
SHA1 40917474ef7914126d62ba7cdbf6cf54d227aa20 Copy to Clipboard
SHA256 2b128b3702f8509f35cad0d657c9a00f0487b93d70336df229f8588fba6ba926 Copy to Clipboard
SSDeep 3072:qgXCFTvwqiiynFa6zqeqQZ06DdEH4sq9gHNaIkIQhEwe:qdvwqMFbOePIP/zkIQ2h Copy to Clipboard
ImpHash 5c16cf7787e29e0a376fecc08a88e484 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x10018f20
Size Of Code 0x18800
Size Of Initialized Data 0x6600
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:52:58+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename ldap60.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1873a 0x18800 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.39
.rdata 0x1001a000 0x40c2 0x4200 0x18c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.43
.data 0x1001f000 0x146c 0xa00 0x1ce00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 5.92
.rsrc 0x10021000 0x378 0x400 0x1d800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.88
.reloc 0x10022000 0x9c8 0xa00 0x1dc00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.53
Imports (10)
»
KERNEL32.dll (27)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetLastError - 0x1001a000 0x1d9a4 0x1c5a4 0x25a
SetLastError - 0x1001a004 0x1d9a8 0x1c5a8 0x523
InitializeCriticalSection - 0x1001a008 0x1d9ac 0x1c5ac 0x355
EnterCriticalSection - 0x1001a00c 0x1d9b0 0x1c5b0 0x12e
LeaveCriticalSection - 0x1001a010 0x1d9b4 0x1c5b4 0x3b2
Sleep - 0x1001a014 0x1d9b8 0x1c5b8 0x56d
FreeLibrary - 0x1001a018 0x1d9bc 0x1c5bc 0x1a7
GetProcAddress - 0x1001a01c 0x1d9c0 0x1c5c0 0x2a7
LoadLibraryA - 0x1001a020 0x1d9c4 0x1c5c4 0x3b6
CloseHandle - 0x1001a024 0x1d9c8 0x1c5c8 0x85
ReleaseMutex - 0x1001a028 0x1d9cc 0x1c5cc 0x4a2
WaitForSingleObject - 0x1001a02c 0x1d9d0 0x1c5d0 0x5c7
CreateMutexA - 0x1001a030 0x1d9d4 0x1c5d4 0xd5
TlsAlloc - 0x1001a034 0x1d9d8 0x1c5d8 0x58e
TlsGetValue - 0x1001a038 0x1d9dc 0x1c5dc 0x590
TlsSetValue - 0x1001a03c 0x1d9e0 0x1c5e0 0x591
IsDebuggerPresent - 0x1001a040 0x1d9e4 0x1c5e4 0x376
InitializeSListHead - 0x1001a044 0x1d9e8 0x1c5e8 0x35a
GetSystemTimeAsFileTime - 0x1001a048 0x1d9ec 0x1c5ec 0x2e2
GetCurrentThreadId - 0x1001a04c 0x1d9f0 0x1c5f0 0x218
GetCurrentProcessId - 0x1001a050 0x1d9f4 0x1c5f4 0x214
QueryPerformanceCounter - 0x1001a054 0x1d9f8 0x1c5f8 0x440
IsProcessorFeaturePresent - 0x1001a058 0x1d9fc 0x1c5fc 0x37d
TerminateProcess - 0x1001a05c 0x1da00 0x1c600 0x57c
GetCurrentProcess - 0x1001a060 0x1da04 0x1c604 0x213
SetUnhandledExceptionFilter - 0x1001a064 0x1da08 0x1c608 0x55e
UnhandledExceptionFilter - 0x1001a068 0x1da0c 0x1c60c 0x59d
VCRUNTIME140.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__std_type_info_destroy_list - 0x1001a070 0x1da14 0x1c614 0x25
strchr - 0x1001a074 0x1da18 0x1c618 0x4a
memmove - 0x1001a078 0x1da1c 0x1c61c 0x47
strrchr - 0x1001a07c 0x1da20 0x1c620 0x4b
_except_handler4_common - 0x1001a080 0x1da24 0x1c624 0x35
memset - 0x1001a084 0x1da28 0x1c628 0x48
memcpy - 0x1001a088 0x1da2c 0x1c62c 0x46
api-ms-win-crt-stdio-l1-1-0.dll (13)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
fflush - 0x1001a0e4 0x1da88 0x1c688 0x77
__acrt_iob_func - 0x1001a0e8 0x1da8c 0x1c68c 0x0
fopen - 0x1001a0ec 0x1da90 0x1c690 0x7d
fread - 0x1001a0f0 0x1da94 0x1c694 0x83
fseek - 0x1001a0f4 0x1da98 0x1c698 0x87
ftell - 0x1001a0f8 0x1da9c 0x1c69c 0x89
fgets - 0x1001a0fc 0x1daa0 0x1c6a0 0x7a
rewind - 0x1001a100 0x1daa4 0x1c6a4 0x96
_write - 0x1001a104 0x1daa8 0x1c6a8 0x6b
__stdio_common_vsprintf - 0x1001a108 0x1daac 0x1c6ac 0xd
fclose - 0x1001a10c 0x1dab0 0x1c6b0 0x74
fputs - 0x1001a110 0x1dab4 0x1c6b4 0x80
feof - 0x1001a114 0x1dab8 0x1c6b8 0x75
api-ms-win-crt-time-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_time64 - 0x1001a144 0x1dae8 0x1c6e8 0x30
_ctime64 - 0x1001a148 0x1daec 0x1c6ec 0xe
_difftime64 - 0x1001a14c 0x1daf0 0x1c6f0 0x11
api-ms-win-crt-string-l1-1-0.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
isalnum - 0x1001a11c 0x1dac0 0x1c6c0 0x64
strncpy - 0x1001a120 0x1dac4 0x1c6c4 0x8f
strtok - 0x1001a124 0x1dac8 0x1c6c8 0x94
_stricmp - 0x1001a128 0x1dacc 0x1c6cc 0x2a
islower - 0x1001a12c 0x1dad0 0x1c6d0 0x6b
isdigit - 0x1001a130 0x1dad4 0x1c6d4 0x68
_strnicmp - 0x1001a134 0x1dad8 0x1c6d8 0x34
toupper - 0x1001a138 0x1dadc 0x1c6dc 0x98
isspace - 0x1001a13c 0x1dae0 0x1c6e0 0x6e
api-ms-win-crt-convert-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
atoi - 0x1001a090 0x1da34 0x1c634 0x50
api-ms-win-crt-runtime-l1-1-0.dll (11)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
perror - 0x1001a0b4 0x1da58 0x1c658 0x62
_errno - 0x1001a0b8 0x1da5c 0x1c65c 0x23
_cexit - 0x1001a0bc 0x1da60 0x1c660 0x17
strerror - 0x1001a0c0 0x1da64 0x1c664 0x67
_execute_onexit_table - 0x1001a0c4 0x1da68 0x1c668 0x24
_initialize_onexit_table - 0x1001a0c8 0x1da6c 0x1c66c 0x36
_initialize_narrow_environment - 0x1001a0cc 0x1da70 0x1c670 0x35
_initterm - 0x1001a0d0 0x1da74 0x1c674 0x38
_initterm_e - 0x1001a0d4 0x1da78 0x1c678 0x39
_seh_filter_dll - 0x1001a0d8 0x1da7c 0x1c67c 0x41
_configure_narrow_argv - 0x1001a0dc 0x1da80 0x1c680 0x19
api-ms-win-crt-heap-l1-1-0.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
realloc - 0x1001a098 0x1da3c 0x1c63c 0x1a
malloc - 0x1001a09c 0x1da40 0x1c640 0x19
free - 0x1001a0a0 0x1da44 0x1c644 0x18
calloc - 0x1001a0a4 0x1da48 0x1c648 0x17
api-ms-win-crt-utility-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
qsort - 0x1001a154 0x1daf8 0x1c6f8 0x19
api-ms-win-crt-math-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_except1 - 0x1001a0ac 0x1da50 0x1c650 0x40
Exports (264)
»
Api name EAT Address Ordinal
ber_alloc 0x1759a 0x1
ber_alloc_t 0x175a2 0x2
ber_bvdup 0x161be 0x3
ber_bvecfree 0x16232 0x4
ber_bvfree 0x1625f 0x5
ber_dup 0x175f9 0x6
ber_err_print 0x16195 0x7
ber_first_element 0x16285 0x8
ber_flatten 0x176bf 0x9
ber_flush 0x1773c 0xa
ber_free 0x1783b 0xb
ber_get_bitstringa 0x162c1 0xc
ber_get_boolean 0x1634a 0xd
ber_get_buf_databegin 0x1786a 0xe
ber_get_buf_datalen 0x1787f 0xf
ber_get_int 0x16353 0x10
ber_get_next 0x178ad 0x11
ber_get_next_buffer 0x17a1d 0x12
ber_get_next_buffer_ext 0x17a3a 0x13
ber_get_null 0x16393 0x14
ber_get_option 0x17c36 0x15
ber_get_stringa 0x163bb 0x16
ber_get_stringal 0x1642d 0x17
ber_get_stringb 0x164ed 0x18
ber_get_tag 0x16541 0x19
ber_init 0x17cba 0x1a
ber_init_w_nullchar 0x17cfc 0x1b
ber_next_element 0x16609 0x1c
ber_peek_tag 0x16629 0x1d
ber_printf 0x16c1c 0x1e
ber_put_bitstring 0x16e8e 0x1f
ber_put_boolean 0x16f1d 0x20
ber_put_enum 0x16f90 0x21
ber_put_int 0x16fb1 0x22
ber_put_null 0x17115 0x23
ber_put_ostring 0x1715a 0x24
ber_put_seq 0x171bc 0x25
ber_put_set 0x171bc 0x26
ber_put_string 0x17408 0x27
ber_read 0x17d2c 0x28
ber_reset 0x17d6a 0x29
ber_scanf 0x16671 0x2a
ber_set_option 0x17d9f 0x2b
ber_skip_tag 0x16b47 0x2c
ber_sockbuf_alloc 0x17e40 0x2d
ber_sockbuf_free 0x17e5d 0x2e
ber_sockbuf_free_data 0x17e8c 0x2f
ber_sockbuf_get_option 0x17eb8 0x30
ber_sockbuf_set_option 0x17fac 0x31
ber_special_alloc 0x18144 0x32
ber_special_free 0x181c7 0x33
ber_stack_init 0x181ec 0x34
ber_start_seq 0x1745f 0x35
ber_start_set 0x17500 0x36
ber_svecfree 0x16bc8 0x37
ber_write 0x18270 0x38
der_alloc 0x18319 0x39
ldap_abandon 0x12da 0x3a
ldap_abandon_ext 0x12f4 0x3b
ldap_add 0x14fa 0x3c
ldap_add_ext 0x1525 0x3d
ldap_add_ext_s 0x1841 0x3e
ldap_add_result_entry 0xe3fd 0x3f
ldap_add_s 0x189a 0x40
ldap_ber_free 0x48da 0x41
ldap_bind 0x19d0 0x42
ldap_bind_s 0x1a06 0x43
ldap_build_filter 0x5833 0x44
ldap_cache_flush 0x1c25 0x45
ldap_charray_add 0x1e11 0x46
ldap_charray_dup 0x1e72 0x47
ldap_charray_free 0x1ef9 0x48
ldap_charray_inlist 0x1f2e 0x49
ldap_charray_merge 0x1f6d 0x4a
ldap_charray_position 0x1ff1 0x4b
ldap_compare 0x20db 0x4c
ldap_compare_ext 0x2129 0x4d
ldap_compare_ext_s 0x2402 0x4e
ldap_compare_s 0x245e 0x4f
ldap_control_free 0x2551 0x50
ldap_controls_free 0x2584 0x51
ldap_count_entries 0x554f 0x52
ldap_count_messages 0x924f 0x53
ldap_count_references 0xc18d 0x54
ldap_count_values 0x2ba1 0x55
ldap_count_values_len 0x2bbc 0x56
ldap_create_authzid_control 0x18b3 0x57
ldap_create_filter 0x5838 0x58
ldap_create_geteffectiveRights_control 0x549a 0x59
ldap_create_passwordpolicy_control 0xbe68 0x5a
ldap_create_passwordpolicy_control_ext 0xbeb8 0x5b
ldap_create_persistentsearch_control 0xb980 0x5c
ldap_create_proxiedauth_control 0xb81f 0x5d
ldap_create_proxyauth_control 0xb8ce 0x5e
ldap_create_sort_control 0x11fa6 0x5f
ldap_create_sort_keylist 0x1211e 0x60
ldap_create_userstatus_control 0x15795 0x61
ldap_create_virtuallist_control 0x15e6e 0x62
ldap_delete 0x2bc5 0x63
ldap_delete_ext 0x2bed 0x64
ldap_delete_ext_s 0x2e97 0x65
ldap_delete_result_entry 0xe419 0x66
ldap_delete_s 0x2eed 0x67
ldap_dn2ufn 0x4e9c 0x68
ldap_entry2html 0x1399f 0x69
ldap_entry2html_search 0x139e0 0x6a
ldap_entry2text 0x13a16 0x6b
ldap_entry2text_search 0x13a4a 0x6c
ldap_err2string 0x3cb8 0x6d
ldap_explode_dn 0x52ff 0x6e
ldap_explode_dns 0x5316 0x6f
ldap_explode_rdn 0x53c4 0x70
ldap_extended_operation 0x4493 0x71
ldap_extended_operation_s 0x4677 0x72
ldap_find_control 0x25b1 0x73
ldap_first_attribute 0x4d4a 0x74
ldap_first_disptmpl 0x12647 0x75
ldap_first_entry 0x557d 0x76
ldap_first_message 0x9270 0x77
ldap_first_reference 0xc1bb 0x78
ldap_first_searchobj 0x12647 0x79
ldap_first_tmplcol 0x301f 0x7a
ldap_first_tmplrow 0x3029 0x7b
ldap_free_friendlymap 0x4aa1 0x7c
ldap_free_searchprefs 0x12651 0x7d
ldap_free_sort_keylist 0x1220d 0x7e
ldap_free_templates 0x3036 0x7f
ldap_free_urldesc 0x15046 0x80
ldap_friendly_name 0x4adf 0x81
ldap_get_dn 0x53db 0x82
ldap_get_entry_controls 0x55a4 0x83
ldap_get_lang_values 0x6b54 0x84
ldap_get_lang_values_len 0x6b71 0x85
ldap_get_lderrno 0x3ce9 0x86
ldap_get_option 0x6006 0x87
ldap_get_values 0x6b8e 0x88
ldap_get_values_len 0x6ba8 0x89
ldap_getfilter_free 0x48df 0x8a
ldap_getfirstfilter 0x5a68 0x8b
ldap_getnextfilter 0x5b6c 0x8c
ldap_init 0x9ba8 0x8d
ldap_init_getfilter 0x5bd2 0x8e
ldap_init_getfilter_buf 0x5c87 0x8f
ldap_init_searchprefs 0x12671 0x90
ldap_init_searchprefs_buf 0x1274a 0x91
ldap_init_templates 0x3056 0x92
ldap_init_templates_buf 0x3135 0x93
ldap_is_dns_dn 0x5464 0x94
ldap_is_ldap_url 0x1507b 0x95
ldap_keysort_entries 0x11bd2 0x96
ldap_memcache_destroy 0x7774 0x97
ldap_memcache_flush 0x7982 0x98
ldap_memcache_get 0x799c 0x99
ldap_memcache_init 0x7a78 0x9a
ldap_memcache_set 0x7f50 0x9b
ldap_memcache_update 0x81fb 0x9c
ldap_memfree 0x49ad 0x9d
ldap_modify 0x92ca 0x9e
ldap_modify_ext 0x92f5 0x9f
ldap_modify_ext_s 0x962b 0xa0
ldap_modify_s 0x9684 0xa1
ldap_modrdn 0xc931 0xa4
ldap_modrdn2 0xc8b7 0xa2
ldap_modrdn2_s 0xc8e6 0xa3
ldap_modrdn_s 0xc948 0xa5
ldap_mods_free 0x49c3 0xa6
ldap_msgfree 0xec45 0xa7
ldap_msgid 0x9282 0xa8
ldap_msgtype 0x9297 0xa9
ldap_multisort_entries 0x11d43 0xaa
ldap_name2template 0x31fe 0xab
ldap_next_attribute 0x4e27 0xac
ldap_next_disptmpl 0x322a 0xad
ldap_next_entry 0x564f 0xae
ldap_next_message 0x92ad 0xaf
ldap_next_reference 0xc1e2 0xb0
ldap_next_searchobj 0x12817 0xb1
ldap_next_tmplcol 0x323b 0xb2
ldap_next_tmplrow 0x324c 0xb3
ldap_oc2template 0x325d 0xb4
ldap_open 0x9d30 0xb5
ldap_parse_authzid_control 0x1905 0xb6
ldap_parse_entrychange_control 0xba19 0xb7
ldap_parse_extended_result 0x46ef 0xb8
ldap_parse_passwd 0xbb50 0xb9
ldap_parse_passwordpolicy_control 0xbf0a 0xba
ldap_parse_passwordpolicy_control_ext 0xc06a 0xbb
ldap_parse_reference 0xc207 0xbc
ldap_parse_result 0x3d34 0xbd
ldap_parse_sasl_bind_result 0xff93 0xbe
ldap_parse_sort_control 0x1225c 0xbf
ldap_parse_userstatus_control 0x157e7 0xc0
ldap_parse_virtuallist_control 0x15f6e 0xc1
ldap_parse_whoami 0x1609a 0xc2
ldap_passwd 0xbc32 0xc3
ldap_passwd_s 0xbdeb 0xc4
ldap_passwordpolicy_err2txt 0xc0fd 0xc5
ldap_perror 0x3e3f 0xc6
ldap_rename 0xc95f 0xc7
ldap_rename_s 0xcc95 0xc8
ldap_result 0xec7a 0xca
ldap_result2error 0x40cb 0xc9
ldap_sasl_bind 0x100c7 0xcb
ldap_sasl_bind_s 0x10447 0xcc
ldap_sasl_interactive_bind_ext_s 0x1046d 0xcd
ldap_sasl_interactive_bind_s 0x10472 0xce
ldap_search 0x10a37 0xcf
ldap_search_ext 0x10a72 0xd0
ldap_search_ext_s 0x10adb 0xd1
ldap_search_s 0x10b24 0xd2
ldap_search_st 0x10b51 0xd3
ldap_set_filter_additions 0x5f96 0xd4
ldap_set_lderrno 0x40f4 0xd5
ldap_set_option 0x115bd 0xd6
ldap_set_rebind_proc 0x1a37 0xd7
ldap_setfilteraffixes 0x6001 0xd8
ldap_simple_bind 0x1054d 0xd9
ldap_simple_bind_s 0x10583 0xda
ldap_sort_entries 0x11eec 0xdb
ldap_sort_strcasecmp 0x11f1a 0xdc
ldap_sort_values 0x11f3d 0xdd
ldap_str2charray 0x2028 0xde
ldap_tmplattrs 0x3326 0xdf
ldap_tmplerr2string 0x3455 0xe0
ldap_ufn_search_c 0x14479 0xe1
ldap_ufn_search_ct 0x144a9 0xe2
ldap_ufn_search_s 0x14919 0xe3
ldap_ufn_setfilter 0x14968 0xe4
ldap_ufn_setprefix 0x1498d 0xe5
ldap_ufn_timeout 0x149b4 0xe6
ldap_unbind 0x14e5b 0xe7
ldap_unbind_ext 0x14e41 0xe8
ldap_unbind_s 0x14e5b 0xe9
ldap_url_parse 0x150ab 0xea
ldap_url_parse_no_defaults 0x15100 0xeb
ldap_url_search 0x15118 0xec
ldap_url_search_s 0x152fa 0xed
ldap_url_search_st 0x1534c 0xee
ldap_utf8characters 0x15a01 0xef
ldap_utf8copy 0x15a27 0xf0
ldap_utf8getcc 0x15ad8 0xf1
ldap_utf8isalnum 0x15bbb 0xf2
ldap_utf8isalpha 0x15bec 0xf3
ldap_utf8isdigit 0x15c16 0xf4
ldap_utf8isspace 0x15c33 0xf5
ldap_utf8isxdigit 0x15cbc 0xf6
ldap_utf8len 0x15ced 0xf7
ldap_utf8next 0x15cff 0xf8
ldap_utf8prev 0x15d6b 0xf9
ldap_utf8strtok_r 0x15d87 0xfa
ldap_vals2html 0x13a7f 0xfb
ldap_vals2text 0x13aba 0xfc
ldap_value_free 0x4a33 0xfd
ldap_value_free_len 0x4a61 0xfe
ldap_version 0x9e65 0xff
ldap_whoami 0x160eb 0x100
ldap_whoami_s 0x16121 0x101
ldap_x_calloc 0x9e92 0x102
ldap_x_free 0x9ea8 0x103
ldap_x_hostlist_first 0x9ebe 0x104
ldap_x_hostlist_next 0x9f5e 0x105
ldap_x_hostlist_statusfree 0xa052 0x106
ldap_x_malloc 0xa076 0x107
ldap_x_realloc 0xa08c 0x108
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
ldif60.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\ldif60.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 19.95 KB
MD5 4fe544dfc7cdaa026da6eda09cad66c4 Copy to Clipboard
SHA1 85d21e5f5f72a4808f02f4ea14aa65154e52ce99 Copy to Clipboard
SHA256 3aabbe0aa86ce8a91e5c49b7de577af73b9889d7f03af919f17f3f315a879b0f Copy to Clipboard
SSDeep 384:YxfML3ALxK0AZEuzOJKRsIFYvDG8A3OPLonw4S:0fMmxFyO4RpGDG8MjS Copy to Clipboard
ImpHash c497e3698361c6ee6b9f6d6658206bb6 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x10001c59
Size Of Code 0x1600
Size Of Initialized Data 0x1c00
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:37:14+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename ldif60.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1488 0x1600 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.17
.rdata 0x10003000 0xae6 0xc00 0x1a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.41
.data 0x10004000 0x814 0x600 0x2600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 1.3
.rsrc 0x10005000 0x378 0x400 0x2c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.87
.reloc 0x10006000 0x178 0x200 0x3000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 5.18
Imports (6)
»
VCRUNTIME140.dll (5)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__std_type_info_destroy_list - 0x10003034 0x3794 0x2194 0x25
memcpy - 0x10003038 0x3798 0x2198 0x46
memset - 0x1000303c 0x379c 0x219c 0x48
_except_handler4_common - 0x10003040 0x37a0 0x21a0 0x35
strchr - 0x10003044 0x37a4 0x21a4 0x4a
api-ms-win-crt-stdio-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
fgets - 0x1000307c 0x37dc 0x21dc 0x7a
api-ms-win-crt-heap-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
malloc - 0x1000304c 0x37ac 0x21ac 0x19
realloc - 0x10003050 0x37b0 0x21b0 0x1a
api-ms-win-crt-string-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
isspace - 0x10003084 0x37e4 0x21e4 0x6e
isprint - 0x10003088 0x37e8 0x21e8 0x6c
api-ms-win-crt-runtime-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_execute_onexit_table - 0x10003058 0x37b8 0x21b8 0x24
_initialize_onexit_table - 0x1000305c 0x37bc 0x21bc 0x36
_initialize_narrow_environment - 0x10003060 0x37c0 0x21c0 0x35
_configure_narrow_argv - 0x10003064 0x37c4 0x21c4 0x19
_seh_filter_dll - 0x10003068 0x37c8 0x21c8 0x41
_initterm_e - 0x1000306c 0x37cc 0x21cc 0x39
_initterm - 0x10003070 0x37d0 0x21d0 0x38
_cexit - 0x10003074 0x37d4 0x21d4 0x17
KERNEL32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
DisableThreadLibraryCalls - 0x10003000 0x3760 0x2160 0x11b
SetUnhandledExceptionFilter - 0x10003004 0x3764 0x2164 0x55e
GetCurrentProcess - 0x10003008 0x3768 0x2168 0x213
TerminateProcess - 0x1000300c 0x376c 0x216c 0x57c
IsProcessorFeaturePresent - 0x10003010 0x3770 0x2170 0x37d
IsDebuggerPresent - 0x10003014 0x3774 0x2174 0x376
InitializeSListHead - 0x10003018 0x3778 0x2178 0x35a
UnhandledExceptionFilter - 0x1000301c 0x377c 0x217c 0x59d
GetSystemTimeAsFileTime - 0x10003020 0x3780 0x2180 0x2e2
GetCurrentThreadId - 0x10003024 0x3784 0x2184 0x218
GetCurrentProcessId - 0x10003028 0x3788 0x2188 0x214
QueryPerformanceCounter - 0x1000302c 0x378c 0x218c 0x440
Exports (12)
»
Api name EAT Address Ordinal
ldif_base64_decode 0x1000 0x1
ldif_base64_encode 0x10d9 0x2
ldif_base64_encode_nowrap 0x1227 0x3
ldif_get_entry 0x1242 0x4
ldif_getline 0x1374 0x5
ldif_parse_line 0x1416 0x6
ldif_put_type_and_value 0x14ef 0x7
ldif_put_type_and_value_nowrap 0x150a 0x8
ldif_put_type_and_value_with_options 0x1525 0x9
ldif_type_and_value 0x16b3 0xa
ldif_type_and_value_nowrap 0x16cb 0xb
ldif_type_and_value_with_options 0x16e3 0xc
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
lgpllibs.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\lgpllibs.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 54.45 KB
MD5 56e982d4c380c9cd24852564a8c02c3e Copy to Clipboard
SHA1 f9031327208176059cd03f53c8c5934c1050897f Copy to Clipboard
SHA256 7f93b70257d966ea1c1a6038892b19e8360aadd8e8ae58e75ebb0697b9ea8786 Copy to Clipboard
SSDeep 1536:LxsBS3Q6j+37mWT7DT/GszGrn7iBCmjFCOu:LxTBcmWT7X/Gszen7icmjFtu Copy to Clipboard
ImpHash 9077bc892f80f34239af08a83206a6f2 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x1000932e
Size Of Code 0x8e00
Size Of Initialized Data 0xa3200
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:52:26+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename lgpllibs.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x8ce6 0x8e00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.52
.rdata 0x1000a000 0x193e 0x1a00 0x9200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.06
.data 0x1000c000 0xa0814 0x200 0xac00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 1.94
.rodata 0x100ad000 0x138 0x200 0xae00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.04
.rsrc 0x100ae000 0x378 0x400 0xb000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.89
.reloc 0x100af000 0x7a8 0x800 0xb400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.33
Imports (7)
»
mozglue.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_aligned_malloc - 0x1000a0b4 0xb534 0xa734 0x75
_aligned_free - 0x1000a0b8 0xb538 0xa738 0x74
KERNEL32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCurrentProcess - 0x1000a000 0xb480 0xa680 0x213
GetSystemTimeAsFileTime - 0x1000a004 0xb484 0xa684 0x2e2
IsDebuggerPresent - 0x1000a008 0xb488 0xa688 0x376
GetCurrentThreadId - 0x1000a00c 0xb48c 0xa68c 0x218
GetCurrentProcessId - 0x1000a010 0xb490 0xa690 0x214
QueryPerformanceCounter - 0x1000a014 0xb494 0xa694 0x440
IsProcessorFeaturePresent - 0x1000a018 0xb498 0xa698 0x37d
DisableThreadLibraryCalls - 0x1000a01c 0xb49c 0xa69c 0x11b
TerminateProcess - 0x1000a020 0xb4a0 0xa6a0 0x57c
InitializeSListHead - 0x1000a024 0xb4a4 0xa6a4 0x35a
SetUnhandledExceptionFilter - 0x1000a028 0xb4a8 0xa6a8 0x55e
UnhandledExceptionFilter - 0x1000a02c 0xb4ac 0xa6ac 0x59d
VCRUNTIME140.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__std_type_info_destroy_list - 0x1000a034 0xb4b4 0xa6b4 0x25
_except_handler4_common - 0x1000a038 0xb4b8 0xa6b8 0x35
_CxxThrowException - 0x1000a03c 0xb4bc 0xa6bc 0x1
__std_exception_destroy - 0x1000a040 0xb4c0 0xa6c0 0x22
__std_exception_copy - 0x1000a044 0xb4c4 0xa6c4 0x21
memmove - 0x1000a048 0xb4c8 0xa6c8 0x47
_purecall - 0x1000a04c 0xb4cc 0xa6cc 0x3d
memset - 0x1000a050 0xb4d0 0xa6d0 0x48
memcpy - 0x1000a054 0xb4d4 0xa6d4 0x46
api-ms-win-crt-math-l1-1-0.dll (6)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_libm_sse2_cos_precise - 0x1000a06c 0xb4ec 0xa6ec 0x65
_libm_sse2_exp_precise - 0x1000a070 0xb4f0 0xa6f0 0x66
_libm_sse2_pow_precise - 0x1000a074 0xb4f4 0xa6f4 0x69
_libm_sse2_sin_precise - 0x1000a078 0xb4f8 0xa6f8 0x6a
_libm_sse2_sqrt_precise - 0x1000a07c 0xb4fc 0xa6fc 0x6b
_except1 - 0x1000a080 0xb500 0xa700 0x40
api-ms-win-crt-string-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strncmp - 0x1000a0ac 0xb52c 0xa72c 0x8e
api-ms-win-crt-runtime-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_initterm - 0x1000a088 0xb508 0xa708 0x38
_initterm_e - 0x1000a08c 0xb50c 0xa70c 0x39
_seh_filter_dll - 0x1000a090 0xb510 0xa710 0x41
_configure_narrow_argv - 0x1000a094 0xb514 0xa714 0x19
_initialize_narrow_environment - 0x1000a098 0xb518 0xa718 0x35
_initialize_onexit_table - 0x1000a09c 0xb51c 0xa71c 0x36
_execute_onexit_table - 0x1000a0a0 0xb520 0xa720 0x24
_cexit - 0x1000a0a4 0xb524 0xa724 0x17
api-ms-win-crt-heap-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_callnewh - 0x1000a05c 0xb4dc 0xa6dc 0x8
malloc - 0x1000a060 0xb4e0 0xa6e0 0x19
free - 0x1000a064 0xb4e4 0xa6e4 0x18
Exports (29)
»
Api name EAT Address Ordinal
??0SoundTouch@soundtouch@@QAE@ABV01@@Z 0x5d6a 0x1
??0SoundTouch@soundtouch@@QAE@XZ 0x5dbe 0x2
??1SoundTouch@soundtouch@@UAE@XZ 0x5f1f 0x3
??4SoundTouch@soundtouch@@QAEAAV01@ABV01@@Z 0x5f74 0x4
??_7SoundTouch@soundtouch@@6B@ 0xa404 0x5
?calcEffectiveRateAndTempo@SoundTouch@soundtouch@@AAEXXZ 0x638e 0x6
?clear@SoundTouch@soundtouch@@UAEXXZ 0x6759 0x7
?createSoundTouchObj@soundtouch@@YAPAVSoundTouch@1@XZ 0x67ad 0x8
?destroySoundTouchObj@soundtouch@@YAXPAVSoundTouch@1@@Z 0x67c3 0x9
?flush@SoundTouch@soundtouch@@QAEXXZ 0x6cda 0xa
?getSetting@SoundTouch@soundtouch@@QBEHH@Z 0x6de5 0xb
?getVersionId@SoundTouch@soundtouch@@SAIXZ 0x6e8d 0xc
?getVersionString@SoundTouch@soundtouch@@SAPBDXZ 0x6e93 0xd
?numUnprocessedSamples@SoundTouch@soundtouch@@UBEIXZ 0x6fdd 0xe
?putSamples@SoundTouch@soundtouch@@UAEXPBMI@Z 0x73ef 0xf
?setChannels@SoundTouch@soundtouch@@QAEXI@Z 0x774d 0x10
?setPitch@SoundTouch@soundtouch@@QAEXM@Z 0x78c3 0x11
?setPitchOctaves@SoundTouch@soundtouch@@QAEXM@Z 0x78d9 0x12
?setPitchSemiTones@SoundTouch@soundtouch@@QAEXH@Z 0x7909 0x13
?setPitchSemiTones@SoundTouch@soundtouch@@QAEXM@Z 0x7944 0x14
?setRate@SoundTouch@soundtouch@@QAEXM@Z 0x79d1 0x15
?setRateChange@SoundTouch@soundtouch@@QAEXM@Z 0x79f8 0x16
?setSampleRate@SoundTouch@soundtouch@@QAEXI@Z 0x7a1e 0x17
?setSetting@SoundTouch@soundtouch@@QAE_NHH@Z 0x7a3a 0x18
?setTempo@SoundTouch@soundtouch@@QAEXM@Z 0x7ae1 0x19
?setTempoChange@SoundTouch@soundtouch@@QAEXM@Z 0x7b44 0x1a
av_rdft_calc 0x3e10 0x1b
av_rdft_end 0x3e21 0x1c
av_rdft_init 0x3e3b 0x1d
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
libEGL.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\libEGL.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 21.95 KB
MD5 96b879b611b2bbee85df18884039c2b8 Copy to Clipboard
SHA1 00794796acac3899c1fb9abbf123fef3cc641624 Copy to Clipboard
SHA256 7b9fc6be34f43d39471c2add872d5b4350853db11cc66a323ef9e0c231542fb9 Copy to Clipboard
SSDeep 384:INZ9mLVDAffJJKAtn0mLAb8X3FbvDG8A3OPLonzvGb:4mx+fXvn4YFrDG8MKb Copy to Clipboard
ImpHash 5869573158f1280c462da5ead76ffd22 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x100015c0
Size Of Code 0x1000
Size Of Initialized Data 0x2800
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:56:17+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename libEGL.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xf20 0x1000 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.9
.rdata 0x10002000 0x1dbc 0x1e00 0x1400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.44
.data 0x10004000 0x390 0x200 0x3200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.27
.rsrc 0x10005000 0x378 0x400 0x3400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.88
.reloc 0x10006000 0x1b0 0x200 0x3800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 5.73
Imports (4)
»
libGLESv2.dll (71)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
?WaitClient@egl@@YGIXZ - 0x10002068 0x2f6c 0x236c 0x27f
?GetCurrentContext@egl@@YGPAXXZ - 0x1000206c 0x2f70 0x2370 0xdb
?CreateSync@egl@@YGPAXPAXIPBH@Z - 0x10002070 0x2f74 0x2374 0x60
?DestroySync@egl@@YGIPAX0@Z - 0x10002074 0x2f78 0x2378 0x80
?ClientWaitSync@egl@@YGHPAX0H_K@Z - 0x10002078 0x2f7c 0x237c 0x33
?GetSyncAttrib@egl@@YGIPAX0HPAH@Z - 0x1000207c 0x2f80 0x2380 0x12e
?CreateImage@egl@@YGPAXPAX0I0PBH@Z - 0x10002080 0x2f84 0x2384 0x54
?DestroyImage@egl@@YGIPAX0@Z - 0x10002084 0x2f88 0x2388 0x7c
?GetPlatformDisplay@egl@@YGPAXIPAXPBH@Z - 0x10002088 0x2f8c 0x238c 0x100
?CreatePlatformWindowSurface@egl@@YGPAXPAX00PBH@Z - 0x1000208c 0x2f90 0x2390 0x5a
?CreatePlatformPixmapSurface@egl@@YGPAXPAX00PBH@Z - 0x10002090 0x2f94 0x2394 0x59
?WaitSync@egl@@YGIPAX0H@Z - 0x10002094 0x2f98 0x2398 0x282
?QuerySurfacePointerANGLE@egl@@YGIPAX0HPAPAX@Z - 0x10002098 0x2f9c 0x239c 0x1e2
?PostSubBufferNV@egl@@YGIPAX0HHHH@Z - 0x1000209c 0x2fa0 0x23a0 0x1aa
?GetPlatformDisplayEXT@egl@@YGPAXIPAXPBH@Z - 0x100020a0 0x2fa4 0x23a4 0x101
?QueryDisplayAttribEXT@egl@@YGIPAXHPAH@Z - 0x100020a4 0x2fa8 0x23a8 0x1dc
?QueryDeviceAttribEXT@egl@@YGIPAXHPAH@Z - 0x100020a8 0x2fac 0x23ac 0x1da
?QueryDeviceStringEXT@egl@@YGPBDPAXH@Z - 0x100020ac 0x2fb0 0x23b0 0x1db
?CreateImageKHR@egl@@YGPAXPAX0I0PBH@Z - 0x100020b0 0x2fb4 0x23b4 0x55
?ReleaseThread@egl@@YGIXZ - 0x100020b4 0x2fb8 0x23b8 0x1eb
?CreateDeviceANGLE@egl@@YGPAXHPAXPBH@Z - 0x100020b8 0x2fbc 0x23bc 0x53
?ReleaseDeviceANGLE@egl@@YGIPAX@Z - 0x100020bc 0x2fc0 0x23c0 0x1e8
?CreateStreamKHR@egl@@YGPAXPAXPBH@Z - 0x100020c0 0x2fc4 0x23c4 0x5e
?DestroyStreamKHR@egl@@YGIPAX0@Z - 0x100020c4 0x2fc8 0x23c8 0x7e
?StreamAttribKHR@egl@@YGIPAX0IH@Z - 0x100020c8 0x2fcc 0x23cc 0x213
?QueryStreamKHR@egl@@YGIPAX0IPAH@Z - 0x100020cc 0x2fd0 0x23d0 0x1de
?QueryStreamu64KHR@egl@@YGIPAX0IPA_K@Z - 0x100020d0 0x2fd4 0x23d4 0x1df
?StreamConsumerGLTextureExternalKHR@egl@@YGIPAX0@Z - 0x100020d4 0x2fd8 0x23d8 0x216
?StreamConsumerAcquireKHR@egl@@YGIPAX0@Z - 0x100020d8 0x2fdc 0x23dc 0x214
?StreamConsumerReleaseKHR@egl@@YGIPAX0@Z - 0x100020dc 0x2fe0 0x23e0 0x217
?StreamConsumerGLTextureExternalAttribsNV@egl@@YGIPAX0PBH@Z - 0x100020e0 0x2fe4 0x23e4 0x215
?CreateStreamProducerD3DTextureANGLE@egl@@YGIPAX0PBH@Z - 0x100020e4 0x2fe8 0x23e8 0x5f
?StreamPostD3DTextureANGLE@egl@@YGIPAX00PBH@Z - 0x100020e8 0x2fec 0x23ec 0x218
?GetSyncValuesCHROMIUM@egl@@YGIPAX0PA_K11@Z - 0x100020ec 0x2ff0 0x23f0 0x12f
?SwapBuffersWithDamageEXT@egl@@YAIPAX0PAHH@Z - 0x100020f0 0x2ff4 0x23f4 0x21b
?ProgramCacheGetAttribANGLE@egl@@YGHPAXI@Z - 0x100020f4 0x2ff8 0x23f8 0x1ad
?ProgramCacheQueryANGLE@egl@@YGXPAXH0PAH01@Z - 0x100020f8 0x2ffc 0x23fc 0x1af
?ProgramCachePopulateANGLE@egl@@YGXPAXPBXH1H@Z - 0x100020fc 0x3000 0x2400 0x1ae
?ProgramCacheResizeANGLE@egl@@YGHPAXHI@Z - 0x10002100 0x3004 0x2404 0x1b0
?GetError@egl@@YGHXZ - 0x10002104 0x3008 0x2408 0xe0
?CreatePbufferFromClientBuffer@egl@@YGPAXPAXI00PBH@Z - 0x10002108 0x300c 0x240c 0x56
?QueryAPI@egl@@YGIXZ - 0x1000210c 0x3010 0x2410 0x1d7
?BindAPI@egl@@YGII@Z - 0x10002110 0x3014 0x2414 0xb
?SwapInterval@egl@@YGIPAXH@Z - 0x10002114 0x3018 0x2418 0x21c
?SurfaceAttrib@egl@@YGIPAX0HH@Z - 0x10002118 0x301c 0x241c 0x219
?ReleaseTexImage@egl@@YGIPAX0H@Z - 0x1000211c 0x3020 0x2420 0x1ea
?BindTexImage@egl@@YGIPAX0H@Z - 0x10002120 0x3024 0x2424 0x16
?WaitNative@egl@@YGIH@Z - 0x10002124 0x3028 0x2428 0x281
?WaitGL@egl@@YGIXZ - 0x10002128 0x302c 0x242c 0x280
?Terminate@egl@@YGIPAX@Z - 0x1000212c 0x3030 0x2430 0x21d
?SwapBuffers@egl@@YGIPAX0@Z - 0x10002130 0x3034 0x2434 0x21a
?QuerySurface@egl@@YGIPAX0HPAH@Z - 0x10002134 0x3038 0x2438 0x1e1
?QueryString@egl@@YGPBDPAXH@Z - 0x10002138 0x303c 0x243c 0x1e0
?QueryContext@egl@@YGIPAX0HPAH@Z - 0x1000213c 0x3040 0x2440 0x1d8
?MakeCurrent@egl@@YGIPAX000@Z - 0x10002140 0x3044 0x2444 0x17f
?GetProcAddress@egl@@YGP6AXXZPBD@Z - 0x10002144 0x3048 0x2448 0x105
?Initialize@egl@@YGIPAXPAH1@Z - 0x10002148 0x304c 0x244c 0x15a
?GetDisplay@egl@@YGPAXPAUHDC__@@@Z - 0x1000214c 0x3050 0x2450 0xdf
?GetCurrentSurface@egl@@YGPAXH@Z - 0x10002150 0x3054 0x2454 0xdd
?GetCurrentDisplay@egl@@YGPAXXZ - 0x10002154 0x3058 0x2458 0xdc
?GetConfigs@egl@@YGIPAXPAPAXHPAH@Z - 0x10002158 0x305c 0x245c 0xda
?GetConfigAttrib@egl@@YGIPAX0HPAH@Z - 0x1000215c 0x3060 0x2460 0xd9
?DestroySurface@egl@@YGIPAX0@Z - 0x10002160 0x3064 0x2464 0x7f
?DestroyContext@egl@@YGIPAX0@Z - 0x10002164 0x3068 0x2468 0x7b
?CreateWindowSurface@egl@@YGPAXPAX0PAUHWND__@@PBH@Z - 0x10002168 0x306c 0x246c 0x61
?CreatePixmapSurface@egl@@YGPAXPAX0PAUHBITMAP__@@PBH@Z - 0x1000216c 0x3070 0x2470 0x58
?CreatePbufferSurface@egl@@YGPAXPAX0PBH@Z - 0x10002170 0x3074 0x2474 0x57
?CreateContext@egl@@YGPAXPAX00PBH@Z - 0x10002174 0x3078 0x2478 0x52
?CopyBuffers@egl@@YGIPAX0PAUHBITMAP__@@@Z - 0x10002178 0x307c 0x247c 0x47
?DestroyImageKHR@egl@@YGIPAX0@Z - 0x1000217c 0x3080 0x2480 0x7d
?ChooseConfig@egl@@YGIPAXPBHPAPAXHPAH@Z - 0x10002180 0x3084 0x2484 0x27
VCRUNTIME140.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__std_type_info_destroy_list - 0x10002034 0x2f38 0x2338 0x25
_except_handler4_common - 0x10002038 0x2f3c 0x233c 0x35
memset - 0x1000203c 0x2f40 0x2340 0x48
api-ms-win-crt-runtime-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_execute_onexit_table - 0x10002044 0x2f48 0x2348 0x24
_initialize_onexit_table - 0x10002048 0x2f4c 0x234c 0x36
_configure_narrow_argv - 0x1000204c 0x2f50 0x2350 0x19
_seh_filter_dll - 0x10002050 0x2f54 0x2354 0x41
_initterm_e - 0x10002054 0x2f58 0x2358 0x39
_initterm - 0x10002058 0x2f5c 0x235c 0x38
_cexit - 0x1000205c 0x2f60 0x2360 0x17
_initialize_narrow_environment - 0x10002060 0x2f64 0x2364 0x35
KERNEL32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetCurrentProcess - 0x10002000 0x2f04 0x2304 0x213
IsProcessorFeaturePresent - 0x10002004 0x2f08 0x2308 0x37d
SetUnhandledExceptionFilter - 0x10002008 0x2f0c 0x230c 0x55e
UnhandledExceptionFilter - 0x1000200c 0x2f10 0x2310 0x59d
IsDebuggerPresent - 0x10002010 0x2f14 0x2314 0x376
InitializeSListHead - 0x10002014 0x2f18 0x2318 0x35a
DisableThreadLibraryCalls - 0x10002018 0x2f1c 0x231c 0x11b
GetSystemTimeAsFileTime - 0x1000201c 0x2f20 0x2320 0x2e2
GetCurrentThreadId - 0x10002020 0x2f24 0x2324 0x218
GetCurrentProcessId - 0x10002024 0x2f28 0x2328 0x214
QueryPerformanceCounter - 0x10002028 0x2f2c 0x232c 0x440
TerminateProcess - 0x1000202c 0x2f30 0x2330 0x57c
Exports (71)
»
Api name EAT Address Ordinal
eglBindAPI 0x1000 0xe
eglBindTexImage 0x100a 0x14
eglChooseConfig 0x1014 0x7
eglClientWaitSync 0x101e 0x28
eglCopyBuffers 0x103a 0x21
eglCreateContext 0x1044 0x17
eglCreateDeviceANGLE 0x104e 0x35
eglCreateImage 0x1058 0x2a
eglCreateImageKHR 0x1062 0x33
eglCreatePbufferFromClientBuffer 0x106c 0x12
eglCreatePbufferSurface 0x1076 0xa
eglCreatePixmapSurface 0x1080 0xb
eglCreatePlatformPixmapSurface 0x108a 0x2e
eglCreatePlatformWindowSurface 0x1094 0x2d
eglCreateStreamKHR 0x109e 0x37
eglCreateStreamProducerD3DTextureANGLE 0x10a8 0x40
eglCreateSync 0x10b2 0x26
eglCreateWindowSurface 0x10bc 0x9
eglDestroyContext 0x10c6 0x18
eglDestroyImage 0x10d0 0x2b
eglDestroyImageKHR 0x10da 0x34
eglDestroyStreamKHR 0x10e4 0x38
eglDestroySurface 0x10ee 0xc
eglDestroySync 0x10f8 0x27
eglGetConfigAttrib 0x1102 0x8
eglGetConfigs 0x110c 0x6
eglGetCurrentContext 0x1116 0x1a
eglGetCurrentDisplay 0x111c 0x1c
eglGetCurrentSurface 0x1122 0x1b
eglGetDisplay 0x112c 0x2
eglGetError 0x1136 0x1
eglGetPlatformDisplay 0x113c 0x2c
eglGetPlatformDisplayEXT 0x1146 0x23
eglGetProcAddress 0x1150 0x22
eglGetSyncAttrib 0x115a 0x29
eglGetSyncValuesCHROMIUM 0x1164 0x42
eglInitialize 0x116e 0x3
eglMakeCurrent 0x1178 0x19
eglPostSubBufferNV 0x1182 0x25
eglProgramCacheGetAttribANGLE 0x118c 0x44
eglProgramCachePopulateANGLE 0x1196 0x45
eglProgramCacheQueryANGLE 0x119c 0x46
eglProgramCacheResizeANGLE 0x11a2 0x47
eglQueryAPI 0x11ac 0xf
eglQueryContext 0x11b2 0x1d
eglQueryDeviceAttribEXT 0x11bc 0x31
eglQueryDeviceStringEXT 0x11c6 0x32
eglQueryDisplayAttribEXT 0x11d0 0x30
eglQueryStreamKHR 0x11da 0x3a
eglQueryStreamu64KHR 0x11e4 0x3b
eglQueryString 0x11ee 0x5
eglQuerySurface 0x11f8 0xd
eglQuerySurfacePointerANGLE 0x1202 0x24
eglReleaseDeviceANGLE 0x120c 0x36
eglReleaseTexImage 0x1216 0x15
eglReleaseThread 0x1220 0x11
eglStreamAttribKHR 0x1226 0x39
eglStreamConsumerAcquireKHR 0x1230 0x3d
eglStreamConsumerGLTextureExternalAttribsNV 0x123a 0x3f
eglStreamConsumerGLTextureExternalKHR 0x1244 0x3c
eglStreamConsumerReleaseKHR 0x124e 0x3e
eglStreamPostD3DTextureANGLE 0x1258 0x41
eglSurfaceAttrib 0x1262 0x13
eglSwapBuffers 0x126c 0x20
eglSwapBuffersWithDamageEXT 0x1276 0x43
eglSwapInterval 0x1292 0x16
eglTerminate 0x129c 0x4
eglWaitClient 0x12a6 0x10
eglWaitGL 0x12ac 0x1e
eglWaitNative 0x12b2 0x1f
eglWaitSync 0x12bc 0x2f
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
MapiProxy.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\MapiProxy.dll (Dropped File)
C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\MapiProxy_InUse.dll (Dropped File)
MapiProxy_InUse.dll (Embedded File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 19.45 KB
MD5 7cd244c3fc13c90487127b8d82f0b264 Copy to Clipboard
SHA1 09e1ad17f1bb3d20bd8c1f62a10569f19e838834 Copy to Clipboard
SHA256 bcfb0e397df40aba8c8c5dd23c13c414345decdd3d4b2df946226be97defbf30 Copy to Clipboard
SSDeep 384:Y0GKgKt7QXmFJNauBT5+BjdvDG8A3OPLon6nt:aKgWc2FnnTOVDG8MSt Copy to Clipboard
ImpHash d365332268bb428c9aac20b2bd82e728 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x10001440
Size Of Code 0x1000
Size Of Initialized Data 0x1e00
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:37:56+00:00
Version Information (11)
»
Comments Mozilla Thunderbird Thunderbird MAPI Proxy Dll
LegalCopyright ©Thunderbird and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL 2.1 licenses, as applicable.
CompanyName Mozilla.org
FileDescription -
FileVersion 0.8
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename MapiProxy.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xd76 0xe00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.05
.orpc 0x10002000 0x3c 0x200 0x1200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 1.03
.rdata 0x10003000 0x1072 0x1200 0x1400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.58
.data 0x10005000 0x3e0 0x200 0x2600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.94
.rsrc 0x10006000 0x470 0x600 0x2800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.64
.reloc 0x10007000 0x1c0 0x200 0x2e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 5.66
Imports (4)
»
KERNEL32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
DisableThreadLibraryCalls - 0x10003000 0x3b54 0x1f54 0x11b
GetCurrentProcess - 0x10003004 0x3b58 0x1f58 0x213
IsProcessorFeaturePresent - 0x10003008 0x3b5c 0x1f5c 0x37d
SetUnhandledExceptionFilter - 0x1000300c 0x3b60 0x1f60 0x55e
UnhandledExceptionFilter - 0x10003010 0x3b64 0x1f64 0x59d
IsDebuggerPresent - 0x10003014 0x3b68 0x1f68 0x376
InitializeSListHead - 0x10003018 0x3b6c 0x1f6c 0x35a
GetSystemTimeAsFileTime - 0x1000301c 0x3b70 0x1f70 0x2e2
GetCurrentThreadId - 0x10003020 0x3b74 0x1f74 0x218
GetCurrentProcessId - 0x10003024 0x3b78 0x1f78 0x214
QueryPerformanceCounter - 0x10003028 0x3b7c 0x1f7c 0x440
TerminateProcess - 0x1000302c 0x3b80 0x1f80 0x57c
RPCRT4.dll (19)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CStdStubBuffer_DebugServerRelease - 0x10003034 0x3b88 0x1f88 0x4
IUnknown_QueryInterface_Proxy - 0x10003038 0x3b8c 0x1f8c 0x10
IUnknown_AddRef_Proxy - 0x1000303c 0x3b90 0x1f90 0xf
IUnknown_Release_Proxy - 0x10003040 0x3b94 0x1f94 0x11
NdrOleAllocate - 0x10003044 0x3b98 0x1f98 0x110
NdrOleFree - 0x10003048 0x3b9c 0x1f9c 0x111
CStdStubBuffer_Invoke - 0x1000304c 0x3ba0 0x1fa0 0x6
CStdStubBuffer_Disconnect - 0x10003050 0x3ba4 0x1fa4 0x5
CStdStubBuffer_Connect - 0x10003054 0x3ba8 0x1fa8 0x1
CStdStubBuffer_AddRef - 0x10003058 0x3bac 0x1fac 0x0
CStdStubBuffer_QueryInterface - 0x1000305c 0x3bb0 0x1fb0 0x8
CStdStubBuffer_CountRefs - 0x10003060 0x3bb4 0x1fb4 0x2
CStdStubBuffer_DebugServerQueryInterface - 0x10003064 0x3bb8 0x1fb8 0x3
NdrCStdStubBuffer_Release - 0x10003068 0x3bbc 0x1fbc 0x9f
NdrDllGetClassObject - 0x1000306c 0x3bc0 0x1fc0 0xd6
NdrDllCanUnloadNow - 0x10003070 0x3bc4 0x1fc4 0xd5
NdrDllRegisterProxy - 0x10003074 0x3bc8 0x1fc8 0xd7
NdrDllUnregisterProxy - 0x10003078 0x3bcc 0x1fcc 0xd8
CStdStubBuffer_IsIIDSupported - 0x1000307c 0x3bd0 0x1fd0 0x7
VCRUNTIME140.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__std_type_info_destroy_list - 0x10003084 0x3bd8 0x1fd8 0x25
memcmp - 0x10003088 0x3bdc 0x1fdc 0x45
memset - 0x1000308c 0x3be0 0x1fe0 0x48
_except_handler4_common - 0x10003090 0x3be4 0x1fe4 0x35
api-ms-win-crt-runtime-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_initialize_onexit_table - 0x10003098 0x3bec 0x1fec 0x36
_cexit - 0x1000309c 0x3bf0 0x1ff0 0x17
_execute_onexit_table - 0x100030a0 0x3bf4 0x1ff4 0x24
_initialize_narrow_environment - 0x100030a4 0x3bf8 0x1ff8 0x35
_configure_narrow_argv - 0x100030a8 0x3bfc 0x1ffc 0x19
_seh_filter_dll - 0x100030ac 0x3c00 0x2000 0x41
_initterm_e - 0x100030b0 0x3c04 0x2004 0x39
_initterm - 0x100030b4 0x3c08 0x2008 0x38
Exports (5)
»
Api name EAT Address Ordinal
DllCanUnloadNow 0x1014 0x1
DllGetClassObject 0x1020 0x2
DllRegisterServer 0x1075 0x3
DllUnregisterServer 0x109c 0x4
GetProxyDllInfo 0x10c3 0x5
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
mozglue.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\mozglue.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 133.95 KB
MD5 eae9273f8cdcf9321c6c37c244773139 Copy to Clipboard
SHA1 8378e2a2f3635574c106eea8419b5eb00b8489b0 Copy to Clipboard
SHA256 a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc Copy to Clipboard
SSDeep 3072:Z6s2DIGLXlNJJcPoN0j/kVqhp1qt/TXTv7q1D2JJJvPhrSeXZ5dR:MszGLXlNrE/kVqhp12/TXTjSD2JJJvPt Copy to Clipboard
ImpHash cd277fcaef27e2c4552601c33d459467 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x100182f0
Size Of Code 0x17a00
Size Of Initialized Data 0x8600
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:43:55+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename mozglue.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x178da 0x17a00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.62
.rdata 0x10019000 0x655e 0x6600 0x17e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.67
.data 0x10020000 0xbbc 0x200 0x1e400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.79
.didat 0x10021000 0x38 0x200 0x1e600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.67
.rsrc 0x10022000 0x378 0x400 0x1e800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.88
.reloc 0x10023000 0xc6c 0xe00 0x1ec00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.26
Imports (14)
»
KERNEL32.dll (76)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
IsDebuggerPresent - 0x10019010 0x1dff0 0x1cdf0 0x376
OutputDebugStringA - 0x10019014 0x1dff4 0x1cdf4 0x40b
EncodePointer - 0x10019018 0x1dff8 0x1cdf8 0x12a
DecodePointer - 0x1001901c 0x1dffc 0x1cdfc 0x106
CloseHandle - 0x10019020 0x1e000 0x1ce00 0x85
ReleaseSRWLockExclusive - 0x10019024 0x1e004 0x1ce04 0x4a4
ReleaseSRWLockShared - 0x10019028 0x1e008 0x1ce08 0x4a5
AcquireSRWLockExclusive - 0x1001902c 0x1e00c 0x1ce0c 0x0
AcquireSRWLockShared - 0x10019030 0x1e010 0x1ce10 0x1
InitializeCriticalSection - 0x10019034 0x1e014 0x1ce14 0x355
EnterCriticalSection - 0x10019038 0x1e018 0x1ce18 0x12e
LeaveCriticalSection - 0x1001903c 0x1e01c 0x1ce1c 0x3b2
GetCurrentProcess - 0x10019040 0x1e020 0x1ce20 0x213
GetCurrentThreadId - 0x10019044 0x1e024 0x1ce24 0x218
FlushInstructionCache - 0x10019048 0x1e028 0x1ce28 0x19c
GetSystemInfo - 0x1001904c 0x1e02c 0x1ce2c 0x2dc
VirtualQuery - 0x10019050 0x1e030 0x1ce30 0x5be
VirtualAllocEx - 0x10019054 0x1e034 0x1ce34 0x5b7
VirtualProtectEx - 0x10019058 0x1e038 0x1ce38 0x5bd
CreateFileMappingW - 0x1001905c 0x1e03c 0x1ce3c 0xc6
MapViewOfFile - 0x10019060 0x1e040 0x1ce40 0x3d1
UnmapViewOfFile - 0x10019064 0x1e044 0x1ce44 0x5a0
GetModuleHandleA - 0x10019068 0x1e048 0x1ce48 0x26e
GetModuleHandleW - 0x1001906c 0x1e04c 0x1ce4c 0x271
GetProcAddress - 0x10019070 0x1e050 0x1ce50 0x2a7
LoadLibraryExA - 0x10019074 0x1e054 0x1ce54 0x3b7
LoadLibraryW - 0x10019078 0x1e058 0x1ce58 0x3b9
VerifyVersionInfoA - 0x1001907c 0x1e05c 0x1ce5c 0x5b4
GetEnvironmentVariableA - 0x10019080 0x1e060 0x1ce60 0x232
WriteFile - 0x10019084 0x1e064 0x1ce64 0x605
TerminateProcess - 0x10019088 0x1e068 0x1ce68 0x57c
VirtualAlloc - 0x1001908c 0x1e06c 0x1ce6c 0x5b6
VirtualFree - 0x10019090 0x1e070 0x1ce70 0x5b9
GetLastError - 0x10019094 0x1e074 0x1ce74 0x25a
InitializeConditionVariable - 0x10019098 0x1e078 0x1ce78 0x353
WakeConditionVariable - 0x1001909c 0x1e07c 0x1ce7c 0x5d0
WakeAllConditionVariable - 0x100190a0 0x1e080 0x1ce80 0x5cf
SleepConditionVariableSRW - 0x100190a4 0x1e084 0x1ce84 0x56f
InitializeSRWLock - 0x100190a8 0x1e088 0x1ce88 0x35b
WideCharToMultiByte - 0x100190ac 0x1e08c 0x1ce8c 0x5f1
DuplicateHandle - 0x100190b0 0x1e090 0x1ce90 0x128
SetEvent - 0x100190b4 0x1e094 0x1ce94 0x507
WaitForSingleObject - 0x100190b8 0x1e098 0x1ce98 0x5c7
CreateEventA - 0x100190bc 0x1e09c 0x1ce9c 0xba
SignalObjectAndWait - 0x100190c0 0x1e0a0 0x1cea0 0x56b
GetCurrentThread - 0x100190c4 0x1e0a4 0x1cea4 0x217
SuspendThread - 0x100190c8 0x1e0a8 0x1cea8 0x575
ResumeThread - 0x100190cc 0x1e0ac 0x1ceac 0x4be
GetThreadContext - 0x100190d0 0x1e0b0 0x1ceb0 0x2f0
LocalFree - 0x100190d4 0x1e0b4 0x1ceb4 0x3c3
FormatMessageA - 0x100190d8 0x1e0b8 0x1ceb8 0x1a2
QueryPerformanceCounter - 0x100190dc 0x1e0bc 0x1cebc 0x440
QueryPerformanceFrequency - 0x100190e0 0x1e0c0 0x1cec0 0x441
DeleteCriticalSection - 0x100190e4 0x1e0c4 0x1cec4 0x10d
GetProcessTimes - 0x100190e8 0x1e0c8 0x1cec8 0x2b7
GetSystemTime - 0x100190ec 0x1e0cc 0x1cecc 0x2e0
GetTickCount64 - 0x100190f0 0x1e0d0 0x1ced0 0x301
GetSystemTimeAdjustment - 0x100190f4 0x1e0d4 0x1ced4 0x2e1
SystemTimeToFileTime - 0x100190f8 0x1e0d8 0x1ced8 0x578
DisableThreadLibraryCalls - 0x100190fc 0x1e0dc 0x1cedc 0x11b
CreateFileW - 0x10019100 0x1e0e0 0x1cee0 0xc9
SearchPathW - 0x10019104 0x1e0e4 0x1cee4 0x4c9
InitializeCriticalSectionAndSpinCount - 0x10019108 0x1e0e8 0x1cee8 0x356
VerSetConditionMask - 0x1001910c 0x1e0ec 0x1ceec 0x5b1
GetSystemTimeAsFileTime - 0x10019110 0x1e0f0 0x1cef0 0x2e2
GetCurrentProcessId - 0x10019114 0x1e0f4 0x1cef4 0x214
CreateEventW - 0x10019118 0x1e0f8 0x1cef8 0xbd
WaitForSingleObjectEx - 0x1001911c 0x1e0fc 0x1cefc 0x5c8
ResetEvent - 0x10019120 0x1e100 0x1cf00 0x4b8
IsProcessorFeaturePresent - 0x10019124 0x1e104 0x1cf04 0x37d
SetUnhandledExceptionFilter - 0x10019128 0x1e108 0x1cf08 0x55e
UnhandledExceptionFilter - 0x1001912c 0x1e10c 0x1cf0c 0x59d
FreeLibrary - 0x10019130 0x1e110 0x1cf10 0x1a7
VirtualProtect - 0x10019134 0x1e114 0x1cf14 0x5bc
RaiseException - 0x10019138 0x1e118 0x1cf18 0x455
InitializeSListHead - 0x1001913c 0x1e11c 0x1cf1c 0x35a
ADVAPI32.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegOpenKeyExW - 0x10019000 0x1dfe0 0x1cde0 0x28a
RegCloseKey - 0x10019004 0x1dfe4 0x1cde4 0x259
RegQueryValueExW - 0x10019008 0x1dfe8 0x1cde8 0x297
dbghelp.dll (10)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SymFromAddr - 0x100192c8 0x1e2a8 0x1d0a8 0x59
SymInitialize - 0x100192cc 0x1e2ac 0x1d0ac 0x9e
SymGetLineFromAddr64 - 0x100192d0 0x1e2b0 0x1d0b0 0x6b
SymGetModuleBase64 - 0x100192d4 0x1e2b4 0x1d0b4 0x79
SymLoadModule64 - 0x100192d8 0x1e2b8 0x1d0b8 0xa1
SymFunctionTableAccess64 - 0x100192dc 0x1e2bc 0x1d0bc 0x64
EnumerateLoadedModules64 - 0x100192e0 0x1e2c0 0x1d0c0 0x5
SymSetOptions - 0x100192e4 0x1e2c4 0x1d0c4 0xb9
StackWalk64 - 0x100192e8 0x1e2c8 0x1d0c8 0x2c
SymGetModuleInfo64 - 0x100192ec 0x1e2cc 0x1d0cc 0x7b
VERSION.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetFileVersionInfoW - 0x100191fc 0x1e1dc 0x1cfdc 0x8
GetFileVersionInfoSizeW - 0x10019200 0x1e1e0 0x1cfe0 0x7
VerQueryValueW - 0x10019204 0x1e1e4 0x1cfe4 0x10
MSVCP140.dll (33)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ - 0x10019144 0x1e124 0x1cf24 0x228
?_Xbad_alloc@std@@YAXXZ - 0x10019148 0x1e128 0x1cf28 0x28b
?_Xlength_error@std@@YAXPBD@Z - 0x1001914c 0x1e12c 0x1cf2c 0x28e
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA - 0x10019150 0x1e130 0x1cf30 0x25c
?_Xout_of_range@std@@YAXPBD@Z - 0x10019154 0x1e134 0x1cf34 0x28f
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z - 0x10019158 0x1e138 0x1cf38 0x218
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ - 0x1001915c 0x1e13c 0x1cf3c 0x2f
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ - 0x10019160 0x1e140 0x1cf40 0x89
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ - 0x10019164 0x1e144 0x1cf44 0x24a
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z - 0x10019168 0x1e148 0x1cf48 0x25
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ - 0x1001916c 0x1e14c 0x1cf4c 0x86
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z - 0x10019170 0x1e150 0x1cf50 0x10b
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z - 0x10019174 0x1e154 0x1cf54 0x10c
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z - 0x10019178 0x1e158 0x1cf58 0x4c4
?id@?$ctype@D@std@@2V0locale@2@A - 0x1001917c 0x1e15c 0x1cf5c 0x3cf
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ - 0x10019180 0x1e160 0x1cf60 0x27f
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z - 0x10019184 0x1e164 0x1cf64 0x3f6
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z - 0x10019188 0x1e168 0x1cf68 0x4b5
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ - 0x1001918c 0x1e16c 0x1cf6c 0x4d5
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ - 0x10019190 0x1e170 0x1cf70 0x4fd
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ - 0x10019194 0x1e174 0x1cf74 0x51b
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z - 0x10019198 0x1e178 0x1cf78 0x543
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z - 0x1001919c 0x1e17c 0x1cf7c 0x546
?_BADOFF@std@@3_JB - 0x100191a0 0x1e180 0x1cf80 0x196
??_7ios_base@std@@6B@ - 0x100191a4 0x1e184 0x1cf84 0x15b
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ - 0x100191a8 0x1e188 0x1cf88 0x133
??0_Lockit@std@@QAE@H@Z - 0x100191ac 0x1e18c 0x1cf8c 0x6d
??1_Lockit@std@@QAE@XZ - 0x100191b0 0x1e190 0x1cf90 0xa5
??Bid@locale@std@@QAEIXZ - 0x100191b4 0x1e194 0x1cf94 0x131
?classic@locale@std@@SAABV12@XZ - 0x100191b8 0x1e198 0x1cf98 0x2a4
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ - 0x100191bc 0x1e19c 0x1cf9c 0x1d5
?tolower@?$ctype@D@std@@QBEDD@Z - 0x100191c0 0x1e1a0 0x1cfa0 0x50f
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z - 0x100191c4 0x1e1a4 0x1cfa4 0x1b6
VCRUNTIME140.dll (11)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
memcpy - 0x100191cc 0x1e1ac 0x1cfac 0x46
_purecall - 0x100191d0 0x1e1b0 0x1cfb0 0x3d
memset - 0x100191d4 0x1e1b4 0x1cfb4 0x48
longjmp - 0x100191d8 0x1e1b8 0x1cfb8 0x43
_setjmp3 - 0x100191dc 0x1e1bc 0x1cfbc 0x42
strchr - 0x100191e0 0x1e1c0 0x1cfc0 0x4a
_except_handler4_common - 0x100191e4 0x1e1c4 0x1cfc4 0x35
memmove - 0x100191e8 0x1e1c8 0x1cfc8 0x47
__CxxFrameHandler3 - 0x100191ec 0x1e1cc 0x1cfcc 0x10
__vcrt_InitializeCriticalSectionEx - 0x100191f0 0x1e1d0 0x1cfd0 0x30
__std_type_info_destroy_list - 0x100191f4 0x1e1d4 0x1cfd4 0x25
api-ms-win-crt-runtime-l1-1-0.dll (14)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_beginthreadex - 0x10019248 0x1e228 0x1d028 0x15
_errno - 0x1001924c 0x1e22c 0x1d02c 0x23
_cexit - 0x10019250 0x1e230 0x1d030 0x17
_initterm_e - 0x10019254 0x1e234 0x1d034 0x39
_initterm - 0x10019258 0x1e238 0x1d038 0x38
_invalid_parameter_noinfo_noreturn - 0x1001925c 0x1e23c 0x1d03c 0x3b
abort - 0x10019260 0x1e240 0x1d040 0x57
_seh_filter_dll - 0x10019264 0x1e244 0x1d044 0x41
_configure_narrow_argv - 0x10019268 0x1e248 0x1d048 0x19
_initialize_narrow_environment - 0x1001926c 0x1e24c 0x1d04c 0x35
_initialize_onexit_table - 0x10019270 0x1e250 0x1d050 0x36
_register_onexit_function - 0x10019274 0x1e254 0x1d054 0x3e
_execute_onexit_table - 0x10019278 0x1e258 0x1d058 0x24
_crt_atexit - 0x1001927c 0x1e25c 0x1d05c 0x1f
api-ms-win-crt-string-l1-1-0.dll (7)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strncpy - 0x100192a8 0x1e288 0x1d088 0x8f
_stricmp - 0x100192ac 0x1e28c 0x1d08c 0x2a
isxdigit - 0x100192b0 0x1e290 0x1d090 0x7e
_strnicmp - 0x100192b4 0x1e294 0x1d094 0x34
_wcsnicmp - 0x100192b8 0x1e298 0x1d098 0x54
wcsncpy - 0x100192bc 0x1e29c 0x1d09c 0xa7
wcstok_s - 0x100192c0 0x1e2a0 0x1d0a0 0xad
api-ms-win-crt-stdio-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
fputs - 0x10019284 0x1e264 0x1d064 0x80
__acrt_iob_func - 0x10019288 0x1e268 0x1d068 0x0
_write - 0x1001928c 0x1e26c 0x1d06c 0x6b
__stdio_common_vfprintf - 0x10019290 0x1e270 0x1d070 0x3
__stdio_common_vsprintf - 0x10019294 0x1e274 0x1d074 0xd
fflush - 0x10019298 0x1e278 0x1d078 0x77
fclose - 0x1001929c 0x1e27c 0x1d07c 0x74
_dup - 0x100192a0 0x1e280 0x1d080 0x1a
api-ms-win-crt-filesystem-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_wsplitpath_s - 0x10019220 0x1e200 0x1d000 0x39
api-ms-win-crt-convert-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_strtoui64 - 0x1001920c 0x1e1ec 0x1cfec 0x27
_ltoa - 0x10019210 0x1e1f0 0x1cff0 0x1b
api-ms-win-crt-math-l1-1-0.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_except1 - 0x10019234 0x1e214 0x1d014 0x40
_dtest - 0x10019238 0x1e218 0x1d018 0x3e
_fdopen - 0x1001923c 0x1e21c 0x1d01c 0x46
ceil - 0x10019240 0x1e220 0x1d020 0xa2
api-ms-win-crt-heap-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
malloc - 0x10019228 0x1e208 0x1d008 0x19
free - 0x1001922c 0x1e20c 0x1d00c 0x18
api-ms-win-crt-environment-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
getenv - 0x10019218 0x1e1f8 0x1cff8 0x10
Exports (159)
»
Api name EAT Address Ordinal
??0ConditionVariableImpl@detail@mozilla@@QAE@XZ 0x9400 0x1
??0Decimal@blink@@QAE@ABV01@@Z 0xd830 0x2
??0Decimal@blink@@QAE@ABVEncodedData@01@@Z 0xd830 0x3
??0Decimal@blink@@QAE@H@Z 0xd850 0x4
??0Decimal@blink@@QAE@W4Sign@01@H_K@Z 0xd880 0x5
??0MutexImpl@detail@mozilla@@QAE@XZ 0x9550 0x6
??0PrintfTarget@mozilla@@IAE@XZ 0x9600 0x7
??0SHA1Sum@mozilla@@QAE@XZ 0x10af0 0x8
??0TimeStampValue@mozilla@@AAE@_K0_N@Z 0xb4e0 0x9
??1ConditionVariableImpl@detail@mozilla@@QAE@XZ 0x9410 0xa
??1MutexImpl@detail@mozilla@@QAE@XZ 0x9410 0xb
??4Decimal@blink@@QAEAAV01@ABV01@@Z 0xd830 0xc
??8Decimal@blink@@QBE_NABV01@@Z 0xd9a0 0xd
??9Decimal@blink@@QBE_NABV01@@Z 0xda20 0xe
??DDecimal@blink@@QBE?AV01@ABV01@@Z 0xda70 0xf
??GDecimal@blink@@QBE?AV01@ABV01@@Z 0xdb70 0x10
??GDecimal@blink@@QBE?AV01@XZ 0xdca0 0x11
??GTimeStampValue@mozilla@@QBE_KABV01@@Z 0xb510 0x12
??HDecimal@blink@@QBE?AV01@ABV01@@Z 0xdce0 0x13
??KDecimal@blink@@QBE?AV01@ABV01@@Z 0xde00 0x14
??MDecimal@blink@@QBE_NABV01@@Z 0xdff0 0x15
??NDecimal@blink@@QBE_NABV01@@Z 0xe020 0x16
??ODecimal@blink@@QBE_NABV01@@Z 0xe080 0x17
??PDecimal@blink@@QBE_NABV01@@Z 0xe0b0 0x18
??XDecimal@blink@@QAEAAV01@ABV01@@Z 0xe110 0x19
??YDecimal@blink@@QAEAAV01@ABV01@@Z 0xe140 0x1a
??YTimeStampValue@mozilla@@QAEAAV01@_J@Z 0xb540 0x1b
??ZDecimal@blink@@QAEAAV01@ABV01@@Z 0xe170 0x1c
??ZTimeStampValue@mozilla@@QAEAAV01@_J@Z 0xb560 0x1d
??_0Decimal@blink@@QAEAAV01@ABV01@@Z 0xe1a0 0x1e
??_FDecimal@blink@@QAEXXZ 0xe2b0 0x1f
?CheckQPC@TimeStampValue@mozilla@@ABE_KABV12@@Z 0xb580 0x20
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ 0xb740 0x21
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z 0x116d0 0x22
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z 0x117e0 0x23
?DllBlocklist_CheckStatus@@YA_NXZ 0x2050 0x24
?DllBlocklist_Initialize@@YAXI@Z 0x2070 0x25
?DllBlocklist_SetDllServices@@YAXPAVDllServicesBase@detail@glue@mozilla@@@Z 0x2170 0x26
?DllBlocklist_WriteNotes@@YAXPAX@Z 0x2200 0x27
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z 0x11f20 0x28
?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ 0x12080 0x29
?FramePointerStackWalk@mozilla@@YAXP6AXIPAX00@ZII0PAPAX0@Z 0xa770 0x2a
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z 0x12b30 0x2b
?HashBytes@mozilla@@YAIPBXI@Z 0x12bb0 0x2c
?IsFloat32Representable@mozilla@@YA_NN@Z 0x12e40 0x2d
?MozDescribeCodeAddress@@YA_NPAXPAUMozCodeAddressDetails@@@Z 0xa7e0 0x2e
?MozFormatCodeAddress@@YAXPADIIPBXPBD2H2I@Z 0xa9b0 0x2f
?MozFormatCodeAddressDetails@@YAXPADIIPAXPBUMozCodeAddressDetails@@@Z 0xaa20 0x30
?MozStackWalk@@YAXP6AXIPAX00@ZII0@Z 0xaa60 0x31
?MozStackWalkThread@@YAXP6AXIPAX00@ZII00PAU_CONTEXT@@@Z 0xaa80 0x32
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z 0xba20 0x33
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@PA_N@Z 0xb3b0 0x34
?RecordProcessRestart@TimeStamp@mozilla@@SAXXZ 0xb4b0 0x35
?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAVPseudoStack@@PBD0PAXI@ZP6AXPAV2@@Z@Z 0x93e0 0x36
?ResolutionInTicks@BaseTimeDurationPlatformUtils@mozilla@@SA_JXZ 0xbb20 0x37
?Shutdown@TimeStamp@mozilla@@SAXXZ 0xbb30 0x38
?Startup@TimeStamp@mozilla@@SAXXZ 0xbb40 0x39
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z 0xbc10 0x3a
?ToExponential@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z 0x13e70 0x3b
?ToFixed@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z 0x13ff0 0x3c
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPA_NPAVStringBuilder@2@@Z 0x141a0 0x3d
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z 0xbc60 0x3e
?ToSecondsSigDigits@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z 0xbca0 0x3f
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z 0x14330 0x40
?Unused@mozilla@@3Uunused_t@1@B 0x207e4 0x41
?abs@Decimal@blink@@QBE?AV12@XZ 0xe480 0x42
?aes_enabled@sse_private@mozilla@@3_NA 0x20078 0x43
?alignOperands@Decimal@blink@@CA?AUAlignedOperands@12@ABV12@0@Z 0xe4a0 0x44
?avx2_enabled@sse_private@mozilla@@3_NA 0x2007d 0x45
?avx_enabled@sse_private@mozilla@@3_NA 0x2007b 0x46
?ceil@Decimal@blink@@QBE?AV12@XZ 0xe6f0 0x47
?compareTo@Decimal@blink@@ABE?AV12@ABV12@@Z 0xe7c0 0x48
?compress@LZ4@Compression@mozilla@@SAIPBDIPAD@Z 0xd460 0x49
?compressLimitedOutput@LZ4@Compression@mozilla@@SAIPBDIPADI@Z 0xd480 0x4a
?decompress@LZ4@Compression@mozilla@@SA_NPBDIPADIPAI@Z 0xd4a0 0x4b
?decompress@LZ4@Compression@mozilla@@SA_NPBDPADI@Z 0xd4d0 0x4c
?decompressPartial@LZ4@Compression@mozilla@@SA_NPBDIPADIPAI@Z 0xd4f0 0x4d
?finish@SHA1Sum@mozilla@@QAEXAAY0BE@E@Z 0x145c0 0x4e
?floor@Decimal@blink@@QBE?AV12@XZ 0xe8c0 0x4f
?fromDouble@Decimal@blink@@SA?AV12@N@Z 0xe980 0x50
?fromString@Decimal@blink@@SA?AV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z 0xea20 0x51
?gChaosFeatures@detail@mozilla@@3W4ChaosFeature@2@A 0x207d0 0x52
?gChaosModeCounter@detail@mozilla@@3V?$Atomic@I$01X@2@A 0x207e8 0x53
?gTwoCharEscapes@detail@mozilla@@3QBDB 0x1add8 0x54
?infinity@Decimal@blink@@SA?AV12@W4Sign@12@@Z 0xed50 0x55
?kBase10MaximalLength@DoubleToStringConverter@double_conversion@@2HB 0x1ad20 0x56
?lock@MutexImpl@detail@mozilla@@IAEXXZ 0x9560 0x57
?mmx_enabled@sse_private@mozilla@@3_NA 0x2007f 0x58
?mozalloc_handle_oom@@YAXI@Z 0x91c0 0x59
?mozalloc_set_oom_abort_handler@@YAXP6AXI@Z@Z 0x9230 0x5a
?nan@Decimal@blink@@SA?AV12@XZ 0xf040 0x5b
?notify_all@ConditionVariableImpl@detail@mozilla@@QAEXXZ 0x9460 0x5c
?notify_one@ConditionVariableImpl@detail@mozilla@@QAEXXZ 0x9470 0x5d
?print@PrintfTarget@mozilla@@QAA_NPBDZZ 0x9eb0 0x5e
?remainder@Decimal@blink@@QBE?AV12@ABV12@@Z 0xf2c0 0x5f
?round@Decimal@blink@@QBE?AV12@XZ 0xf340 0x60
?sse3_enabled@sse_private@mozilla@@3_NA 0x2007c 0x61
?sse4_1_enabled@sse_private@mozilla@@3_NA 0x2007a 0x62
?sse4_2_enabled@sse_private@mozilla@@3_NA 0x2007e 0x63
?sse4a_enabled@sse_private@mozilla@@3_NA 0x20080 0x64
?ssse3_enabled@sse_private@mozilla@@3_NA 0x20079 0x65
?toDouble@Decimal@blink@@QBENXZ 0xf7e0 0x66
?toString@Decimal@blink@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ 0xf880 0x67
?toString@Decimal@blink@@QBE_NPADI@Z 0xfb90 0x68
?unlock@MutexImpl@detail@mozilla@@IAEXXZ 0x9570 0x69
?update@SHA1Sum@mozilla@@QAEXPBXI@Z 0x15b90 0x6a
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z 0x9ed0 0x6b
?wait@ConditionVariableImpl@detail@mozilla@@QAEXAAVMutexImpl@23@@Z 0x9480 0x6c
?wait_for@ConditionVariableImpl@detail@mozilla@@QAE?AW4CVStatus@23@AAVMutexImpl@23@ABV?$BaseTimeDuration@VTimeDurationValueCalculator@mozilla@@@3@@Z 0x94c0 0x6d
?zero@Decimal@blink@@SA?AV12@W4Sign@12@@Z 0xfc80 0x6e
CFG_DisabledOrCrash 0x15a0 0x6f
MOZ_CrashOOL 0x15c70 0x73
MOZ_CrashPrintf 0x15c90 0x74
_HeapAlloc@12 0x9160 0x70
_HeapFree@12 0x9180 0x71
_HeapReAlloc@16 0x91a0 0x72
_aligned_free 0x8ee0 0x75
_aligned_malloc 0x9030 0x76
_expand 0x8df0 0x77
_msize 0x8e20 0x78
_recalloc 0x8e40 0x79
_strdup 0x9050 0x7a
_wcsdup 0x90a0 0x7b
calloc 0x8ec0 0x7c
free 0x8ee0 0x7d
gMozCrashReason 0x207d4 0x7e
gMozillaPoisonBase 0x207dc 0x7f
gMozillaPoisonSize 0x207e0 0x80
gMozillaPoisonValue 0x207d8 0x81
jemalloc_free_dirty_pages 0x8f80 0x82
jemalloc_ptr_info 0x8f90 0x83
jemalloc_purge_freed_pages 0x9410 0x84
jemalloc_stats 0x8fa0 0x85
jemalloc_thread_local_arena 0x8fb0 0x86
malloc 0x8f00 0x87
malloc_good_size 0x8f20 0x88
malloc_usable_size 0x8e20 0x89
mozPoisonValueInit 0x15cf0 0x8a
moz_arena_calloc 0x8fc0 0x8b
moz_arena_free 0x8fd0 0x8c
moz_arena_malloc 0x8fe0 0x8d
moz_arena_memalign 0x8ff0 0x8e
moz_arena_realloc 0x9000 0x8f
moz_create_arena_with_params 0x9010 0x90
moz_dispose_arena 0x9020 0x91
moz_malloc_enclosing_size_of 0x9240 0x92
moz_malloc_size_of 0x9280 0x93
moz_malloc_usable_size 0x9280 0x94
moz_xcalloc 0x92a0 0x95
moz_xmalloc 0x9300 0x96
moz_xmemalign 0x9320 0x97
moz_xrealloc 0x9350 0x98
moz_xstrdup 0x9380 0x99
mozalloc_abort 0x9100 0x9a
posix_memalign 0x8f50 0x9b
realloc 0x8f60 0x9c
strdup 0x9050 0x9d
strndup 0x9070 0x9e
wcsdup 0x90a0 0x9f
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
mozMapi32.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\mozMapi32.dll (Dropped File)
C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\mozMapi32_InUse.dll (Dropped File)
mozMapi32_InUse.dll (Embedded File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 81.45 KB
MD5 385a92719cc3a215007b83947922b9b5 Copy to Clipboard
SHA1 38de6ca70cee1bad84bed29ce7620a15e6abcd10 Copy to Clipboard
SHA256 06ef2010b738fbe99bcdebbf162473a4ee090678bb6862eeb0d4c7a8c3f225bb Copy to Clipboard
SSDeep 1536:CNr03+TtFKytqB0EeCsu1sW+cdQOTki9jHiU:CNrDKHBBjXQSki9OU Copy to Clipboard
ImpHash 9cbfe23029f9386c84bb71d003ea1e41 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x10001903
Size Of Code 0xaa00
Size Of Initialized Data 0x8600
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:37:53+00:00
Version Information (11)
»
Comments Mozilla Thunderbird MAPI Dll
LegalCopyright ©Thunderbird and Mozilla Developers, according to the MPL 1.1/GPL 2.0/LGPL 2.1 licenses, as applicable.
CompanyName Mozilla.org
FileDescription -
FileVersion 0.8
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename mozMapi32.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xa917 0xaa00 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.6
.rdata 0x1000c000 0x5b5a 0x5c00 0xae00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 4.88
.data 0x10012000 0x12f4 0x800 0x10a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 2.43
.rsrc 0x10014000 0x450 0x600 0x11200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.58
.reloc 0x10015000 0xe64 0x1000 0x11800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.25
Imports (2)
»
KERNEL32.dll (64)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
TlsAlloc - 0x1000c000 0x11558 0x10358 0x58e
TlsGetValue - 0x1000c004 0x1155c 0x1035c 0x590
TlsSetValue - 0x1000c008 0x11560 0x10360 0x591
TlsFree - 0x1000c00c 0x11564 0x10364 0x58f
CreateFileW - 0x1000c010 0x11568 0x10368 0xc9
CloseHandle - 0x1000c014 0x1156c 0x1036c 0x85
DecodePointer - 0x1000c018 0x11570 0x10370 0x106
QueryPerformanceCounter - 0x1000c01c 0x11574 0x10374 0x440
GetCurrentProcessId - 0x1000c020 0x11578 0x10378 0x214
GetCurrentThreadId - 0x1000c024 0x1157c 0x1037c 0x218
GetSystemTimeAsFileTime - 0x1000c028 0x11580 0x10380 0x2e2
InitializeSListHead - 0x1000c02c 0x11584 0x10384 0x35a
IsDebuggerPresent - 0x1000c030 0x11588 0x10388 0x376
UnhandledExceptionFilter - 0x1000c034 0x1158c 0x1038c 0x59d
SetUnhandledExceptionFilter - 0x1000c038 0x11590 0x10390 0x55e
GetStartupInfoW - 0x1000c03c 0x11594 0x10394 0x2c9
IsProcessorFeaturePresent - 0x1000c040 0x11598 0x10398 0x37d
GetModuleHandleW - 0x1000c044 0x1159c 0x1039c 0x271
GetCurrentProcess - 0x1000c048 0x115a0 0x103a0 0x213
TerminateProcess - 0x1000c04c 0x115a4 0x103a4 0x57c
RaiseException - 0x1000c050 0x115a8 0x103a8 0x455
InterlockedFlushSList - 0x1000c054 0x115ac 0x103ac 0x363
RtlUnwind - 0x1000c058 0x115b0 0x103b0 0x4c4
GetLastError - 0x1000c05c 0x115b4 0x103b4 0x25a
SetLastError - 0x1000c060 0x115b8 0x103b8 0x523
EnterCriticalSection - 0x1000c064 0x115bc 0x103bc 0x12e
LeaveCriticalSection - 0x1000c068 0x115c0 0x103c0 0x3b2
DeleteCriticalSection - 0x1000c06c 0x115c4 0x103c4 0x10d
InitializeCriticalSectionAndSpinCount - 0x1000c070 0x115c8 0x103c8 0x356
FreeLibrary - 0x1000c074 0x115cc 0x103cc 0x1a7
GetProcAddress - 0x1000c078 0x115d0 0x103d0 0x2a7
LoadLibraryExW - 0x1000c07c 0x115d4 0x103d4 0x3b8
ExitProcess - 0x1000c080 0x115d8 0x103d8 0x15a
GetModuleHandleExW - 0x1000c084 0x115dc 0x103dc 0x270
GetModuleFileNameA - 0x1000c088 0x115e0 0x103e0 0x26c
MultiByteToWideChar - 0x1000c08c 0x115e4 0x103e4 0x3e2
WideCharToMultiByte - 0x1000c090 0x115e8 0x103e8 0x5f1
HeapFree - 0x1000c094 0x115ec 0x103ec 0x341
HeapAlloc - 0x1000c098 0x115f0 0x103f0 0x33d
FindClose - 0x1000c09c 0x115f4 0x103f4 0x171
FindFirstFileExA - 0x1000c0a0 0x115f8 0x103f8 0x176
FindNextFileA - 0x1000c0a4 0x115fc 0x103fc 0x186
IsValidCodePage - 0x1000c0a8 0x11600 0x10400 0x382
GetACP - 0x1000c0ac 0x11604 0x10404 0x1ae
GetOEMCP - 0x1000c0b0 0x11608 0x10408 0x290
GetCPInfo - 0x1000c0b4 0x1160c 0x1040c 0x1bd
GetCommandLineA - 0x1000c0b8 0x11610 0x10410 0x1d2
GetCommandLineW - 0x1000c0bc 0x11614 0x10414 0x1d3
GetEnvironmentStringsW - 0x1000c0c0 0x11618 0x10418 0x231
FreeEnvironmentStringsW - 0x1000c0c4 0x1161c 0x1041c 0x1a6
LCMapStringW - 0x1000c0c8 0x11620 0x10420 0x3a6
GetProcessHeap - 0x1000c0cc 0x11624 0x10424 0x2ad
GetStdHandle - 0x1000c0d0 0x11628 0x10428 0x2cb
GetFileType - 0x1000c0d4 0x1162c 0x1042c 0x248
GetStringTypeW - 0x1000c0d8 0x11630 0x10430 0x2d0
HeapSize - 0x1000c0dc 0x11634 0x10434 0x346
HeapReAlloc - 0x1000c0e0 0x11638 0x10438 0x344
SetStdHandle - 0x1000c0e4 0x1163c 0x1043c 0x53b
WriteFile - 0x1000c0e8 0x11640 0x10440 0x605
FlushFileBuffers - 0x1000c0ec 0x11644 0x10444 0x19b
GetConsoleCP - 0x1000c0f0 0x11648 0x10448 0x1e6
GetConsoleMode - 0x1000c0f4 0x1164c 0x1044c 0x1f8
SetFilePointerEx - 0x1000c0f8 0x11650 0x10450 0x514
WriteConsoleW - 0x1000c0fc 0x11654 0x10454 0x604
ole32.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CoUninitialize - 0x1000c104 0x1165c 0x1045c 0x8d
CoCreateInstance - 0x1000c108 0x11660 0x10460 0x28
CoInitialize - 0x1000c10c 0x11664 0x10464 0x5d
Exports (13)
»
Api name EAT Address Ordinal
GetMapiDllVersion 0x1144 0x1
MAPIAddress 0x1389 0x6
MAPIDeleteMail 0x138f 0x7
MAPIDetails 0x13d2 0x8
MAPIFindNext 0x11c6 0x2
MAPIFreeBuffer 0x13d8 0x9
MAPILogoff 0x141d 0xa
MAPILogon 0x1461 0xb
MAPIReadMail 0x120f 0x3
MAPIResolveName 0x14ae 0xc
MAPISaveMail 0x1255 0x4
MAPISendDocuments 0x156b 0xd
MAPISendMail 0x127a 0x5
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
msvcp140.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\msvcp140.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 429.80 KB
MD5 109f0f02fd37c84bfc7508d4227d7ed5 Copy to Clipboard
SHA1 ef7420141bb15ac334d3964082361a460bfdb975 Copy to Clipboard
SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4 Copy to Clipboard
SSDeep 12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI Copy to Clipboard
ImpHash 6033404985b7d360f94b5f6fbed98789 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x1003b150
Size Of Code 0x60400
Size Of Initialized Data 0x8200
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2017-05-25 20:01:26+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription Microsoft® C Runtime Library
FileVersion 14.11.25325.0 built by: VCTOOLSREL
InternalName msvcp140.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename msvcp140.dll
ProductName Microsoft® Visual Studio® 2017
ProductVersion 14.11.25325.0
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x60372 0x60400 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.55
.data 0x10062000 0x2810 0x1800 0x60800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 4.41
.idata 0x10065000 0x1436 0x1600 0x62000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.09
.didat 0x10067000 0x34 0x200 0x63600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.72
.rsrc 0x10068000 0x3f8 0x400 0x63800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.36
.reloc 0x10069000 0x3a34 0x3c00 0x63c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.52
Imports (14)
»
VCRUNTIME140.dll (18)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
memchr - 0x10065108 0x65528 0x62528 0x44
memcmp - 0x1006510c 0x6552c 0x6252c 0x45
__std_type_info_destroy_list - 0x10065110 0x65530 0x62530 0x25
_except_handler4_common - 0x10065114 0x65534 0x62534 0x35
memset - 0x10065118 0x65538 0x62538 0x48
_CxxThrowException - 0x1006511c 0x6553c 0x6253c 0x1
__CxxFrameHandler3 - 0x10065120 0x65540 0x62540 0x10
__std_exception_destroy - 0x10065124 0x65544 0x62544 0x22
__current_exception - 0x10065128 0x65548 0x62548 0x1c
__AdjustPointer - 0x1006512c 0x6554c 0x6254c 0x9
__uncaught_exception - 0x10065130 0x65550 0x62550 0x2c
__uncaught_exceptions - 0x10065134 0x65554 0x62554 0x2d
memmove - 0x10065138 0x65558 0x62558 0x47
__std_exception_copy - 0x1006513c 0x6555c 0x6255c 0x21
_purecall - 0x10065140 0x65560 0x62560 0x3d
memcpy - 0x10065144 0x65564 0x62564 0x46
__processing_throw - 0x10065148 0x65568 0x62568 0x1f
__std_terminate - 0x1006514c 0x6556c 0x6256c 0x23
api-ms-win-crt-string-l1-1-0.dll (13)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
isspace - 0x1006528c 0x656ac 0x626ac 0x6e
islower - 0x10065290 0x656b0 0x626b0 0x6b
wcscpy_s - 0x10065294 0x656b4 0x626b4 0xa1
wcsnlen - 0x10065298 0x656b8 0x626b8 0xa9
__strncnt - 0x1006529c 0x656bc 0x626bc 0x5
_wcsdup - 0x100652a0 0x656c0 0x626c0 0x49
iswctype - 0x100652a4 0x656c4 0x626c4 0x75
strcspn - 0x100652a8 0x656c8 0x626c8 0x8a
tolower - 0x100652ac 0x656cc 0x626cc 0x97
isalnum - 0x100652b0 0x656d0 0x626d0 0x64
isxdigit - 0x100652b4 0x656d4 0x626d4 0x7e
isdigit - 0x100652b8 0x656d8 0x626d8 0x68
isupper - 0x100652bc 0x656dc 0x626dc 0x6f
api-ms-win-crt-heap-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_calloc_base - 0x10065188 0x655a8 0x625a8 0x9
_malloc_base - 0x1006518c 0x655ac 0x625ac 0x10
malloc - 0x10065190 0x655b0 0x625b0 0x19
_callnewh - 0x10065194 0x655b4 0x625b4 0x8
_free_base - 0x10065198 0x655b8 0x625b8 0xb
free - 0x1006519c 0x655bc 0x625bc 0x18
calloc - 0x100651a0 0x655c0 0x625c0 0x17
_realloc_base - 0x100651a4 0x655c4 0x625c4 0x14
api-ms-win-crt-locale-l1-1-0.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_lock_locales - 0x100651ac 0x655cc 0x625cc 0xd
__pctype_func - 0x100651b0 0x655d0 0x625d0 0x6
localeconv - 0x100651b4 0x655d4 0x625d4 0x12
___lc_collate_cp_func - 0x100651b8 0x655d8 0x625d8 0x1
___lc_locale_name_func - 0x100651bc 0x655dc 0x625dc 0x2
___lc_codepage_func - 0x100651c0 0x655e0 0x625e0 0x0
setlocale - 0x100651c4 0x655e4 0x625e4 0x13
___mb_cur_max_func - 0x100651c8 0x655e8 0x625e8 0x3
_unlock_locales - 0x100651cc 0x655ec 0x625ec 0xf
api-ms-win-crt-runtime-l1-1-0.dll (18)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
terminate - 0x100651ec 0x6560c 0x6260c 0x6a
abort - 0x100651f0 0x65610 0x62610 0x57
_seh_filter_dll - 0x100651f4 0x65614 0x62614 0x41
_initterm_e - 0x100651f8 0x65618 0x62618 0x39
_initterm - 0x100651fc 0x6561c 0x6261c 0x38
_cexit - 0x10065200 0x65620 0x62620 0x17
_crt_atexit - 0x10065204 0x65624 0x62624 0x1f
_execute_onexit_table - 0x10065208 0x65628 0x62628 0x24
_register_onexit_function - 0x1006520c 0x6562c 0x6262c 0x3e
_initialize_onexit_table - 0x10065210 0x65630 0x62630 0x36
_initialize_narrow_environment - 0x10065214 0x65634 0x62634 0x35
_configure_narrow_argv - 0x10065218 0x65638 0x62638 0x19
_endthreadex - 0x1006521c 0x6563c 0x6263c 0x22
_errno - 0x10065220 0x65640 0x62640 0x23
_beginthreadex - 0x10065224 0x65644 0x62644 0x15
_invalid_parameter_noinfo_noreturn - 0x10065228 0x65648 0x62648 0x3b
_invalid_parameter_noinfo - 0x1006522c 0x6564c 0x6264c 0x3a
_set_new_handler - 0x10065230 0x65650 0x62650 0x4a
api-ms-win-crt-stdio-l1-1-0.dll (20)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
fputwc - 0x10065238 0x65658 0x62658 0x81
__stdio_common_vsprintf_s - 0x1006523c 0x6565c 0x6265c 0xf
fputs - 0x10065240 0x65660 0x62660 0x80
_fsopen - 0x10065244 0x65664 0x62664 0x31
fseek - 0x10065248 0x65668 0x62668 0x87
_wfsopen - 0x1006524c 0x6566c 0x6266c 0x66
_get_stream_buffer_pointers - 0x10065250 0x65670 0x62670 0x39
fgetwc - 0x10065254 0x65674 0x62674 0x7b
_fseeki64 - 0x10065258 0x65678 0x62678 0x2f
__acrt_iob_func - 0x1006525c 0x6567c 0x6267c 0x0
fputc - 0x10065260 0x65680 0x62680 0x7f
fsetpos - 0x10065264 0x65684 0x62684 0x88
ungetc - 0x10065268 0x65688 0x62688 0x9d
setvbuf - 0x1006526c 0x6568c 0x6268c 0x98
fgetpos - 0x10065270 0x65690 0x62690 0x79
fwrite - 0x10065274 0x65694 0x62694 0x8a
ungetwc - 0x10065278 0x65698 0x62698 0x9e
fgetc - 0x1006527c 0x6569c 0x6269c 0x78
fflush - 0x10065280 0x656a0 0x626a0 0x77
fclose - 0x10065284 0x656a4 0x626a4 0x74
api-ms-win-crt-math-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_CIpow - 0x100651d4 0x655f4 0x625f4 0xa
ldexp - 0x100651d8 0x655f8 0x625f8 0xf0
frexp - 0x100651dc 0x655fc 0x625fc 0xeb
api-ms-win-crt-multibyte-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_ismbblead - 0x100651e4 0x65604 0x62604 0x12
api-ms-win-crt-convert-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strtof - 0x10065154 0x65574 0x62574 0x5f
btowc - 0x10065158 0x65578 0x62578 0x53
strtod - 0x1006515c 0x6557c 0x6257c 0x5e
api-ms-win-crt-time-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_Gettnames - 0x100652c4 0x656e4 0x626e4 0x2
_Getmonths - 0x100652c8 0x656e8 0x626e8 0x1
_Wcsftime - 0x100652cc 0x656ec 0x626ec 0x7
_Strftime - 0x100652d0 0x656f0 0x626f0 0x3
_Getdays - 0x100652d4 0x656f4 0x626f4 0x0
_W_Getdays - 0x100652d8 0x656f8 0x626f8 0x4
_W_Gettnames - 0x100652dc 0x656fc 0x626fc 0x6
_W_Getmonths - 0x100652e0 0x65700 0x62700 0x5
api-ms-win-crt-filesystem-l1-1-0.dll (6)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_lock_file - 0x1006516c 0x6558c 0x6258c 0x16
_wrename - 0x10065170 0x65590 0x62590 0x36
_wrmdir - 0x10065174 0x65594 0x62594 0x37
_wremove - 0x10065178 0x65598 0x62598 0x35
_wchdir - 0x1006517c 0x6559c 0x6259c 0x27
_unlock_file - 0x10065180 0x655a0 0x625a0 0x24
api-ms-win-crt-environment-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_wgetcwd - 0x10065164 0x65584 0x62584 0x8
api-ms-win-crt-utility-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
rand_s - 0x100652e8 0x65708 0x62708 0x1c
KERNEL32.dll (65)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
TryEnterCriticalSection - 0x10065000 0x65420 0x62420 0x57c
Sleep - 0x10065004 0x65424 0x62424 0x552
GetExitCodeThread - 0x10065008 0x65428 0x62428 0x22b
DuplicateHandle - 0x1006500c 0x6542c 0x6242c 0x11d
GetCurrentThreadId - 0x10065010 0x65430 0x62430 0x20c
GetCurrentProcess - 0x10065014 0x65434 0x62434 0x207
WaitForSingleObjectEx - 0x10065018 0x65438 0x62438 0x5ad
CloseHandle - 0x1006501c 0x6543c 0x6243c 0x7d
GetNativeSystemInfo - 0x10065020 0x65440 0x62440 0x272
QueryPerformanceFrequency - 0x10065024 0x65444 0x62444 0x42c
QueryPerformanceCounter - 0x10065028 0x65448 0x62448 0x42b
GetStringTypeW - 0x1006502c 0x6544c 0x6244c 0x2c3
MultiByteToWideChar - 0x10065030 0x65450 0x62450 0x3cf
EnterCriticalSection - 0x10065034 0x65454 0x62454 0x123
LeaveCriticalSection - 0x10065038 0x65458 0x62458 0x3a0
DeleteCriticalSection - 0x1006503c 0x6545c 0x6245c 0x103
WideCharToMultiByte - 0x10065040 0x65460 0x62460 0x5d0
EncodePointer - 0x10065044 0x65464 0x62464 0x11f
RaiseException - 0x10065048 0x65468 0x62468 0x43f
DecodePointer - 0x1006504c 0x6546c 0x6246c 0xfc
GetCPInfo - 0x10065050 0x65470 0x62470 0x1b1
CompareStringW - 0x10065054 0x65474 0x62474 0x91
GetLocaleInfoW - 0x10065058 0x65478 0x62478 0x252
LoadLibraryExA - 0x1006505c 0x6547c 0x6247c 0x3a4
FreeLibrary - 0x10065060 0x65480 0x62480 0x19c
VirtualQuery - 0x10065064 0x65484 0x62484 0x5a3
VirtualProtect - 0x10065068 0x65488 0x62488 0x5a1
GetSystemInfo - 0x1006506c 0x6548c 0x6248c 0x2ce
InitializeSListHead - 0x10065070 0x65490 0x62490 0x349
LCMapStringW - 0x10065074 0x65494 0x62494 0x394
GetCurrentProcessId - 0x10065078 0x65498 0x62498 0x208
AreFileApisANSI - 0x1006507c 0x6549c 0x6249c 0x1b
CreateDirectoryW - 0x10065080 0x654a0 0x624a0 0xb0
IsDebuggerPresent - 0x10065084 0x654a4 0x624a4 0x365
TerminateProcess - 0x10065088 0x654a8 0x624a8 0x561
SetUnhandledExceptionFilter - 0x1006508c 0x654ac 0x624ac 0x543
UnhandledExceptionFilter - 0x10065090 0x654b0 0x624b0 0x582
FindFirstFileExW - 0x10065094 0x654b4 0x624b4 0x16c
FindNextFileW - 0x10065098 0x654b8 0x624b8 0x17d
SetFileTime - 0x1006509c 0x654bc 0x624bc 0x500
SetEndOfFile - 0x100650a0 0x654c0 0x624c0 0x4ea
GetProcAddress - 0x100650a4 0x654c4 0x624c4 0x29b
GetModuleHandleW - 0x100650a8 0x654c8 0x624c8 0x265
GetTempPathW - 0x100650ac 0x654cc 0x624cc 0x2e1
GetTickCount - 0x100650b0 0x654d0 0x624d0 0x2f0
CreateHardLinkW - 0x100650b4 0x654d4 0x624d4 0xc4
FindClose - 0x100650b8 0x654d8 0x624d8 0x166
GetSystemTimeAsFileTime - 0x100650bc 0x654dc 0x624dc 0x2d4
CreateEventW - 0x100650c0 0x654e0 0x624e0 0xb4
InitializeCriticalSectionAndSpinCount - 0x100650c4 0x654e4 0x624e4 0x346
SetLastError - 0x100650c8 0x654e8 0x624e8 0x50b
QueueUserWorkItem - 0x100650cc 0x654ec 0x624ec 0x435
GetModuleHandleExW - 0x100650d0 0x654f0 0x624f0 0x264
IsProcessorFeaturePresent - 0x100650d4 0x654f4 0x624f4 0x36b
CreateFileW - 0x100650d8 0x654f8 0x624f8 0xc0
SetFileAttributesW - 0x100650dc 0x654fc 0x624fc 0x4f7
RtlCaptureStackBackTrace - 0x100650e0 0x65500 0x62500 0x4a9
GetCurrentThread - 0x100650e4 0x65504 0x62504 0x20b
FormatMessageW - 0x100650e8 0x65508 0x62508 0x198
CopyFileW - 0x100650ec 0x6550c 0x6250c 0xa3
SetFilePointerEx - 0x100650f0 0x65510 0x62510 0x4fd
GetDiskFreeSpaceExW - 0x100650f4 0x65514 0x62514 0x218
GetFileAttributesExW - 0x100650f8 0x65518 0x62518 0x230
GetLastError - 0x100650fc 0x6551c 0x6251c 0x24e
GetFileInformationByHandle - 0x10065100 0x65520 0x62520 0x235
Exports (1515)
»
Api name EAT Address Ordinal
??$_Getvals@_W@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z 0x29040 0x1
??$_Getvals@_W@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z 0x29040 0x2
??$_Getvals@_W@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEX_WABV_Locinfo@1@@Z 0x29040 0x3
??0?$_Yarn@D@std@@QAE@ABV01@@Z 0x30cc0 0x4
??0?$_Yarn@D@std@@QAE@PBD@Z 0x14990 0x5
??0?$_Yarn@D@std@@QAE@XZ 0x149b0 0x6
??0?$_Yarn@G@std@@QAE@ABV01@@Z 0x2f6c0 0x7
??0?$_Yarn@G@std@@QAE@PBG@Z 0x2f6a0 0x8
??0?$_Yarn@G@std@@QAE@XZ 0x14920 0x9
??0?$_Yarn@_W@std@@QAE@ABV01@@Z 0x2f6c0 0xa
??0?$_Yarn@_W@std@@QAE@PB_W@Z 0x2f6a0 0xb
??0?$_Yarn@_W@std@@QAE@XZ 0x14920 0xc
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ 0x15b00 0xd
??0?$basic_ios@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z 0x39dc0 0xe
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ 0x1d5e0 0xf
??0?$basic_ios@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z 0x34400 0x10
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ 0x1dd10 0x11
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z 0x36f30 0x12
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z 0x37010 0x13
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z 0x370e0 0x14
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z 0x30d90 0x15
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z 0x30e60 0x16
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z 0x34490 0x17
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z 0x34560 0x18
??0?$basic_istream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z 0x39950 0x19
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z 0x39a60 0x1a
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z 0x16260 0x1b
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@@Z 0x399f0 0x1c
??0?$basic_istream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z 0x33b30 0x1d
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N1@Z 0x33c40 0x1e
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z 0x1d8b0 0x1f
??0?$basic_istream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@@Z 0x33bd0 0x20
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z 0x36cc0 0x21
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N1@Z 0x36dd0 0x22
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z 0x1df90 0x23
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@@Z 0x36d60 0x24
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@IAE@$$QAV01@@Z 0x37e40 0x25
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z 0x15260 0x26
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@W4_Uninitialized@1@_N@Z 0x37ed0 0x27
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@IAE@$$QAV01@@Z 0x31eb0 0x28
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z 0x1d020 0x29
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE@W4_Uninitialized@1@_N@Z 0x31f40 0x2a
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAE@$$QAV01@@Z 0x350c0 0x2b
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z 0x1dba0 0x2c
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@W4_Uninitialized@1@_N@Z 0x35150 0x2d
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@ABV01@@Z 0x39c40 0x2e
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@W4_Uninitialized@1@@Z 0x39cc0 0x2f
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ 0x15ac0 0x30
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@ABV01@@Z 0x34180 0x31
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@W4_Uninitialized@1@@Z 0x34200 0x32
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ 0x1d5a0 0x33
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@ABV01@@Z 0x36e50 0x34
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@W4_Uninitialized@1@@Z 0x36ed0 0x35
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ 0x1dcd0 0x36
??0?$codecvt@DDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z 0x16190 0x37
??0?$codecvt@DDU_Mbstatet@@@std@@QAE@I@Z 0x30c60 0x38
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z 0x12d10 0x39
??0?$codecvt@GDU_Mbstatet@@@std@@QAE@I@Z 0x12cb0 0x3a
??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z 0x11d50 0x3b
??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@KW4_Codecvt_mode@1@I@Z 0x11d80 0x3c
??0?$codecvt@_SDU_Mbstatet@@@std@@QAE@I@Z 0x11d00 0x3d
??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z 0x123d0 0x3e
??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@KW4_Codecvt_mode@1@I@Z 0x123f0 0x3f
??0?$codecvt@_UDU_Mbstatet@@@std@@QAE@I@Z 0x12380 0x40
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@ABV_Locinfo@1@I@Z 0x12850 0x41
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z 0x127f0 0x42
??0?$ctype@D@std@@QAE@ABV_Locinfo@1@I@Z 0x13090 0x43
??0?$ctype@D@std@@QAE@PBF_NI@Z 0x12ff0 0x44
??0?$ctype@G@std@@QAE@ABV_Locinfo@1@I@Z 0x13b40 0x45
??0?$ctype@G@std@@QAE@I@Z 0x13af0 0x46
??0?$ctype@_W@std@@QAE@ABV_Locinfo@1@I@Z 0x13630 0x47
??0?$ctype@_W@std@@QAE@I@Z 0x135e0 0x48
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x18e70 0x49
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z 0x30c20 0x4a
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x21290 0x4b
??0?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z 0x30b20 0x4c
??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x23690 0x4d
??0?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z 0x30ba0 0x4e
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x184c0 0x4f
??0?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z 0x30be0 0x50
??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x208f0 0x51
??0?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z 0x309a0 0x52
??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x22ce0 0x53
??0?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z 0x30b60 0x54
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAE@PBDI@Z 0x303e0 0x55
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x2be30 0x56
??0?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z 0x30430 0x57
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAE@PBDI@Z 0x2f940 0x58
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x1f9e0 0x59
??0?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z 0x2f990 0x5a
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAE@PBDI@Z 0x2ff20 0x5b
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x21e40 0x5c
??0?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z 0x2ff70 0x5d
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x2b340 0x5e
??0?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@I@Z 0x30220 0x5f
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAE@PBDI@Z 0x2f6e0 0x60
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x1eeb0 0x61
??0?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z 0x2f740 0x62
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAE@PBDI@Z 0x2fd00 0x63
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z 0x21390 0x64
??0?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAE@I@Z 0x2fd60 0x65
??0Init@ios_base@std@@QAE@XZ 0x14000 0x66
??0_Facet_base@std@@QAE@ABV01@@Z 0x11640 0x67
??0_Facet_base@std@@QAE@XZ 0x11630 0x68
??0_Init_locks@std@@QAE@XZ 0x2e230 0x69
??0_Locimp@locale@std@@AAE@ABV012@@Z 0x11820 0x6a
??0_Locimp@locale@std@@AAE@_N@Z 0x117e0 0x6b
??0_Locinfo@std@@QAE@HPBD@Z 0x11280 0x6c
??0_Locinfo@std@@QAE@PBD@Z 0x11200 0x6d
??0_Lockit@std@@QAE@H@Z 0x2e330 0x6e
??0_Lockit@std@@QAE@XZ 0x2e320 0x6f
??0_Timevec@std@@QAE@ABV01@@Z 0x111c0 0x70
??0_Timevec@std@@QAE@PAX@Z 0x111b0 0x71
??0_UShinit@std@@QAE@XZ 0x1d930 0x72
??0_Winit@std@@QAE@XZ 0x1e010 0x73
??0codecvt_base@std@@QAE@I@Z 0x11b70 0x74
??0ctype_base@std@@QAE@I@Z 0x12dd0 0x75
??0facet@locale@std@@IAE@I@Z 0x11760 0x76
??0id@locale@std@@QAE@I@Z 0x111b0 0x77
??0ios_base@std@@IAE@XZ 0x145b0 0x78
??0task_continuation_context@Concurrency@@AAE@XZ 0x149b0 0x79
??0time_base@std@@QAE@I@Z 0x162e0 0x7a
??1?$_Yarn@D@std@@QAE@XZ 0x148a0 0x7b
??1?$_Yarn@G@std@@QAE@XZ 0x148a0 0x7c
??1?$_Yarn@_W@std@@QAE@XZ 0x148a0 0x7d
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ 0x155d0 0x7e
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ 0x155d0 0x7f
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ 0x155d0 0x80
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ 0x36f60 0x81
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ 0x30ce0 0x82
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ 0x34430 0x83
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ 0x16240 0x84
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ 0x1d890 0x85
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ 0x1df70 0x86
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ 0x15240 0x87
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UAE@XZ 0x1d000 0x88
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ 0x1db80 0x89
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ 0x15590 0x8a
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ 0x1d320 0x8b
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ 0x1dc10 0x8c
??1?$codecvt@DDU_Mbstatet@@@std@@MAE@XZ 0x11620 0x8d
??1?$codecvt@GDU_Mbstatet@@@std@@MAE@XZ 0x11620 0x8e
??1?$codecvt@_SDU_Mbstatet@@@std@@MAE@XZ 0x11620 0x8f
??1?$codecvt@_UDU_Mbstatet@@@std@@MAE@XZ 0x11620 0x90
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ 0x11620 0x91
??1?$ctype@D@std@@MAE@XZ 0x13190 0x92
??1?$ctype@G@std@@MAE@XZ 0x13bf0 0x93
??1?$ctype@_W@std@@MAE@XZ 0x136e0 0x94
??1?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ 0x11620 0x95
??1?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ 0x11620 0x96
??1?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ 0x11620 0x97
??1?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ 0x11620 0x98
??1?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ 0x11620 0x99
??1?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ 0x11620 0x9a
??1?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ 0x2bda0 0x9b
??1?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ 0x1f950 0x9c
??1?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ 0x21db0 0x9d
??1?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MAE@XZ 0x2b2c0 0x9e
??1?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MAE@XZ 0x1ee30 0x9f
??1?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MAE@XZ 0x21310 0xa0
??1Init@ios_base@std@@QAE@XZ 0x14010 0xa1
??1_Facet_base@std@@UAE@XZ 0x11620 0xa2
??1_Init_locks@std@@QAE@XZ 0x2e260 0xa3
??1_Locimp@locale@std@@MAE@XZ 0x11780 0xa4
??1_Locinfo@std@@QAE@XZ 0x11310 0xa5
??1_Lockit@std@@QAE@XZ 0x2e370 0xa6
??1_Timevec@std@@QAE@XZ 0x111e0 0xa7
??1_UShinit@std@@QAE@XZ 0x1d950 0xa8
??1_Winit@std@@QAE@XZ 0x1e030 0xa9
??1codecvt_base@std@@UAE@XZ 0x11620 0xaa
??1ctype_base@std@@UAE@XZ 0x11620 0xab
??1facet@locale@std@@MAE@XZ 0x11620 0xac
??1ios_base@std@@UAE@XZ 0x14570 0xad
??1time_base@std@@UAE@XZ 0x11620 0xae
??4?$_Iosb@H@std@@QAEAAV01@$$QAV01@@Z 0xffa0 0xaf
??4?$_Iosb@H@std@@QAEAAV01@ABV01@@Z 0xffa0 0xb0
??4?$_Yarn@D@std@@QAEAAV01@ABV01@@Z 0x30ca0 0xb1
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z 0x14930 0xb2
??4?$_Yarn@G@std@@QAEAAV01@ABV01@@Z 0x2f680 0xb3
??4?$_Yarn@G@std@@QAEAAV01@PBG@Z 0x148c0 0xb4
??4?$_Yarn@_W@std@@QAEAAV01@ABV01@@Z 0x2f680 0xb5
??4?$_Yarn@_W@std@@QAEAAV01@PB_W@Z 0x148c0 0xb6
??4?$basic_iostream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z 0x36ff0 0xb7
??4?$basic_iostream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z 0x30d70 0xb8
??4?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z 0x30d70 0xb9
??4?$basic_istream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z 0x39930 0xba
??4?$basic_istream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z 0x33b10 0xbb
??4?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z 0x33b10 0xbc
??4?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEAAV01@$$QAV01@@Z 0x36ff0 0xbd
??4?$basic_ostream@GU?$char_traits@G@std@@@std@@IAEAAV01@$$QAV01@@Z 0x30d70 0xbe
??4?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAEAAV01@$$QAV01@@Z 0x30d70 0xbf
??4?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEAAV01@ABV01@@Z 0x340f0 0xc0
??4?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEAAV01@ABV01@@Z 0x340f0 0xc1
??4?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEAAV01@ABV01@@Z 0x340f0 0xc2
??4Init@ios_base@std@@QAEAAV012@ABV012@@Z 0xffa0 0xc3
??4_Crt_new_delete@std@@QAEAAU01@$$QAU01@@Z 0xffa0 0xc4
??4_Crt_new_delete@std@@QAEAAU01@ABU01@@Z 0xffa0 0xc5
??4_Facet_base@std@@QAEAAV01@ABV01@@Z 0xffa0 0xc6
??4_Init_locks@std@@QAEAAV01@ABV01@@Z 0xffa0 0xc7
??4_Timevec@std@@QAEAAV01@ABV01@@Z 0x111c0 0xc8
??4_UShinit@std@@QAEAAV01@ABV01@@Z 0xffa0 0xc9
??4_Winit@std@@QAEAAV01@ABV01@@Z 0xffa0 0xca
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAF@Z 0x395b0 0xcb
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z 0x394d0 0xcc
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z 0x393d0 0xcd
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z 0x392f0 0xce
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z 0x39210 0xcf
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAK@Z 0x39130 0xd0
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z 0x38e90 0xd1
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z 0x38db0 0xd2
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAO@Z 0x38cd0 0xd3
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAPAX@Z 0x38bf0 0xd4
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z 0x39050 0xd5
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z 0x38f70 0xd6
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z 0x396c0 0xd7
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0xd8
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z 0x31e20 0xd9
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0xda
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z 0x38b10 0xdb
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAF@Z 0x33760 0xdc
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAG@Z 0x33670 0xdd
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z 0x33560 0xde
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAI@Z 0x33470 0xdf
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAJ@Z 0x33380 0xe0
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAK@Z 0x33290 0xe1
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAM@Z 0x32fc0 0xe2
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAN@Z 0x32ed0 0xe3
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAO@Z 0x32de0 0xe4
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAPAX@Z 0x32cf0 0xe5
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_J@Z 0x331a0 0xe6
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_K@Z 0x330b0 0xe7
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AA_N@Z 0x33880 0xe8
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0xe9
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z 0x31e20 0xea
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0xeb
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z 0x32c00 0xec
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAF@Z 0x36960 0xed
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAG@Z 0x36870 0xee
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z 0x36760 0xef
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAI@Z 0x36670 0xf0
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAJ@Z 0x36580 0xf1
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAK@Z 0x36490 0xf2
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAM@Z 0x361c0 0xf3
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAN@Z 0x360d0 0xf4
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAO@Z 0x35fe0 0xf5
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAPAX@Z 0x35ef0 0xf6
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_J@Z 0x363a0 0xf7
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_K@Z 0x362b0 0xf8
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_N@Z 0x36a80 0xf9
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0xfa
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AAV21@@Z@Z 0x31e20 0xfb
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0xfc
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z 0x35e00 0xfd
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z 0x37c60 0xfe
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z 0x37b70 0xff
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z 0x37a90 0x100
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z 0x378d0 0x101
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z 0x379b0 0x102
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z 0x378d0 0x103
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z 0x37600 0x104
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z 0x37510 0x105
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z 0x37420 0x106
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0x107
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@DU?$char_traits@D@std@@@1@AAV21@@Z@Z 0x31e20 0x108
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0x109
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z 0x37210 0x10a
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z 0x37340 0x10b
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z 0x377e0 0x10c
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z 0x376f0 0x10d
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z 0x37d60 0x10e
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@F@Z 0x31c40 0x10f
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@G@Z 0x31b60 0x110
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z 0x31a80 0x111
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z 0x318c0 0x112
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@J@Z 0x319a0 0x113
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z 0x318c0 0x114
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@M@Z 0x31610 0x115
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@N@Z 0x31520 0x116
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@O@Z 0x31430 0x117
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0x118
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@GU?$char_traits@G@std@@@1@AAV21@@Z@Z 0x31e20 0x119
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0x11a
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z 0x31210 0x11b
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z 0x31350 0x11c
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_J@Z 0x317e0 0x11d
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_K@Z 0x31700 0x11e
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@_N@Z 0x31d40 0x11f
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@F@Z 0x34ee0 0x120
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@G@Z 0x34e00 0x121
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z 0x34d20 0x122
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z 0x34b60 0x123
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@J@Z 0x34c40 0x124
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@K@Z 0x34b60 0x125
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z 0x348b0 0x126
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z 0x347c0 0x127
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@O@Z 0x346d0 0x128
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z 0x31e50 0x129
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV?$basic_ios@_WU?$char_traits@_W@std@@@1@AAV21@@Z@Z 0x31e20 0x12a
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z 0x31e20 0x12b
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z 0x31210 0x12c
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@PBX@Z 0x345f0 0x12d
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z 0x34a80 0x12e
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z 0x349a0 0x12f
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_N@Z 0x34fe0 0x130
??7ios_base@std@@QBE_NXZ 0x14060 0x131
??Bid@locale@std@@QAEIXZ 0x116e0 0x132
??Bios_base@std@@QBE_NXZ 0x14050 0x133
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ 0x8f18 0x134
??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@ 0x92a4 0x135
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@ 0x92bc 0x136
??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@ 0x98ac 0x137
??_7?$basic_iostream@GU?$char_traits@G@std@@@std@@6B@ 0x98b4 0x138
??_7?$basic_iostream@_WU?$char_traits@_W@std@@@std@@6B@ 0x98a4 0x139
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ 0x90d4 0x13a
??_7?$basic_istream@GU?$char_traits@G@std@@@std@@6B@ 0x92b4 0x13b
??_7?$basic_istream@_WU?$char_traits@_W@std@@@std@@6B@ 0x934c 0x13c
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ 0x905c 0x13d
??_7?$basic_ostream@GU?$char_traits@G@std@@@std@@6B@ 0x92ac 0x13e
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@ 0x92c4 0x13f
??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@ 0x8de0 0x140
??_7?$basic_streambuf@GU?$char_traits@G@std@@@std@@6B@ 0x9264 0x141
??_7?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@6B@ 0x930c 0x142
??_7?$codecvt@DDU_Mbstatet@@@std@@6B@ 0x9070 0x143
??_7?$codecvt@GDU_Mbstatet@@@std@@6B@ 0x8e8c 0x144
??_7?$codecvt@_SDU_Mbstatet@@@std@@6B@ 0x9020 0x145
??_7?$codecvt@_UDU_Mbstatet@@@std@@6B@ 0x8e20 0x146
??_7?$codecvt@_WDU_Mbstatet@@@std@@6B@ 0x90a8 0x147
??_7?$ctype@D@std@@6B@ 0x8f2c 0x148
??_7?$ctype@G@std@@6B@ 0x8fe0 0x149
??_7?$ctype@_W@std@@6B@ 0x8fa0 0x14a
??_7?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ 0x9104 0x14b
??_7?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ 0x95ac 0x14c
??_7?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ 0x9570 0x14d
??_7?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ 0x9164 0x14e
??_7?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ 0x9664 0x14f
??_7?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ 0x95e8 0x150
??_7?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ 0x9798 0x151
??_7?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ 0x9474 0x152
??_7?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ 0x9694 0x153
??_7?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@6B@ 0x97f8 0x154
??_7?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@6B@ 0x9460 0x155
??_7?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@6B@ 0x955c 0x156
??_7_Facet_base@std@@6B@ 0x904c 0x157
??_7_Locimp@locale@std@@6B@ 0x8f08 0x158
??_7codecvt_base@std@@6B@ 0x8f6c 0x159
??_7ctype_base@std@@6B@ 0x8ef8 0x15a
??_7facet@locale@std@@6B@ 0x8f5c 0x15b
??_7ios_base@std@@6B@ 0x8e84 0x15c
??_7time_base@std@@6B@ 0x90dc 0x15d
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@ 0x6550 0x15e
??_8?$basic_iostream@DU?$char_traits@D@std@@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@ 0x6548 0x15f
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_istream@GU?$char_traits@G@std@@@1@@ 0x6550 0x160
??_8?$basic_iostream@GU?$char_traits@G@std@@@std@@7B?$basic_ostream@GU?$char_traits@G@std@@@1@@ 0x6548 0x161
??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_istream@_WU?$char_traits@_W@std@@@1@@ 0x6550 0x162
??_8?$basic_iostream@_WU?$char_traits@_W@std@@@std@@7B?$basic_ostream@_WU?$char_traits@_W@std@@@1@@ 0x6548 0x163
??_8?$basic_istream@DU?$char_traits@D@std@@@std@@7B@ 0x55f4 0x164
??_8?$basic_istream@GU?$char_traits@G@std@@@std@@7B@ 0x55f4 0x165
??_8?$basic_istream@_WU?$char_traits@_W@std@@@std@@7B@ 0x55f4 0x166
??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@ 0x55e8 0x167
??_8?$basic_ostream@GU?$char_traits@G@std@@@std@@7B@ 0x55e8 0x168
??_8?$basic_ostream@_WU?$char_traits@_W@std@@@std@@7B@ 0x55e8 0x169
??_D?$basic_iostream@DU?$char_traits@D@std@@@std@@QAEXXZ 0x2f0d0 0x16a
??_D?$basic_iostream@GU?$char_traits@G@std@@@std@@QAEXXZ 0x2f270 0x16b
??_D?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x2f1a0 0x16c
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ 0x161e0 0x16d
??_D?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ 0x1d830 0x16e
??_D?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x1df10 0x16f
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ 0x14820 0x170
??_D?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ 0x1c7f0 0x171
??_D?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x1d9c0 0x172
??_F?$codecvt@DDU_Mbstatet@@@std@@QAEXXZ 0x2ea90 0x173
??_F?$codecvt@GDU_Mbstatet@@@std@@QAEXXZ 0x12dc0 0x174
??_F?$codecvt@_SDU_Mbstatet@@@std@@QAEXXZ 0x122e0 0x175
??_F?$codecvt@_UDU_Mbstatet@@@std@@QAEXXZ 0x127e0 0x176
??_F?$codecvt@_WDU_Mbstatet@@@std@@QAEXXZ 0x12c10 0x177
??_F?$ctype@D@std@@QAEXXZ 0x13350 0x178
??_F?$ctype@G@std@@QAEXXZ 0x13c20 0x179
??_F?$ctype@_W@std@@QAEXXZ 0x13a50 0x17a
??_F?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ 0x2ec50 0x17b
??_F?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ 0x2ec90 0x17c
??_F?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ 0x2ec70 0x17d
??_F?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ 0x2ec60 0x17e
??_F?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ 0x2eca0 0x17f
??_F?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ 0x2ec80 0x180
??_F?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ 0x2f2c0 0x181
??_F?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ 0x2f540 0x182
??_F?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ 0x2f400 0x183
??_F?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ 0x2f360 0x184
??_F?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAEXXZ 0x2f5e0 0x185
??_F?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QAEXXZ 0x2f4a0 0x186
??_F_Locinfo@std@@QAEXXZ 0x115f0 0x187
??_F_Timevec@std@@QAEXXZ 0x111f0 0x188
??_Fcodecvt_base@std@@QAEXXZ 0x11c10 0x189
??_Fctype_base@std@@QAEXXZ 0x12df0 0x18a
??_Ffacet@locale@std@@QAEXXZ 0x11a40 0x18b
??_Fid@locale@std@@QAEXXZ 0x111f0 0x18c
??_Ftime_base@std@@QAEXXZ 0x16300 0x18d
?CaptureCallstack@platform@details@Concurrency@@YAIPAPAXII@Z 0x1c440 0x18e
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ 0xa990 0x18f
?GetNextAsyncId@platform@details@Concurrency@@YAIXZ 0x1c460 0x190
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ 0xff90 0x191
?_Addcats@_Locinfo@std@@QAEAAV12@HPBD@Z 0x113a0 0x192
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z 0x11890 0x193
?_Addstd@ios_base@std@@SAXPAV12@@Z 0x173a0 0x194
?_Assign@_ContextCallback@details@Concurrency@@AAEXPAX@Z 0x11e20 0x195
?_Atexit@@YAXP6AXXZ@Z 0x17400 0x196
?_BADOFF@std@@3_JB 0x3398 0x197
?_C_str@?$_Yarn@D@std@@QBEPBDXZ 0x14880 0x198
?_C_str@?$_Yarn@G@std@@QBEPBGXZ 0x14880 0x199
?_C_str@?$_Yarn@_W@std@@QBEPB_WXZ 0x14880 0x19a
?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z 0x1c470 0x19b
?_Callfns@ios_base@std@@AAEXW4event@12@@Z 0x14620 0x19c
?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ 0xff90 0x19d
?_Clocptr@_Locimp@locale@std@@0PAV123@A 0x63b54 0x19e
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ 0x11740 0x19f
?_Donarrow@?$ctype@G@std@@IBEDGD@Z 0x13990 0x1a0
?_Donarrow@?$ctype@_W@std@@IBED_WD@Z 0x13990 0x1a1
?_Dowiden@?$ctype@G@std@@IBEGD@Z 0x138f0 0x1a2
?_Dowiden@?$ctype@_W@std@@IBE_WD@Z 0x138f0 0x1a3
?_Empty@?$_Yarn@D@std@@QBE_NXZ 0x14890 0x1a4
?_Empty@?$_Yarn@G@std@@QBE_NXZ 0x14890 0x1a5
?_Empty@?$_Yarn@_W@std@@QBE_NXZ 0x14890 0x1a6
?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z 0x2e5f0 0x1a7
?_Ffmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAPADPADDH@Z 0x19710 0x1a8
?_Ffmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAPADPADDH@Z 0x19710 0x1a9
?_Ffmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADDH@Z 0x19710 0x1aa
?_Findarr@ios_base@std@@AAEAAU_Iosarray@12@H@Z 0x14660 0x1ab
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z 0x16f20 0x1ac
?_Fiopen@std@@YAPAU_iobuf@@PBGHH@Z 0x16f40 0x1ad
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z 0x16f40 0x1ae
?_Fput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBDI@Z 0x193d0 0x1af
?_Fput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBDI@Z 0x252f0 0x1b0
?_Fput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBDI@Z 0x276e0 0x1b1
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x160f0 0x1b2
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x12d50 0x1b3
?_Getcat@?$codecvt@_SDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x11db0 0x1b4
?_Getcat@?$codecvt@_UDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x12420 0x1b5
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x12890 0x1b6
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x130d0 0x1b7
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x13b80 0x1b8
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x13670 0x1b9
?_Getcat@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x18e90 0x1ba
?_Getcat@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x212b0 0x1bb
?_Getcat@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x236b0 0x1bc
?_Getcat@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x184e0 0x1bd
?_Getcat@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x20910 0x1be
?_Getcat@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x22d00 0x1bf
?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x2bdc0 0x1c0
?_Getcat@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x1f970 0x1c1
?_Getcat@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x21dd0 0x1c2
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x2b2e0 0x1c3
?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x1ee50 0x1c4
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z 0x21330 0x1c5
?_Getcat@facet@locale@std@@SAIPAPBV123@PBV23@@Z 0x11720 0x1c6
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ 0x113f0 0x1c7
?_Getctype@_Locinfo@std@@QBE?AU_Ctypevec@@XZ 0x11410 0x1c8
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ 0x11440 0x1c9
?_Getdateorder@_Locinfo@std@@QBEHXZ 0x11540 0x1ca
?_Getdays@_Locinfo@std@@QBEPBDXZ 0x114a0 0x1cb
?_Getfalse@_Locinfo@std@@QBEPBDXZ 0x11520 0x1cc
?_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z 0x197b0 0x1cd
?_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z 0x25630 0x1ce
?_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AAVios_base@2@PAH@Z 0x27a20 0x1cf
?_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1AAVios_base@2@PAH@Z 0x1a280 0x1d0
?_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1AAVios_base@2@PAH@Z 0x28750 0x1d1
?_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1AAVios_base@2@PAH@Z 0x290a0 0x1d2
?_Getfmt@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z 0x2c890 0x1d3
?_Getfmt@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z 0x23c60 0x1d4
?_Getfmt@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD@Z 0x26140 0x1d5
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ 0x1b130 0x1d6
?_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@1HABVlocale@2@@Z 0x19e80 0x1d7
?_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@1HABVlocale@2@@Z 0x25d10 0x1d8
?_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@1HABVlocale@2@@Z 0x28100 0x1d9
?_Getint@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@0HHAAHABV?$ctype@D@2@@Z 0x2c6d0 0x1da
?_Getint@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@0HHAAHABV?$ctype@G@2@@Z 0x23ab0 0x1db
?_Getint@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@0HHAAHABV?$ctype@_W@2@@Z 0x23ab0 0x1dc
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ 0x11470 0x1dd
?_Getmonths@_Locinfo@std@@QBEPBDXZ 0x114e0 0x1de
?_Getname@_Locinfo@std@@QBEPBDXZ 0x113e0 0x1df
?_Getptr@_Timevec@std@@QBEPAXXZ 0x107e0 0x1e0
?_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ 0x11480 0x1e1
?_Gettrue@_Locinfo@std@@QBEPBDXZ 0x11530 0x1e2
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ 0x15a10 0x1e3
?_Gnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBE_JXZ 0x15a10 0x1e4
?_Gnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBE_JXZ 0x15a10 0x1e5
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ 0x15a40 0x1e6
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ 0x1d550 0x1e7
?_Gndec@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ 0x1d550 0x1e8
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ 0x15a30 0x1e9
?_Gninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ 0x1d540 0x1ea
?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ 0x1d540 0x1eb
?_Gnpreinc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ 0x39b10 0x1ec
?_Gnpreinc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ 0x33cf0 0x1ed
?_Gnpreinc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ 0x33cf0 0x1ee
?_Id_cnt@id@locale@std@@0HA 0x63b60 0x1ef
?_Ifmt@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAPADPADPBDH@Z 0x19350 0x1f0
?_Ifmt@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAPADPADPBDH@Z 0x19350 0x1f1
?_Ifmt@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAPADPADPBDH@Z 0x19350 0x1f2
?_Incref@facet@locale@std@@UAEXXZ 0x11730 0x1f3
?_Index@ios_base@std@@0HA 0x63ad0 0x1f4
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z 0x15bb0 0x1f5
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ 0x15be0 0x1f6
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAPAG0PAH001@Z 0x15bb0 0x1f7
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXXZ 0x15be0 0x1f8
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPAPA_W0PAH001@Z 0x15bb0 0x1f9
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ 0x15be0 0x1fa
?_Init@?$codecvt@DDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x1fb
?_Init@?$codecvt@GDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z 0x12900 0x1fc
?_Init@?$codecvt@_SDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x1fd
?_Init@?$codecvt@_UDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x1fe
?_Init@?$codecvt@_WDU_Mbstatet@@@std@@IAEXABV_Locinfo@2@@Z 0x12900 0x1ff
?_Init@?$ctype@D@std@@IAEXABV_Locinfo@2@@Z 0x131b0 0x200
?_Init@?$ctype@G@std@@IAEXABV_Locinfo@2@@Z 0x13710 0x201
?_Init@?$ctype@_W@std@@IAEXABV_Locinfo@2@@Z 0x13710 0x202
?_Init@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x203
?_Init@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x204
?_Init@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x205
?_Init@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x206
?_Init@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x207
?_Init@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x11e20 0x208
?_Init@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x2c9c0 0x209
?_Init@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x23db0 0x20a
?_Init@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x26290 0x20b
?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x2c6b0 0x20c
?_Init@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x23a60 0x20d
?_Init@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z 0x23a60 0x20e
?_Init@ios_base@std@@IAEXXZ 0x145c0 0x20f
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z 0x1b1a0 0x210
?_Init_cnt@Init@ios_base@std@@0HA 0x62164 0x211
?_Init_cnt@_UShinit@std@@0HA 0x62168 0x212
?_Init_cnt@_Winit@std@@0HA 0x6216c 0x213
?_Init_cnt_func@Init@ios_base@std@@CAAAHXZ 0x17430 0x214
?_Init_ctor@Init@ios_base@std@@CAXPAV123@@Z 0x17440 0x215
?_Init_dtor@Init@ios_base@std@@CAXPAV123@@Z 0x17460 0x216
?_Init_locks_ctor@_Init_locks@std@@CAXPAV12@@Z 0x2e2c0 0x217
?_Init_locks_dtor@_Init_locks@std@@CAXPAV12@@Z 0x2e2f0 0x218
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z 0x17360 0x219
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z 0x397b0 0x21a
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z 0x33980 0x21b
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z 0x36b80 0x21c
?_Iput@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPADI@Z 0x19080 0x21d
?_Iput@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPADI@Z 0x25020 0x21e
?_Iput@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPADI@Z 0x27410 0x21f
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ 0x11bf0 0x220
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ 0x11bf0 0x221
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z 0x17bb0 0x222
?_Locimp_ctor@_Locimp@locale@std@@CAXPAV123@ABV123@@Z 0x17af0 0x223
?_Locimp_dtor@_Locimp@locale@std@@CAXPAV123@@Z 0x1b280 0x224
?_Locinfo_Addcats@_Locinfo@std@@SAAAV12@PAV12@HPBD@Z 0x17cc0 0x225
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@HPBD@Z 0x17c80 0x226
?_Locinfo_ctor@_Locinfo@std@@SAXPAV12@PBD@Z 0x1b300 0x227
?_Locinfo_dtor@_Locinfo@std@@SAXPAV12@@Z 0x1b350 0x228
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ 0xff90 0x229
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ 0xff90 0x22a
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ 0xff90 0x22b
?_Lockit_ctor@_Lockit@std@@CAXPAV12@@Z 0x2e3d0 0x22c
?_Lockit_ctor@_Lockit@std@@CAXPAV12@H@Z 0x2e3e0 0x22d
?_Lockit_ctor@_Lockit@std@@SAXH@Z 0x2e430 0x22e
?_Lockit_dtor@_Lockit@std@@CAXPAV12@@Z 0x2e410 0x22f
?_Lockit_dtor@_Lockit@std@@SAXH@Z 0x2e460 0x230
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ 0xff90 0x231
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z 0x11e20 0x232
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ 0xff90 0x233
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ 0xff90 0x234
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ 0xff90 0x235
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ 0xff90 0x236
?_MP_Add@std@@YAXQA_K_K@Z 0x1b430 0x237
?_MP_Get@std@@YA_KQA_K@Z 0x1b380 0x238
?_MP_Mul@std@@YAXQA_K_K1@Z 0x1b4c0 0x239
?_MP_Rem@std@@YAXQA_K_K@Z 0x1b5d0 0x23a
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z 0x178e0 0x23b
?_Makeushloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z 0x1e7d0 0x23c
?_Makewloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z 0x1e300 0x23d
?_Makexloc@_Locimp@locale@std@@CAXABV_Locinfo@3@HPAV123@PBV23@@Z 0x2aeb0 0x23e
?_Mtx_delete@threads@stdext@@YAXPAX@Z 0x2ad30 0x23f
?_Mtx_lock@threads@stdext@@YAXPAX@Z 0xd400 0x240
?_Mtx_new@threads@stdext@@YAXAAPAX@Z 0x2ad00 0x241
?_Mtx_unlock@threads@stdext@@YAXPAX@Z 0xd410 0x242
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z 0x1b250 0x243
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z 0x1b230 0x244
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ 0x17680 0x245
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ 0x17680 0x246
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x17680 0x247
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ 0x159c0 0x248
?_Pnavail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBE_JXZ 0x159c0 0x249
?_Pnavail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBE_JXZ 0x159c0 0x24a
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ 0x159e0 0x24b
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ 0x1d510 0x24c
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ 0x1d510 0x24d
?_Ptr_cerr@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63b0c 0x24e
?_Ptr_cin@std@@3PAV?$basic_istream@DU?$char_traits@D@std@@@1@A 0x63b10 0x24f
?_Ptr_clog@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63b14 0x250
?_Ptr_cout@std@@3PAV?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63b08 0x251
?_Ptr_wcerr@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x63b74 0x252
?_Ptr_wcerr@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x63b50 0x253
?_Ptr_wcin@std@@3PAV?$basic_istream@GU?$char_traits@G@std@@@1@A 0x63b78 0x254
?_Ptr_wcin@std@@3PAV?$basic_istream@_WU?$char_traits@_W@std@@@1@A 0x63b18 0x255
?_Ptr_wclog@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x63b7c 0x256
?_Ptr_wclog@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x63b4c 0x257
?_Ptr_wcout@std@@3PAV?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x63b70 0x258
?_Ptr_wcout@std@@3PAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x63b48 0x259
?_Put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@PBDI@Z 0x19040 0x25a
?_Put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@PBGI@Z 0x24fe0 0x25b
?_Put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@PB_WI@Z 0x24fe0 0x25c
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA 0x63b64 0x25d
?_Random_device@std@@YAIXZ 0x2e6f0 0x25e
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z 0x1c590 0x25f
?_Rep@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@DI@Z 0x19010 0x260
?_Rep@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@GI@Z 0x24fb0 0x261
?_Rep@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@_WI@Z 0x24fb0 0x262
?_ReportUnobservedException@details@Concurrency@@YAXXZ 0x1c420 0x263
?_Reschedule_chore@details@Concurrency@@YAHPBU_Threadpool_chore@12@@Z 0x1c5c0 0x264
?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ 0xff90 0x265
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z 0x171e0 0x266
?_Rng_abort@std@@YAXPBD@Z 0xa9c0 0x267
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z 0x1c5f0 0x268
?_Setgloballocale@locale@std@@CAXPAX@Z 0x1b140 0x269
?_Src@?1??_Getffld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f3c 0x26a
?_Src@?1??_Getffld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f3c 0x26b
?_Src@?1??_Getffld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f3c 0x26c
?_Src@?1??_Getffldx@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f60 0x26d
?_Src@?1??_Getffldx@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f60 0x26e
?_Src@?1??_Getffldx@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1AAVios_base@3@PAH@Z@4QBDB 0x5f60 0x26f
?_Src@?1??_Getifld@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@DU?$char_traits@D@std@@@3@1HABVlocale@3@@Z@4QBDB 0x57a0 0x270
?_Src@?1??_Getifld@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@GU?$char_traits@G@std@@@3@1HABVlocale@3@@Z@4QBDB 0x57a0 0x271
?_Src@?1??_Getifld@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@ABAHPADAAV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@3@1HABVlocale@3@@Z@4QBDB 0x57a0 0x272
?_Sync@ios_base@std@@0_NA 0x6215c 0x273
?_Syserror_map@std@@YAPBDH@Z 0x1bad0 0x274
?_Throw_C_error@std@@YAXH@Z 0x1c730 0x275
?_Throw_Cpp_error@std@@YAXH@Z 0x1c6f0 0x276
?_Throw_future_error@std@@YAXABVerror_code@1@@Z 0x171b0 0x277
?_Tidy@?$_Yarn@D@std@@AAEXXZ 0x148a0 0x278
?_Tidy@?$_Yarn@G@std@@AAEXXZ 0x148a0 0x279
?_Tidy@?$_Yarn@_W@std@@AAEXXZ 0x148a0 0x27a
?_Tidy@?$ctype@D@std@@IAEXXZ 0x131e0 0x27b
?_Tidy@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@AAEXXZ 0x23a80 0x27c
?_Tidy@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@AAEXXZ 0x23a80 0x27d
?_Tidy@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@AAEXXZ 0x23a80 0x27e
?_Tidy@ios_base@std@@AAEXXZ 0x146d0 0x27f
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ 0xff90 0x280
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ 0xff90 0x281
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ 0xff90 0x282
?_W_Getdays@_Locinfo@std@@QBEPBGXZ 0x11570 0x283
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ 0x115b0 0x284
?_W_Gettnames@_Locinfo@std@@QBE?AV_Timevec@2@XZ 0x11550 0x285
?_Winerror_map@std@@YAHH@Z 0x1ba20 0x286
?_Winerror_message@std@@YAKKPADK@Z 0x1ba50 0x287
?_XGetLastError@std@@YAXXZ 0x2e610 0x288
?_XLgamma@std@@YAMM@Z 0x2ada0 0x289
?_XLgamma@std@@YANN@Z 0x2ae40 0x28a
?_XLgamma@std@@YAOO@Z 0x2ae40 0x28b
?_Xbad_alloc@std@@YAXXZ 0x2e790 0x28c
?_Xbad_function_call@std@@YAXXZ 0x2e900 0x28d
?_Xinvalid_argument@std@@YAXPBD@Z 0x2e7b0 0x28e
?_Xlength_error@std@@YAXPBD@Z 0x2e7f0 0x28f
?_Xout_of_range@std@@YAXPBD@Z 0x2e830 0x290
?_Xoverflow_error@std@@YAXPBD@Z 0x2e870 0x291
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z 0x2ea40 0x292
?_Xruntime_error@std@@YAXPBD@Z 0x2e8b0 0x293
?__ExceptionPtrAssign@@YAXPAXPBX@Z 0x10670 0x294
?__ExceptionPtrCompare@@YA_NPBX0@Z 0x106b0 0x295
?__ExceptionPtrCopy@@YAXPAXPBX@Z 0x10660 0x296
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z 0x10760 0x297
?__ExceptionPtrCreate@@YAXPAX@Z 0x10630 0x298
?__ExceptionPtrCurrentException@@YAXPAX@Z 0x10710 0x299
?__ExceptionPtrDestroy@@YAXPAX@Z 0x10640 0x29a
?__ExceptionPtrRethrow@@YAXPBX@Z 0x10740 0x29b
?__ExceptionPtrSwap@@YAXPAX0@Z 0x106e0 0x29c
?__ExceptionPtrToBool@@YA_NPBX@Z 0x106d0 0x29d
?always_noconv@codecvt_base@std@@QBE_NXZ 0x11b90 0x29e
?bad@ios_base@std@@QBE_NXZ 0x14190 0x29f
?c_str@?$_Yarn@D@std@@QBEPBDXZ 0x14880 0x2a0
?c_str@?$_Yarn@G@std@@QBEPBGXZ 0x14880 0x2a1
?c_str@?$_Yarn@_W@std@@QBEPB_WXZ 0x14880 0x2a2
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63b90 0x2a3
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A 0x63c90 0x2a4
?classic@locale@std@@SAABV12@XZ 0x1b170 0x2a5
?classic_table@?$ctype@D@std@@SAPBFXZ 0x13150 0x2a6
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z 0x15d00 0x2a7
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z 0x343e0 0x2a8
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z 0x15d00 0x2a9
?clear@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXI@Z 0x343e0 0x2aa
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z 0x15d00 0x2ab
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXI@Z 0x343e0 0x2ac
?clear@ios_base@std@@QAEXH@Z 0x14110 0x2ad
?clear@ios_base@std@@QAEXH_N@Z 0x14070 0x2ae
?clear@ios_base@std@@QAEXI@Z 0x14110 0x2af
?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63d48 0x2b0
?copyfmt@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEAAV12@ABV12@@Z 0x39d90 0x2b1
?copyfmt@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEAAV12@ABV12@@Z 0x34390 0x2b2
?copyfmt@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEAAV12@ABV12@@Z 0x34390 0x2b3
?copyfmt@ios_base@std@@QAEAAV12@ABV12@@Z 0x143e0 0x2b4
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A 0x63d98 0x2b5
?date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ 0x11b90 0x2b6
?date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ 0x11b90 0x2b7
?date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AW4dateorder@time_base@2@XZ 0x11b90 0x2b8
?do_always_noconv@?$codecvt@DDU_Mbstatet@@@std@@MBE_NXZ 0x15690 0x2b9
?do_always_noconv@?$codecvt@GDU_Mbstatet@@@std@@MBE_NXZ 0x11bf0 0x2ba
?do_always_noconv@?$codecvt@_SDU_Mbstatet@@@std@@MBE_NXZ 0x11bf0 0x2bb
?do_always_noconv@?$codecvt@_UDU_Mbstatet@@@std@@MBE_NXZ 0x11bf0 0x2bc
?do_always_noconv@?$codecvt@_WDU_Mbstatet@@@std@@MBE_NXZ 0x11bf0 0x2bd
?do_always_noconv@codecvt_base@std@@MBE_NXZ 0x11bf0 0x2be
?do_date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ 0x141d0 0x2bf
?do_date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ 0x141d0 0x2c0
?do_date_order@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AW4dateorder@time_base@2@XZ 0x141d0 0x2c1
?do_encoding@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ 0x122d0 0x2c2
?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MBEHXZ 0x122d0 0x2c3
?do_encoding@?$codecvt@_UDU_Mbstatet@@@std@@MBEHXZ 0x127d0 0x2c4
?do_encoding@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ 0x122d0 0x2c5
?do_encoding@codecvt_base@std@@MBEHXZ 0x11c00 0x2c6
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x18bb0 0x2c7
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x18ae0 0x2c8
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x18a20 0x2c9
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x18960 0x2ca
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x186f0 0x2cb
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x18600 0x2cc
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x18600 0x2cd
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x18540 0x2ce
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x188a0 0x2cf
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x187e0 0x2d0
?do_get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x18c80 0x2d1
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x20fe0 0x2d2
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x20f10 0x2d3
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x20e50 0x2d4
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x20d90 0x2d5
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x20b20 0x2d6
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x20a30 0x2d7
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x20a30 0x2d8
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x20970 0x2d9
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x20cd0 0x2da
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x20c10 0x2db
?do_get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x210b0 0x2dc
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x233d0 0x2dd
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x23300 0x2de
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x23240 0x2df
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x23180 0x2e0
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x22f10 0x2e1
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x22e20 0x2e2
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x22e20 0x2e3
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x22d60 0x2e4
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x230c0 0x2e5
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x23000 0x2e6
?do_get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x234a0 0x2e7
?do_get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x2b370 0x2e8
?do_get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x1eee0 0x2e9
?do_get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x213c0 0x2ea
?do_get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2b820 0x2eb
?do_get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f380 0x2ec
?do_get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x217e0 0x2ed
?do_get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2b7a0 0x2ee
?do_get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f300 0x2ef
?do_get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f300 0x2f0
?do_get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2bc80 0x2f1
?do_get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f830 0x2f2
?do_get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x21c90 0x2f3
?do_get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2b7e0 0x2f4
?do_get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f340 0x2f5
?do_get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f340 0x2f6
?do_get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2b700 0x2f7
?do_get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x1f260 0x2f8
?do_get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x21740 0x2f9
?do_in@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z 0x15670 0x2fa
?do_in@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z 0x12930 0x2fb
?do_in@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_S3AAPA_S@Z 0x11e30 0x2fc
?do_in@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_U3AAPA_U@Z 0x12490 0x2fd
?do_in@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z 0x12930 0x2fe
?do_is@?$ctype@G@std@@MBEPBGPBG0PAF@Z 0x13770 0x2ff
?do_is@?$ctype@G@std@@MBE_NFG@Z 0x13750 0x300
?do_is@?$ctype@_W@std@@MBEPB_WPB_W0PAF@Z 0x13770 0x301
?do_is@?$ctype@_W@std@@MBE_NF_W@Z 0x13750 0x302
?do_length@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z 0x15650 0x303
?do_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z 0x12b70 0x304
?do_length@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z 0x12230 0x305
?do_length@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z 0x12730 0x306
?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1I@Z 0x12b70 0x307
?do_max_length@?$codecvt@GDU_Mbstatet@@@std@@MBEHXZ 0x12c00 0x308
?do_max_length@?$codecvt@_SDU_Mbstatet@@@std@@MBEHXZ 0x122b0 0x309
?do_max_length@?$codecvt@_UDU_Mbstatet@@@std@@MBEHXZ 0x127b0 0x30a
?do_max_length@?$codecvt@_WDU_Mbstatet@@@std@@MBEHXZ 0x12c00 0x30b
?do_max_length@codecvt_base@std@@MBEHXZ 0x11c00 0x30c
?do_narrow@?$ctype@D@std@@MBEDDD@Z 0x13320 0x30d
?do_narrow@?$ctype@D@std@@MBEPBDPBD0DPAD@Z 0x13330 0x30e
?do_narrow@?$ctype@G@std@@MBEDGD@Z 0x139e0 0x30f
?do_narrow@?$ctype@G@std@@MBEPBGPBG0DPAD@Z 0x139f0 0x310
?do_narrow@?$ctype@_W@std@@MBED_WD@Z 0x139e0 0x311
?do_narrow@?$ctype@_W@std@@MBEPB_WPB_W0DPAD@Z 0x139f0 0x312
?do_out@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z 0x15670 0x313
?do_out@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z 0x129e0 0x314
?do_out@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_S1AAPB_SPAD3AAPAD@Z 0x12060 0x315
?do_out@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_U1AAPB_UPAD3AAPAD@Z 0x125d0 0x316
?do_out@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z 0x129e0 0x317
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DJ@Z 0x182c0 0x318
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DK@Z 0x18240 0x319
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DN@Z 0x18010 0x31a
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DO@Z 0x17ee0 0x31b
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBX@Z 0x17e70 0x31c
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_J@Z 0x181c0 0x31d
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_K@Z 0x18140 0x31e
?do_put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_N@Z 0x18340 0x31f
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GJ@Z 0x20700 0x320
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GK@Z 0x20680 0x321
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GN@Z 0x20450 0x322
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GO@Z 0x20320 0x323
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBX@Z 0x202b0 0x324
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_J@Z 0x20600 0x325
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_K@Z 0x20580 0x326
?do_put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_N@Z 0x20780 0x327
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z 0x22af0 0x328
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z 0x22a70 0x329
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z 0x22840 0x32a
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z 0x22710 0x32b
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z 0x226a0 0x32c
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z 0x229f0 0x32d
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z 0x22970 0x32e
?do_put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z 0x22b70 0x32f
?do_put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z 0x2b1e0 0x330
?do_put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@DD@Z 0x1ed50 0x331
?do_put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@MBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z 0x1ed50 0x332
?do_scan_is@?$ctype@G@std@@MBEPBGFPBG0@Z 0x13790 0x333
?do_scan_is@?$ctype@_W@std@@MBEPB_WFPB_W0@Z 0x13790 0x334
?do_scan_not@?$ctype@G@std@@MBEPBGFPBG0@Z 0x137d0 0x335
?do_scan_not@?$ctype@_W@std@@MBEPB_WFPB_W0@Z 0x137d0 0x336
?do_tolower@?$ctype@D@std@@MBEDD@Z 0x13210 0x337
?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z 0x13230 0x338
?do_tolower@?$ctype@G@std@@MBEGG@Z 0x13810 0x339
?do_tolower@?$ctype@G@std@@MBEPBGPAGPBG@Z 0x13830 0x33a
?do_tolower@?$ctype@_W@std@@MBEPB_WPA_WPB_W@Z 0x13830 0x33b
?do_tolower@?$ctype@_W@std@@MBE_W_W@Z 0x13810 0x33c
?do_toupper@?$ctype@D@std@@MBEDD@Z 0x13280 0x33d
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z 0x132a0 0x33e
?do_toupper@?$ctype@G@std@@MBEGG@Z 0x13880 0x33f
?do_toupper@?$ctype@G@std@@MBEPBGPAGPBG@Z 0x138a0 0x340
?do_toupper@?$ctype@_W@std@@MBEPB_WPA_WPB_W@Z 0x138a0 0x341
?do_toupper@?$ctype@_W@std@@MBE_W_W@Z 0x13880 0x342
?do_unshift@?$codecvt@DDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x12710 0x343
?do_unshift@?$codecvt@GDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x12ad0 0x344
?do_unshift@?$codecvt@_SDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x12210 0x345
?do_unshift@?$codecvt@_UDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x12710 0x346
?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x12ad0 0x347
?do_widen@?$ctype@D@std@@MBEDD@Z 0x132f0 0x348
?do_widen@?$ctype@D@std@@MBEPBDPBD0PAD@Z 0x13300 0x349
?do_widen@?$ctype@G@std@@MBEGD@Z 0x13930 0x34a
?do_widen@?$ctype@G@std@@MBEPBDPBD0PAG@Z 0x13940 0x34b
?do_widen@?$ctype@_W@std@@MBEPBDPBD0PA_W@Z 0x13940 0x34c
?do_widen@?$ctype@_W@std@@MBE_WD@Z 0x13930 0x34d
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x15ab0 0x34e
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x15ab0 0x34f
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x15ab0 0x350
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x15a80 0x351
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x1d590 0x352
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x1d590 0x353
?empty@?$_Yarn@D@std@@QBE_NXZ 0x14890 0x354
?empty@?$_Yarn@G@std@@QBE_NXZ 0x14890 0x355
?empty@?$_Yarn@_W@std@@QBE_NXZ 0x14890 0x356
?empty@locale@std@@SA?AV12@XZ 0x1b180 0x357
?encoding@codecvt_base@std@@QBEHXZ 0x11bd0 0x358
?eof@ios_base@std@@QBE_NXZ 0x14180 0x359
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x15a50 0x35a
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x1d560 0x35b
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x1d560 0x35c
?exceptions@ios_base@std@@QAEXH@Z 0x141b0 0x35d
?exceptions@ios_base@std@@QAEXI@Z 0x141b0 0x35e
?exceptions@ios_base@std@@QBEHXZ 0x141a0 0x35f
?fail@ios_base@std@@QBE_NXZ 0x14060 0x360
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z 0x39d70 0x361
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ 0x39d80 0x362
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEGG@Z 0x342d0 0x363
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ 0x342f0 0x364
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE_W_W@Z 0x342d0 0x365
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ 0x342f0 0x366
?flags@ios_base@std@@QAEHH@Z 0x141e0 0x367
?flags@ios_base@std@@QBEHXZ 0x141d0 0x368
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ 0x174a0 0x369
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ 0x174a0 0x36a
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ 0x174a0 0x36b
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z 0x15a60 0x36c
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z 0x1d570 0x36d
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z 0x1d570 0x36e
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ 0x32200 0x36f
?gcount@?$basic_istream@GU?$char_traits@G@std@@@std@@QBE_JXZ 0x32200 0x370
?gcount@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QBE_JXZ 0x32200 0x371
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z 0x388d0 0x372
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z 0x388a0 0x373
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAV?$basic_streambuf@DU?$char_traits@D@std@@@2@D@Z 0x387b0 0x374
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z 0x38a00 0x375
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_JD@Z 0x388f0 0x376
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ 0x38a40 0x377
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAG@Z 0x329a0 0x378
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z 0x32970 0x379
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@AAV?$basic_streambuf@GU?$char_traits@G@std@@@2@G@Z 0x32870 0x37a
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z 0x32af0 0x37b
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_JG@Z 0x329d0 0x37c
?get@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ 0x32b30 0x37d
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z 0x35b70 0x37e
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_W@Z 0x35a70 0x37f
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@AA_W@Z 0x35ba0 0x380
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z 0x35cf0 0x381
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J_W@Z 0x35bd0 0x382
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x35d30 0x383
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x30aa0 0x384
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x30a60 0x385
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x30a20 0x386
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x309e0 0x387
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x23e80 0x388
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x2fc80 0x389
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x2fcc0 0x38a
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x2f7a0 0x38b
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x23e00 0x38c
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x23e40 0x38d
?get@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x30ae0 0x38e
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x30aa0 0x38f
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x30a60 0x390
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x30a20 0x391
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x309e0 0x392
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x23e80 0x393
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x2fc80 0x394
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x2fcc0 0x395
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x2f7a0 0x396
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x23e00 0x397
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x23e40 0x398
?get@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x30ae0 0x399
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAG@Z 0x30aa0 0x39a
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAI@Z 0x30a60 0x39b
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAJ@Z 0x30a20 0x39c
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAK@Z 0x309e0 0x39d
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAM@Z 0x23e80 0x39e
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAN@Z 0x2fc80 0x39f
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAO@Z 0x2fcc0 0x3a0
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAAPAX@Z 0x2f7a0 0x3a1
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_J@Z 0x23e00 0x3a2
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_K@Z 0x23e40 0x3a3
?get@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHAA_N@Z 0x30ae0 0x3a4
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x2fc40 0x3a5
?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD4@Z 0x30480 0x3a6
?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x2fc40 0x3a7
?get@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBG4@Z 0x2f9e0 0x3a8
?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@DD@Z 0x2fc40 0x3a9
?get@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PB_W4@Z 0x2ffc0 0x3aa
?get_date@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fc80 0x3ab
?get_date@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fc80 0x3ac
?get_date@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fc80 0x3ad
?get_monthname@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e40 0x3ae
?get_monthname@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e40 0x3af
?get_monthname@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e40 0x3b0
?get_new_handler@std@@YAP6AXXZXZ 0x1b990 0x3b1
?get_time@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fcc0 0x3b2
?get_time@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fcc0 0x3b3
?get_time@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x2fcc0 0x3b4
?get_weekday@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e80 0x3b5
?get_weekday@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e80 0x3b6
?get_weekday@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e80 0x3b7
?get_year@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e00 0x3b8
?get_year@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@GU?$char_traits@G@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e00 0x3b9
?get_year@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@@Z 0x23e00 0x3ba
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z 0x38770 0x3bb
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_JD@Z 0x38630 0x3bc
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z 0x32830 0x3bd
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_JG@Z 0x326e0 0x3be
?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z 0x35a30 0x3bf
?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J_W@Z 0x358e0 0x3c0
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ 0x33ee0 0x3c1
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QBE?AVlocale@2@XZ 0x33ee0 0x3c2
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ 0x33ee0 0x3c3
?getloc@ios_base@std@@QBE?AVlocale@2@XZ 0x142c0 0x3c4
?global@locale@std@@SA?AV12@ABV12@@Z 0x177f0 0x3c5
?good@ios_base@std@@QBE_NXZ 0x14170 0x3c6
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x15aa0 0x3c7
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x15aa0 0x3c8
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x15aa0 0x3c9
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A 0x64780 0x3ca
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A 0x63e4c 0x3cb
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A 0x63e48 0x3cc
?id@?$collate@D@std@@2V0locale@2@A 0x647f0 0x3cd
?id@?$collate@G@std@@2V0locale@2@A 0x647c4 0x3ce
?id@?$collate@_W@std@@2V0locale@2@A 0x647b4 0x3cf
?id@?$ctype@D@std@@2V0locale@2@A 0x63e54 0x3d0
?id@?$ctype@G@std@@2V0locale@2@A 0x63e44 0x3d1
?id@?$ctype@_W@std@@2V0locale@2@A 0x63e50 0x3d2
?id@?$messages@D@std@@2V0locale@2@A 0x647fc 0x3d3
?id@?$messages@G@std@@2V0locale@2@A 0x647a4 0x3d4
?id@?$messages@_W@std@@2V0locale@2@A 0x647c0 0x3d5
?id@?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x64800 0x3d6
?id@?$money_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x647d8 0x3d7
?id@?$money_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647cc 0x3d8
?id@?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x64804 0x3d9
?id@?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x647bc 0x3da
?id@?$money_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647c8 0x3db
?id@?$moneypunct@D$00@std@@2V0locale@2@A 0x647f4 0x3dc
?id@?$moneypunct@D$0A@@std@@2V0locale@2@A 0x647f8 0x3dd
?id@?$moneypunct@G$00@std@@2V0locale@2@A 0x647b0 0x3de
?id@?$moneypunct@G$0A@@std@@2V0locale@2@A 0x647b8 0x3df
?id@?$moneypunct@_W$00@std@@2V0locale@2@A 0x64794 0x3e0
?id@?$moneypunct@_W$0A@@std@@2V0locale@2@A 0x64790 0x3e1
?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x64788 0x3e2
?id@?$num_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x647d0 0x3e3
?id@?$num_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647d4 0x3e4
?id@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x64784 0x3e5
?id@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x6479c 0x3e6
?id@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647e4 0x3e7
?id@?$numpunct@D@std@@2V0locale@2@A 0x6478c 0x3e8
?id@?$numpunct@G@std@@2V0locale@2@A 0x647e0 0x3e9
?id@?$numpunct@_W@std@@2V0locale@2@A 0x647a8 0x3ea
?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x647ec 0x3eb
?id@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x64798 0x3ec
?id@?$time_get@_WV?$istreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647ac 0x3ed
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A 0x647e8 0x3ee
?id@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@2V0locale@2@A 0x647dc 0x3ef
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A 0x647a0 0x3f0
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z 0x38540 0x3f1
?ignore@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JG@Z 0x325e0 0x3f2
?ignore@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JG@Z 0x357e0 0x3f3
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x34300 0x3f4
?imbue@?$basic_ios@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x34300 0x3f5
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x34300 0x3f6
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z 0x11e20 0x3f7
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z 0x11e20 0x3f8
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z 0x11e20 0x3f9
?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z 0x142e0 0x3fa
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z 0x11c20 0x3fb
?in@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAG3AAPAG@Z 0x11c20 0x3fc
?in@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_S3AAPA_S@Z 0x11c20 0x3fd
?in@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_U3AAPA_U@Z 0x11c20 0x3fe
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z 0x11c20 0x3ff
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JXZ 0x33ea0 0x400
?in_avail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JXZ 0x33ea0 0x401
?in_avail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JXZ 0x33ea0 0x402
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z 0x15b10 0x403
?init@?$basic_ios@GU?$char_traits@G@std@@@std@@IAEXPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@_N@Z 0x1d5f0 0x404
?init@?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAEXPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@_N@Z 0x1dd20 0x405
?intl@?$moneypunct@D$00@std@@2_NB 0x6558 0x406
?intl@?$moneypunct@D$0A@@std@@2_NB 0x6559 0x407
?intl@?$moneypunct@G$00@std@@2_NB 0x6558 0x408
?intl@?$moneypunct@G$0A@@std@@2_NB 0x6559 0x409
?intl@?$moneypunct@_W$00@std@@2_NB 0x6558 0x40a
?intl@?$moneypunct@_W$0A@@std@@2_NB 0x6559 0x40b
?ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z 0x397a0 0x40c
?ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z 0x33970 0x40d
?ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z 0x36b70 0x40e
?is@?$ctype@D@std@@QBEPBDPBD0PAF@Z 0x12e20 0x40f
?is@?$ctype@D@std@@QBE_NFD@Z 0x12e00 0x410
?is@?$ctype@G@std@@QBEPBGPBG0PAF@Z 0x13420 0x411
?is@?$ctype@G@std@@QBE_NFG@Z 0x133f0 0x412
?is@?$ctype@_W@std@@QBEPB_WPB_W0PAF@Z 0x13420 0x413
?is@?$ctype@_W@std@@QBE_NF_W@Z 0x133f0 0x414
?isfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ 0xff90 0x415
?isfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEXXZ 0xff90 0x416
?isfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0xff90 0x417
?iword@ios_base@std@@QAEAAJH@Z 0x14370 0x418
?length@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z 0x11cd0 0x419
?length@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z 0x11cd0 0x41a
?length@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z 0x11cd0 0x41b
?length@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z 0x11cd0 0x41c
?length@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1I@Z 0x11cd0 0x41d
?max_length@codecvt_base@std@@QBEHXZ 0x11bb0 0x41e
?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEX$$QAV12@@Z 0x39d00 0x41f
?move@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXAAV12@@Z 0x39d00 0x420
?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEX$$QAV12@@Z 0x34260 0x421
?move@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXAAV12@@Z 0x34260 0x422
?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEX$$QAV12@@Z 0x34260 0x423
?move@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z 0x34260 0x424
?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDDD@Z 0x39d20 0x425
?narrow@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEDGD@Z 0x34280 0x426
?narrow@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBED_WD@Z 0x36ee0 0x427
?narrow@?$ctype@D@std@@QBEDDD@Z 0x12fc0 0x428
?narrow@?$ctype@D@std@@QBEPBDPBD0DPAD@Z 0x11cd0 0x429
?narrow@?$ctype@G@std@@QBEDGD@Z 0x13580 0x42a
?narrow@?$ctype@G@std@@QBEPBGPBG0DPAD@Z 0x135b0 0x42b
?narrow@?$ctype@_W@std@@QBED_WD@Z 0x13580 0x42c
?narrow@?$ctype@_W@std@@QBEPB_WPB_W0DPAD@Z 0x135b0 0x42d
?opfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE_NXZ 0x31e80 0x42e
?opfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE_NXZ 0x31e80 0x42f
?opfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE_NXZ 0x31e80 0x430
?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ 0x31e70 0x431
?osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ 0x31e70 0x432
?osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x31e70 0x433
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z 0x11c60 0x434
?out@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBG1AAPBGPAD3AAPAD@Z 0x11c60 0x435
?out@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_S1AAPB_SPAD3AAPAD@Z 0x11c60 0x436
?out@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_U1AAPB_UPAD3AAPAD@Z 0x11c60 0x437
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z 0x11c60 0x438
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z 0x15580 0x439
?overflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z 0x1d310 0x43a
?overflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z 0x1d310 0x43b
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z 0x15580 0x43c
?pbackfail@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGG@Z 0x1d310 0x43d
?pbackfail@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGG@Z 0x1d310 0x43e
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x33d00 0x43f
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x33d00 0x440
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x33d00 0x441
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z 0x159f0 0x442
?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z 0x1d520 0x443
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z 0x1d520 0x444
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ 0x38320 0x445
?peek@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ 0x323b0 0x446
?peek@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x355b0 0x447
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ 0x15a90 0x448
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ 0x15a90 0x449
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ 0x15a90 0x44a
?precision@ios_base@std@@QAE_J_J@Z 0x14270 0x44b
?precision@ios_base@std@@QBE_JXZ 0x14260 0x44c
?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x33f00 0x44d
?pubimbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x33f00 0x44e
?pubimbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z 0x33f00 0x44f
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x33ff0 0x450
?pubseekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z 0x33fd0 0x451
?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x33ff0 0x452
?pubseekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z 0x33fd0 0x453
?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x33ff0 0x454
?pubseekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@_JII@Z 0x33fd0 0x455
?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x33f90 0x456
?pubseekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z 0x33f90 0x457
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x33f90 0x458
?pubseekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z 0x33f90 0x459
?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x33f90 0x45a
?pubseekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@V32@I@Z 0x33f90 0x45b
?pubsetbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PAD_J@Z 0x33f60 0x45c
?pubsetbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PAG_J@Z 0x33f60 0x45d
?pubsetbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEPAV12@PA_W_J@Z 0x33f60 0x45e
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ 0x17600 0x45f
?pubsync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEHXZ 0x17600 0x460
?pubsync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHXZ 0x17600 0x461
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z 0x37170 0x462
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z 0x31160 0x463
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z 0x31160 0x464
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DJ@Z 0x30920 0x465
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DK@Z 0x308e0 0x466
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DN@Z 0x30820 0x467
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DO@Z 0x307e0 0x468
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBX@Z 0x307a0 0x469
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_J@Z 0x308a0 0x46a
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_K@Z 0x30860 0x46b
?put@?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@D_N@Z 0x30960 0x46c
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GJ@Z 0x30920 0x46d
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GK@Z 0x308e0 0x46e
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GN@Z 0x30820 0x46f
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GO@Z 0x307e0 0x470
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBX@Z 0x307a0 0x471
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_J@Z 0x308a0 0x472
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_K@Z 0x30860 0x473
?put@?$num_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@G_N@Z 0x30960 0x474
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WJ@Z 0x30920 0x475
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WK@Z 0x308e0 0x476
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WN@Z 0x30820 0x477
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WO@Z 0x307e0 0x478
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBX@Z 0x307a0 0x479
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_J@Z 0x308a0 0x47a
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_K@Z 0x30860 0x47b
?put@?$num_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_W_N@Z 0x30960 0x47c
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z 0x2f7a0 0x47d
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z 0x30280 0x47e
?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@DD@Z 0x2f7a0 0x47f
?put@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@GU?$char_traits@G@std@@@2@V32@AAVios_base@2@GPBUtm@@PBG3@Z 0x2f7e0 0x480
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@DD@Z 0x2f7a0 0x481
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@PB_W4@Z 0x2fdc0 0x482
?putback@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z 0x38250 0x483
?putback@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@G@Z 0x322e0 0x484
?putback@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z 0x354e0 0x485
?pword@ios_base@std@@QAEAAPAXH@Z 0x14390 0x486
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z 0x34360 0x487
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ 0x17620 0x488
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@PAV32@@Z 0x34360 0x489
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ 0x17620 0x48a
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@PAV32@@Z 0x34360 0x48b
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ 0x17620 0x48c
?rdstate@ios_base@std@@QBEHXZ 0x13140 0x48d
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z 0x38480 0x48e
?read@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAG_J@Z 0x32520 0x48f
?read@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z 0x35720 0x490
?readsome@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z 0x383d0 0x491
?readsome@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_JPAG_J@Z 0x32470 0x492
?readsome@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_JPA_W_J@Z 0x35670 0x493
?register_callback@ios_base@std@@QAEXP6AXW4event@12@AAV12@H@ZH@Z 0x143b0 0x494
?resetiosflags@std@@YA?AU?$_Smanip@H@1@H@Z 0x172c0 0x495
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ 0x1ab60 0x496
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ 0x298f0 0x497
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x298f0 0x498
?scan_is@?$ctype@D@std@@QBEPBDFPBD0@Z 0x12e70 0x499
?scan_is@?$ctype@G@std@@QBEPBGFPBG0@Z 0x13450 0x49a
?scan_is@?$ctype@_W@std@@QBEPB_WFPB_W0@Z 0x13450 0x49b
?scan_not@?$ctype@D@std@@QBEPBDFPBD0@Z 0x12ea0 0x49c
?scan_not@?$ctype@G@std@@QBEPBGFPBG0@Z 0x13480 0x49d
?scan_not@?$ctype@_W@std@@QBEPB_WFPB_W0@Z 0x13480 0x49e
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x38060 0x49f
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z 0x37fc0 0x4a0
?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x320d0 0x4a1
?seekg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JH@Z 0x32030 0x4a2
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x352e0 0x4a3
?seekg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z 0x35240 0x4a4
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x15300 0x4a5
?seekoff@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x15300 0x4a6
?seekoff@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z 0x15300 0x4a7
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x31000 0x4a8
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z 0x30f70 0x4a9
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x31000 0x4aa
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@_JH@Z 0x30f70 0x4ab
?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z 0x31000 0x4ac
?seekp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_JH@Z 0x30f70 0x4ad
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x152e0 0x4ae
?seekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x152e0 0x4af
?seekpos@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z 0x152e0 0x4b0
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z 0x1b910 0x4b1
?set_rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@@Z 0x34210 0x4b2
?set_rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@@Z 0x34210 0x4b3
?set_rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@@Z 0x34210 0x4b4
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z 0x17300 0x4b5
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z 0x152d0 0x4b6
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z 0x152d0 0x4b7
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z 0x152d0 0x4b8
?setf@ios_base@std@@QAEHH@Z 0x14200 0x4b9
?setf@ios_base@std@@QAEHHH@Z 0x14220 0x4ba
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z 0x15c30 0x4bb
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z 0x1d640 0x4bc
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z 0x1d640 0x4bd
?setiosflags@std@@YA?AU?$_Smanip@H@1@H@Z 0x172e0 0x4be
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z 0x39ae0 0x4bf
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z 0x15ce0 0x4c0
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z 0x33cc0 0x4c1
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z 0x1d6c0 0x4c2
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z 0x33cc0 0x4c3
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z 0x1d6c0 0x4c4
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z 0x17320 0x4c5
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z 0x15cb0 0x4c6
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXI@Z 0x343c0 0x4c7
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z 0x15cb0 0x4c8
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXI@Z 0x343c0 0x4c9
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z 0x15cb0 0x4ca
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXI@Z 0x343c0 0x4cb
?setstate@ios_base@std@@QAEXH@Z 0x14150 0x4cc
?setstate@ios_base@std@@QAEXH_N@Z 0x14130 0x4cd
?setstate@ios_base@std@@QAEXI@Z 0x14150 0x4ce
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z 0x17340 0x4cf
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ 0x1ab20 0x4d0
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ 0x298b0 0x4d1
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x298b0 0x4d2
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z 0x33e70 0x4d3
?sgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPAG_J@Z 0x33e70 0x4d4
?sgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPA_W_J@Z 0x33e70 0x4d5
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ 0x15570 0x4d6
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ 0x15570 0x4d7
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ 0x15570 0x4d8
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ 0x39bf0 0x4d9
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ 0x33e20 0x4da
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x33e20 0x4db
?sputbackc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z 0x39ba0 0x4dc
?sputbackc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z 0x33dd0 0x4dd
?sputbackc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z 0x33dd0 0x4de
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z 0x1aad0 0x4df
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z 0x29860 0x4e0
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z 0x29860 0x4e1
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z 0x33d10 0x4e2
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z 0x33d10 0x4e3
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z 0x33d10 0x4e4
?stossc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ 0x39b60 0x4e5
?stossc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ 0x33d90 0x4e6
?stossc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ 0x33d90 0x4e7
?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ 0x39b20 0x4e8
?sungetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ 0x33d40 0x4e9
?sungetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ 0x33d40 0x4ea
?swap@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXAAV12@@Z 0x39cd0 0x4eb
?swap@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXAAV12@@Z 0x34220 0x4ec
?swap@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXAAV12@@Z 0x34220 0x4ed
?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z 0x36fc0 0x4ee
?swap@?$basic_iostream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z 0x30d40 0x4ef
?swap@?$basic_iostream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z 0x30d40 0x4f0
?swap@?$basic_istream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z 0x398e0 0x4f1
?swap@?$basic_istream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z 0x33ac0 0x4f2
?swap@?$basic_istream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z 0x33ac0 0x4f3
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z 0x36fc0 0x4f4
?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z 0x30d40 0x4f5
?swap@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z 0x30d40 0x4f6
?swap@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXAAV12@@Z 0x34020 0x4f7
?swap@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXAAV12@@Z 0x34020 0x4f8
?swap@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXAAV12@@Z 0x34020 0x4f9
?swap@ios_base@std@@QAEXAAV12@@Z 0x144e0 0x4fa
?sync@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ 0x38110 0x4fb
?sync@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEHXZ 0x32180 0x4fc
?sync@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEHXZ 0x35390 0x4fd
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ 0x122d0 0x4fe
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ 0x122d0 0x4ff
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ 0x122d0 0x500
?sync_with_stdio@ios_base@std@@SA_N_N@Z 0x144a0 0x501
?table@?$ctype@D@std@@QBEPBFXZ 0x13140 0x502
?table_size@?$ctype@D@std@@2IB 0x55f0 0x503
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x37f40 0x504
?tellg@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x31fb0 0x505
?tellg@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x351c0 0x506
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x30ef0 0x507
?tellp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x30ef0 0x508
?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ 0x30ef0 0x509
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@PAV32@@Z 0x155c0 0x50a
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ 0x176f0 0x50b
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@PAV32@@Z 0x155c0 0x50c
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ 0x176f0 0x50d
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@PAV32@@Z 0x155c0 0x50e
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ 0x176f0 0x50f
?tolower@?$ctype@D@std@@QBEDD@Z 0x12ed0 0x510
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z 0x12ef0 0x511
?tolower@?$ctype@G@std@@QBEGG@Z 0x12f70 0x512
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z 0x134b0 0x513
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z 0x134b0 0x514
?tolower@?$ctype@_W@std@@QBE_W_W@Z 0x12f70 0x515
?toupper@?$ctype@D@std@@QBEDD@Z 0x12f20 0x516
?toupper@?$ctype@D@std@@QBEPBDPADPBD@Z 0x12f40 0x517
?toupper@?$ctype@G@std@@QBEGG@Z 0x134e0 0x518
?toupper@?$ctype@G@std@@QBEPBGPAGPBG@Z 0x13500 0x519
?toupper@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z 0x13500 0x51a
?toupper@?$ctype@_W@std@@QBE_W_W@Z 0x134e0 0x51b
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ 0x15530 0x51c
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ 0x1d2c0 0x51d
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ 0x1d2c0 0x51e
?uncaught_exception@std@@YA_NXZ 0x1c780 0x51f
?uncaught_exceptions@std@@YAHXZ 0x1c790 0x520
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ 0x11720 0x521
?underflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ 0x1d300 0x522
?underflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ 0x1d300 0x523
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ 0x38190 0x524
?unget@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ 0x32210 0x525
?unget@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ 0x35410 0x526
?unsetf@ios_base@std@@QAEXH@Z 0x14250 0x527
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x11ca0 0x528
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x11ca0 0x529
?unshift@?$codecvt@_SDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x11ca0 0x52a
?unshift@?$codecvt@_UDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x11ca0 0x52b
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z 0x11ca0 0x52c
?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x63e68 0x52d
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x64120 0x52e
?wcin@std@@3V?$basic_istream@GU?$char_traits@G@std@@@1@A 0x63f68 0x52f
?wcin@std@@3V?$basic_istream@_WU?$char_traits@_W@std@@@1@A 0x64220 0x530
?wclog@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x63fc8 0x531
?wclog@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x64280 0x532
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A 0x64070 0x533
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A 0x64328 0x534
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z 0x15c60 0x535
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z 0x1d670 0x536
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z 0x1dd70 0x537
?widen@?$ctype@D@std@@QBEDD@Z 0x12f70 0x538
?widen@?$ctype@D@std@@QBEPBDPBD0PAD@Z 0x12f90 0x539
?widen@?$ctype@G@std@@QBEGD@Z 0x13530 0x53a
?widen@?$ctype@G@std@@QBEPBDPBD0PAG@Z 0x13550 0x53b
?widen@?$ctype@_W@std@@QBEPBDPBD0PA_W@Z 0x13550 0x53c
?widen@?$ctype@_W@std@@QBE_WD@Z 0x13530 0x53d
?width@ios_base@std@@QAE_J_J@Z 0x142a0 0x53e
?width@ios_base@std@@QBE_JXZ 0x14290 0x53f
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z 0x310a0 0x540
?write@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@PBG_J@Z 0x310a0 0x541
?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z 0x310a0 0x542
?xalloc@ios_base@std@@SAHXZ 0x14330 0x543
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z 0x15420 0x544
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z 0x1d1a0 0x545
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z 0x1d1a0 0x546
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z 0x15320 0x547
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z 0x1d090 0x548
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z 0x1d090 0x549
_Chmod 0x16c00 0x54a
_Close_dir 0x16330 0x54b
_Cnd_broadcast 0x1bf00 0x54c
_Cnd_destroy 0x1bdc0 0x54d
_Cnd_destroy_in_situ 0x1bd70 0x54e
_Cnd_do_broadcast_at_thread_exit 0xab90 0x54f
_Cnd_init 0x1bd90 0x550
_Cnd_init_in_situ 0x1bd00 0x551
_Cnd_register_at_thread_exit 0xaa90 0x552
_Cnd_signal 0x1bee0 0x553
_Cnd_timedwait 0x1bec0 0x554
_Cnd_unregister_at_thread_exit 0xab30 0x555
_Cnd_wait 0x1bea0 0x556
_Copy_file 0x16bd0 0x557
_Cosh 0xae10 0x558
_Current_get 0x16590 0x559
_Current_set 0x165c0 0x55a
_Denorm 0x62148 0x55b
_Dtest 0xb500 0x55c
_Equivalent 0x169d0 0x55d
_Exp 0xb5f0 0x55e
_FCosh 0xb710 0x55f
_FDenorm 0x62068 0x560
_FDtest 0xbc70 0x561
_FExp 0xbd40 0x562
_FInf 0x62028 0x563
_FNan 0x62048 0x564
_FSinh 0xc5a0 0x565
_FSnan 0x62078 0x566
_File_size 0x167b0 0x567
_Getcoll 0xed90 0x568
_Getctype 0xa5e0 0x569
_Getcvt 0xf150 0x56a
_Getdateorder 0x2ad50 0x56b
_Getwctype 0xc710 0x56c
_Getwctypes 0xc740 0x56d
_Hard_links 0x16730 0x56e
_Hugeval 0x62128 0x56f
_Inf 0x620e8 0x570
_LCosh 0xc760 0x571
_LDenorm 0x620c8 0x572
_LDtest 0xc960 0x573
_LExp 0xc970 0x574
_LInf 0x62088 0x575
_LNan 0x620a8 0x576
_LSinh 0xd130 0x577
_LSnan 0x620d8 0x578
_Last_write_time 0x16800 0x579
_Link 0x16ac0 0x57a
_Lock_shared_ptr_spin_lock 0xa770 0x57b
_Lstat 0x16720 0x57c
_Make_dir 0x16640 0x57d
_Mbrtowc 0xd270 0x57e
_Mtx_clear_owner 0x1c3c0 0x57f
_Mtx_current_owns 0x1c380 0x580
_Mtx_destroy 0x1c130 0x581
_Mtx_destroy_in_situ 0x1c0d0 0x582
_Mtx_getconcrtcs 0x1c3b0 0x583
_Mtx_init 0x1c0f0 0x584
_Mtx_init_in_situ 0x1c0b0 0x585
_Mtx_lock 0x1c320 0x586
_Mtx_reset_owner 0x1c3d0 0x587
_Mtx_timedlock 0x1c360 0x588
_Mtx_trylock 0x1c330 0x589
_Mtx_unlock 0x1c2f0 0x58a
_Mtxdst 0xd3f0 0x58b
_Mtxinit 0xd3d0 0x58c
_Mtxlock 0xd400 0x58d
_Mtxunlock 0xd410 0x58e
_Nan 0x62108 0x58f
_Open_dir 0x16480 0x590
_Query_perf_counter 0xadd0 0x591
_Query_perf_frequency 0xadf0 0x592
_Read_dir 0x16360 0x593
_Remove_dir 0x16670 0x594
_Rename 0x16b20 0x595
_Resize 0x16b40 0x596
_Set_last_write_time 0x16850 0x597
_Sinh 0xd950 0x598
_Snan 0x62138 0x599
_Stat 0x16690 0x59a
_Statvfs 0x168c0 0x59b
_Stod 0xdcd0 0x59c
_Stodx 0xda90 0x59d
_Stof 0xdef0 0x59e
_Stofx 0xdcf0 0x59f
_Stold 0xe440 0x5a0
_Stoldx 0xe200 0x5a1
_Stoll 0xe540 0x5a2
_Stollx 0xe460 0x5a3
_Stolx 0xe150 0x5a4
_Stoul 0xe830 0x5a5
_Stoull 0xea70 0x5a6
_Stoullx 0xe850 0x5a7
_Stoulx 0xe6b0 0x5a8
_Strcoll 0xecf0 0x5a9
_Strxfrm 0xedc0 0x5aa
_Symlink 0x16af0 0x5ab
_Symlink_get 0x165e0 0x5ac
_Temp_get 0x165f0 0x5ad
_Thrd_abort 0xa9c0 0x5ae
_Thrd_create 0xa9f0 0x5af
_Thrd_current 0xa940 0x5b0
_Thrd_detach 0xa880 0x5b1
_Thrd_equal 0xa930 0x5b2
_Thrd_exit 0xa7f0 0x5b3
_Thrd_hardware_concurrency 0xa9a0 0x5b4
_Thrd_id 0xa990 0x5b5
_Thrd_join 0xa830 0x5b6
_Thrd_sleep 0xa8a0 0x5b7
_Thrd_start 0xa800 0x5b8
_Thrd_yield 0xa920 0x5b9
_To_byte 0x16450 0x5ba
_To_wide 0x16420 0x5bb
_Tolower 0xa4d0 0x5bc
_Toupper 0xa660 0x5bd
_Towlower 0xee70 0x5be
_Towupper 0xeee0 0x5bf
_Unlink 0x16bb0 0x5c0
_Unlock_shared_ptr_spin_lock 0xa780 0x5c1
_WStod 0xf410 0x5c2
_WStodx 0xf1d0 0x5c3
_WStof 0xf630 0x5c4
_WStofx 0xf430 0x5c5
_WStold 0xfb00 0x5c6
_WStoldx 0xf8c0 0x5c7
_Wcrtomb 0xf0f0 0x5c8
_Wcscoll 0xef50 0x5c9
_Wcsxfrm 0xf010 0x5ca
_Xtime_diff_to_millis 0xad40 0x5cb
_Xtime_diff_to_millis2 0xad00 0x5cc
_Xtime_get_ticks 0xacd0 0x5cd
__Wcrtomb_lk 0xf0e0 0x5ce
__crtCloseThreadpoolTimer 0x3a250 0x5cf
__crtCloseThreadpoolWait 0x3a280 0x5d0
__crtCompareStringA 0x10940 0x5d1
__crtCompareStringEx 0x10f50 0x5d2
__crtCompareStringW 0x10bb0 0x5d3
__crtCreateEventExW 0x3a2c0 0x5d4
__crtCreateSemaphoreExW 0x3a310 0x5d5
__crtCreateSymbolicLinkW 0x3a370 0x5d6
__crtCreateThreadpoolTimer 0x3a3b0 0x5d7
__crtCreateThreadpoolWait 0x3a3e0 0x5d8
__crtFlushProcessWriteBuffers 0x3a430 0x5d9
__crtFreeLibraryWhenCallbackReturns 0x3a450 0x5da
__crtGetCurrentProcessorNumber 0x3a480 0x5db
__crtGetFileInformationByHandleEx 0x3a4a0 0x5dc
__crtGetLocaleInfoEx 0x11020 0x5dd
__crtGetSystemTimePreciseAsFileTime 0x3a4e0 0x5de
__crtGetTickCount64 0x3a510 0x5df
__crtInitOnceExecuteOnce 0x3a540 0x5e0
__crtInitializeCriticalSectionEx 0x3a5f0 0x5e1
__crtIsPackagedApp 0x3a650 0x5e2
__crtLCMapStringA 0x10c20 0x5e3
__crtLCMapStringEx 0x10fc0 0x5e4
__crtLCMapStringW 0x10e30 0x5e5
__crtSetFileInformationByHandle 0x3a690 0x5e6
__crtSetThreadpoolTimer 0x3a6d0 0x5e7
__crtSetThreadpoolWait 0x3a700 0x5e8
__crtWaitForThreadpoolTimerCallbacks 0x3a7c0 0x5e9
__set_stl_sync_api_mode 0x1c0a0 0x5ea
xtime_get 0xad80 0x5eb
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2016-08-18 22:17 (UTC+2)
Valid Until 2017-11-02 21:17 (UTC+1)
Algorithm sha1_rsa
Serial Number 33 00 00 01 40 96 A9 EE 70 56 FE CC 07 00 01 00 00 01 40
Thumbprint 98 ED 99 A6 78 86 D0 20 C5 64 92 3B 7D F2 5E 9A C0 19 DF 26
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
nss3.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\nss3.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 1.19 MB
MD5 02cc7b8ee30056d5912de54f1bdfc219 Copy to Clipboard
SHA1 a6923da95705fb81e368ae48f93d28522ef552fb Copy to Clipboard
SHA256 1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5 Copy to Clipboard
SSDeep 24576:ido5Js2a56/+VwJebKj5KYFsRjzx5ZxKV6D1Z4Go/LCiytoxq2Zwn5hCM4MSRdY8:Q2aY4w6aozx5ZWMM7yew8MSRK1y Copy to Clipboard
ImpHash e8770320e60634e39c48ab989d174c2a Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x100eef97
Size Of Code 0xee800
Size Of Initialized Data 0x41c00
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:53:27+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename nss3.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xee7a1 0xee800 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.62
.rdata 0x100f0000 0x351f4 0x35200 0xeec00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.96
.data 0x10126000 0x4774 0x2200 0x123e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 3.94
.rsrc 0x1012b000 0x370 0x400 0x126000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.87
.reloc 0x1012c000 0x7cb8 0x7e00 0x126400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.67
Imports (16)
»
mozglue.dll (9)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
realloc - 0x100f03cc 0x124298 0x122e98 0x9b
malloc_usable_size - 0x100f03d0 0x12429c 0x122e9c 0x88
strdup - 0x100f03d4 0x1242a0 0x122ea0 0x9c
calloc - 0x100f03d8 0x1242a4 0x122ea4 0x7b
_HeapAlloc@12 - 0x100f03dc 0x1242a8 0x122ea8 0x71
malloc - 0x100f03e0 0x1242ac 0x122eac 0x86
free - 0x100f03e4 0x1242b0 0x122eb0 0x7c
_HeapReAlloc@16 - 0x100f03e8 0x1242b4 0x122eb4 0x73
_HeapFree@12 - 0x100f03ec 0x1242b8 0x122eb8 0x72
KERNEL32.dll (114)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetFullPathNameW - 0x100f0034 0x123f00 0x122b00 0x253
HeapCreate - 0x100f0038 0x123f04 0x122b04 0x33f
ReadFile - 0x100f003c 0x123f08 0x122b08 0x465
AreFileApisANSI - 0x100f0040 0x123f0c 0x122b0c 0x23
FlushFileBuffers - 0x100f0044 0x123f10 0x122b10 0x19b
GetTickCount - 0x100f0048 0x123f14 0x122b14 0x300
QueryPerformanceCounter - 0x100f004c 0x123f18 0x122b18 0x440
MapViewOfFile - 0x100f0050 0x123f1c 0x122b1c 0x3d1
CreateFileMappingW - 0x100f0054 0x123f20 0x122b20 0xc6
FormatMessageA - 0x100f0058 0x123f24 0x122b24 0x1a2
GetSystemTime - 0x100f005c 0x123f28 0x122b28 0x2e0
GetSystemTimeAsFileTime - 0x100f0060 0x123f2c 0x122b2c 0x2e2
WideCharToMultiByte - 0x100f0064 0x123f30 0x122b30 0x5f1
FreeLibrary - 0x100f0068 0x123f34 0x122b34 0x1a7
SystemTimeToFileTime - 0x100f006c 0x123f38 0x122b38 0x578
GetProcessHeap - 0x100f0070 0x123f3c 0x122b3c 0x2ad
GetCurrentProcessId - 0x100f0074 0x123f40 0x122b40 0x214
GetFileSize - 0x100f0078 0x123f44 0x122b44 0x245
LockFileEx - 0x100f007c 0x123f48 0x122b48 0x3cd
LocalFree - 0x100f0080 0x123f4c 0x122b4c 0x3c3
CreateFileMappingA - 0x100f0084 0x123f50 0x122b50 0xc2
GetProcAddress - 0x100f0088 0x123f54 0x122b54 0x2a7
UnlockFile - 0x100f008c 0x123f58 0x122b58 0x59e
HeapDestroy - 0x100f0090 0x123f5c 0x122b5c 0x340
HeapCompact - 0x100f0094 0x123f60 0x122b60 0x33e
LoadLibraryW - 0x100f0098 0x123f64 0x122b64 0x3b9
GetSystemInfo - 0x100f009c 0x123f68 0x122b68 0x2dc
CloseHandle - 0x100f00a0 0x123f6c 0x122b6c 0x85
DeleteFileW - 0x100f00a4 0x123f70 0x122b70 0x112
DeleteFileA - 0x100f00a8 0x123f74 0x122b74 0x10f
WaitForSingleObjectEx - 0x100f00ac 0x123f78 0x122b78 0x5c8
LoadLibraryA - 0x100f00b0 0x123f7c 0x122b7c 0x3b6
CreateFileA - 0x100f00b4 0x123f80 0x122b80 0xc1
FlushViewOfFile - 0x100f00b8 0x123f84 0x122b84 0x19e
OutputDebugStringW - 0x100f00bc 0x123f88 0x122b88 0x40c
GetFileAttributesExW - 0x100f00c0 0x123f8c 0x122b8c 0x23c
GetFileAttributesA - 0x100f00c4 0x123f90 0x122b90 0x23a
GetLastError - 0x100f00c8 0x123f94 0x122b94 0x25a
GetDiskFreeSpaceA - 0x100f00cc 0x123f98 0x122b98 0x222
FormatMessageW - 0x100f00d0 0x123f9c 0x122b9c 0x1a3
GetTempPathA - 0x100f00d4 0x123fa0 0x122ba0 0x2ee
Sleep - 0x100f00d8 0x123fa4 0x122ba4 0x56d
MultiByteToWideChar - 0x100f00dc 0x123fa8 0x122ba8 0x3e2
HeapSize - 0x100f00e0 0x123fac 0x122bac 0x346
HeapValidate - 0x100f00e4 0x123fb0 0x122bb0 0x349
UnmapViewOfFile - 0x100f00e8 0x123fb4 0x122bb4 0x5a0
GetFileAttributesW - 0x100f00ec 0x123fb8 0x122bb8 0x23f
CreateFileW - 0x100f00f0 0x123fbc 0x122bbc 0xc9
WaitForSingleObject - 0x100f00f4 0x123fc0 0x122bc0 0x5c7
CreateMutexW - 0x100f00f8 0x123fc4 0x122bc4 0xd8
GetTempPathW - 0x100f00fc 0x123fc8 0x122bc8 0x2ef
UnlockFileEx - 0x100f0100 0x123fcc 0x122bcc 0x59f
GetDiskFreeSpaceW - 0x100f0104 0x123fd0 0x122bd0 0x225
GetFullPathNameA - 0x100f0108 0x123fd4 0x122bd4 0x250
SetFilePointer - 0x100f010c 0x123fd8 0x122bd8 0x513
LockFile - 0x100f0110 0x123fdc 0x122bdc 0x3cc
InitializeCriticalSection - 0x100f0114 0x123fe0 0x122be0 0x355
EnterCriticalSection - 0x100f0118 0x123fe4 0x122be4 0x12e
LeaveCriticalSection - 0x100f011c 0x123fe8 0x122be8 0x3b2
TryEnterCriticalSection - 0x100f0120 0x123fec 0x122bec 0x597
DeleteCriticalSection - 0x100f0124 0x123ff0 0x122bf0 0x10d
GetCurrentThreadId - 0x100f0128 0x123ff4 0x122bf4 0x218
CreatePipe - 0x100f012c 0x123ff8 0x122bf8 0xdb
GetStdHandle - 0x100f0130 0x123ffc 0x122bfc 0x2cb
DebugBreak - 0x100f0134 0x124000 0x122c00 0x103
GetModuleFileNameW - 0x100f0138 0x124004 0x122c04 0x26d
GetModuleHandleA - 0x100f013c 0x124008 0x122c08 0x26e
GetModuleHandleW - 0x100f0140 0x12400c 0x122c0c 0x271
LoadLibraryExW - 0x100f0144 0x124010 0x122c10 0x3b8
GetThreadContext - 0x100f0148 0x124014 0x122c14 0x2f0
GetEnvironmentStrings - 0x100f014c 0x124018 0x122c18 0x22f
FreeEnvironmentStringsA - 0x100f0150 0x12401c 0x122c1c 0x1a5
TerminateProcess - 0x100f0154 0x124020 0x122c20 0x57c
GetExitCodeProcess - 0x100f0158 0x124024 0x122c24 0x236
CreateProcessA - 0x100f015c 0x124028 0x122c28 0xde
GetVersionExA - 0x100f0160 0x12402c 0x122c2c 0x312
GetCurrentProcess - 0x100f0164 0x124030 0x122c30 0x213
ReleaseSemaphore - 0x100f0168 0x124034 0x122c34 0x4a6
CreateSemaphoreA - 0x100f016c 0x124038 0x122c38 0xe6
OpenSemaphoreA - 0x100f0170 0x12403c 0x122c3c 0x403
DuplicateHandle - 0x100f0174 0x124040 0x122c40 0x128
OpenFileMappingA - 0x100f0178 0x124044 0x122c44 0x3f7
InitializeCriticalSectionAndSpinCount - 0x100f017c 0x124048 0x122c48 0x356
TlsGetValue - 0x100f0180 0x12404c 0x122c4c 0x590
CreateDirectoryA - 0x100f0184 0x124050 0x122c50 0xb3
FindClose - 0x100f0188 0x124054 0x122c54 0x171
FindFirstFileA - 0x100f018c 0x124058 0x122c58 0x175
FindNextFileA - 0x100f0190 0x12405c 0x122c5c 0x186
GetFileAttributesExA - 0x100f0194 0x124060 0x122c60 0x23b
GetFileInformationByHandle - 0x100f0198 0x124064 0x122c64 0x241
RemoveDirectoryA - 0x100f019c 0x124068 0x122c68 0x4a8
GetHandleInformation - 0x100f01a0 0x12406c 0x122c6c 0x257
SetHandleInformation - 0x100f01a4 0x124070 0x122c70 0x51f
MoveFileA - 0x100f01a8 0x124074 0x122c74 0x3d9
IsDebuggerPresent - 0x100f01ac 0x124078 0x122c78 0x376
RaiseException - 0x100f01b0 0x12407c 0x122c7c 0x455
GetCurrentThread - 0x100f01b4 0x124080 0x122c80 0x217
SetThreadPriority - 0x100f01b8 0x124084 0x122c84 0x54f
SuspendThread - 0x100f01bc 0x124088 0x122c88 0x575
ResumeThread - 0x100f01c0 0x12408c 0x122c8c 0x4be
TlsAlloc - 0x100f01c4 0x124090 0x122c90 0x58e
TlsSetValue - 0x100f01c8 0x124094 0x122c94 0x591
TlsFree - 0x100f01cc 0x124098 0x122c98 0x58f
GlobalMemoryStatusEx - 0x100f01d0 0x12409c 0x122c9c 0x332
MoveFileW - 0x100f01d4 0x1240a0 0x122ca0 0x3de
ReleaseMutex - 0x100f01d8 0x1240a4 0x122ca4 0x4a2
CreateMutexA - 0x100f01dc 0x1240a8 0x122ca8 0xd5
OutputDebugStringA - 0x100f01e0 0x1240ac 0x122cac 0x40b
WriteFile - 0x100f01e4 0x1240b0 0x122cb0 0x605
UnhandledExceptionFilter - 0x100f01e8 0x1240b4 0x122cb4 0x59d
SetUnhandledExceptionFilter - 0x100f01ec 0x1240b8 0x122cb8 0x55e
IsProcessorFeaturePresent - 0x100f01f0 0x1240bc 0x122cbc 0x37d
InitializeSListHead - 0x100f01f4 0x1240c0 0x122cc0 0x35a
SetEndOfFile - 0x100f01f8 0x1240c4 0x122cc4 0x501
WINMM.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
timeGetTime - 0x100f022c 0x1240f8 0x122cf8 0x94
WSOCK32.dll (30)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
sendto 0x14 0x100f0234 0x124100 0x122d00 -
setsockopt 0x15 0x100f0238 0x124104 0x122d04 -
shutdown 0x16 0x100f023c 0x124108 0x122d08 -
socket 0x17 0x100f0240 0x12410c 0x122d0c -
WSACleanup 0x74 0x100f0244 0x124110 0x122d10 -
htons 0x9 0x100f0248 0x124114 0x122d14 -
ntohl 0xe 0x100f024c 0x124118 0x122d18 -
listen 0xd 0x100f0250 0x12411c 0x122d1c -
recvfrom 0x11 0x100f0254 0x124120 0x122d20 -
getprotobynumber 0x36 0x100f0258 0x124124 0x122d24 -
getprotobyname 0x35 0x100f025c 0x124128 0x122d28 -
getsockname 0x6 0x100f0260 0x12412c 0x122d2c -
gethostname 0x39 0x100f0264 0x124130 0x122d30 -
WSAGetLastError 0x6f 0x100f0268 0x124134 0x122d34 -
ntohs 0xf 0x100f026c 0x124138 0x122d38 -
getsockopt 0x7 0x100f0270 0x12413c 0x122d3c -
htonl 0x8 0x100f0274 0x124140 0x122d40 -
send 0x13 0x100f0278 0x124144 0x122d44 -
gethostbyname 0x34 0x100f027c 0x124148 0x122d48 -
getpeername 0x5 0x100f0280 0x12414c 0x122d4c -
inet_ntoa 0xc 0x100f0284 0x124150 0x122d50 -
connect 0x4 0x100f0288 0x124154 0x122d54 -
closesocket 0x3 0x100f028c 0x124158 0x122d58 -
bind 0x2 0x100f0290 0x12415c 0x122d5c -
recv 0x10 0x100f0294 0x124160 0x122d60 -
accept 0x1 0x100f0298 0x124164 0x122d64 -
WSAStartup 0x73 0x100f029c 0x124168 0x122d68 -
select 0x12 0x100f02a0 0x12416c 0x122d6c -
gethostbyaddr 0x33 0x100f02a4 0x124170 0x122d70 -
__WSAFDIsSet 0x97 0x100f02a8 0x124174 0x122d74 -
ADVAPI32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
OpenProcessToken - 0x100f0000 0x123ecc 0x122acc 0x214
AllocateAndInitializeSid - 0x100f0004 0x123ed0 0x122ad0 0x20
CopySid - 0x100f0008 0x123ed4 0x122ad4 0x85
FreeSid - 0x100f000c 0x123ed8 0x122ad8 0x133
GetLengthSid - 0x100f0010 0x123edc 0x122adc 0x14a
GetTokenInformation - 0x100f0014 0x123ee0 0x122ae0 0x16f
SetSecurityDescriptorOwner - 0x100f0018 0x123ee4 0x122ae4 0x2e6
SetSecurityDescriptorGroup - 0x100f001c 0x123ee8 0x122ae8 0x2e5
SetSecurityDescriptorDacl - 0x100f0020 0x123eec 0x122aec 0x2e4
InitializeSecurityDescriptor - 0x100f0024 0x123ef0 0x122af0 0x18e
InitializeAcl - 0x100f0028 0x123ef4 0x122af4 0x18d
AddAccessAllowedAce - 0x100f002c 0x123ef8 0x122af8 0x10
VCRUNTIME140.dll (10)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
memcpy - 0x100f0200 0x1240cc 0x122ccc 0x46
memcmp - 0x100f0204 0x1240d0 0x122cd0 0x45
memmove - 0x100f0208 0x1240d4 0x122cd4 0x47
__std_type_info_destroy_list - 0x100f020c 0x1240d8 0x122cd8 0x25
_except_handler4_common - 0x100f0210 0x1240dc 0x122cdc 0x35
strstr - 0x100f0214 0x1240e0 0x122ce0 0x4c
strrchr - 0x100f0218 0x1240e4 0x122ce4 0x4b
memchr - 0x100f021c 0x1240e8 0x122ce8 0x44
strchr - 0x100f0220 0x1240ec 0x122cec 0x4a
memset - 0x100f0224 0x1240f0 0x122cf0 0x48
api-ms-win-crt-utility-l1-1-0.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
qsort - 0x100f03c4 0x124290 0x122e90 0x19
api-ms-win-crt-string-l1-1-0.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strcspn - 0x100f037c 0x124248 0x122e48 0x8a
strncmp - 0x100f0380 0x12424c 0x122e4c 0x8e
toupper - 0x100f0384 0x124250 0x122e50 0x98
isalnum - 0x100f0388 0x124254 0x122e54 0x64
strcmp - 0x100f038c 0x124258 0x122e58 0x86
isalpha - 0x100f0390 0x12425c 0x122e5c 0x65
strpbrk - 0x100f0394 0x124260 0x122e60 0x92
_stricmp - 0x100f0398 0x124264 0x122e64 0x2a
tolower - 0x100f039c 0x124268 0x122e68 0x97
isspace - 0x100f03a0 0x12426c 0x122e6c 0x6e
isdigit - 0x100f03a4 0x124270 0x122e70 0x68
strncpy - 0x100f03a8 0x124274 0x122e74 0x8f
api-ms-win-crt-time-l1-1-0.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_mktime64 - 0x100f03b0 0x12427c 0x122e7c 0x28
_time64 - 0x100f03b4 0x124280 0x122e80 0x30
strftime - 0x100f03b8 0x124284 0x122e84 0x46
_localtime64_s - 0x100f03bc 0x124288 0x122e88 0x24
api-ms-win-crt-runtime-l1-1-0.dll (16)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_initterm - 0x100f02f8 0x1241c4 0x122dc4 0x38
_initterm_e - 0x100f02fc 0x1241c8 0x122dc8 0x39
_execute_onexit_table - 0x100f0300 0x1241cc 0x122dcc 0x24
_seh_filter_dll - 0x100f0304 0x1241d0 0x122dd0 0x41
_configure_narrow_argv - 0x100f0308 0x1241d4 0x122dd4 0x19
_cexit - 0x100f030c 0x1241d8 0x122dd8 0x17
_initialize_narrow_environment - 0x100f0310 0x1241dc 0x122ddc 0x35
_initialize_onexit_table - 0x100f0314 0x1241e0 0x122de0 0x36
strerror - 0x100f0318 0x1241e4 0x122de4 0x67
_errno - 0x100f031c 0x1241e8 0x122de8 0x23
__fpe_flt_rounds - 0x100f0320 0x1241ec 0x122dec 0x3
abort - 0x100f0324 0x1241f0 0x122df0 0x57
_endthreadex - 0x100f0328 0x1241f4 0x122df4 0x22
_beginthreadex - 0x100f032c 0x1241f8 0x122df8 0x15
_exit - 0x100f0330 0x1241fc 0x122dfc 0x25
_getpid - 0x100f0334 0x124200 0x122e00 0x34
api-ms-win-crt-convert-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
strtoul - 0x100f02b0 0x12417c 0x122d7c 0x64
atoi - 0x100f02b4 0x124180 0x122d80 0x50
strtol - 0x100f02b8 0x124184 0x122d84 0x61
api-ms-win-crt-stdio-l1-1-0.dll (15)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
fclose - 0x100f033c 0x124208 0x122e08 0x74
_close - 0x100f0340 0x12420c 0x122e0c 0x17
fflush - 0x100f0344 0x124210 0x122e10 0x77
setvbuf - 0x100f0348 0x124214 0x122e14 0x98
fopen - 0x100f034c 0x124218 0x122e18 0x7d
fwrite - 0x100f0350 0x12421c 0x122e1c 0x8a
__stdio_common_vsprintf - 0x100f0354 0x124220 0x122e20 0xd
_wfopen - 0x100f0358 0x124224 0x122e24 0x62
__stdio_common_vsscanf - 0x100f035c 0x124228 0x122e28 0x10
feof - 0x100f0360 0x12422c 0x122e2c 0x75
fgets - 0x100f0364 0x124230 0x122e30 0x7a
fputs - 0x100f0368 0x124234 0x122e34 0x80
__stdio_common_vfprintf - 0x100f036c 0x124238 0x122e38 0x3
_wopen - 0x100f0370 0x12423c 0x122e3c 0x69
__acrt_iob_func - 0x100f0374 0x124240 0x122e40 0x0
api-ms-win-crt-environment-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_putenv - 0x100f02c0 0x12418c 0x122d8c 0x3
getenv - 0x100f02c4 0x124190 0x122d90 0x10
__p__environ - 0x100f02c8 0x124194 0x122d94 0x0
api-ms-win-crt-filesystem-l1-1-0.dll (3)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_wstat64i32 - 0x100f02d0 0x12419c 0x122d9c 0x3d
_access - 0x100f02d4 0x1241a0 0x122da0 0x0
_waccess - 0x100f02d8 0x1241a4 0x122da4 0x25
api-ms-win-crt-multibyte-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_mbsdec - 0x100f02ec 0x1241b8 0x122db8 0x68
_mbsinc - 0x100f02f0 0x1241bc 0x122dbc 0x6f
api-ms-win-crt-math-l1-1-0.dll (2)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_except1 - 0x100f02e0 0x1241ac 0x122dac 0x40
_fdopen - 0x100f02e4 0x1241b0 0x122db0 0x46
Exports (1332)
»
Api name EAT Address Ordinal
ATOB_AsciiToData 0x8ed7d 0x1
ATOB_AsciiToData_Util 0xb5f0b 0x2
ATOB_ConvertAsciiToItem_Util 0xb5f4f 0x3
BTOA_ConvertItemToAscii_Util 0xb63e3 0x4
BTOA_DataToAscii 0x8ed86 0x5
BTOA_DataToAscii_Util 0xb63f8 0x6
CERT_AddCertToListHead 0x7d506 0x7
CERT_AddCertToListTail 0x7d5db 0x8
CERT_AddExtension 0x7f80a 0x9
CERT_AddExtensionByOID 0x7f836 0xa
CERT_AsciiToName 0x7c201 0xb
CERT_CacheOCSPResponseFromSideChannel 0x87221 0xc
CERT_CertChainFromCert 0x84c05 0xd
CERT_CertListFromCert 0x84dd7 0xe
CERT_CertificateRequestTemplate 0xffe20 0xf
CERT_CertificateTemplate 0xfeee8 0x10
CERT_ChangeCertTrust 0x8371d 0x11
CERT_CheckCertUsage 0x7f5de 0x12
CERT_CheckCertValidTimes 0x7d62f 0x13
CERT_CheckNameSpace 0x81818 0x14
CERT_ClearOCSPCache 0x87412 0x15
CERT_CompareCerts 0x7d77c 0x16
CERT_CompareName 0x82f5b 0x17
CERT_ConvertAndDecodeCertificate 0xc5752 0x18
CERT_CopyName 0x8307e 0x19
CERT_CopyRDN 0x8311a 0x1a
CERT_CreateCertificate 0x85668 0x1b
CERT_CreateCertificateRequest 0x8574f 0x1c
CERT_CreateSubjectCertList 0x83741 0x1d
CERT_CreateValidity 0x7d7dd 0x1e
CERT_CrlTemplate 0xff2a0 0x1f
CERT_DecodeAVAValue 0x8331e 0x20
CERT_DecodeAltNameExtension 0x849c3 0x21
CERT_DecodeAuthInfoAccessExtension 0x84a27 0x22
CERT_DecodeAuthKeyID 0x84758 0x23
CERT_DecodeBasicConstraintValue 0x8484d 0x24
CERT_DecodeCRLDistributionPoints 0x8a5ac 0x25
CERT_DecodeCertFromPackage 0xc5798 0x26
CERT_DecodeCertPackage 0xc57f4 0x27
CERT_DecodeCertificatePoliciesExtension 0x829ed 0x28
CERT_DecodeNameConstraintsExtension 0x84ab1 0x29
CERT_DecodeOidSequence 0x82a9d 0x2a
CERT_DecodePrivKeyUsagePeriodExtension 0x84aba 0x2b
CERT_DecodeTrustString 0x7da3e 0x2c
CERT_DecodeUserNotice 0x82b09 0x2d
CERT_DerNameToAscii 0x7c220 0x2e
CERT_DestroyCertArray 0x7db3b 0x2f
CERT_DestroyCertList 0x7db6e 0x30
CERT_DestroyCertificate 0x83831 0x31
CERT_DestroyCertificateList 0x84e4f 0x32
CERT_DestroyCertificatePoliciesExtension 0x82b95 0x33
CERT_DestroyCertificateRequest 0x7dba6 0x34
CERT_DestroyName 0x834cc 0x35
CERT_DestroyOidSequence 0x82b95 0x36
CERT_DestroyUserNotice 0x82b95 0x37
CERT_DestroyValidity 0x7dba6 0x38
CERT_DisableOCSPChecking 0x875fc 0x39
CERT_DisableOCSPDefaultResponder 0x87653 0x3a
CERT_DupCertificate 0x7dbc2 0x3b
CERT_EnableOCSPChecking 0x876a5 0x3c
CERT_EncodeAltNameExtension 0x84b0f 0x3d
CERT_EncodeAndAddBitStrExtension 0x7f8d7 0x3e
CERT_EncodeAuthKeyID 0x847ec 0x3f
CERT_EncodeBasicConstraintValue 0x848fe 0x40
CERT_EncodeCRLDistributionPoints 0x8a6da 0x41
CERT_EncodeCertPoliciesExtension 0x82bac 0x42
CERT_EncodeInfoAccessExtension 0x84b4a 0x43
CERT_EncodeInhibitAnyExtension 0x82be4 0x44
CERT_EncodeNameConstraintsExtension 0x84bb1 0x45
CERT_EncodeNoticeReference 0x82c1c 0x46
CERT_EncodePolicyConstraintsExtension 0x82c54 0x47
CERT_EncodePolicyMappingExtension 0x82c8c 0x48
CERT_EncodeSubjectKeyID 0x84bc7 0x49
CERT_EncodeUserNotice 0x82cc4 0x4a
CERT_ExtractPublicKey 0x8ace4 0x4b
CERT_FilterCertListByCANames 0x85a22 0x4c
CERT_FilterCertListByUsage 0x7dbe0 0x4d
CERT_FilterCertListForUserCerts 0x7dc88 0x4e
CERT_FindCertByDERCert 0x8385f 0x4f
CERT_FindCertByIssuerAndSN 0x838a5 0x50
CERT_FindCertByName 0x838ba 0x51
CERT_FindCertByNickname 0x83967 0x52
CERT_FindCertByNicknameOrEmailAddr 0x839fb 0x53
CERT_FindCertByNicknameOrEmailAddrCX 0x83a14 0x54
CERT_FindCertExtension 0x7f6e2 0x55
CERT_FindCertIssuer 0x85b22 0x56
CERT_FindKeyUsageExtension 0x7f6fe 0x57
CERT_FindUserCertByUsage 0x84fb9 0x58
CERT_FindUserCertsByUsage 0x850b8 0x59
CERT_FinishCertificateRequestAttributes 0x858c1 0x5a
CERT_FinishExtensions 0x7f9fc 0x5b
CERT_ForcePostMethodForOCSP 0x87726 0x5c
CERT_FreeNicknames 0x85228 0x5d
CERT_GenTime2FormattedAscii_Util 0xbcdae 0x5e
CERT_GetCertChainFromCert 0x85c00 0x5f
CERT_GetCertEmailAddress 0x7c273 0x60
CERT_GetCertTimes 0x7ddaf 0x61
CERT_GetCertTrust 0x83b07 0x62
CERT_GetCertificateRequestExtensions 0x8599f 0x63
CERT_GetCommonName 0x7c2b7 0x64
CERT_GetConstrainedCertificateNames 0x81d27 0x65
CERT_GetCountryName 0x7c319 0x66
CERT_GetDefaultCertDB 0x7de03 0x67
CERT_GetFirstEmailAddress 0x7c341 0x68
CERT_GetGeneralNameTypeFromString 0x81eaa 0x69
CERT_GetImposedNameConstraints 0x81ed9 0x6a
CERT_GetLocalityName 0x7c35e 0x6b
CERT_GetNextEmailAddress 0x7c3d4 0x6c
CERT_GetNextGeneralName 0x81fe0 0x6d
CERT_GetNextNameConstraint 0x81fee 0x6e
CERT_GetOCSPAuthorityInfoAccessLocation 0x87762 0x6f
CERT_GetOidString 0x7c400 0x70
CERT_GetOrgName 0x7c766 0x71
CERT_GetOrgUnitName 0x7c77a 0x72
CERT_GetStateName 0x7c78e 0x73
CERT_Hexify 0x855e9 0x74
CERT_ImportCerts 0x7de09 0x75
CERT_IsCACert 0x7df43 0x76
CERT_IsUserCert 0x7e0c4 0x77
CERT_MakeCANickname 0x7e32e 0x78
CERT_MergeExtensions 0x7fa55 0x79
CERT_NameTemplate 0xffc78 0x7a
CERT_NameToAscii 0x7c7a2 0x7b
CERT_NewCertList 0x8bc5e 0x7c
CERT_NewTempCertificate 0x83d3a 0x7d
CERT_NicknameStringsFromCertList 0x85d47 0x7e
CERT_OCSPCacheSettings 0x87941 0x7f
CERT_RFC1485_EscapeAndQuote 0x7c879 0x80
CERT_RemoveCertListNode 0x7e437 0x81
CERT_SaveSMimeProfile 0x83f68 0x82
CERT_SequenceOfCertExtensionTemplate 0xff088 0x83
CERT_SetOCSPFailureMode 0x879c8 0x84
CERT_SetOCSPTimeout 0x87a08 0x85
CERT_SignedCrlTemplate 0xff340 0x86
CERT_SignedDataTemplate 0x100b28 0x87
CERT_StartCertExtensions 0x7f7d1 0x88
CERT_StartCertificateRequestAttributes 0x859f6 0x89
CERT_SubjectPublicKeyInfoTemplate 0x100948 0x8a
CERT_TimeChoiceTemplate 0xff098 0x8b
CERT_VerifyCertificate 0x85f0d 0x8c
CERT_VerifySignedDataWithPublicKeyInfo 0x86308 0x8d
DER_AsciiToTime_Util 0xb57f3 0x8e
DER_DecodeTimeChoice_Util 0xbce29 0x8f
DER_Encode 0x8ed8f 0x90
DER_EncodeTimeChoice_Util 0xbce62 0x91
DER_Encode_Util 0xb5143 0x92
DER_GeneralizedTimeToTime 0x8ed98 0x93
DER_GeneralizedTimeToTime_Util 0xb580a 0x94
DER_GetInteger 0x8eda1 0x95
DER_GetInteger_Util 0xb55b3 0x96
DER_Lengths 0x8edaa 0x97
DER_SetUInteger 0xb56bb 0x98
DER_UTCTimeToTime_Util 0xb5b55 0x99
DSAU_DecodeDerSigToLen 0x8a8a1 0x9a
DSAU_EncodeDerSigWithLen 0x8a8b6 0x9b
DTLS_GetHandshakeTimeout 0xce45f 0x9c
DTLS_ImportFD 0xe50a3 0x9d
GetExecutionEnvironment 0x7b17a 0x9e
HASH_Begin 0x8aac4 0x9f
HASH_Create 0x8aad5 0xa0
HASH_Destroy 0x8ab1f 0xa1
HASH_End 0x8ab3c 0xa2
HASH_GetHashObject 0x8ab58 0xa3
HASH_GetType 0x8ac32 0xa4
HASH_HashBuf 0x8ac3f 0xa5
HASH_ResultLenByOidTag 0x8acb3 0xa6
HASH_Update 0x8accb 0xa7
LL_MaxInt 0x744d1 0xa8
LL_MaxUint 0x744dd 0xa9
LL_MinInt 0x744e9 0xaa
LL_Zero 0x744f5 0xab
NSSBase64_EncodeItem_Util 0xb641f 0xac
NSSSMIME_GetVersion 0xdf3da 0xad
NSSSSL_GetVersion 0xdf3da 0xae
NSSUTIL_ArgDecodeNumber 0xbe42c 0xaf
NSSUTIL_ArgFetchValue 0xbe4c2 0xb0
NSSUTIL_ArgGetLabel 0xbe5ca 0xb1
NSSUTIL_ArgGetParamValue 0xbe671 0xb2
NSSUTIL_ArgHasFlag 0xbe727 0xb3
NSSUTIL_ArgIsBlank 0xbe794 0xb4
NSSUTIL_ArgParseCipherFlags 0xbe7e2 0xb5
NSSUTIL_ArgParseModuleSpec 0xbe846 0xb6
NSSUTIL_ArgParseSlotFlags 0xbeadb 0xb7
NSSUTIL_ArgParseSlotInfo 0xbeb7e 0xb8
NSSUTIL_ArgReadLong 0xbec7f 0xb9
NSSUTIL_ArgSkipParameter 0xbecc6 0xba
NSSUTIL_ArgStrip 0xbecfc 0xbb
NSSUTIL_DoModuleDBFunction 0xbd503 0xbc
NSSUTIL_GetVersion 0xdf3da 0xbd
NSSUTIL_MkModuleSpec 0xbedd6 0xbe
NSSUTIL_MkNSSString 0xbeebc 0xbf
NSSUTIL_MkSlotString 0xbf09c 0xc0
NSSUTIL_Quote 0xbf16e 0xc1
NSS_CMSContentInfo_GetContent 0xc912f 0xc2
NSS_CMSContentInfo_GetContentTypeTag 0xc91ea 0xc3
NSS_CMSContentInfo_SetContent_Data 0xc937a 0xc4
NSS_CMSContentInfo_SetContent_EnvelopedData 0xc93aa 0xc5
NSS_CMSContentInfo_SetContent_SignedData 0xc93c2 0xc6
NSS_CMSDecoder_Cancel 0xc99fa 0xc7
NSS_CMSDecoder_Finish 0xc9a21 0xc8
NSS_CMSDecoder_Start 0xc9a5e 0xc9
NSS_CMSDecoder_Update 0xc9afb 0xca
NSS_CMSEncoder_Cancel 0xca74c 0xcb
NSS_CMSEncoder_Finish 0xca7b8 0xcc
NSS_CMSEncoder_Start 0xca87d 0xcd
NSS_CMSEncoder_Update 0xca9bf 0xce
NSS_CMSEnvelopedData_AddRecipient 0xcafa1 0xcf
NSS_CMSEnvelopedData_Create 0xcafed 0xd0
NSS_CMSEnvelopedData_GetContentInfo 0xcb3ef 0xd1
NSS_CMSMessage_ContentLevel 0xcb3fa 0xd2
NSS_CMSMessage_ContentLevelCount 0xcb41b 0xd3
NSS_CMSMessage_Create 0xcb439 0xd4
NSS_CMSMessage_CreateFromDER 0xc9b8e 0xd5
NSS_CMSMessage_Destroy 0xcb4d2 0xd6
NSS_CMSMessage_GetContent 0xcb508 0xd7
NSS_CMSMessage_GetContentInfo 0xb46a2 0xd8
NSS_CMSMessage_IsEncrypted 0xcb51b 0xd9
NSS_CMSMessage_IsSigned 0xcb54c 0xda
NSS_CMSRecipientInfo_Create 0xcb6c4 0xdb
NSS_CMSSignedData_AddCertList 0xcbdc0 0xdc
NSS_CMSSignedData_AddCertificate 0xcbdf7 0xdd
NSS_CMSSignedData_AddSignerInfo 0xcbeca 0xde
NSS_CMSSignedData_Create 0xcbf82 0xdf
NSS_CMSSignedData_CreateCertsOnly 0xcbfd9 0xe0
NSS_CMSSignedData_Destroy 0xcc1aa 0xe1
NSS_CMSSignedData_GetContentInfo 0xcc652 0xe2
NSS_CMSSignedData_GetDigestAlgs 0xcc670 0xe3
NSS_CMSSignedData_GetSignerInfo 0xcc6e4 0xe4
NSS_CMSSignedData_HasDigests 0xcc708 0xe5
NSS_CMSSignedData_ImportCerts 0xcc72b 0xe6
NSS_CMSSignedData_SetDigestValue 0xcc930 0xe7
NSS_CMSSignedData_SignerInfoCount 0xcca0b 0xe8
NSS_CMSSignedData_VerifySignerInfo 0xcca2e 0xe9
NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs 0xccab8 0xea
NSS_CMSSignerInfo_AddSMIMECaps 0xccb5f 0xeb
NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs 0xccbd3 0xec
NSS_CMSSignerInfo_AddSigningTime 0xccc7a 0xed
NSS_CMSSignerInfo_Create 0xcccfd 0xee
NSS_CMSSignerInfo_GetSignerCommonName 0xccd9e 0xef
NSS_CMSSignerInfo_GetSignerEmailAddress 0xccdbb 0xf0
NSS_CMSSignerInfo_GetSigningCertificate 0xccde4 0xf1
NSS_CMSSignerInfo_IncludeCerts 0xccea9 0xf2
NSS_CMSSignerInfo_Verify 0xcd13c 0xf3
NSS_FindCertKEAType 0xdeb7e 0xf4
NSS_GetAlgorithmPolicy 0xbbf71 0xf5
NSS_GetVersion 0xdf3da 0xf6
NSS_Get_CERT_CertificateRequestTemplate 0x85a0e 0xf7
NSS_Get_CERT_CertificateTemplate 0x7e777 0xf8
NSS_Get_CERT_CrlTemplate 0x80f59 0xf9
NSS_Get_CERT_NameTemplate 0x8352a 0xfa
NSS_Get_CERT_SequenceOfCertExtensionTemplate 0x7e77d 0xfb
NSS_Get_CERT_SignedCrlTemplate 0x80f6b 0xfc
NSS_Get_CERT_SignedDataTemplate 0x8c523 0xfd
NSS_Get_CERT_SubjectPublicKeyInfoTemplate 0x8ad11 0xfe
NSS_Get_CERT_TimeChoiceTemplate 0x7d4ac 0xff
NSS_Get_SECKEY_RSAPSSParamsTemplate 0x8ad17 0x100
NSS_Get_SECOID_AlgorithmIDTemplate 0x8edb3 0x101
NSS_Get_SECOID_AlgorithmIDTemplate_Util 0xbcea7 0x102
NSS_Get_SEC_AnyTemplate_Util 0xbcead 0x103
NSS_Get_SEC_BMPStringTemplate 0x8edb9 0x104
NSS_Get_SEC_BitStringTemplate 0x8edbf 0x105
NSS_Get_SEC_BitStringTemplate_Util 0xbceb9 0x106
NSS_Get_SEC_BooleanTemplate_Util 0xbcebf 0x107
NSS_Get_SEC_GeneralizedTimeTemplate_Util 0xbcec5 0x108
NSS_Get_SEC_IA5StringTemplate 0x8edc5 0x109
NSS_Get_SEC_IA5StringTemplate_Util 0xbcecb 0x10a
NSS_Get_SEC_IntegerTemplate 0x8edcb 0x10b
NSS_Get_SEC_IntegerTemplate_Util 0xbced1 0x10c
NSS_Get_SEC_NullTemplate_Util 0xbced7 0x10d
NSS_Get_SEC_ObjectIDTemplate_Util 0xbcedd 0x10e
NSS_Get_SEC_OctetStringTemplate 0x8edd1 0x10f
NSS_Get_SEC_OctetStringTemplate_Util 0xbcee3 0x110
NSS_Get_SEC_SignedCertificateTemplate 0x7e783 0x111
NSS_Get_SEC_UTF8StringTemplate 0x8edd7 0x112
NSS_Get_SEC_UTF8StringTemplate_Util 0xbcefb 0x113
NSS_Init 0x8dc13 0x114
NSS_InitWithMerge 0x8dc43 0x115
NSS_Initialize 0x8dcb7 0x116
NSS_IsInitialized 0x8dd26 0x117
NSS_NoDB_Init 0x8dd3f 0x118
NSS_OptionGet 0x8ec73 0x119
NSS_OptionSet 0x8ecf2 0x11a
NSS_SMIMESignerInfo_SaveSMIMEProfile 0xcd3bf 0x11b
NSS_SMIMEUtil_FindBulkAlgForRecipients 0xcdc58 0x11c
NSS_SecureMemcmp 0xbc650 0x11d
NSS_SecureMemcmpZero 0xbc679 0x11e
NSS_SetAlgorithmPolicy 0xbbfa4 0x11f
NSS_SetDomesticPolicy 0xe50b8 0x120
NSS_Shutdown 0x8de9e 0x121
NSS_VersionCheck 0x8df1a 0x122
PK11SDR_Decrypt 0xae275 0x123
PK11SDR_Encrypt 0xae473 0x124
PK11_AlgtagToMechanism 0xa4f31 0x125
PK11_Authenticate 0x9aaa6 0x126
PK11_ChangePW 0x9aae2 0x127
PK11_CheckUserPassword 0x9abab 0x128
PK11_CipherOp 0x9db03 0x129
PK11_ConfigurePKCS11 0x8e02b 0x12a
PK11_CreateContextBySymKey 0x9dded 0x12b
PK11_CreateDigestContext 0x9de36 0x12c
PK11_CreateGenericObject 0xa9087 0x12d
PK11_CreateMergeLog 0xa6e7e 0x12e
PK11_CreatePBEV2AlgorithmID 0xac9bc 0x12f
PK11_DEREncodePublicKey 0x98396 0x130
PK11_Decrypt 0xa9138 0x131
PK11_DeleteTokenCertAndKey 0x9b3e8 0x132
PK11_DeleteTokenPrivateKey 0x9839f 0x133
PK11_DeleteTokenPublicKey 0x983e6 0x134
PK11_Derive 0xae90d 0x135
PK11_DeriveWithTemplate 0xae9a8 0x136
PK11_DestroyContext 0x9de98 0x137
PK11_DestroyGenericObject 0xa923b 0x138
PK11_DestroyMergeLog 0xa6eb9 0x139
PK11_DestroyObject 0xa927b 0x13a
PK11_DestroyTokenObject 0xa92a9 0x13b
PK11_DigestBegin 0x9df0f 0x13c
PK11_DigestFinal 0x9df6e 0x13d
PK11_DigestOp 0x9e19e 0x13e
PK11_DoesMechanism 0xb1973 0x13f
PK11_Encrypt 0xa9300 0x140
PK11_ExportDERPrivateKeyInfo 0xad768 0x141
PK11_ExportEncryptedPrivKeyInfo 0x98411 0x142
PK11_ExtractKeyValue 0xaecff 0x143
PK11_FindCertFromNickname 0x9b852 0x144
PK11_FindCertInSlot 0x9b896 0x145
PK11_FindCertsFromEmailAddress 0x9b8f8 0x146
PK11_FindCertsFromNickname 0x9b971 0x147
PK11_FindKeyByAnyCert 0x9b9ec 0x148
PK11_FindKeyByDERCert 0x9ba93 0x149
PK11_FindKeyByKeyID 0x98a9d 0x14a
PK11_FindSlotByName 0xb1a03 0x14b
PK11_FindSlotsByNames 0xb1b19 0x14c
PK11_FreeSlot 0xb1d37 0x14d
PK11_FreeSlotList 0xb1d50 0x14e
PK11_FreeSlotListElement 0xb1d62 0x14f
PK11_FreeSymKey 0xaedf4 0x150
PK11_GenerateKeyPair 0x98ac8 0x151
PK11_GenerateKeyPairWithFlags 0x98afd 0x152
PK11_GenerateKeyPairWithOpFlags 0x98b20 0x153
PK11_GenerateRandom 0xb1dbf 0x154
PK11_GenerateRandomOnSlot 0xb1dfa 0x155
PK11_GetAllSlotsForCert 0x9bc62 0x156
PK11_GetAllTokens 0xb1e4f 0x157
PK11_GetBestSlot 0xb203c 0x158
PK11_GetBestSlotMultiple 0xb2056 0x159
PK11_GetBlockSize 0xa4fa9 0x15a
PK11_GetCertFromPrivateKey 0x9bd1f 0x15b
PK11_GetDefaultArray 0xb226d 0x15c
PK11_GetDefaultFlags 0xb2284 0x15d
PK11_GetDisabledReason 0xb228f 0x15e
PK11_GetFirstSafe 0xb229a 0x15f
PK11_GetIVLength 0xa520b 0x160
PK11_GetInternalKeySlot 0xb22c5 0x161
PK11_GetInternalSlot 0xb22fa 0x162
PK11_GetKeyData 0xaef16 0x163
PK11_GetKeyGen 0xa543b 0x164
PK11_GetLowLevelKeyIDForPrivateKey 0x9975d 0x165
PK11_GetMechanism 0xaf04f 0x166
PK11_GetModInfo 0xb3b5d 0x167
PK11_GetModuleURI 0xb3b94 0x168
PK11_GetNextSafe 0xb244a 0x169
PK11_GetNextSymKey 0xaf059 0x16a
PK11_GetPadMechanism 0xa5d44 0x16b
PK11_GetPrivateKeyNickname 0x99772 0x16c
PK11_GetPrivateModulusLen 0x99787 0x16d
PK11_GetSlotID 0xaf081 0x16e
PK11_GetSlotInfo 0xb2514 0x16f
PK11_GetSlotName 0xb2767 0x170
PK11_GetSlotSeries 0xb2774 0x171
PK11_GetSymKeyNickname 0xaf06c 0x172
PK11_GetTokenInfo 0xb2783 0x173
PK11_GetTokenName 0xb282b 0x174
PK11_GetTokenURI 0xb2838 0x175
PK11_HasAttributeSet 0xa95b7 0x176
PK11_HasRootCerts 0xb2972 0x177
PK11_HashBuf 0x9e31d 0x178
PK11_ImportCRL 0xa88ab 0x179
PK11_ImportCert 0x9bdb2 0x17a
PK11_ImportCertForKey 0x9bfe8 0x17b
PK11_ImportDERPrivateKeyInfoAndReturnKey 0xadff8 0x17c
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey 0x9985a 0x17d
PK11_ImportPublicKey 0x99a97 0x17e
PK11_ImportSymKey 0xaf0cb 0x17f
PK11_InitPin 0x9ae60 0x180
PK11_IsDisabled 0xb2f25 0x181
PK11_IsFIPS 0xb3c9c 0x182
PK11_IsFriendly 0xb2f30 0x183
PK11_IsHW 0xb2f4b 0x184
PK11_IsInternal 0x7b17a 0x185
PK11_IsInternalKeySlot 0xb2f56 0x186
PK11_IsLoggedIn 0x9afa4 0x187
PK11_IsPresent 0xb2f81 0x188
PK11_IsReadOnly 0xb2f92 0x189
PK11_IsRemovable 0xb2f9d 0x18a
PK11_KeyForCertExists 0x9c1dd 0x18b
PK11_KeyGen 0xaf307 0x18c
PK11_KeyGenWithTemplate 0xaf327 0x18d
PK11_ListCerts 0x9c2c7 0x18e
PK11_ListCertsInSlot 0x9c30d 0x18f
PK11_ListFixedKeysInSlot 0xaf4ed 0x190
PK11_ListPrivKeysInSlot 0x99f4b 0x191
PK11_ListPrivateKeysInSlot 0x9a038 0x192
PK11_LoadPrivKey 0x9a06a 0x193
PK11_Logout 0x9b103 0x194
PK11_LogoutAll 0x9b148 0x195
PK11_MakeIDFromPubKey 0x9a073 0x196
PK11_MapSignKeyType 0xa5ecb 0x197
PK11_MechanismToAlgtag 0xa5ef8 0x198
PK11_MergeTokens 0xa6ed7 0x199
PK11_NeedLogin 0x91a68 0x19a
PK11_NeedUserInit 0xb30a9 0x19b
PK11_PBEKeyGen 0xaca1c 0x19c
PK11_ParamFromIV 0xa63e6 0x19d
PK11_PrivDecrypt 0xa96ab 0x19e
PK11_PrivDecryptPKCS1 0xa96f4 0x19f
PK11_ProtectedAuthenticationPath 0x9b198 0x1a0
PK11_PubDeriveWithKDF 0xafa01 0x1a1
PK11_PubEncrypt 0xa972b 0x1a2
PK11_PubEncryptPKCS1 0xa9777 0x1a3
PK11_PubUnwrapSymKey 0xafa79 0x1a4
PK11_PubWrapSymKey 0xafc1f 0x1a5
PK11_RandomUpdate 0xb328c 0x1a6
PK11_ReadRawAttribute 0xa98a6 0x1a7
PK11_ReferenceSlot 0xb342f 0x1a8
PK11_ResetToken 0xb343b 0x1a9
PK11_SetPasswordFunc 0x9b1a6 0x1aa
PK11_SetSymKeyNickname 0xafd6c 0x1ab
PK11_Sign 0xa99df 0x1ac
PK11_SignWithMechanism 0xa9a03 0x1ad
PK11_SignatureLen 0xa9c93 0x1ae
PK11_TokenKeyGenWithFlags 0xafeb2 0x1af
PK11_UnwrapPrivKey 0xa9df5 0x1b0
PK11_UnwrapSymKey 0xafed9 0x1b1
PK11_UpdateSlotAttribute 0xb3663 0x1b2
PK11_UserDisableSlot 0xb36c0 0x1b3
PK11_UserEnableSlot 0xb36ef 0x1b4
PK11_Verify 0xaa240 0x1b5
PK11_VerifyWithMechanism 0xaa3e6 0x1b6
PK11_WrapPrivKey 0xaa574 0x1b7
PK11_WrapSymKey 0xaffce 0x1b8
PL_ArenaAllocate 0xc094f 0x1b9
PL_ArenaFinish 0x8aa6d 0x1ba
PL_ArenaGrow 0xc09f2 0x1bb
PL_ArenaRelease 0xc0a60 0x1bc
PL_Base64Decode 0xbf9e7 0x1bd
PL_Base64Encode 0xbfa97 0x1be
PL_ClearArenaPool 0xc0aa2 0x1bf
PL_CompactArenaPool 0x8aa6d 0x1c0
PL_CompareStrings 0xc0ba1 0x1c1
PL_CompareValues 0xc0bd8 0x1c2
PL_CreateLongOptState 0xbfe11 0x1c3
PL_CreateOptState 0xbfec0 0x1c4
PL_DestroyOptState 0xbfed8 0x1c5
PL_FPrintError 0xbfd87 0x1c6
PL_FinishArenaPool 0xc0ace 0x1c7
PL_FreeArenaPool 0xc0ace 0x1c8
PL_GetNextOpt 0xbfef6 0x1c9
PL_HashString 0xc0be8 0x1ca
PL_HashTableAdd 0xc0c03 0x1cb
PL_HashTableDestroy 0xc0c6b 0x1cc
PL_HashTableDump 0xc0ce9 0x1cd
PL_HashTableEnumerateEntries 0xc0cf2 0x1ce
PL_HashTableLookup 0xc0d96 0x1cf
PL_HashTableLookupConst 0xc0dc0 0x1d0
PL_HashTableRawAdd 0xc0dea 0x1d1
PL_HashTableRawLookup 0xc0eeb 0x1d2
PL_HashTableRawLookupConst 0xc0f4b 0x1d3
PL_HashTableRawRemove 0xc0f94 0x1d4
PL_HashTableRemove 0xc1062 0x1d5
PL_InitArenaPool 0xc0ae0 0x1d6
PL_NewHashTable 0xc1097 0x1d7
PL_PrintError 0xbfdeb 0x1d8
PL_SizeOfArenaPoolExcludingPool 0xc0b47 0x1d9
PL_strcasecmp 0xc00b5 0x1da
PL_strcaserstr 0xc0108 0x1db
PL_strcasestr 0xc016e 0x1dc
PL_strcat 0xc02f1 0x1dd
PL_strcatn 0xc033b 0x1de
PL_strchr 0xc03ab 0x1df
PL_strcmp 0xc045f 0x1e0
PL_strcpy 0xc04c9 0x1e1
PL_strdup 0xc056a 0x1e2
PL_strfree 0x5911 0x1e3
PL_strlen 0xc05f5 0x1e4
PL_strncasecmp 0xc01ba 0x1e5
PL_strncaserstr 0xc0226 0x1e6
PL_strncasestr 0xc028c 0x1e7
PL_strncat 0xc0376 0x1e8
PL_strnchr 0xc03c9 0x1e9
PL_strncmp 0xc04a5 0x1ea
PL_strncpy 0xc04f0 0x1eb
PL_strncpyz 0xc0527 0x1ec
PL_strndup 0xc05ae 0x1ed
PL_strnlen 0xc060f 0x1ee
PL_strnpbrk 0xc0635 0x1ef
PL_strnprbrk 0xc0674 0x1f0
PL_strnrchr 0xc0401 0x1f1
PL_strnrstr 0xc072b 0x1f2
PL_strnstr 0xc0798 0x1f3
PL_strpbrk 0xc06c6 0x1f4
PL_strprbrk 0xc06e0 0x1f5
PL_strrchr 0xc0441 0x1f6
PL_strrstr 0xc0805 0x1f7
PL_strstr 0xc0872 0x1f8
PL_strtok_r 0xc089c 0x1f9
PORT_Alloc 0x8eddd 0x1fa
PORT_Alloc_Util 0xbc696 0x1fb
PORT_ArenaAlloc 0x8ede6 0x1fc
PORT_ArenaAlloc_Util 0xbc6d1 0x1fd
PORT_ArenaGrow_Util 0xbc793 0x1fe
PORT_ArenaMark_Util 0xbc8b0 0x1ff
PORT_ArenaRelease_Util 0xbc8e9 0x200
PORT_ArenaStrdup 0x8edef 0x201
PORT_ArenaStrdup_Util 0xbc8fe 0x202
PORT_ArenaUnmark_Util 0x8aa6d 0x203
PORT_ArenaZAlloc 0x8edf8 0x204
PORT_ArenaZAlloc_Util 0xbc939 0x205
PORT_DestroyCheapArena 0xbc981 0x206
PORT_Free 0x8ee01 0x207
PORT_FreeArena 0x8ee06 0x208
PORT_FreeArena_Util 0xbc9ab 0x209
PORT_Free_Util 0xbca2f 0x20a
PORT_GetError 0x8ee0b 0x20b
PORT_GetError_Util 0xbca41 0x20c
PORT_InitCheapArena 0xbca50 0x20d
PORT_NewArena 0x8ee10 0x20e
PORT_NewArena_Util 0xbca72 0x20f
PORT_Realloc_Util 0xbcad7 0x210
PORT_RegExpSearch 0xb7b44 0x211
PORT_SetError 0x8ee19 0x212
PORT_SetError_Util 0xbcb0e 0x213
PORT_SetUCS2_ASCIIConversionFunction 0x8ee1e 0x214
PORT_SetUCS2_ASCIIConversionFunction_Util 0xbcb20 0x215
PORT_Strdup 0x8ee23 0x216
PORT_Strdup_Util 0xbcb2d 0x217
PORT_UCS2_ASCIIConversion_Util 0xbcb64 0x218
PORT_UCS2_UTF8Conversion 0x8ee2c 0x219
PORT_UCS2_UTF8Conversion_Util 0xbcb75 0x21a
PORT_ZAlloc 0x8ee35 0x21b
PORT_ZAllocAlignedOffset_Util 0xbcb9f 0x21c
PORT_ZAlloc_Util 0xbcc2f 0x21d
PORT_ZFree_Util 0xbcc6d 0x21e
PRP_DestroyNakedCondVar 0x795a2 0x21f
PRP_NakedBroadcast 0x795bd 0x220
PRP_NakedNotify 0x79624 0x221
PRP_NakedWait 0x7963b 0x222
PRP_NewNakedCondVar 0x79657 0x223
PRP_TryLock 0x7988d 0x224
PR_Abort 0x677d4 0x225
PR_Accept 0x663f4 0x226
PR_AcceptRead 0x6640b 0x227
PR_Access 0x65def 0x228
PR_AddToCounter 0x70b96 0x229
PR_AddWaitFileDesc 0x68707 0x22a
PR_AllocFileDesc 0x661e2 0x22b
PR_Assert 0x677e5 0x22c
PR_AssertCurrentThreadInMonitor 0x8aa6d 0x22d
PR_AssertCurrentThreadOwnsLock 0x798a2 0x22e
PR_AtomicAdd 0x708f1 0x22f
PR_AtomicDecrement 0x708fa 0x230
PR_AtomicIncrement 0x70903 0x231
PR_AtomicSet 0x7090c 0x232
PR_AttachSharedMemory 0x70567 0x233
PR_AttachThread 0x79bf3 0x234
PR_AttachThreadGCAble 0x705b9 0x235
PR_Available 0x6642b 0x236
PR_Available64 0x6643a 0x237
PR_Bind 0x66449 0x238
PR_BlockClockInterrupts 0x8aa6d 0x239
PR_BlockInterrupt 0x7b185 0x23a
PR_CEnterMonitor 0x7af50 0x23b
PR_CExitMonitor 0x7af99 0x23c
PR_CNotify 0x7affc 0x23d
PR_CNotifyAll 0x7b041 0x23e
PR_CSetOnMonitorRecycle 0x7b086 0x23f
PR_CWait 0x7b093 0x240
PR_CallOnce 0x739c4 0x241
PR_CallOnceWithArg 0x73a64 0x242
PR_Calloc 0x6c991 0x243
PR_CancelJob 0x778ec 0x244
PR_CancelWaitFileDesc 0x687c4 0x245
PR_CancelWaitGroup 0x68861 0x246
PR_CeilingLog2 0x744a7 0x247
PR_ChangeFileDescNativeHandle 0x6b80b 0x248
PR_Cleanup 0x73b07 0x249
PR_ClearInterrupt 0x7b195 0x24a
PR_ClearThreadGCAble 0x7b1a2 0x24b
PR_Close 0x6645c 0x24c
PR_CloseDir 0x657b1 0x24d
PR_CloseFileMap 0x684d0 0x24e
PR_CloseSemaphore 0x743b8 0x24f
PR_CloseSharedMemory 0x70570 0x250
PR_Connect 0x6646b 0x251
PR_ConnectContinue 0x66482 0x252
PR_ConvertIPv4AddrToIPv6 0x74870 0x253
PR_CreateAlarm 0x705dc 0x254
PR_CreateCounter 0x70bd4 0x255
PR_CreateFileMap 0x684d9 0x256
PR_CreateIOLayer 0x67350 0x257
PR_CreateIOLayerStub 0x6739e 0x258
PR_CreateMWaitEnumerator 0x6893d 0x259
PR_CreateOrderedLock 0x705b9 0x25a
PR_CreatePipe 0x65e0b 0x25b
PR_CreateProcess 0x73c37 0x25c
PR_CreateProcessDetached 0x73c40 0x25d
PR_CreateSocketPollFd 0x6b820 0x25e
PR_CreateStack 0x70919 0x25f
PR_CreateThread 0x79bf8 0x260
PR_CreateThreadGCAble 0x7b1d8 0x261
PR_CreateThreadPool 0x77a41 0x262
PR_CreateTrace 0x7894e 0x263
PR_CreateWaitGroup 0x68972 0x264
PR_DecrementCounter 0x70d06 0x265
PR_Delete 0x65ed5 0x266
PR_DeleteSemaphore 0x743c1 0x267
PR_DeleteSharedMemory 0x70579 0x268
PR_DestroyAlarm 0x70667 0x269
PR_DestroyCondVar 0x79698 0x26a
PR_DestroyCounter 0x70d41 0x26b
PR_DestroyLock 0x798a7 0x26c
PR_DestroyMWaitEnumerator 0x68a8e 0x26d
PR_DestroyMonitor 0x7b50c 0x26e
PR_DestroyOrderedLock 0x759f2 0x26f
PR_DestroyPollableEvent 0x69207 0x270
PR_DestroyProcessAttr 0x73c7d 0x271
PR_DestroyRWLock 0x7b859 0x272
PR_DestroySem 0x7ba34 0x273
PR_DestroySocketPollFd 0x6b870 0x274
PR_DestroyStack 0x709a3 0x275
PR_DestroyTrace 0x78aa5 0x276
PR_DestroyWaitGroup 0x68ac2 0x277
PR_DetachProcess 0x73cb4 0x278
PR_DetachSharedMemory 0x70590 0x279
PR_DetachThread 0x8aa6d 0x27a
PR_DisableClockInterrupts 0x73cbd 0x27b
PR_DuplicateEnvironment 0x6b563 0x27c
PR_EmulateAcceptRead 0x66495 0x27d
PR_EmulateSendFile 0x66540 0x27e
PR_EnableClockInterrupts 0x73cbd 0x27f
PR_EnterMonitor 0x7b540 0x280
PR_EnumerateAddrInfo 0x7488f 0x281
PR_EnumerateHostEnt 0x7492c 0x282
PR_EnumerateThreads 0x79c1c 0x283
PR_EnumerateWaitGroup 0x68bbe 0x284
PR_ErrorInstallCallback 0x73797 0x285
PR_ErrorInstallTable 0x737eb 0x286
PR_ErrorLanguages 0x7383d 0x287
PR_ErrorToName 0x73843 0x288
PR_ErrorToString 0x7387b 0x289
PR_ExitMonitor 0x7b59f 0x28a
PR_ExplodeTime 0x75f33 0x28b
PR_ExportFileMapAsString 0x705b0 0x28c
PR_FD_CLR 0x6b89f 0x28d
PR_FD_ISSET 0x6b8e4 0x28e
PR_FD_NCLR 0x6b90d 0x28f
PR_FD_NISSET 0x6b964 0x290
PR_FD_NSET 0x6b996 0x291
PR_FD_SET 0x6b9b4 0x292
PR_FD_ZERO 0x6b9c7 0x293
PR_FileDesc2NativeHandle 0x6b9de 0x294
PR_FindFunctionSymbol 0x6c072 0x295
PR_FindFunctionSymbolAndLibrary 0x6c07b 0x296
PR_FindNextCounterQname 0x70dfe 0x297
PR_FindNextCounterRname 0x70e44 0x298
PR_FindNextTraceQname 0x78b62 0x299
PR_FindNextTraceRname 0x78ba8 0x29a
PR_FindSymbol 0x6c084 0x29b
PR_FindSymbolAndLibrary 0x6c0b3 0x29c
PR_FloorLog2 0x744c0 0x29d
PR_FormatTime 0x75f5f 0x29e
PR_FormatTimeUSEnglish 0x75ff9 0x29f
PR_Free 0x5911 0x2a0
PR_FreeAddrInfo 0x749b2 0x2a1
PR_FreeFileDesc 0x6621d 0x2a2
PR_FreeLibraryName 0x6c12f 0x2a3
PR_GMTParameters 0x764d0 0x2a4
PR_GetAddrInfoByName 0x749cf 0x2a5
PR_GetCanonNameFromAddrInfo 0x74a80 0x2a6
PR_GetConnectStatus 0x6ba12 0x2a7
PR_GetCounter 0x70e8a 0x2a8
PR_GetCounterHandleFromName 0x70eb3 0x2a9
PR_GetCounterNameFromHandle 0x70fa3 0x2aa
PR_GetCurrentThread 0x7b1ff 0x2ab
PR_GetDefaultIOMethods 0x673ef 0x2ac
PR_GetDescType 0x66767 0x2ad
PR_GetDirectorySeparator 0x75a0a 0x2ae
PR_GetDirectorySepartor 0x75a0a 0x2af
PR_GetEnv 0x735e4 0x2b0
PR_GetEnvSecure 0x73627 0x2b1
PR_GetError 0x736ba 0x2b2
PR_GetErrorText 0x736c3 0x2b3
PR_GetErrorTextLength 0x736eb 0x2b4
PR_GetFileInfo 0x65eed 0x2b5
PR_GetFileInfo64 0x65f09 0x2b6
PR_GetFileMethods 0x65f33 0x2b7
PR_GetGCRegisters 0x75b27 0x2b8
PR_GetHostByAddr 0x74aa7 0x2b9
PR_GetHostByName 0x74bc2 0x2ba
PR_GetIPNodeByName 0x74c20 0x2bb
PR_GetIdentitiesLayer 0x673f5 0x2bc
PR_GetInheritedFD 0x73ccb 0x2bd
PR_GetInheritedFileMap 0x705b9 0x2be
PR_GetLayersIdentity 0x67436 0x2bf
PR_GetLibraryFilePathname 0x6c134 0x2c0
PR_GetLibraryName 0x6c212 0x2c1
PR_GetLibraryPath 0x6c275 0x2c2
PR_GetMemMapAlignment 0x6852a 0x2c3
PR_GetMonitorEntryCount 0x7b623 0x2c4
PR_GetNameForIdentity 0x6744c 0x2c5
PR_GetNumberOfProcessors 0x75a0d 0x2c6
PR_GetOSError 0x736f4 0x2c7
PR_GetOpenFileInfo 0x66773 0x2c8
PR_GetOpenFileInfo64 0x66786 0x2c9
PR_GetPageShift 0x6c9e6 0x2ca
PR_GetPageSize 0x6c9fa 0x2cb
PR_GetPathSeparator 0x75a24 0x2cc
PR_GetPeerName 0x66799 0x2cd
PR_GetPhysicalMemorySize 0x75a27 0x2ce
PR_GetPipeMethods 0x65f39 0x2cf
PR_GetProtoByName 0x74ca3 0x2d0
PR_GetProtoByNumber 0x74d32 0x2d1
PR_GetRandomNoise 0x75a01 0x2d2
PR_GetSP 0x7b212 0x2d3
PR_GetSockName 0x667ac 0x2d4
PR_GetSocketOption 0x667bf 0x2d5
PR_GetSpecialFD 0x66222 0x2d6
PR_GetStackSpaceLeft 0x75b30 0x2d7
PR_GetSysfdTableMax 0x65f3f 0x2d8
PR_GetSystemInfo 0x75a70 0x2d9
PR_GetTCPMethods 0x6ba4a 0x2da
PR_GetThreadAffinityMask 0x6b563 0x2db
PR_GetThreadID 0x7b220 0x2dc
PR_GetThreadName 0x79c99 0x2dd
PR_GetThreadPriority 0xb2431 0x2de
PR_GetThreadPrivate 0x7bb22 0x2df
PR_GetThreadScope 0x7b22e 0x2e0
PR_GetThreadState 0x7b255 0x2e1
PR_GetThreadType 0x7b268 0x2e2
PR_GetTraceEntries 0x78bee 0x2e3
PR_GetTraceHandleFromName 0x78d83 0x2e4
PR_GetTraceNameFromHandle 0x78e73 0x2e5
PR_GetTraceOption 0x78eb9 0x2e6
PR_GetUDPMethods 0x6ba50 0x2e7
PR_GetUniqueIdentity 0x6749a 0x2e8
PR_GetVersion 0x73dd7 0x2e9
PR_ImplodeTime 0x764d5 0x2ea
PR_ImportFile 0x65f45 0x2eb
PR_ImportFileMapFromString 0x705ca 0x2ec
PR_ImportPipe 0x65f85 0x2ed
PR_ImportTCPSocket 0x6ba56 0x2ee
PR_ImportUDPSocket 0x6ba9e 0x2ef
PR_IncrementCounter 0x70fe9 0x2f0
PR_Init 0x73ddd 0x2f1
PR_Initialize 0x73de2 0x2f2
PR_InitializeNetAddr 0x74dc1 0x2f3
PR_Initialized 0x73e02 0x2f4
PR_Interrupt 0x7b279 0x2f5
PR_IntervalNow 0x74263 0x2f6
PR_IntervalToMicroseconds 0x74276 0x2f7
PR_IntervalToMilliseconds 0x742a8 0x2f8
PR_IntervalToSeconds 0x742da 0x2f9
PR_IsNetAddrType 0x74e35 0x2fa
PR_JoinJob 0x77b73 0x2fb
PR_JoinThread 0x79caa 0x2fc
PR_JoinThreadPool 0x77bc9 0x2fd
PR_KillProcess 0x73e08 0x2fe
PR_Listen 0x667d2 0x2ff
PR_LoadLibrary 0x6c2ec 0x300
PR_LoadLibraryWithFlags 0x6c319 0x301
PR_LoadStaticLibrary 0x6c355 0x302
PR_LocalTimeParameters 0x76599 0x303
PR_Lock 0x798b9 0x304
PR_LockFile 0x65fc5 0x305
PR_LockOrderedLock 0x759f2 0x306
PR_LogFlush 0x67836 0x307
PR_LogPrint 0x678be 0x308
PR_MakeDir 0x657e0 0x309
PR_Malloc 0x6c99b 0x30a
PR_MemMap 0x6852f 0x30b
PR_MemUnmap 0x68548 0x30c
PR_MicrosecondsToInterval 0x742ed 0x30d
PR_MillisecondsToInterval 0x74314 0x30e
PR_MkDir 0x6580a 0x30f
PR_NetAddrToString 0x74f42 0x310
PR_NewCondVar 0x796aa 0x311
PR_NewLock 0x798d9 0x312
PR_NewLogModule 0x67c99 0x313
PR_NewMonitor 0x7b65e 0x314
PR_NewNamedMonitor 0x7b6fd 0x315
PR_NewPollableEvent 0x69210 0x316
PR_NewProcessAttr 0x73e11 0x317
PR_NewRWLock 0x7b892 0x318
PR_NewSem 0x7ba57 0x319
PR_NewTCPSocket 0x6bae6 0x31a
PR_NewTCPSocketPair 0x6baf5 0x31b
PR_NewThreadPrivateIndex 0x7bb42 0x31c
PR_NewUDPSocket 0x6bc29 0x31d
PR_NormalizeTime 0x766c3 0x31e
PR_Notify 0x7b710 0x31f
PR_NotifyAll 0x7b72c 0x320
PR_NotifyAllCondVar 0x796ef 0x321
PR_NotifyCondVar 0x79719 0x322
PR_Now 0x6cad2 0x323
PR_Open 0x66057 0x324
PR_OpenAnonFileMap 0x705d3 0x325
PR_OpenDir 0x65826 0x326
PR_OpenFile 0x660bf 0x327
PR_OpenSemaphore 0x74417 0x328
PR_OpenSharedMemory 0x70599 0x329
PR_OpenTCPSocket 0x6bc38 0x32a
PR_OpenUDPSocket 0x6bc4c 0x32b
PR_ParseTimeString 0x7692a 0x32c
PR_ParseTimeStringToExplodedTime 0x76975 0x32d
PR_Poll 0x66270 0x32e
PR_PopIOLayer 0x675fc 0x32f
PR_PostSem 0x7baab 0x330
PR_PostSemaphore 0x74495 0x331
PR_ProcessAttrSetCurrentDirectory 0x73e34 0x332
PR_ProcessAttrSetInheritableFD 0x73e95 0x333
PR_ProcessAttrSetInheritableFileMap 0x6f2da 0x334
PR_ProcessAttrSetStdioRedirect 0x73f94 0x335
PR_ProcessExit 0x73fc9 0x336
PR_PushIOLayer 0x676ab 0x337
PR_QueueJob 0x77d48 0x338
PR_QueueJob_Accept 0x77d7f 0x339
PR_QueueJob_Connect 0x77d9d 0x33a
PR_QueueJob_Read 0x77dfd 0x33b
PR_QueueJob_Timer 0x77e1b 0x33c
PR_QueueJob_Write 0x77ef2 0x33d
PR_RWLock_Rlock 0x7b969 0x33e
PR_RWLock_Unlock 0x7b9a9 0x33f
PR_RWLock_Wlock 0x7b9fc 0x340
PR_Read 0x667e5 0x341
PR_ReadDir 0x6586b 0x342
PR_Realloc 0x6c9a5 0x343
PR_RecordTraceEntries 0x78efc 0x344
PR_Recv 0x667fc 0x345
PR_RecvFrom 0x66819 0x346
PR_Rename 0x66127 0x347
PR_ResetAlarm 0x706c5 0x348
PR_ResetProcessAttr 0x73fce 0x349
PR_ResumeAll 0x79d17 0x34a
PR_RmDir 0x6588e 0x34b
PR_ScanStackPointers 0x75b5c 0x34c
PR_SecondsToInterval 0x7433b 0x34d
PR_Seek 0x66839 0x34e
PR_Seek64 0x66850 0x34f
PR_Select 0x6bc60 0x350
PR_Send 0x6686a 0x351
PR_SendFile 0x66887 0x352
PR_SendTo 0x668a1 0x353
PR_SetAlarm 0x70700 0x354
PR_SetCPUAffinityMask 0x6b563 0x355
PR_SetConcurrency 0x8aa6d 0x356
PR_SetCounter 0x71024 0x357
PR_SetCurrentThreadName 0x79da5 0x358
PR_SetEnv 0x73630 0x359
PR_SetError 0x736fd 0x35a
PR_SetErrorText 0x73717 0x35b
PR_SetFDCacheSize 0x658a6 0x35c
PR_SetFDInheritable 0x66279 0x35d
PR_SetLibraryPath 0x6c405 0x35e
PR_SetLogBuffering 0x67ce7 0x35f
PR_SetLogFile 0x67d2d 0x360
PR_SetNetAddr 0x74fa1 0x361
PR_SetPollableEvent 0x6933e 0x362
PR_SetSocketOption 0x668c1 0x363
PR_SetStdioRedirect 0x74005 0x364
PR_SetSysfdTableSize 0x6f2da 0x365
PR_SetThreadAffinityMask 0x6b563 0x366
PR_SetThreadDumpProc 0x7b429 0x367
PR_SetThreadGCAble 0x7b2d2 0x368
PR_SetThreadPriority 0x79e1c 0x369
PR_SetThreadPrivate 0x7bb8f 0x36a
PR_SetThreadRecycleMode 0x7b308 0x36b
PR_SetTraceOption 0x79069 0x36c
PR_ShowStatus 0x7b43d 0x36d
PR_Shutdown 0x668d4 0x36e
PR_ShutdownThreadPool 0x77f10 0x36f
PR_Sleep 0x7b315 0x370
PR_Socket 0x6be26 0x371
PR_StackPop 0x709e4 0x372
PR_StackPush 0x70a11 0x373
PR_StringToNetAddr 0x75064 0x374
PR_SubtractFromCounter 0x7104e 0x375
PR_SuspendAll 0x79e48 0x376
PR_Sync 0x668e7 0x377
PR_SyncMemMap 0x68551 0x378
PR_TLockFile 0x66143 0x379
PR_TestAndEnterMonitor 0x7b73d 0x37a
PR_TestAndLock 0x79916 0x37b
PR_ThreadScanStackPointers 0x75b81 0x37c
PR_TicksPerSecond 0x74349 0x37d
PR_Trace 0x792c9 0x37e
PR_TransmitFile 0x668f6 0x37f
PR_USPacificTimeParameters 0x777c9 0x380
PR_UnblockClockInterrupts 0x8aa6d 0x381
PR_UnblockInterrupt 0x7b3a7 0x382
PR_UnloadLibrary 0x6c476 0x383
PR_Unlock 0x79939 0x384
PR_UnlockFile 0x66194 0x385
PR_UnlockOrderedLock 0x6f2da 0x386
PR_VersionCheck 0x7400a 0x387
PR_Wait 0x7b78b 0x388
PR_WaitCondVar 0x7973d 0x389
PR_WaitForPollableEvent 0x6935f 0x38a
PR_WaitProcess 0x740d1 0x38b
PR_WaitRecvReady 0x68c7e 0x38c
PR_WaitSem 0x7bada 0x38d
PR_WaitSemaphore 0x7449e 0x38e
PR_Write 0x66916 0x38f
PR_Writev 0x6692d 0x390
PR_Yield 0x7b3b7 0x391
PR_cnvtf 0x711a8 0x392
PR_dtoa 0x71344 0x393
PR_fprintf 0x6bfc6 0x394
PR_htonl 0x750c8 0x395
PR_htonll 0x750d5 0x396
PR_htons 0x750f9 0x397
PR_ntohl 0x75106 0x398
PR_ntohll 0x75113 0x399
PR_ntohs 0x75137 0x39a
PR_smprintf 0x697b6 0x39b
PR_smprintf_free 0x70556 0x39c
PR_snprintf 0x697c9 0x39d
PR_sprintf_append 0x697e3 0x39e
PR_sscanf 0x6ad8a 0x39f
PR_strtod 0x71402 0x3a0
PR_sxprintf 0x697fa 0x3a1
PR_vfprintf 0x6bfdd 0x3a2
PR_vsmprintf 0x69814 0x3a3
PR_vsnprintf 0x6985c 0x3a4
PR_vsprintf_append 0x698c0 0x3a5
PR_vsxprintf 0x69934 0x3a6
PT_FPrintStats 0x8aa6d 0x3a7
SECITEM_AllocArray 0xbb8e6 0x3a8
SECITEM_AllocItem 0x8ee3e 0x3a9
SECITEM_AllocItem_Util 0xbb9b9 0x3aa
SECITEM_ArenaDupItem_Util 0xbba77 0x3ab
SECITEM_CompareItem_Util 0xbbaf6 0x3ac
SECITEM_CopyItem 0x8ee47 0x3ad
SECITEM_CopyItem_Util 0xbbb83 0x3ae
SECITEM_DupArray 0xbbbe8 0x3af
SECITEM_DupItem 0x8ee50 0x3b0
SECITEM_DupItem_Util 0xbbc5f 0x3b1
SECITEM_FreeItem 0x8ee59 0x3b2
SECITEM_FreeItem_Util 0xbbc85 0x3b3
SECITEM_HashCompare 0x8ee5e 0x3b4
SECITEM_ItemsAreEqual 0x8ee5e 0x3b5
SECITEM_ItemsAreEqual_Util 0xbbce5 0x3b6
SECITEM_ReallocItemV2 0xbbd31 0x3b7
SECITEM_ZfreeItem 0x8ee67 0x3b8
SECITEM_ZfreeItem_Util 0xbbdd8 0x3b9
SECKEY_ConvertToPublicKey 0x8ae15 0x3ba
SECKEY_CopyPrivateKey 0x8af71 0x3bb
SECKEY_CopyPublicKey 0x8b07e 0x3bc
SECKEY_CopySubjectPublicKeyInfo 0x8b202 0x3bd
SECKEY_CreateSubjectPublicKeyInfo 0x8b386 0x3be
SECKEY_DecodeDERSubjectPublicKeyInfo 0x8b3c5 0x3bf
SECKEY_DestroyEncryptedPrivateKeyInfo 0x8b44b 0x3c0
SECKEY_DestroyPrivateKey 0x8b4c0 0x3c1
SECKEY_DestroyPrivateKeyList 0x8b57e 0x3c2
SECKEY_DestroyPublicKey 0x8b5a3 0x3c3
SECKEY_DestroySubjectPublicKeyInfo 0x7dba6 0x3c4
SECKEY_ECParamsToBasePointOrderLen 0x8b5ee 0x3c5
SECKEY_ECParamsToKeySize 0x8b8a4 0x3c6
SECKEY_EncodeDERSubjectPublicKeyInfo 0x8bada 0x3c7
SECKEY_ExtractPublicKey 0x8bb0e 0x3c8
SECKEY_GetPrivateKeyType 0xb2431 0x3c9
SECKEY_GetPublicKeyType 0xb2431 0x3ca
SECKEY_ImportDERPublicKey 0x8bb5b 0x3cb
SECKEY_PublicKeyStrength 0x8bc95 0x3cc
SECKEY_RSAPSSParamsTemplate 0x1009c8 0x3cd
SECKEY_SignatureLen 0x8bd2b 0x3ce
SECMIME_DecryptionAllowed 0xc8a4f 0x3cf
SECMOD_AddNewModule 0xb3da9 0x3d0
SECMOD_AddNewModuleEx 0xb3dc6 0x3d1
SECMOD_CanDeleteInternalModule 0x6b563 0x3d2
SECMOD_CancelWait 0xb3ef6 0x3d3
SECMOD_CloseUserDB 0xb3f73 0x3d4
SECMOD_CreateModule 0xaaff4 0x3d5
SECMOD_DeleteInternalModule 0xb3fe1 0x3d6
SECMOD_DeleteModule 0xb4010 0x3d7
SECMOD_DestroyModule 0xb4174 0x3d8
SECMOD_FindModule 0xb4231 0x3d9
SECMOD_GetDeadModuleList 0xb43e7 0x3da
SECMOD_GetDefaultModuleList 0xb43ed 0x3db
SECMOD_GetDefaultModuleListLock 0xb43f3 0x3dc
SECMOD_GetInternalModule 0xb43f9 0x3dd
SECMOD_GetModuleSpecList 0xab24e 0x3de
SECMOD_GetReadLock 0x9ee0e 0x3df
SECMOD_HasRemovableSlots 0xb43ff 0x3e0
SECMOD_InternaltoPubMechFlags 0xb447c 0x3e1
SECMOD_LoadModule 0xab26d 0x3e2
SECMOD_LoadUserModule 0xab4a5 0x3e3
SECMOD_OpenUserDB 0xb4619 0x3e4
SECMOD_PubCipherFlagstoInternal 0xb46a2 0x3e5
SECMOD_PubMechFlagstoInternal 0xb46aa 0x3e6
SECMOD_ReferenceModule 0xb46c3 0x3e7
SECMOD_ReleaseReadLock 0x9ee27 0x3e8
SECMOD_UnloadUserModule 0xab4f6 0x3e9
SECMOD_UpdateModule 0xb4945 0x3ea
SECMOD_UpdateSlotList 0xb495d 0x3eb
SECMOD_WaitForAnyTokenEvent 0xb4b54 0x3ec
SECOID_AddEntry 0x8ee6c 0x3ed
SECOID_AddEntry_Util 0xbbfcd 0x3ee
SECOID_AlgorithmIDTemplate 0x100e88 0x3ef
SECOID_AlgorithmIDTemplate_Util 0x10f7c8 0x3f0
SECOID_CopyAlgorithmID_Util 0xb8bd2 0x3f1
SECOID_DestroyAlgorithmID 0x8ee75 0x3f2
SECOID_DestroyAlgorithmID_Util 0xb8c05 0x3f3
SECOID_FindOID 0x8ee7a 0x3f4
SECOID_FindOIDByMechanism 0xbc13c 0x3f5
SECOID_FindOIDByTag 0x8ee83 0x3f6
SECOID_FindOIDByTag_Util 0xbc166 0x3f7
SECOID_FindOIDTag 0x8ee8c 0x3f8
SECOID_FindOIDTagDescription_Util 0xbc186 0x3f9
SECOID_FindOIDTag_Util 0xc8fc1 0x3fa
SECOID_FindOID_Util 0xbc19f 0x3fb
SECOID_GetAlgorithmTag 0x8ee95 0x3fc
SECOID_GetAlgorithmTag_Util 0xb8c32 0x3fd
SECOID_Init 0xbc1d8 0x3fe
SECOID_SetAlgorithmID 0x8ee9e 0x3ff
SECOID_SetAlgorithmID_Util 0xb8c4f 0x400
SECOID_Shutdown 0xbc31d 0x401
SEC_ASN1Decode 0x8eea7 0x402
SEC_ASN1DecodeInteger 0x8eeb0 0x403
SEC_ASN1DecodeItem 0x8eeb9 0x404
SEC_ASN1DecodeItem_Util 0xb8da2 0x405
SEC_ASN1Decode_Util 0xb8dc1 0x406
SEC_ASN1EncodeInteger_Util 0xba78b 0x407
SEC_ASN1EncodeItem 0x8eec2 0x408
SEC_ASN1EncodeItem_Util 0xba7a3 0x409
SEC_ASN1EncodeUnsignedInteger_Util 0xba849 0x40a
SEC_ASN1Encode_Util 0xba861 0x40b
SEC_AnyTemplate_Util 0x10f848 0x40c
SEC_BMPStringTemplate 0x100ec8 0x40d
SEC_BitStringTemplate 0x100ed8 0x40e
SEC_BitStringTemplate_Util 0x10f858 0x40f
SEC_BooleanTemplate_Util 0x10f878 0x410
SEC_CertNicknameConflict 0x84027 0x411
SEC_CreateSignatureAlgorithmParameters 0x8c529 0x412
SEC_DeletePermCertificate 0x8405f 0x413
SEC_DerSignData 0x8c58a 0x414
SEC_DerSignDataWithAlgorithmID 0x8c5ab 0x415
SEC_DestroyCrl 0x8105a 0x416
SEC_GeneralizedTimeTemplate_Util 0x10f888 0x417
SEC_GetSignatureAlgorithmOidTag 0x8c5d7 0x418
SEC_IA5StringTemplate 0x100ee8 0x419
SEC_IA5StringTemplate_Util 0x10f898 0x41a
SEC_IntegerTemplate 0x100ef8 0x41b
SEC_IntegerTemplate_Util 0x10f8a8 0x41c
SEC_NullTemplate_Util 0x10f8b8 0x41d
SEC_ObjectIDTemplate_Util 0x10f8c8 0x41e
SEC_OctetStringTemplate 0x100f08 0x41f
SEC_OctetStringTemplate_Util 0x10f8d8 0x420
SEC_PKCS12AddCertAndKey 0xc3cdb 0x421
SEC_PKCS12AddPasswordIntegrity 0xc4001 0x422
SEC_PKCS12CreateExportContext 0xc405c 0x423
SEC_PKCS12CreatePasswordPrivSafe 0xc40e1 0x424
SEC_PKCS12CreateUnencryptedSafe 0xc4288 0x425
SEC_PKCS12DecoderFinish 0xc1143 0x426
SEC_PKCS12DecoderImportBags 0xc12c9 0x427
SEC_PKCS12DecoderIterateInit 0xc1321 0x428
SEC_PKCS12DecoderIterateNext 0xc134c 0x429
SEC_PKCS12DecoderRenameCertNicknames 0xc14db 0x42a
SEC_PKCS12DecoderStart 0xc15d8 0x42b
SEC_PKCS12DecoderUpdate 0xc174f 0x42c
SEC_PKCS12DecoderValidateBags 0xc179a 0x42d
SEC_PKCS12DecoderVerify 0xc1820 0x42e
SEC_PKCS12DestroyExportContext 0xc4326 0x42f
SEC_PKCS12EnableCipher 0xc54e7 0x430
SEC_PKCS12Encode 0xc4391 0x431
SEC_PKCS12IsEncryptionAllowed 0xc5534 0x432
SEC_PKCS12SetPreferredCipher 0xc555d 0x433
SEC_PKCS5GetPBEAlgorithm 0xacd8f 0x434
SEC_PKCS5IsAlgorithmPBEAlgTag 0xace3b 0x435
SEC_PKCS7AddSigningTime 0xc5ec7 0x436
SEC_PKCS7ContentIsEncrypted 0xc66f3 0x437
SEC_PKCS7ContentIsSigned 0xc6717 0x438
SEC_PKCS7CopyContentInfo 0xc5cc9 0x439
SEC_PKCS7CreateSignedData 0xc60f1 0x43a
SEC_PKCS7DecodeItem 0xc6751 0x43b
SEC_PKCS7DecoderFinish 0xc67a7 0x43c
SEC_PKCS7DecoderStart 0xc67f4 0x43d
SEC_PKCS7DecoderUpdate 0xc6905 0x43e
SEC_PKCS7DestroyContentInfo 0xc5cda 0x43f
SEC_PKCS7Encode 0xc778f 0x440
SEC_PKCS7IncludeCertChain 0xc6136 0x441
SEC_PKCS7VerifyDetachedSignature 0xc69d2 0x442
SEC_QuickDERDecodeItem 0x8eecb 0x443
SEC_QuickDERDecodeItem_Util 0xb8ab4 0x444
SEC_RegisterDefaultHttpClient 0x87cb5 0x445
SEC_SignData 0x8c6c8 0x446
SEC_SignedCertificateTemplate 0xfefd8 0x447
SEC_StringToOID 0xb6b3b 0x448
SEC_UTF8StringTemplate 0x100f18 0x449
SEC_UTF8StringTemplate_Util 0x10f8f8 0x44a
SGN_Begin 0x8c6e6 0x44b
SGN_CreateDigestInfo 0x8eed4 0x44c
SGN_CreateDigestInfo_Util 0xbb773 0x44d
SGN_DecodeDigestInfo 0xbb861 0x44e
SGN_DestroyContext 0x8c732 0x44f
SGN_DestroyDigestInfo 0x8eedd 0x450
SGN_DestroyDigestInfo_Util 0x7dba6 0x451
SGN_End 0x8c856 0x452
SGN_NewContext 0x8cabd 0x453
SGN_Update 0x8cad2 0x454
SSL_AuthCertificateComplete 0xe1cb5 0x455
SSL_AuthCertificateHook 0xde8d4 0x456
SSL_CipherPrefGet 0xe512a 0x457
SSL_CipherPrefSet 0xe5177 0x458
SSL_CipherPrefSetDefault 0xe51ac 0x459
SSL_ClearSessionCache 0xe0a0e 0x45a
SSL_ConfigSecureServer 0xdebbf 0x45b
SSL_ConfigSecureServerWithCertChain 0xdebda 0x45c
SSL_ConfigServerSessionIDCache 0xe3643 0x45d
SSL_ExportKeyingMaterial 0xe0047 0x45e
SSL_ForceHandshake 0xe1d65 0x45f
SSL_GetChannelInfo 0xe01c0 0x460
SSL_GetCipherSuiteInfo 0xe040b 0x461
SSL_GetClientAuthDataHook 0xde901 0x462
SSL_GetExperimentalAPI 0xe51c0 0x463
SSL_GetImplementedCiphers 0xdfe0d 0x464
SSL_GetNextProto 0xe5218 0x465
SSL_GetNumImplementedCiphers 0xdfe13 0x466
SSL_GetPreliminaryChannelInfo 0xe0472 0x467
SSL_GetSRTPCipher 0xe52a2 0x468
SSL_GetStatistics 0xcfabc 0x469
SSL_HandshakeCallback 0xe1e98 0x46a
SSL_HandshakeNegotiatedExtension 0xe1b48 0x46b
SSL_ImplementedCiphers 0x111b70 0x46c
SSL_ImportFD 0xe52d8 0x46d
SSL_NamedGroupConfig 0xe52ed 0x46e
SSL_NumImplementedCiphers 0x111c00 0x46f
SSL_OptionSet 0xe5374 0x470
SSL_OptionSetDefault 0xe57c4 0x471
SSL_PeerCertificate 0xde92e 0x472
SSL_PeerCertificateChain 0xde959 0x473
SSL_PeerSignedCertTimestamps 0xe5b44 0x474
SSL_PeerStapledOCSPResponses 0xe5b76 0x475
SSL_ResetHandshake 0xe1f27 0x476
SSL_SNISocketConfigHook 0xe20f3 0x477
SSL_SendAdditionalKeyShares 0xe7adc 0x478
SSL_SetCanFalseStartCallback 0xe2120 0x479
SSL_SetDowngradeCheckVersion 0xe5ba6 0x47a
SSL_SetNextProtoNego 0xe5cc0 0x47b
SSL_SetPKCS11PinArg 0xde9db 0x47c
SSL_SetSRTPCiphers 0xe5d81 0x47d
SSL_SetSockPeerID 0xe5e19 0x47e
SSL_SetStapledOCSPResponses 0xdec67 0x47f
SSL_SetTrustAnchors 0xe21af 0x480
SSL_SetURL 0xe2260 0x481
SSL_ShutdownServerSessionIDCache 0xe366b 0x482
SSL_SignatureSchemePrefSet 0xcfac2 0x483
SSL_VersionRangeGet 0xe5e76 0x484
SSL_VersionRangeGetDefault 0xe5f18 0x485
SSL_VersionRangeGetSupported 0xe5f5b 0x486
SSL_VersionRangeSet 0xe5fd4 0x487
SSL_VersionRangeSetDefault 0xe60c3 0x488
SetExecutionEnvironment 0x8fd68 0x489
UTIL_SetForkState 0xbc41d 0x48a
VFY_Begin 0x8cfdd 0x48b
VFY_CreateContext 0x8d039 0x48c
VFY_DestroyContext 0x8d07b 0x48d
VFY_End 0x8d0ef 0x48e
VFY_EndWithSignature 0x8d100 0x48f
VFY_Update 0x8d34c 0x490
VFY_VerifyData 0x8d383 0x491
VFY_VerifyDataWithAlgorithmID 0x8d3ee 0x492
VFY_VerifyDigestDirect 0x8d43e 0x493
_NSSUTIL_Access 0xbd5fb 0x494
_NSSUTIL_EvaluateConfigDir 0xbf183 0x495
_NSSUTIL_GetSecmodName 0xbf29b 0x496
_NSSUTIL_UTF8ToWide 0xbd6c2 0x497
_PR_AddSleepQ 0x7a08f 0x498
_PR_CreateThread 0x7a24a 0x499
_PR_DelSleepQ 0x7a6e3 0x49a
_PR_GetPrimordialCPU 0x7958c 0x49b
_PR_MD_FREE_CV 0x6e517 0x49c
_PR_MD_INIT_LOCKS 0x6e522 0x49d
_PR_MD_NEW_CV 0x6e53f 0x49e
_PR_MD_NEW_LOCK 0x6e54f 0x49f
_PR_MD_NOTIFYALL_CV 0x6e59d 0x4a0
_PR_MD_NOTIFY_CV 0x6e5b2 0x4a1
_PR_MD_UNLOCK 0x6e5c7 0x4a2
_PR_MD_WAIT_CV 0x6e5ea 0x4a3
_PR_NativeCreateThread 0x7a8d6 0x4a4
_SGN_VerifyPKCS1DigestInfo 0xb78d7 0x4a5
__PK11_SetCertificateNickname 0x9c871 0x4a6
_pr_push_ipv6toipv4_layer 0x66ec0 0x4a7
_pr_test_ipv6_socket 0x6bfa5 0x4a8
sqlite3_aggregate_context 0x732b 0x4a9
sqlite3_auto_extension 0x8b9f 0x4aa
sqlite3_bind_blob 0x5054 0x4ab
sqlite3_bind_double 0x51ec 0x4ac
sqlite3_bind_int 0x525e 0x4ad
sqlite3_bind_int64 0x5277 0x4ae
sqlite3_bind_null 0x5302 0x4af
sqlite3_bind_parameter_count 0x597f 0x4b0
sqlite3_bind_parameter_index 0x5a0c 0x4b1
sqlite3_bind_parameter_name 0x599c 0x4b2
sqlite3_bind_text 0x5353 0x4b3
sqlite3_bind_text16 0x53f8 0x4b4
sqlite3_bind_value 0x568f 0x4b5
sqlite3_busy_handler 0x38e2 0x4b6
sqlite3_busy_timeout 0x3920 0x4b7
sqlite3_changes 0x35be 0x4b8
sqlite3_clear_bindings 0x5a28 0x4b9
sqlite3_close 0x1fae 0x4ba
sqlite3_collation_needed 0x8169 0x4bb
sqlite3_collation_needed16 0x824f 0x4bc
sqlite3_column_blob 0x6144 0x4bd
sqlite3_column_bytes 0x6543 0x4be
sqlite3_column_bytes16 0x656a 0x4bf
sqlite3_column_count 0x5b89 0x4c0
sqlite3_column_double 0x616b 0x4c1
sqlite3_column_int 0x6196 0x4c2
sqlite3_column_int64 0x61c8 0x4c3
sqlite3_column_name 0x5ba0 0x4c4
sqlite3_column_name16 0x5bc8 0x4c5
sqlite3_column_text 0x61f5 0x4c6
sqlite3_column_text16 0x621c 0x4c7
sqlite3_column_type 0x6595 0x4c8
sqlite3_column_value 0x62c9 0x4c9
sqlite3_commit_hook 0x8551 0x4ca
sqlite3_complete 0x3674 0x4cb
sqlite3_complete16 0x388b 0x4cc
sqlite3_config 0x58636 0x4cd
sqlite3_create_collation 0x7f20 0x4ce
sqlite3_create_collation16 0x804a 0x4cf
sqlite3_create_function 0x69b0 0x4d0
sqlite3_create_function16 0x6aa2 0x4d1
sqlite3_create_module 0x90ab 0x4d2
sqlite3_data_count 0x6102 0x4d3
sqlite3_db_filename 0x8390 0x4d4
sqlite3_db_handle 0x82bd 0x4d5
sqlite3_db_mutex 0x90915 0x4d6
sqlite3_db_status 0xa721 0x4d7
sqlite3_declare_vtab 0x90cf 0x4d8
sqlite3_enable_load_extension 0x5888a 0x4d9
sqlite3_enable_shared_cache 0x8612 0x4da
sqlite3_errcode 0x4460 0x4db
sqlite3_errmsg 0x44cb 0x4dc
sqlite3_errmsg16 0x453e 0x4dd
sqlite3_exec 0x20e6 0x4de
sqlite3_expanded_sql 0x4fc0 0x4df
sqlite3_extended_result_codes 0x3544 0x4e0
sqlite3_file_control 0xa01d 0x4e1
sqlite3_finalize 0x65c2 0x4e2
sqlite3_free 0x3d51 0x4e3
sqlite3_free_table 0x3b0d 0x4e4
sqlite3_get_autocommit 0x82b1 0x4e5
sqlite3_get_auxdata 0x7372 0x4e6
sqlite3_get_table 0x39c9 0x4e7
sqlite3_initialize 0x589e7 0x4e8
sqlite3_interrupt 0x3662 0x4e9
sqlite3_last_insert_rowid 0x3588 0x4ea
sqlite3_libversion 0x1e95 0x4eb
sqlite3_libversion_number 0x1f21 0x4ec
sqlite3_load_extension 0x8b66 0x4ed
sqlite3_malloc 0x3c77 0x4ee
sqlite3_memory_highwater 0x3de3 0x4ef
sqlite3_memory_used 0x3dbf 0x4f0
sqlite3_mprintf 0x3b46 0x4f1
sqlite3_mutex_alloc 0x9e5f 0x4f2
sqlite3_mutex_enter 0x9e95 0x4f3
sqlite3_mutex_free 0x9e83 0x4f4
sqlite3_mutex_leave 0x9ebb 0x4f5
sqlite3_mutex_try 0x9ea7 0x4f6
sqlite3_next_stmt 0x8522 0x4f7
sqlite3_open 0x4082 0x4f8
sqlite3_open16 0x4099 0x4f9
sqlite3_open_v2 0x412a 0x4fa
sqlite3_overload_function 0x9296 0x4fb
sqlite3_prepare 0x48c8 0x4fc
sqlite3_prepare16 0x4b8e 0x4fd
sqlite3_prepare16_v2 0x4d16 0x4fe
sqlite3_prepare_v2 0x48e8 0x4ff
sqlite3_progress_handler 0x4037 0x500
sqlite3_realloc 0x3cb9 0x501
sqlite3_release_memory 0x6b563 0x502
sqlite3_reset 0x6689 0x503
sqlite3_reset_auto_extension 0x8c94 0x504
sqlite3_result_blob 0x7473 0x505
sqlite3_result_double 0x754d 0x506
sqlite3_result_error 0x756b 0x507
sqlite3_result_error16 0x7618 0x508
sqlite3_result_error_code 0x7690 0x509
sqlite3_result_error_nomem 0x7667 0x50a
sqlite3_result_int 0x76c1 0x50b
sqlite3_result_int64 0x776c 0x50c
sqlite3_result_null 0x7784 0x50d
sqlite3_result_text 0x7794 0x50e
sqlite3_result_text16 0x7bb9 0x50f
sqlite3_result_text16be 0x7c7e 0x510
sqlite3_result_text16le 0x7bb9 0x511
sqlite3_result_value 0x7c99 0x512
sqlite3_rollback_hook 0x85a2 0x513
sqlite3_set_authorizer 0x3f8b 0x514
sqlite3_set_auxdata 0x73aa 0x515
sqlite3_shutdown 0x58c18 0x516
sqlite3_sleep 0x8286 0x517
sqlite3_snprintf 0x3bd2 0x518
sqlite3_sql 0x4f8f 0x519
sqlite3_status 0xa2c2 0x51a
sqlite3_step 0x5f16 0x51b
sqlite3_stmt_readonly 0x4fff 0x51c
sqlite3_stmt_status 0xaa45 0x51d
sqlite3_total_changes 0x35c9 0x51e
sqlite3_trace_v2 0x3ff2 0x51f
sqlite3_unlock_notify 0xb402 0x520
sqlite3_update_hook 0x85da 0x521
sqlite3_uri_parameter 0x4326 0x522
sqlite3_user_data 0x7364 0x523
sqlite3_value_blob 0x7074 0x524
sqlite3_value_bytes 0x7216 0x525
sqlite3_value_bytes16 0x7227 0x526
sqlite3_value_double 0x70bc 0x527
sqlite3_value_int 0x70c5 0x528
sqlite3_value_int64 0x70c5 0x529
sqlite3_value_numeric_type 0x724e 0x52a
sqlite3_value_text 0x7159 0x52b
sqlite3_value_text16 0x71f4 0x52c
sqlite3_value_text16be 0x7205 0x52d
sqlite3_value_text16le 0x71f4 0x52e
sqlite3_value_type 0x7238 0x52f
sqlite3_version 0xf0e0c 0x530
sqlite3_vfs_find 0x9d3e 0x531
sqlite3_vfs_register 0x9dc0 0x532
sqlite3_vfs_unregister 0x9e27 0x533
sqlite3_vmprintf 0x3b66 0x534
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
nssckbi.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\nssckbi.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 328.45 KB
MD5 bdaf9852f588c86b055c846b53d4c144 Copy to Clipboard
SHA1 03b739430cf9eade21c977b5b416c4dd94528c3b Copy to Clipboard
SHA256 2481da1c459a2429a933d19ad6ae514bd2ae59818246ddb67b0ef44146ced3d8 Copy to Clipboard
SSDeep 6144:8bndzEL04gF85K9autIMyEhZ/V3psPyHa9tBe1:8bndzEL04pnutIMyAp2z9tBe1 Copy to Clipboard
ImpHash 974f7cca14d8a1fd15587253239a48c2 Copy to Clipboard
PE Information
»
Image Base 0x10000000
Entry Point 0x1000a971
Size Of Code 0xa400
Size Of Initialized Data 0x46000
File Type FileType.dll
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2019-03-14 11:53:37+00:00
Version Information (11)
»
Comments -
LegalCopyright License: MPL 2
CompanyName Mozilla Foundation
FileDescription -
FileVersion 60.6.0
ProductVersion 60.6.0
InternalName -
LegalTrademarks Mozilla
OriginalFilename nssckbi.dll
ProductName Thunderbird
BuildID 20190314112142
Sections (5)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xa2da 0xa400 0x400 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.35
.rdata 0x1000c000 0x3e03e 0x3e200 0xa800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 7.18
.data 0x1004b000 0x4e90 0x4c00 0x48a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 1.5
.rsrc 0x10050000 0x378 0x400 0x4d600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 2.88
.reloc 0x10051000 0x2974 0x2a00 0x4da00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 5.78
Imports (4)
»
nss3.dll (21)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
PL_HashTableAdd - 0x1000c074 0x49be8 0x483e8 0x1ca
PL_HashTableRemove - 0x1000c078 0x49bec 0x483ec 0x1d4
PL_HashTableLookup - 0x1000c07c 0x49bf0 0x483f0 0x1ce
PL_HashTableEnumerateEntries - 0x1000c080 0x49bf4 0x483f4 0x1cd
PR_DestroyLock - 0x1000c084 0x49bf8 0x483f8 0x26b
PL_strlen - 0x1000c088 0x49bfc 0x483fc 0x1e3
PL_CompareValues - 0x1000c08c 0x49c00 0x48400 0x1c1
PL_HashTableDestroy - 0x1000c090 0x49c04 0x48404 0x1cb
PL_NewHashTable - 0x1000c094 0x49c08 0x48408 0x1d6
PR_CallOnce - 0x1000c098 0x49c0c 0x4840c 0x240
PR_GetThreadPrivate - 0x1000c09c 0x49c10 0x48410 0x2de
PR_SetThreadPrivate - 0x1000c0a0 0x49c14 0x48414 0x369
PR_NewThreadPrivateIndex - 0x1000c0a4 0x49c18 0x48418 0x31b
PL_ArenaAllocate - 0x1000c0a8 0x49c1c 0x4841c 0x1b8
PL_FinishArenaPool - 0x1000c0ac 0x49c20 0x48420 0x1c6
PL_InitArenaPool - 0x1000c0b0 0x49c24 0x48424 0x1d5
PR_Free - 0x1000c0b4 0x49c28 0x48428 0x29f
PR_Calloc - 0x1000c0b8 0x49c2c 0x4842c 0x242
PR_Unlock - 0x1000c0bc 0x49c30 0x48430 0x383
PR_Lock - 0x1000c0c0 0x49c34 0x48434 0x303
PR_NewLock - 0x1000c0c4 0x49c38 0x48438 0x311
VCRUNTIME140.dll (6)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_except_handler4_common - 0x1000c034 0x49ba8 0x483a8 0x35
__std_type_info_destroy_list - 0x1000c038 0x49bac 0x483ac 0x25
memset - 0x1000c03c 0x49bb0 0x483b0 0x48
memcpy - 0x1000c040 0x49bb4 0x483b4 0x46
memcmp - 0x1000c044 0x49bb8 0x483b8 0x45
memmove - 0x1000c048 0x49bbc 0x483bc 0x47
api-ms-win-crt-runtime-l1-1-0.dll (8)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_cexit - 0x1000c050 0x49bc4 0x483c4 0x17
_execute_onexit_table - 0x1000c054 0x49bc8 0x483c8 0x24
_initialize_onexit_table - 0x1000c058 0x49bcc 0x483cc 0x36
_initialize_narrow_environment - 0x1000c05c 0x49bd0 0x483d0 0x35
_configure_narrow_argv - 0x1000c060 0x49bd4 0x483d4 0x19
_seh_filter_dll - 0x1000c064 0x49bd8 0x483d8 0x41
_initterm_e - 0x1000c068 0x49bdc 0x483dc 0x39
_initterm - 0x1000c06c 0x49be0 0x483e0 0x38
KERNEL32.dll (12)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
UnhandledExceptionFilter - 0x1000c000 0x49b74 0x48374 0x59d
TerminateProcess - 0x1000c004 0x49b78 0x48378 0x57c
GetCurrentProcess - 0x1000c008 0x49b7c 0x4837c 0x213
IsProcessorFeaturePresent - 0x1000c00c 0x49b80 0x48380 0x37d
SetUnhandledExceptionFilter - 0x1000c010 0x49b84 0x48384 0x55e
QueryPerformanceCounter - 0x1000c014 0x49b88 0x48388 0x440
IsDebuggerPresent - 0x1000c018 0x49b8c 0x4838c 0x376
InitializeSListHead - 0x1000c01c 0x49b90 0x48390 0x35a
DisableThreadLibraryCalls - 0x1000c020 0x49b94 0x48394 0x11b
GetSystemTimeAsFileTime - 0x1000c024 0x49b98 0x48398 0x2e2
GetCurrentThreadId - 0x1000c028 0x49b9c 0x4839c 0x218
GetCurrentProcessId - 0x1000c02c 0x49ba0 0x483a0 0x214
Exports (1)
»
Api name EAT Address Ordinal
C_GetFunctionList 0x1798 0x1
Digital Signature Information
»
Verification Status Trusted
Certificate: Mozilla Corporation
»
Issued by Mozilla Corporation
Parent Certificate DigiCert SHA2 Assured ID Code Signing CA
Country Name US
Valid From 2017-06-23 02:00 (UTC+2)
Valid Until 2019-06-28 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 0C 53 96 DC B2 94 9C 70 FA C4 8A B0 8A 07 33 8E
Thumbprint B6 B2 4A EA 9E 98 3E D6 BD A9 58 6A 14 5A 7D DD 7E 22 01 96
Certificate: DigiCert SHA2 Assured ID Code Signing CA
»
Issued by DigiCert SHA2 Assured ID Code Signing CA
Parent Certificate DigiCert Assured ID Root CA
Country Name US
Valid From 2013-10-22 14:00 (UTC+2)
Valid Until 2028-10-22 14:00 (UTC+2)
Algorithm sha256_rsa
Serial Number 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
Thumbprint 92 C1 58 8E 85 AF 22 01 CE 79 15 E8 53 8B 49 2F 60 5B 80 C6
Certificate: DigiCert Assured ID Root CA
»
Issued by DigiCert Assured ID Root CA
Country Name US
Valid From 2006-11-10 01:00 (UTC+1)
Valid Until 2031-11-10 01:00 (UTC+1)
Algorithm sha1_rsa
Serial Number 0C E7 E0 E5 17 D8 46 FE 8F E5 60 FC 1B F0 30 39
Thumbprint 05 63 B8 63 0D 62 D7 5A BB C8 AB 1E 4B DF B5 A8 99 B2 4D 43
api-ms-win-core-namedpipe-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-namedpipe-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 6f6796d1278670cce6e2d85199623e27 Copy to Clipboard
SHA1 8aa2155c3d3d5aa23f56cd0bc507255fc953ccc3 Copy to Clipboard
SHA256 c4f60f911068ab6d7f578d449ba7b5b9969f08fc683fd0ce8e2705bbf061f507 Copy to Clipboard
SSDeep 192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2094-02-27 02:21:20+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x391 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.48
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (10)
»
Api name EAT Address Ordinal
ConnectNamedPipe 0x11c2 0x1
CreateNamedPipeW 0x11ed 0x2
CreatePipe 0x1212 0x3
DisconnectNamedPipe 0x123a 0x4
GetNamedPipeClientComputerNameW 0x1277 0x5
ImpersonateNamedPipeClient 0x12bb 0x6
PeekNamedPipe 0x12ed 0x7
SetNamedPipeHandleState 0x131c 0x8
TransactNamedPipe 0x134f 0x9
WaitNamedPipeW 0x1379 0xa
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-processenvironment-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-processenvironment-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.80 KB
MD5 5f73a814936c8e7e4a2dfd68876143c8 Copy to Clipboard
SHA1 d960016c4f553e461afb5b06b039a15d2e76135e Copy to Clipboard
SHA256 96898930ffb338da45497be019ae1adcd63c5851141169d3023e53ce4c7a483e Copy to Clipboard
SSDeep 192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x800
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2050-07-08 10:36:25+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x647 0x800 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.33
.rsrc 0x10002000 0x3f0 0x400 0xa00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (21)
»
Api name EAT Address Ordinal
ExpandEnvironmentStringsA 0x1242 0x1
ExpandEnvironmentStringsW 0x127f 0x2
FreeEnvironmentStringsA 0x12ba 0x3
FreeEnvironmentStringsW 0x12f3 0x4
GetCommandLineA 0x1324 0x5
GetCommandLineW 0x134d 0x6
GetCurrentDirectoryA 0x137b 0x7
GetCurrentDirectoryW 0x13ae 0x8
GetEnvironmentStrings 0x13e2 0x9
GetEnvironmentStringsW 0x1418 0xa
GetEnvironmentVariableA 0x1450 0xb
GetEnvironmentVariableW 0x1489 0xc
GetStdHandle 0x14b7 0xd
SearchPathW 0x14d9 0xe
SetCurrentDirectoryA 0x1503 0xf
SetCurrentDirectoryW 0x1536 0x10
SetEnvironmentStringsW 0x156b 0x11
SetEnvironmentVariableA 0x15a3 0x12
SetEnvironmentVariableW 0x15dc 0x13
SetStdHandle 0x160a 0x14
SetStdHandleEx 0x162f 0x15
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-processthreads-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-processthreads-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.94 KB
MD5 a2d7d7711f9c0e3e065b2929ff342666 Copy to Clipboard
SHA1 a17b1f36e73b82ef9bfb831058f187535a550eb8 Copy to Clipboard
SHA256 9dab884071b1f7d7a167f9bec94ba2bee875e3365603fa29b31de286c6a97a1d Copy to Clipboard
SSDeep 384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0xc00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2066-01-02 15:06:27+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xbe3 0xc00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.08
.rsrc 0x10002000 0x3f0 0x400 0xe00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (49)
»
Api name EAT Address Ordinal
CreateProcessA 0x134b 0x1
CreateProcessAsUserW 0x1378 0x2
CreateProcessW 0x13a5 0x3
CreateRemoteThread 0x13d0 0x4
CreateRemoteThreadEx 0x1401 0x5
CreateThread 0x142c 0x6
DeleteProcThreadAttributeList 0x1460 0x7
ExitProcess 0x1493 0x8
ExitThread 0x14b3 0x9
FlushProcessWriteBuffers 0x14e0 0xa
GetCurrentProcess 0x1514 0xb
GetCurrentProcessId 0x1543 0xc
GetCurrentThread 0x1571 0xd
GetCurrentThreadId 0x159e 0xe
GetExitCodeProcess 0x15cd 0xf
GetExitCodeThread 0x15fb 0x10
GetPriorityClass 0x1627 0x11
GetProcessId 0x164e 0x12
GetProcessIdOfThread 0x1679 0x13
GetProcessTimes 0x16a7 0x14
GetProcessVersion 0x16d2 0x15
GetStartupInfoW 0x16fd 0x16
GetThreadId 0x1722 0x17
GetThreadPriority 0x1749 0x18
GetThreadPriorityBoost 0x177b 0x19
InitializeProcThreadAttributeList 0x17bd 0x1a
OpenProcessToken 0x17f9 0x1b
OpenThread 0x181e 0x1c
OpenThreadToken 0x1842 0x1d
ProcessIdToSessionId 0x1870 0x1e
QueryProcessAffinityUpdateMode 0x18ad 0x1f
QueueUserAPC 0x18e2 0x20
ResumeThread 0x1905 0x21
SetPriorityClass 0x192c 0x22
SetProcessAffinityUpdateMode 0x1963 0x23
SetProcessShutdownParameters 0x19a6 0x24
SetThreadPriority 0x19de 0x25
SetThreadPriorityBoost 0x1a10 0x26
SetThreadStackGuarantee 0x1a48 0x27
SetThreadToken 0x1a78 0x28
SuspendThread 0x1a9e 0x29
SwitchToThread 0x1ac4 0x2a
TerminateProcess 0x1aed 0x2b
TerminateThread 0x1b17 0x2c
TlsAlloc 0x1b39 0x2d
TlsFree 0x1b53 0x2e
TlsGetValue 0x1b70 0x2f
TlsSetValue 0x1b91 0x30
UpdateProcThreadAttribute 0x1bc0 0x31
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-processthreads-l1-1-1.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-processthreads-l1-1-1.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 d0289835d97d103bad0dd7b9637538a1 Copy to Clipboard
SHA1 8ceebe1e9abb0044808122557de8aab28ad14575 Copy to Clipboard
SHA256 91eeb842973495deb98cef0377240d2f9c3d370ac4cf513fd215857e9f265a6a Copy to Clipboard
SSDeep 384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2084-10-18 13:20:17+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x4da 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.39
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (14)
»
Api name EAT Address Ordinal
FlushInstructionCache 0x11f4 0x1
GetCurrentProcessorNumber 0x122d 0x2
GetCurrentProcessorNumberEx 0x126c 0x3
GetCurrentThreadStackLimits 0x12ad 0x4
GetProcessHandleCount 0x12e8 0x5
GetProcessMitigationPolicy 0x1322 0x6
GetThreadContext 0x1357 0x7
GetThreadIdealProcessorEx 0x138b 0x8
GetThreadTimes 0x13bd 0x9
IsProcessorFeaturePresent 0x13ef 0xa
OpenProcess 0x141e 0xb
SetProcessMitigationPolicy 0x144e 0xc
SetThreadContext 0x1483 0xd
SetThreadIdealProcessorEx 0x14b7 0xe
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-profile-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-profile-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 17.30 KB
MD5 fee0926aa1bf00f2bec9da5db7b2de56 Copy to Clipboard
SHA1 f5a4eb3d8ac8fb68af716857629a43cd6be63473 Copy to Clipboard
SHA256 8eb5270fa99069709c846db38be743a1a80a42aa1a88776131f79e1d07cc411c Copy to Clipboard
SSDeep 192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x200
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2087-01-16 03:30:42+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1d5 0x200 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.25
.rsrc 0x10002000 0x3f0 0x400 0x400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (2)
»
Api name EAT Address Ordinal
QueryPerformanceCounter 0x1177 0x1
QueryPerformanceFrequency 0x11b2 0x2
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-rtlsupport-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-rtlsupport-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 17.30 KB
MD5 fdba0db0a1652d86cd471eaa509e56ea Copy to Clipboard
SHA1 3197cb45787d47bac80223e3e98851e48a122efa Copy to Clipboard
SHA256 2257fea1e71f7058439b3727ed68ef048bd91dcacd64762eb5c64a9d49df0b57 Copy to Clipboard
SSDeep 384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x200
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1991-09-02 22:58:18+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1e8 0x200 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.36
.rsrc 0x10002000 0x3f0 0x400 0x400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (3)
»
Api name EAT Address Ordinal
RtlCaptureContext 0x117e 0x1
RtlCaptureStackBackTrace 0x11af 0x2
RtlUnwind 0x11d8 0x3
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-string-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-string-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 12cc7d8017023ef04ebdd28ef9558305 Copy to Clipboard
SHA1 f859a66009d1caae88bf36b569b63e1fbdae9493 Copy to Clipboard
SHA256 7670fdede524a485c13b11a7c878015e9b0d441b7d8eb15ca675ad6b9c9a7311 Copy to Clipboard
SSDeep 384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1982-05-26 10:44:09+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x2f2 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.96
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (8)
»
Api name EAT Address Ordinal
CompareStringEx 0x11aa 0x1
CompareStringOrdinal 0x11d8 0x2
CompareStringW 0x1205 0x3
FoldStringW 0x1229 0x4
GetStringTypeExW 0x124f 0x5
GetStringTypeW 0x1278 0x6
MultiByteToWideChar 0x12a4 0x7
WideCharToMultiByte 0x12d5 0x8
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-synch-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-synch-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 19.80 KB
MD5 71af7ed2a72267aaad8564524903cff6 Copy to Clipboard
SHA1 8a8437123de5a22ab843adc24a01ac06f48db0d3 Copy to Clipboard
SHA256 5dd4ccd63e6ed07ca3987ab5634ca4207d69c47c2544dfefc41935617652820f Copy to Clipboard
SSDeep 384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0xc00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1996-08-13 19:03:36+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xa56 0xc00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.71
.rsrc 0x10002000 0x3f0 0x400 0xe00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (41)
»
Api name EAT Address Ordinal
AcquireSRWLockExclusive 0x12fb 0x1
AcquireSRWLockShared 0x1331 0x2
CancelWaitableTimer 0x1363 0x3
CreateEventA 0x138d 0x4
CreateEventExA 0x13b2 0x5
CreateEventExW 0x13d9 0x6
CreateEventW 0x13fe 0x7
CreateMutexA 0x1421 0x8
CreateMutexExA 0x1446 0x9
CreateMutexExW 0x146d 0xa
CreateMutexW 0x1492 0xb
CreateSemaphoreExW 0x14bb 0xc
CreateWaitableTimerExW 0x14ee 0xd
DeleteCriticalSection 0x1524 0xe
EnterCriticalSection 0x1558 0xf
InitializeCriticalSection 0x1590 0x10
InitializeCriticalSectionAndSpinCount 0x15d9 0x11
InitializeCriticalSectionEx 0x1624 0x12
InitializeSRWLock 0x165b 0x13
LeaveCriticalSection 0x168b 0x14
OpenEventA 0x16b4 0x15
OpenEventW 0x16d3 0x16
OpenMutexW 0x16f2 0x17
OpenSemaphoreW 0x1715 0x18
OpenWaitableTimerW 0x1740 0x19
ReleaseMutex 0x1769 0x1a
ReleaseSRWLockExclusive 0x1797 0x1b
ReleaseSRWLockShared 0x17cd 0x1c
ReleaseSemaphore 0x17fc 0x1d
ResetEvent 0x1821 0x1e
SetCriticalSectionSpinCount 0x1851 0x1f
SetEvent 0x187f 0x20
SetWaitableTimer 0x18a2 0x21
SetWaitableTimerEx 0x18cf 0x22
SleepEx 0x18f3 0x23
TryAcquireSRWLockExclusive 0x191f 0x24
TryAcquireSRWLockShared 0x195b 0x25
TryEnterCriticalSection 0x1994 0x26
WaitForMultipleObjectsEx 0x19ce 0x27
WaitForSingleObject 0x1a04 0x28
WaitForSingleObjectEx 0x1a37 0x29
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-synch-l1-2-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-synch-l1-2-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 0d1aa99ed8069ba73cfd74b0fddc7b3a Copy to Clipboard
SHA1 ba1f5384072df8af5743f81fd02c98773b5ed147 Copy to Clipboard
SHA256 30d99ce1d732f6c9cf82671e1d9088aa94e720382066b79175e2d16778a3dad1 Copy to Clipboard
SSDeep 384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53 Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2017-07-23 22:59:36+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x576 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.7
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (17)
»
Api name EAT Address Ordinal
DeleteSynchronizationBarrier 0x1210 0x1
EnterSynchronizationBarrier 0x1252 0x2
InitOnceBeginInitialize 0x128f 0x3
InitOnceComplete 0x12c1 0x4
InitOnceExecuteOnce 0x12ef 0x5
InitOnceInitialize 0x131f 0x6
InitializeConditionVariable 0x1357 0x7
InitializeSynchronizationBarrier 0x139d 0x8
SignalObjectAndWait 0x13db 0x9
Sleep 0x13fe 0xa
SleepConditionVariableCS 0x1426 0xb
SleepConditionVariableSRW 0x1462 0xc
WaitOnAddress 0x1493 0xd
WakeAllConditionVariable 0x14c3 0xe
WakeByAddressAll 0x14f6 0xf
WakeByAddressSingle 0x1524 0x10
WakeConditionVariable 0x1557 0x11
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-sysinfo-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-sysinfo-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.80 KB
MD5 19a40af040bd7add901aa967600259d9 Copy to Clipboard
SHA1 05b6322979b0b67526ae5cd6e820596cbe7393e4 Copy to Clipboard
SHA256 4b704b36e1672ae02e697efd1bf46f11b42d776550ba34a90cd189f6c5c61f92 Copy to Clipboard
SSDeep 384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8 Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x800
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2002-07-28 05:58:26+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x645 0x800 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.39
.rsrc 0x10002000 0x3f0 0x400 0xa00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (22)
»
Api name EAT Address Ordinal
GetComputerNameExA 0x123a 0x1
GetComputerNameExW 0x1269 0x2
GetLocalTime 0x1292 0x3
GetLogicalProcessorInformation 0x12c7 0x4
GetLogicalProcessorInformationEx 0x1310 0x5
GetSystemDirectoryA 0x134e 0x6
GetSystemDirectoryW 0x137f 0x7
GetSystemInfo 0x13aa 0x8
GetSystemTime 0x13cf 0x9
GetSystemTimeAdjustment 0x13fe 0xa
GetSystemTimeAsFileTime 0x1437 0xb
GetSystemWindowsDirectoryA 0x1473 0xc
GetSystemWindowsDirectoryW 0x14b2 0xd
GetTickCount 0x150a 0xf
GetTickCount64 0x14e5 0xe
GetVersion 0x152b 0x10
GetVersionExA 0x154d 0x11
GetVersionExW 0x1572 0x12
GetWindowsDirectoryA 0x159e 0x13
GetWindowsDirectoryW 0x15d1 0x14
GlobalMemoryStatusEx 0x1604 0x15
SetLocalTime 0x162f 0x16
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-timezone-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-timezone-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 babf80608fd68a09656871ec8597296c Copy to Clipboard
SHA1 33952578924b0376ca4ae6a10b8d4ed749d10688 Copy to Clipboard
SHA256 24c9aa0b70e557a49dac159c825a013a71a190df5e7a837bfa047a06bba59eca Copy to Clipboard
SSDeep 384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2034-03-22 16:36:28+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x3db 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.73
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (9)
»
Api name EAT Address Ordinal
FileTimeToSystemTime 0x11bb 0x1
GetDynamicTimeZoneInformation 0x11f7 0x2
GetTimeZoneInformation 0x1235 0x3
GetTimeZoneInformationForYear 0x1273 0x4
SetDynamicTimeZoneInformation 0x12b8 0x5
SetTimeZoneInformation 0x12f6 0x6
SystemTimeToFileTime 0x132b 0x7
SystemTimeToTzSpecificLocalTime 0x1369 0x8
TzSpecificLocalTimeToSystemTime 0x13b2 0x9
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-util-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-util-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 0f079489abd2b16751ceb7447512a70d Copy to Clipboard
SHA1 679dd712ed1c46fbd9bc8615598da585d94d5d87 Copy to Clipboard
SHA256 f7d450a0f59151bcefb98d20fcae35f76029df57138002db5651d1b6a33adc86 Copy to Clipboard
SSDeep 192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552 Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2061-02-14 06:53:13+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x229 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.0
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (5)
»
Api name EAT Address Ordinal
Beep 0x116f 0x1
DecodePointer 0x118b 0x2
DecodeSystemPointer 0x11b6 0x3
EncodePointer 0x11e1 0x4
EncodeSystemPointer 0x120c 0x5
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-conio-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-conio-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.80 KB
MD5 6ea692f862bdeb446e649e4b2893e36f Copy to Clipboard
SHA1 84fceae03d28ff1907048acee7eae7e45baaf2bd Copy to Clipboard
SHA256 9ca21763c528584bdb4efebe914faaf792c9d7360677c87e93bd7ba7bb4367f2 Copy to Clipboard
SSDeep 384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x800
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2059-10-13 02:38:07+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x6f0 0x800 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.46
.rsrc 0x10002000 0x3f0 0x400 0xa00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (30)
»
Api name EAT Address Ordinal
__conio_common_vcprintf 0x128c 0x1
__conio_common_vcprintf_p 0x12c7 0x2
__conio_common_vcprintf_s 0x1304 0x3
__conio_common_vcscanf 0x133e 0x4
__conio_common_vcwprintf 0x1377 0x5
__conio_common_vcwprintf_p 0x13b4 0x6
__conio_common_vcwprintf_s 0x13f3 0x7
__conio_common_vcwscanf 0x142f 0x8
_cgets 0x1457 0x9
_cgets_s 0x1470 0xa
_cgetws 0x148a 0xb
_cgetws_s 0x14a5 0xc
_cputs 0x14bf 0xd
_cputws 0x14d7 0xe
_getch 0x14ef 0xf
_getch_nolock 0x150d 0x10
_getche 0x152c 0x11
_getche_nolock 0x154c 0x12
_getwch 0x156c 0x13
_getwch_nolock 0x158c 0x14
_getwche 0x15ad 0x15
_getwche_nolock 0x15cf 0x16
_putch 0x15ef 0x17
_putch_nolock 0x160d 0x18
_putwch 0x162c 0x19
_putwch_nolock 0x164c 0x1a
_ungetch 0x166d 0x1b
_ungetch_nolock 0x168f 0x1c
_ungetwch 0x16b2 0x1d
_ungetwch_nolock 0x16d6 0x1e
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-convert-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-convert-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 21.80 KB
MD5 72e28c902cd947f9a3425b19ac5a64bd Copy to Clipboard
SHA1 9b97f7a43d43cb0f1b87fc75fef7d9eeea11e6f7 Copy to Clipboard
SHA256 3cc1377d495260c380e8d225e5ee889cbb2ed22e79862d4278cfa898e58e44d1 Copy to Clipboard
SSDeep 384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x1400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2073-04-13 15:13:55+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x12fe 0x1400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.7
.rsrc 0x10003000 0x3f0 0x400 0x1600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (122)
»
Api name EAT Address Ordinal
__toascii 0x1628 0x1
_atodbl 0x1643 0x2
_atodbl_l 0x165e 0x3
_atof_l 0x1679 0x4
_atoflt 0x1692 0x5
_atoflt_l 0x16ad 0x6
_atoi64 0x16c8 0x7
_atoi64_l 0x16e3 0x8
_atoi_l 0x16fe 0x9
_atol_l 0x1717 0xa
_atoldbl 0x1731 0xb
_atoldbl_l 0x174e 0xc
_atoll_l 0x176b 0xd
_ecvt 0x1783 0xe
_ecvt_s 0x179a 0xf
_fcvt 0x17b1 0x10
_fcvt_s 0x17c8 0x11
_gcvt 0x17df 0x12
_gcvt_s 0x17f6 0x13
_i64toa 0x180f 0x14
_i64toa_s 0x182a 0x15
_i64tow 0x1845 0x16
_i64tow_s 0x1860 0x17
_itoa 0x1879 0x18
_itoa_s 0x1890 0x19
_itow 0x18a7 0x1a
_itow_s 0x18be 0x1b
_ltoa 0x18d5 0x1c
_ltoa_s 0x18ec 0x1d
_ltow 0x1903 0x1e
_ltow_s 0x191a 0x1f
_strtod_l 0x1935 0x20
_strtof_l 0x1952 0x21
_strtoi64 0x196f 0x22
_strtoi64_l 0x198e 0x23
_strtoimax_l 0x19b0 0x24
_strtol_l 0x19d0 0x25
_strtold_l 0x19ee 0x26
_strtoll_l 0x1a0d 0x27
_strtoui64 0x1a2c 0x28
_strtoui64_l 0x1a4d 0x29
_strtoul_l 0x1a6e 0x2a
_strtoull_l 0x1a8e 0x2b
_strtoumax_l 0x1ab0 0x2c
_ui64toa 0x1acf 0x2d
_ui64toa_s 0x1aec 0x2e
_ui64tow 0x1b09 0x2f
_ui64tow_s 0x1b26 0x30
_ultoa 0x1b41 0x31
_ultoa_s 0x1b5a 0x32
_ultow 0x1b73 0x33
_ultow_s 0x1b8c 0x34
_wcstod_l 0x1ba8 0x35
_wcstof_l 0x1bc5 0x36
_wcstoi64 0x1be2 0x37
_wcstoi64_l 0x1c01 0x38
_wcstoimax_l 0x1c23 0x39
_wcstol_l 0x1c43 0x3a
_wcstold_l 0x1c61 0x3b
_wcstoll_l 0x1c80 0x3c
_wcstombs_l 0x1ca0 0x3d
_wcstombs_s_l 0x1cc3 0x3e
_wcstoui64 0x1ce5 0x3f
_wcstoui64_l 0x1d06 0x40
_wcstoul_l 0x1d27 0x41
_wcstoull_l 0x1d47 0x42
_wcstoumax_l 0x1d69 0x43
_wctomb_l 0x1d89 0x44
_wctomb_s_l 0x1da8 0x45
_wtof 0x1dc3 0x46
_wtof_l 0x1dda 0x47
_wtoi 0x1df1 0x48
_wtoi64 0x1e08 0x49
_wtoi64_l 0x1e23 0x4a
_wtoi_l 0x1e3e 0x4b
_wtol 0x1e55 0x4c
_wtol_l 0x1e6c 0x4d
_wtoll 0x1e84 0x4e
_wtoll_l 0x1e9d 0x4f
atof 0x1eb4 0x50
atoi 0x1ec7 0x51
atol 0x1eda 0x52
atoll 0x1eee 0x53
btowc 0x1f03 0x54
c16rtomb 0x1f1b 0x55
c32rtomb 0x1f36 0x56
mbrtoc16 0x1f51 0x57
mbrtoc32 0x1f6c 0x58
mbrtowc 0x1f86 0x59
mbsrtowcs 0x1fa1 0x5a
mbsrtowcs_s 0x1fc0 0x5b
mbstowcs 0x1fde 0x5c
mbstowcs_s 0x1ffb 0x5d
mbtowc 0x2016 0x5e
strtod 0x202d 0x5f
strtof 0x2044 0x60
strtoimax 0x205e 0x61
strtol 0x2078 0x62
strtold 0x2090 0x63
strtoll 0x20a9 0x64
strtoul 0x20c2 0x65
strtoull 0x20dc 0x66
strtoumax 0x20f8 0x67
wcrtomb 0x2113 0x68
wcrtomb_s 0x212e 0x69
wcsrtombs 0x214b 0x6a
wcsrtombs_s 0x216a 0x6b
wcstod 0x2186 0x6c
wcstof 0x219d 0x6d
wcstoimax 0x21b7 0x6e
wcstol 0x21d1 0x6f
wcstold 0x21e9 0x70
wcstoll 0x2202 0x71
wcstombs 0x221c 0x72
wcstombs_s 0x2239 0x73
wcstoul 0x2255 0x74
wcstoull 0x226f 0x75
wcstoumax 0x228b 0x76
wctob 0x22a4 0x77
wctomb 0x22ba 0x78
wctomb_s 0x22d3 0x79
wctrans 0x22ed 0x7a
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-environment-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-environment-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 ac290dad7cb4ca2d93516580452eda1c Copy to Clipboard
SHA1 fa949453557d0049d723f9615e4f390010520eda Copy to Clipboard
SHA256 c0d75d1887c32a1b1006b3cffc29df84a0d73c435cdcb404b6964be176a61382 Copy to Clipboard
SSDeep 192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2 Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1972-04-21 12:19:18+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x432 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.67
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (18)
»
Api name EAT Address Ordinal
__p__environ 0x121f 0x1
__p__wenviron 0x1243 0x2
_dupenv_s 0x1264 0x3
_putenv 0x127f 0x4
_putenv_s 0x129a 0x5
_searchenv 0x12b8 0x6
_searchenv_s 0x12d9 0x7
_wdupenv_s 0x12fa 0x8
_wgetcwd 0x1317 0x9
_wgetdcwd 0x1333 0xa
_wgetenv 0x134f 0xb
_wgetenv_s 0x136c 0xc
_wputenv 0x1389 0xd
_wputenv_s 0x13a6 0xe
_wsearchenv 0x13c6 0xf
_wsearchenv_s 0x13e9 0x10
getenv 0x1407 0x11
getenv_s 0x1420 0x12
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-filesystem-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-filesystem-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 19.80 KB
MD5 aec2268601470050e62cb8066dd41a59 Copy to Clipboard
SHA1 363ed259905442c4e3b89901bfd8a43b96bf25e4 Copy to Clipboard
SHA256 7633774effe7c0add6752ffe90104d633fc8262c87871d096c2fc07c20018ed2 Copy to Clipboard
SSDeep 384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/ Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0xc00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2025-08-26 11:12:21+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xbc0 0xc00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.99
.rsrc 0x10002000 0x3f0 0x400 0xe00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (65)
»
Api name EAT Address Ordinal
_access 0x13ef 0x1
_access_s 0x140a 0x2
_chdir 0x1424 0x3
_chdrive 0x143d 0x4
_chmod 0x1456 0x5
_findclose 0x1471 0x6
_findfirst32 0x1492 0x7
_findfirst32i64 0x14b8 0x8
_findfirst64 0x14de 0x9
_findfirst64i32 0x1504 0xa
_findnext32 0x1529 0xb
_findnext32i64 0x154d 0xc
_findnext64 0x1571 0xd
_findnext64i32 0x1595 0xe
_fstat32 0x15b6 0xf
_fstat32i64 0x15d4 0x10
_fstat64 0x15f2 0x11
_fstat64i32 0x1610 0x12
_fullpath 0x162f 0x13
_getdiskfree 0x164f 0x14
_getdrive 0x166f 0x15
_getdrives 0x168d 0x16
_lock_file 0x16ac 0x17
_makepath 0x16ca 0x18
_makepath_s 0x16e9 0x19
_mkdir 0x1705 0x1a
_rmdir 0x171c 0x1b
_splitpath 0x1737 0x1c
_splitpath_s 0x1758 0x1d
_stat32 0x1776 0x1e
_stat32i64 0x1792 0x1f
_stat64 0x17ae 0x20
_stat64i32 0x17ca 0x21
_umask 0x17e5 0x22
_umask_s 0x17fe 0x23
_unlink 0x1818 0x24
_unlock_file 0x1836 0x25
_waccess 0x1855 0x26
_waccess_s 0x1872 0x27
_wchdir 0x188e 0x28
_wchmod 0x18a7 0x29
_wfindfirst32 0x18c6 0x2a
_wfindfirst32i64 0x18ee 0x2b
_wfindfirst64 0x1916 0x2c
_wfindfirst64i32 0x193e 0x2d
_wfindnext32 0x1965 0x2e
_wfindnext32i64 0x198b 0x2f
_wfindnext64 0x19b1 0x30
_wfindnext64i32 0x19d7 0x31
_wfullpath 0x19fb 0x32
_wmakepath 0x1a1a 0x33
_wmakepath_s 0x1a3b 0x34
_wmkdir 0x1a59 0x35
_wremove 0x1a73 0x36
_wrename 0x1a8e 0x37
_wrmdir 0x1aa8 0x38
_wsplitpath 0x1ac5 0x39
_wsplitpath_s 0x1ae8 0x3a
_wstat32 0x1b08 0x3b
_wstat32i64 0x1b26 0x3c
_wstat64 0x1b44 0x3d
_wstat64i32 0x1b62 0x3e
_wunlink 0x1b80 0x3f
remove 0x1b99 0x40
rename 0x1bb0 0x41
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-heap-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-heap-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.80 KB
MD5 93d3da06bf894f4fa21007bee06b5e7d Copy to Clipboard
SHA1 1e47230a7ebcfaf643087a1929a385e0d554ad15 Copy to Clipboard
SHA256 f5cf623ba14b017af4aec6c15eee446c647ab6d2a5dee9d6975adc69994a113d Copy to Clipboard
SSDeep 192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x800
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1987-03-31 17:26:34+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x616 0x800 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.05
.rsrc 0x10002000 0x3f0 0x400 0xa00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (27)
»
Api name EAT Address Ordinal
_aligned_free 0x1263 0x1
_aligned_malloc 0x128a 0x2
_aligned_msize 0x12b2 0x3
_aligned_offset_malloc 0x12e1 0x4
_aligned_offset_realloc 0x1319 0x5
_aligned_offset_recalloc 0x1353 0x6
_aligned_realloc 0x1386 0x7
_aligned_recalloc 0x13b2 0x8
_callnewh 0x13d7 0x9
_calloc_base 0x13f7 0xa
_expand 0x1415 0xb
_free_base 0x1431 0xc
_get_heap_handle 0x1456 0xd
_heapchk 0x1479 0xe
_heapmin 0x1494 0xf
_heapwalk 0x14b0 0x10
_malloc_base 0x14d0 0x11
_msize 0x14ed 0x12
_query_new_handler 0x1510 0x13
_query_new_mode 0x153c 0x14
_realloc_base 0x1563 0x15
_recalloc 0x1584 0x16
_set_new_mode 0x15a5 0x17
calloc 0x15c3 0x18
free 0x15d8 0x19
malloc 0x15ed 0x1a
realloc 0x1605 0x1b
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-locale-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-locale-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 a2f2258c32e3ba9abf9e9e38ef7da8c9 Copy to Clipboard
SHA1 116846ca871114b7c54148ab2d968f364da6142f Copy to Clipboard
SHA256 565a2eec5449eeeed68b430f2e9b92507f979174f9c9a71d0c36d58b96051c33 Copy to Clipboard
SSDeep 192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0 Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2012-06-17 17:10:20+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x575 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.47
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (20)
»
Api name EAT Address Ordinal
___lc_codepage_func 0x1235 0x1
___lc_collate_cp_func 0x1268 0x2
___lc_locale_name_func 0x129e 0x3
___mb_cur_max_func 0x12d1 0x4
___mb_cur_max_l_func 0x1302 0x5
__initialize_lconv_for_unsigned_char 0x1345 0x6
__pctype_func 0x1381 0x7
__pwctype_func 0x13a7 0x8
_configthreadlocale 0x13d3 0x9
_create_locale 0x13ff 0xa
_free_locale 0x1424 0xb
_get_current_locale 0x144e 0xc
_getmbcp 0x1474 0xd
_lock_locales 0x1494 0xe
_setmbcp 0x14b4 0xf
_unlock_locales 0x14d6 0x10
_wcreate_locale 0x14ff 0x11
_wsetlocale 0x1524 0x12
localeconv 0x1544 0x13
setlocale 0x1562 0x14
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-math-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-math-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 28.30 KB
MD5 8b0ba750e7b15300482ce6c961a932f0 Copy to Clipboard
SHA1 71a2f5d76d23e48cef8f258eaad63e586cfc0e19 Copy to Clipboard
SHA256 bece7bab83a5d0ec5c35f0841cbbf413e01ac878550fbdb34816ed55185dcfed Copy to Clipboard
SSDeep 384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x2e00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1982-09-29 08:09:06+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x2cd7 0x2e00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.07
.rsrc 0x10004000 0x3f0 0x400 0x3000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (314)
»
Api name EAT Address Ordinal
_CIacos 0x1d93 0x1
_CIasin 0x1dac 0x2
_CIatan 0x1dc5 0x3
_CIatan2 0x1ddf 0x4
_CIcos 0x1df8 0x5
_CIcosh 0x1e10 0x6
_CIexp 0x1e28 0x7
_CIfmod 0x1e40 0x8
_CIlog 0x1e58 0x9
_CIlog10 0x1e71 0xa
_CIpow 0x1e8a 0xb
_CIsin 0x1ea1 0xc
_CIsinh 0x1eb9 0xd
_CIsqrt 0x1ed2 0xe
_CItan 0x1eea 0xf
_CItanh 0x1f02 0x10
_Cbuild 0x1f1b 0x11
_Cmulcc 0x1f34 0x12
_Cmulcr 0x1f4d 0x13
_FCbuild 0x1f67 0x14
_FCmulcc 0x1f82 0x15
_FCmulcr 0x1f9d 0x16
_LCbuild 0x1fb8 0x17
_LCmulcc 0x1fd3 0x18
_LCmulcr 0x1fee 0x19
__libm_sse2_acos 0x2011 0x1a
__libm_sse2_acosf 0x203d 0x1b
__libm_sse2_asin 0x2069 0x1c
__libm_sse2_asinf 0x2095 0x1d
__libm_sse2_atan 0x20c1 0x1e
__libm_sse2_atan2 0x20ed 0x1f
__libm_sse2_atanf 0x211a 0x20
__libm_sse2_cos 0x2145 0x21
__libm_sse2_cosf 0x216f 0x22
__libm_sse2_exp 0x2199 0x23
__libm_sse2_expf 0x21c3 0x24
__libm_sse2_log 0x21ed 0x25
__libm_sse2_log10 0x2218 0x26
__libm_sse2_log10f 0x2246 0x27
__libm_sse2_logf 0x2273 0x28
__libm_sse2_pow 0x229d 0x29
__libm_sse2_powf 0x22c7 0x2a
__libm_sse2_sin 0x22f1 0x2b
__libm_sse2_sinf 0x231b 0x2c
__libm_sse2_tan 0x2345 0x2d
__libm_sse2_tanf 0x236f 0x2e
__setusermatherr 0x239a 0x2f
_cabs 0x23ba 0x30
_chgsign 0x23d2 0x31
_chgsignf 0x23ee 0x32
_copysign 0x240b 0x33
_copysignf 0x2429 0x34
_d_int 0x2444 0x35
_dclass 0x245c 0x36
_dexp 0x2473 0x37
_dlog 0x2488 0x38
_dnorm 0x249e 0x39
_dpcomp 0x24b6 0x3a
_dpoly 0x24ce 0x3b
_dscale 0x24e6 0x3c
_dsign 0x24fe 0x3d
_dsin 0x2514 0x3e
_dtest 0x252a 0x3f
_dunscale 0x2544 0x40
_except1 0x2560 0x41
_fd_int 0x257a 0x42
_fdclass 0x2594 0x43
_fdexp 0x25ad 0x44
_fdlog 0x25c4 0x45
_fdnorm 0x25dc 0x46
_fdopen 0x25f5 0x47
_fdpcomp 0x260f 0x48
_fdpoly 0x2629 0x49
_fdscale 0x2643 0x4a
_fdsign 0x265d 0x4b
_fdsin 0x2675 0x4c
_fdtest 0x268d 0x4d
_fdunscale 0x26a9 0x4e
_finite 0x26c5 0x4f
_fpclass 0x26df 0x50
_ftol 0x26f7 0x51
_hypot 0x270d 0x52
_hypotf 0x2725 0x53
_isnan 0x273d 0x54
_j0 0x2751 0x55
_j1 0x2762 0x56
_jn 0x2773 0x57
_ld_int 0x2788 0x58
_ldclass 0x27a2 0x59
_ldexp 0x27bb 0x5a
_ldlog 0x27d2 0x5b
_ldpcomp 0x27eb 0x5c
_ldpoly 0x2805 0x5d
_ldscale 0x281f 0x5e
_ldsign 0x2839 0x5f
_ldsin 0x2851 0x60
_ldtest 0x2869 0x61
_ldunscale 0x2885 0x62
_libm_sse2_acos_precise 0x28b1 0x63
_libm_sse2_asin_precise 0x28ea 0x64
_libm_sse2_atan_precise 0x2923 0x65
_libm_sse2_cos_precise 0x295b 0x66
_libm_sse2_exp_precise 0x2992 0x67
_libm_sse2_log10_precise 0x29cb 0x68
_libm_sse2_log_precise 0x2a04 0x69
_libm_sse2_pow_precise 0x2a3b 0x6a
_libm_sse2_sin_precise 0x2a72 0x6b
_libm_sse2_sqrt_precise 0x2aaa 0x6c
_libm_sse2_tan_precise 0x2ae2 0x6d
_logb 0x2b08 0x6e
_nextafter 0x2b22 0x6f
_scalb 0x2b3d 0x70
_set_SSE2_enable 0x2b5e 0x71
_y0 0x2b7c 0x72
_y1 0x2b8d 0x73
_yn 0x2b9e 0x74
acos 0x2bb0 0x75
acosh 0x2bc4 0x76
acoshf 0x2bda 0x77
acoshl 0x2bf1 0x78
asin 0x2c06 0x79
asinh 0x2c1a 0x7a
asinhf 0x2c30 0x7b
asinhl 0x2c47 0x7c
atan 0x2c5c 0x7d
atan2 0x2c70 0x7e
atanh 0x2c85 0x7f
atanhf 0x2c9b 0x80
atanhl 0x2cb2 0x81
cabs 0x2cc7 0x82
cabsf 0x2cdb 0x83
cabsl 0x2cf0 0x84
cacos 0x2d05 0x85
cacosf 0x2d1b 0x86
cacosh 0x2d32 0x87
cacoshf 0x2d4a 0x88
cacoshl 0x2d63 0x89
cacosl 0x2d7b 0x8a
carg 0x2d90 0x8b
cargf 0x2da4 0x8c
cargl 0x2db9 0x8d
casin 0x2dce 0x8e
casinf 0x2de4 0x8f
casinh 0x2dfb 0x90
casinhf 0x2e13 0x91
casinhl 0x2e2c 0x92
casinl 0x2e44 0x93
catan 0x2e5a 0x94
catanf 0x2e70 0x95
catanh 0x2e87 0x96
catanhf 0x2e9f 0x97
catanhl 0x2eb8 0x98
catanl 0x2ed0 0x99
cbrt 0x2ee5 0x9a
cbrtf 0x2ef9 0x9b
cbrtl 0x2f0e 0x9c
ccos 0x2f22 0x9d
ccosf 0x2f36 0x9e
ccosh 0x2f4b 0x9f
ccoshf 0x2f61 0xa0
ccoshl 0x2f78 0xa1
ccosl 0x2f8e 0xa2
ceil 0x2fa2 0xa3
cexp 0x2fb5 0xa4
cexpf 0x2fc9 0xa5
cexpl 0x2fde 0xa6
cimag 0x2ff3 0xa7
cimagf 0x3009 0xa8
cimagl 0x3020 0xa9
clog 0x3035 0xaa
clog10 0x304a 0xab
clog10f 0x3062 0xac
clog10l 0x307b 0xad
clogf 0x3092 0xae
clogl 0x30a7 0xaf
conj 0x30bb 0xb0
conjf 0x30cf 0xb1
conjl 0x30e4 0xb2
copysign 0x30fc 0xb3
copysignf 0x3118 0xb4
copysignl 0x3135 0xb5
cos 0x314c 0xb6
cosh 0x315e 0xb7
cpow 0x3171 0xb8
cpowf 0x3185 0xb9
cpowl 0x319a 0xba
cproj 0x31af 0xbb
cprojf 0x31c5 0xbc
cprojl 0x31dc 0xbd
creal 0x31f2 0xbe
crealf 0x3208 0xbf
creall 0x321f 0xc0
csin 0x3234 0xc1
csinf 0x3248 0xc2
csinh 0x325d 0xc3
csinhf 0x3273 0xc4
csinhl 0x328a 0xc5
csinl 0x32a0 0xc6
csqrt 0x32b5 0xc7
csqrtf 0x32cb 0xc8
csqrtl 0x32e2 0xc9
ctan 0x32f7 0xca
ctanf 0x330b 0xcb
ctanh 0x3320 0xcc
ctanhf 0x3336 0xcd
ctanhl 0x334d 0xce
ctanl 0x3363 0xcf
erf 0x3376 0xd0
erfc 0x3388 0xd1
erfcf 0x339c 0xd2
erfcl 0x33b1 0xd3
erff 0x33c5 0xd4
erfl 0x33d8 0xd5
exp 0x33ea 0xd6
exp2 0x33fc 0xd7
exp2f 0x3410 0xd8
exp2l 0x3425 0xd9
expm1 0x343a 0xda
expm1f 0x3450 0xdb
expm1l 0x3467 0xdc
fabs 0x347c 0xdd
fdim 0x348f 0xde
fdimf 0x34a3 0xdf
fdiml 0x34b8 0xe0
floor 0x34cd 0xe1
fma 0x34e0 0xe2
fmaf 0x34f2 0xe3
fmal 0x3505 0xe4
fmax 0x3518 0xe5
fmaxf 0x352c 0xe6
fmaxl 0x3541 0xe7
fmin 0x3555 0xe8
fminf 0x3569 0xe9
fminl 0x357e 0xea
fmod 0x3592 0xeb
frexp 0x35a6 0xec
hypot 0x35bb 0xed
ilogb 0x35d0 0xee
ilogbf 0x35e6 0xef
ilogbl 0x35fd 0xf0
ldexp 0x3613 0xf1
lgamma 0x3629 0xf2
lgammaf 0x3641 0xf3
lgammal 0x365a 0xf4
llrint 0x3672 0xf5
llrintf 0x368a 0xf6
llrintl 0x36a3 0xf7
llround 0x36bc 0xf8
llroundf 0x36d6 0xf9
llroundl 0x36f1 0xfa
log 0x3707 0xfb
log10 0x371a 0xfc
log1p 0x372f 0xfd
log1pf 0x3745 0xfe
log1pl 0x375c 0xff
log2 0x3771 0x100
log2f 0x3785 0x101
log2l 0x379a 0x102
logb 0x37ae 0x103
logbf 0x37c2 0x104
logbl 0x37d7 0x105
lrint 0x37ec 0x106
lrintf 0x3802 0x107
lrintl 0x3819 0x108
lround 0x3830 0x109
lroundf 0x3848 0x10a
lroundl 0x3861 0x10b
modf 0x3877 0x10c
nan 0x3889 0x10d
nanf 0x389b 0x10e
nanl 0x38ae 0x10f
nearbyint 0x38c6 0x110
nearbyintf 0x38e4 0x111
nearbyintl 0x3903 0x112
nextafter 0x3921 0x113
nextafterf 0x393f 0x114
nextafterl 0x395e 0x115
nexttoward 0x397d 0x116
nexttowardf 0x399d 0x117
nexttowardl 0x39be 0x118
norm 0x39d8 0x119
normf 0x39ec 0x11a
norml 0x3a01 0x11b
pow 0x3a14 0x11c
powf 0x3a26 0x11d
remainder 0x3a3e 0x11e
remainderf 0x3a5c 0x11f
remainderl 0x3a7b 0x120
remquo 0x3a96 0x121
remquof 0x3aae 0x122
remquol 0x3ac7 0x123
rint 0x3add 0x124
rintf 0x3af1 0x125
rintl 0x3b06 0x126
round 0x3b1b 0x127
roundf 0x3b31 0x128
roundl 0x3b48 0x129
scalbln 0x3b60 0x12a
scalblnf 0x3b7a 0x12b
scalblnl 0x3b95 0x12c
scalbn 0x3bae 0x12d
scalbnf 0x3bc6 0x12e
scalbnl 0x3bdf 0x12f
sin 0x3bf4 0x130
sinh 0x3c06 0x131
sqrt 0x3c19 0x132
tan 0x3c2b 0x133
tanh 0x3c3d 0x134
tgamma 0x3c52 0x135
tgammaf 0x3c6a 0x136
tgammal 0x3c83 0x137
trunc 0x3c9a 0x138
truncf 0x3cb0 0x139
truncl 0x3cc7 0x13a
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-multibyte-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-multibyte-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 25.80 KB
MD5 35fc66bd813d0f126883e695664e7b83 Copy to Clipboard
SHA1 2fd63c18cc5dc4defc7ea82f421050e668f68548 Copy to Clipboard
SHA256 66abf3a1147751c95689f5bc6a259e55281ec3d06d3332dd0ba464effa716735 Copy to Clipboard
SSDeep 384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x2400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2054-08-12 16:00:10+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x2204 0x2400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.68
.rsrc 0x10004000 0x3f0 0x400 0x2600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (200)
»
Api name EAT Address Ordinal
__p__mbcasemap 0x193b 0x1
__p__mbctype 0x1960 0x2
_ismbbalnum 0x1982 0x3
_ismbbalnum_l 0x19a5 0x4
_ismbbalpha 0x19c8 0x5
_ismbbalpha_l 0x19eb 0x6
_ismbbblank 0x1a0e 0x7
_ismbbblank_l 0x1a31 0x8
_ismbbgraph 0x1a54 0x9
_ismbbgraph_l 0x1a77 0xa
_ismbbkalnum 0x1a9b 0xb
_ismbbkalnum_l 0x1ac0 0xc
_ismbbkana 0x1ae3 0xd
_ismbbkana_l 0x1b04 0xe
_ismbbkprint 0x1b27 0xf
_ismbbkprint_l 0x1b4c 0x10
_ismbbkpunct 0x1b71 0x11
_ismbbkpunct_l 0x1b96 0x12
_ismbblead 0x1bb9 0x13
_ismbblead_l 0x1bda 0x14
_ismbbprint 0x1bfc 0x15
_ismbbprint_l 0x1c1f 0x16
_ismbbpunct 0x1c42 0x17
_ismbbpunct_l 0x1c65 0x18
_ismbbtrail 0x1c88 0x19
_ismbbtrail_l 0x1cab 0x1a
_ismbcalnum 0x1cce 0x1b
_ismbcalnum_l 0x1cf1 0x1c
_ismbcalpha 0x1d14 0x1d
_ismbcalpha_l 0x1d37 0x1e
_ismbcblank 0x1d5a 0x1f
_ismbcblank_l 0x1d7d 0x20
_ismbcdigit 0x1da0 0x21
_ismbcdigit_l 0x1dc3 0x22
_ismbcgraph 0x1de6 0x23
_ismbcgraph_l 0x1e09 0x24
_ismbchira 0x1e2b 0x25
_ismbchira_l 0x1e4c 0x26
_ismbckata 0x1e6d 0x27
_ismbckata_l 0x1e8e 0x28
_ismbcl0 0x1ead 0x29
_ismbcl0_l 0x1eca 0x2a
_ismbcl1 0x1ee7 0x2b
_ismbcl1_l 0x1f04 0x2c
_ismbcl2 0x1f21 0x2d
_ismbcl2_l 0x1f3e 0x2e
_ismbclegal 0x1f5e 0x2f
_ismbclegal_l 0x1f81 0x30
_ismbclower 0x1fa4 0x31
_ismbclower_l 0x1fc7 0x32
_ismbcprint 0x1fea 0x33
_ismbcprint_l 0x200d 0x34
_ismbcpunct 0x2030 0x35
_ismbcpunct_l 0x2053 0x36
_ismbcspace 0x2076 0x37
_ismbcspace_l 0x2099 0x38
_ismbcsymbol 0x20bd 0x39
_ismbcsymbol_l 0x20e2 0x3a
_ismbcupper 0x2106 0x3b
_ismbcupper_l 0x2129 0x3c
_ismbslead 0x214b 0x3d
_ismbslead_l 0x216c 0x3e
_ismbstrail 0x218e 0x3f
_ismbstrail_l 0x21b1 0x40
_mbbtombc 0x21d2 0x41
_mbbtombc_l 0x21f1 0x42
_mbbtype 0x220f 0x43
_mbbtype_l 0x222c 0x44
_mbcasemap 0x224b 0x45
_mbccpy 0x2267 0x46
_mbccpy_l 0x2282 0x47
_mbccpy_s 0x229f 0x48
_mbccpy_s_l 0x22be 0x49
_mbcjistojms 0x22e0 0x4a
_mbcjistojms_l 0x2305 0x4b
_mbcjmstojis 0x232a 0x4c
_mbcjmstojis_l 0x234f 0x4d
_mbclen 0x236f 0x4e
_mbclen_l 0x238a 0x4f
_mbctohira 0x23a8 0x50
_mbctohira_l 0x23c9 0x51
_mbctokata 0x23ea 0x52
_mbctokata_l 0x240b 0x53
_mbctolower 0x242d 0x54
_mbctolower_l 0x2450 0x55
_mbctombb 0x2471 0x56
_mbctombb_l 0x2490 0x57
_mbctoupper 0x24b1 0x58
_mbctoupper_l 0x24d4 0x59
_mblen_l 0x24f4 0x5a
_mbsbtype 0x2510 0x5b
_mbsbtype_l 0x252f 0x5c
_mbscat_s 0x254e 0x5d
_mbscat_s_l 0x256d 0x5e
_mbschr 0x258a 0x5f
_mbschr_l 0x25a5 0x60
_mbscmp 0x25c0 0x61
_mbscmp_l 0x25db 0x62
_mbscoll 0x25f7 0x63
_mbscoll_l 0x2614 0x64
_mbscpy_s 0x2632 0x65
_mbscpy_s_l 0x2651 0x66
_mbscspn 0x266f 0x67
_mbscspn_l 0x268c 0x68
_mbsdec 0x26a8 0x69
_mbsdec_l 0x26c3 0x6a
_mbsdup 0x26de 0x6b
_mbsicmp 0x26f8 0x6c
_mbsicmp_l 0x2715 0x6d
_mbsicoll 0x2733 0x6e
_mbsicoll_l 0x2752 0x6f
_mbsinc 0x276f 0x70
_mbsinc_l 0x278a 0x71
_mbslen 0x27a5 0x72
_mbslen_l 0x27c0 0x73
_mbslwr 0x27db 0x74
_mbslwr_l 0x27f6 0x75
_mbslwr_s 0x2813 0x76
_mbslwr_s_l 0x2832 0x77
_mbsnbcat 0x2851 0x78
_mbsnbcat_l 0x2870 0x79
_mbsnbcat_s 0x2891 0x7a
_mbsnbcat_s_l 0x28b4 0x7b
_mbsnbcmp 0x28d5 0x7c
_mbsnbcmp_l 0x28f4 0x7d
_mbsnbcnt 0x2913 0x7e
_mbsnbcnt_l 0x2932 0x7f
_mbsnbcoll 0x2952 0x80
_mbsnbcoll_l 0x2973 0x81
_mbsnbcpy 0x2993 0x82
_mbsnbcpy_l 0x29b2 0x83
_mbsnbcpy_s 0x29d3 0x84
_mbsnbcpy_s_l 0x29f6 0x85
_mbsnbicmp 0x2a18 0x86
_mbsnbicmp_l 0x2a39 0x87
_mbsnbicoll 0x2a5b 0x88
_mbsnbicoll_l 0x2a7e 0x89
_mbsnbset 0x2a9f 0x8a
_mbsnbset_l 0x2abe 0x8b
_mbsnbset_s 0x2adf 0x8c
_mbsnbset_s_l 0x2b02 0x8d
_mbsncat 0x2b22 0x8e
_mbsncat_l 0x2b3f 0x8f
_mbsncat_s 0x2b5e 0x90
_mbsncat_s_l 0x2b7f 0x91
_mbsnccnt 0x2b9f 0x92
_mbsnccnt_l 0x2bbe 0x93
_mbsncmp 0x2bdc 0x94
_mbsncmp_l 0x2bf9 0x95
_mbsncoll 0x2c17 0x96
_mbsncoll_l 0x2c36 0x97
_mbsncpy 0x2c54 0x98
_mbsncpy_l 0x2c71 0x99
_mbsncpy_s 0x2c90 0x9a
_mbsncpy_s_l 0x2cb1 0x9b
_mbsnextc 0x2cd1 0x9c
_mbsnextc_l 0x2cf0 0x9d
_mbsnicmp 0x2d0f 0x9e
_mbsnicmp_l 0x2d2e 0x9f
_mbsnicoll 0x2d4e 0xa0
_mbsnicoll_l 0x2d6f 0xa1
_mbsninc 0x2d8e 0xa2
_mbsninc_l 0x2dab 0xa3
_mbsnlen 0x2dc8 0xa4
_mbsnlen_l 0x2de5 0xa5
_mbsnset 0x2e02 0xa6
_mbsnset_l 0x2e1f 0xa7
_mbsnset_s 0x2e3e 0xa8
_mbsnset_s_l 0x2e5f 0xa9
_mbspbrk 0x2e7e 0xaa
_mbspbrk_l 0x2e9b 0xab
_mbsrchr 0x2eb8 0xac
_mbsrchr_l 0x2ed5 0xad
_mbsrev 0x2ef1 0xae
_mbsrev_l 0x2f0c 0xaf
_mbsset 0x2f27 0xb0
_mbsset_l 0x2f42 0xb1
_mbsset_s 0x2f5f 0xb2
_mbsset_s_l 0x2f7e 0xb3
_mbsspn 0x2f9b 0xb4
_mbsspn_l 0x2fb6 0xb5
_mbsspnp 0x2fd2 0xb6
_mbsspnp_l 0x2fef 0xb7
_mbsstr 0x300b 0xb8
_mbsstr_l 0x3026 0xb9
_mbstok 0x3041 0xba
_mbstok_l 0x305c 0xbb
_mbstok_s 0x3079 0xbc
_mbstok_s_l 0x3098 0xbd
_mbstowcs_l 0x30b9 0xbe
_mbstowcs_s_l 0x30dc 0xbf
_mbstrlen 0x30fd 0xc0
_mbstrlen_l 0x311c 0xc1
_mbstrnlen 0x313c 0xc2
_mbstrnlen_l 0x315d 0xc3
_mbsupr 0x317b 0xc4
_mbsupr_l 0x3196 0xc5
_mbsupr_s 0x31b3 0xc6
_mbsupr_s_l 0x31d2 0xc7
_mbtowc_l 0x31f1 0xc8
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-private-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-private-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 71.30 KB
MD5 9910a1bfdc41c5b39f6af37f0a22aacd Copy to Clipboard
SHA1 47fa76778556f34a5e7910c816c78835109e4050 Copy to Clipboard
SHA256 65ded8d2ce159b2f5569f55b2caf0e2c90f3694bd88c89de790a15a49d8386b9 Copy to Clipboard
SSDeep 1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0xda00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1996-03-31 17:57:49+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xd8ba 0xda00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.05
.rsrc 0x1000f000 0x3f0 0x400 0xdc00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (1164)
»
Api name EAT Address Ordinal
_CreateFrameInfo 0x3ee3 0x1
_CxxThrowException 0x3f10 0x2
_EH_prolog 0x3f37 0x3
_FindAndUnlinkFrame 0x3f5f 0x4
_IsExceptionObjectToBeDestroyed 0x3f9c 0x5
_NLG_Dispatch2 0x3fd4 0x6
_NLG_Return 0x3ff8 0x7
_NLG_Return2 0x401a 0x8
_SetWinRTOutOfMemoryExceptionCallback 0x4056 0x9
__AdjustPointer 0x4095 0xa
__BuildCatchObject 0x40c1 0xb
__BuildCatchObjectHelper 0x40f6 0xc
__CxxDetectRethrow 0x412b 0xd
__CxxExceptionFilter 0x415c 0xe
__CxxFrameHandler 0x418c 0xf
__CxxFrameHandler2 0x41ba 0x10
__CxxFrameHandler3 0x41e9 0x11
__CxxLongjmpUnwind 0x4218 0x12
__CxxQueryExceptionSize 0x424c 0x13
__CxxRegisterExceptionObject 0x428a 0x14
__CxxUnregisterExceptionObject 0x42cf 0x15
__DestructExceptionObject 0x4311 0x16
__FrameUnwindFilter 0x4348 0x17
__GetPlatformExceptionInfo 0x4380 0x18
__RTCastToVoid 0x43b3 0x19
__RTDynamicCast 0x43db 0x1a
__RTtypeid 0x43ff 0x1b
__TypeMatch 0x441f 0x1c
__current_exception 0x4448 0x1d
__current_exception_context 0x4481 0x1e
__dcrt_get_wide_environment_from_os 0x44ca 0x1f
__dcrt_initial_narrow_environment 0x4519 0x20
__intrinsic_abnormal_termination 0x4565 0x21
__intrinsic_setjmp 0x45a2 0x22
__processing_throw 0x45d1 0x23
__report_gsfailure 0x4600 0x24
__std_exception_copy 0x4631 0x25
__std_exception_destroy 0x4667 0x26
__std_terminate 0x4698 0x27
__std_type_info_compare 0x46c9 0x28
__std_type_info_destroy_list 0x4707 0x29
__std_type_info_hash 0x4742 0x2a
__std_type_info_name 0x4775 0x2b
__unDName 0x479d 0x2c
__unDNameEx 0x47bc 0x2d
__uncaught_exception 0x47e6 0x2e
__uncaught_exceptions 0x481a 0x2f
_chkesp 0x4841 0x30
_except_handler2 0x4863 0x31
_except_handler3 0x488e 0x32
_except_handler4_common 0x48c0 0x33
_get_purecall_handler 0x48f7 0x34
_get_unexpected 0x4926 0x35
_global_unwind2 0x494f 0x36
_is_exception_typeof 0x497d 0x37
_local_unwind2 0x49aa 0x38
_local_unwind4 0x49d1 0x39
_longjmpex 0x49f4 0x3a
_o__CIacos 0x4a13 0x3b
_o__CIasin 0x4a32 0x3c
_o__CIatan 0x4a51 0x3d
_o__CIatan2 0x4a71 0x3e
_o__CIcos 0x4a90 0x3f
_o__CIcosh 0x4aae 0x40
_o__CIexp 0x4acc 0x41
_o__CIfmod 0x4aea 0x42
_o__CIlog 0x4b08 0x43
_o__CIlog10 0x4b27 0x44
_o__CIpow 0x4b46 0x45
_o__CIsin 0x4b63 0x46
_o__CIsinh 0x4b81 0x47
_o__CIsqrt 0x4ba0 0x48
_o__CItan 0x4bbe 0x49
_o__CItanh 0x4bdc 0x4a
_o__Getdays 0x4bfc 0x4b
_o__Getmonths 0x4c1f 0x4c
_o__Gettnames 0x4c44 0x4d
_o__Strftime 0x4c68 0x4e
_o__W_Getdays 0x4c8c 0x4f
_o__W_Getmonths 0x4cb3 0x50
_o__W_Gettnames 0x4cdc 0x51
_o__Wcsftime 0x4d02 0x52
_o____lc_codepage_func 0x4d2f 0x53
_o____lc_collate_cp_func 0x4d68 0x54
_o____lc_locale_name_func 0x4da4 0x55
_o____mb_cur_max_func 0x4ddd 0x56
_o___acrt_iob_func 0x4e0f 0x57
_o___conio_common_vcprintf 0x4e46 0x58
_o___conio_common_vcprintf_p 0x4e87 0x59
_o___conio_common_vcprintf_s 0x4eca 0x5a
_o___conio_common_vcscanf 0x4f0a 0x5b
_o___conio_common_vcwprintf 0x4f49 0x5c
_o___conio_common_vcwprintf_p 0x4f8c 0x5d
_o___conio_common_vcwprintf_s 0x4fd1 0x5e
_o___conio_common_vcwscanf 0x5013 0x5f
_o___daylight 0x5045 0x60
_o___dstbias 0x5069 0x61
_o___fpe_flt_rounds 0x5093 0x62
_o___libm_sse2_acos 0x50c4 0x63
_o___libm_sse2_acosf 0x50f6 0x64
_o___libm_sse2_asin 0x5128 0x65
_o___libm_sse2_asinf 0x515a 0x66
_o___libm_sse2_atan 0x518c 0x67
_o___libm_sse2_atan2 0x51be 0x68
_o___libm_sse2_atanf 0x51f1 0x69
_o___libm_sse2_cos 0x5222 0x6a
_o___libm_sse2_cosf 0x5252 0x6b
_o___libm_sse2_exp 0x5282 0x6c
_o___libm_sse2_expf 0x52b2 0x6d
_o___libm_sse2_log 0x52e2 0x6e
_o___libm_sse2_log10 0x5313 0x6f
_o___libm_sse2_log10f 0x5347 0x70
_o___libm_sse2_logf 0x537a 0x71
_o___libm_sse2_pow 0x53aa 0x72
_o___libm_sse2_powf 0x53da 0x73
_o___libm_sse2_sin 0x540a 0x74
_o___libm_sse2_sinf 0x543a 0x75
_o___libm_sse2_tan 0x546a 0x76
_o___libm_sse2_tanf 0x549a 0x77
_o___p___argc 0x54c5 0x78
_o___p___argv 0x54ea 0x79
_o___p___wargv 0x5510 0x7a
_o___p__acmdln 0x5537 0x7b
_o___p__commode 0x555f 0x7c
_o___p__environ 0x5588 0x7d
_o___p__fmode 0x55af 0x7e
_o___p__mbcasemap 0x55d8 0x7f
_o___p__mbctype 0x5603 0x80
_o___p__pgmptr 0x562b 0x81
_o___p__wcmdln 0x5652 0x82
_o___p__wenviron 0x567b 0x83
_o___p__wpgmptr 0x56a5 0x84
_o___pctype_func 0x56cf 0x85
_o___pwctype_func 0x56fb 0x86
_o___std_exception_copy 0x572e 0x87
_o___std_exception_destroy 0x576a 0x88
_o___std_type_info_destroy_list 0x57ae 0x89
_o___std_type_info_name 0x57ef 0x8a
_o___stdio_common_vfprintf 0x582b 0x8b
_o___stdio_common_vfprintf_p 0x586c 0x8c
_o___stdio_common_vfprintf_s 0x58af 0x8d
_o___stdio_common_vfscanf 0x58ef 0x8e
_o___stdio_common_vfwprintf 0x592e 0x8f
_o___stdio_common_vfwprintf_p 0x5971 0x90
_o___stdio_common_vfwprintf_s 0x59b6 0x91
_o___stdio_common_vfwscanf 0x59f8 0x92
_o___stdio_common_vsnprintf_s 0x5a3a 0x93
_o___stdio_common_vsnwprintf_s 0x5a80 0x94
_o___stdio_common_vsprintf 0x5ac3 0x95
_o___stdio_common_vsprintf_p 0x5b04 0x96
_o___stdio_common_vsprintf_s 0x5b47 0x97
_o___stdio_common_vsscanf 0x5b87 0x98
_o___stdio_common_vswprintf 0x5bc6 0x99
_o___stdio_common_vswprintf_p 0x5c09 0x9a
_o___stdio_common_vswprintf_s 0x5c4e 0x9b
_o___stdio_common_vswscanf 0x5c90 0x9c
_o___timezone 0x5cc2 0x9d
_o___tzname 0x5ce5 0x9e
_o___wcserror 0x5d08 0x9f
_o__access 0x5d2a 0xa0
_o__access_s 0x5d4b 0xa1
_o__aligned_free 0x5d72 0xa2
_o__aligned_malloc 0x5d9f 0xa3
_o__aligned_msize 0x5dcd 0xa4
_o__aligned_offset_malloc 0x5e02 0xa5
_o__aligned_offset_realloc 0x5e40 0xa6
_o__aligned_offset_recalloc 0x5e80 0xa7
_o__aligned_realloc 0x5eb9 0xa8
_o__aligned_recalloc 0x5eeb 0xa9
_o__atodbl 0x5f14 0xaa
_o__atodbl_l 0x5f35 0xab
_o__atof_l 0x5f56 0xac
_o__atoflt 0x5f75 0xad
_o__atoflt_l 0x5f96 0xae
_o__atoi64 0x5fb7 0xaf
_o__atoi64_l 0x5fd8 0xb0
_o__atoi_l 0x5ff9 0xb1
_o__atol_l 0x6018 0xb2
_o__atoldbl 0x6038 0xb3
_o__atoldbl_l 0x605b 0xb4
_o__atoll_l 0x607e 0xb5
_o__beep 0x609c 0xb6
_o__beginthread 0x60be 0xb7
_o__beginthreadex 0x60e9 0xb8
_o__cabs 0x610d 0xb9
_o__callnewh 0x612c 0xba
_o__calloc_base 0x6152 0xbb
_o__cexit 0x6175 0xbc
_o__cgets 0x6192 0xbd
_o__cgets_s 0x61b1 0xbe
_o__cgetws 0x61d1 0xbf
_o__cgetws_s 0x61f2 0xc0
_o__chdir 0x6212 0xc1
_o__chdrive 0x6231 0xc2
_o__chmod 0x6250 0xc3
_o__chsize 0x626e 0xc4
_o__chsize_s 0x628f 0xc5
_o__close 0x62af 0xc6
_o__commit 0x62cd 0xc7
_o__configthreadlocale 0x62f8 0xc8
_o__configure_narrow_argv 0x6332 0xc9
_o__configure_wide_argv 0x636d 0xca
_o__controlfp_s 0x639e 0xcb
_o__cputs 0x63c1 0xcc
_o__cputws 0x63df 0xcd
_o__creat 0x63fd 0xce
_o__create_locale 0x6422 0xcf
_o__crt_atexit 0x644c 0xd0
_o__ctime32_s 0x6472 0xd1
_o__ctime64_s 0x6497 0xd2
_o__cwait 0x64b8 0xd3
_o__d_int 0x64d5 0xd4
_o__dclass 0x64f3 0xd5
_o__difftime32 0x6516 0xd6
_o__difftime64 0x653d 0xd7
_o__dlog 0x655e 0xd8
_o__dnorm 0x657a 0xd9
_o__dpcomp 0x6598 0xda
_o__dpoly 0x65b6 0xdb
_o__dscale 0x65d4 0xdc
_o__dsign 0x65f2 0xdd
_o__dsin 0x660e 0xde
_o__dtest 0x662a 0xdf
_o__dunscale 0x664a 0xe0
_o__dup 0x6668 0xe1
_o__dup2 0x6682 0xe2
_o__dupenv_s 0x66a1 0xe3
_o__ecvt 0x66c0 0xe4
_o__ecvt_s 0x66dd 0xe5
_o__endthread 0x66ff 0xe6
_o__endthreadex 0x6726 0xe7
_o__eof 0x6747 0xe8
_o__errno 0x6762 0xe9
_o__except1 0x6781 0xea
_o__execute_onexit_table 0x67af 0xeb
_o__execv 0x67db 0xec
_o__execve 0x67f9 0xed
_o__execvp 0x6818 0xee
_o__execvpe 0x6838 0xef
_o__exit 0x6856 0xf0
_o__expand 0x6873 0xf1
_o__fclose_nolock 0x6899 0xf2
_o__fcloseall 0x68c2 0xf3
_o__fcvt 0x68e2 0xf4
_o__fcvt_s 0x68ff 0xf5
_o__fd_int 0x691e 0xf6
_o__fdclass 0x693e 0xf7
_o__fdexp 0x695d 0xf8
_o__fdlog 0x697a 0xf9
_o__fdopen 0x6998 0xfa
_o__fdpcomp 0x69b8 0xfb
_o__fdpoly 0x69d8 0xfc
_o__fdscale 0x69f8 0xfd
_o__fdsign 0x6a18 0xfe
_o__fdsin 0x6a36 0xff
_o__fflush_nolock 0x6a5b 0x100
_o__fgetc_nolock 0x6a87 0x101
_o__fgetchar 0x6aae 0x102
_o__fgetwc_nolock 0x6ad6 0x103
_o__fgetwchar 0x6aff 0x104
_o__filelength 0x6b25 0x105
_o__filelengthi64 0x6b4f 0x106
_o__fileno 0x6b75 0x107
_o__findclose 0x6b97 0x108
_o__findfirst32 0x6bbe 0x109
_o__findfirst32i64 0x6bea 0x10a
_o__findfirst64 0x6c16 0x10b
_o__findfirst64i32 0x6c42 0x10c
_o__findnext32 0x6c6d 0x10d
_o__findnext32i64 0x6c97 0x10e
_o__findnext64 0x6cc1 0x10f
_o__findnext64i32 0x6ceb 0x110
_o__flushall 0x6d13 0x111
_o__fpclass 0x6d35 0x112
_o__fputc_nolock 0x6d5b 0x113
_o__fputchar 0x6d82 0x114
_o__fputwc_nolock 0x6daa 0x115
_o__fputwchar 0x6dd3 0x116
_o__fread_nolock 0x6dfb 0x117
_o__fread_nolock_s 0x6e28 0x118
_o__free_base 0x6e52 0x119
_o__free_locale 0x6e79 0x11a
_o__fseek_nolock 0x6ea3 0x11b
_o__fseeki64 0x6eca 0x11c
_o__fseeki64_nolock 0x6ef4 0x11d
_o__fsopen 0x6f1c 0x11e
_o__fstat32 0x6f3c 0x11f
_o__fstat32i64 0x6f60 0x120
_o__fstat64 0x6f84 0x121
_o__fstat64i32 0x6fa8 0x122
_o__ftell_nolock 0x6fd1 0x123
_o__ftelli64 0x6ff8 0x124
_o__ftelli64_nolock 0x7022 0x125
_o__ftime32 0x704b 0x126
_o__ftime32_s 0x706e 0x127
_o__ftime64 0x7091 0x128
_o__ftime64_s 0x70b4 0x129
_o__fullpath 0x70d8 0x12a
_o__futime32 0x70fb 0x12b
_o__futime64 0x711e 0x12c
_o__fwrite_nolock 0x7146 0x12d
_o__gcvt 0x716a 0x12e
_o__gcvt_s 0x7187 0x12f
_o__get_daylight 0x71ac 0x130
_o__get_doserrno 0x71d7 0x131
_o__get_dstbias 0x7201 0x132
_o__get_errno 0x7228 0x133
_o__get_fmode 0x724d 0x134
_o__get_heap_handle 0x7278 0x135
_o__get_initial_narrow_environment 0x72b8 0x136
_o__get_initial_wide_environment 0x7305 0x137
_o__get_invalid_parameter_handler 0x7351 0x138
_o__get_narrow_winmain_command_line 0x73a0 0x139
_o__get_osfhandle 0x73df 0x13a
_o__get_pgmptr 0x7409 0x13b
_o__get_stream_buffer_pointers 0x7440 0x13c
_o__get_terminate 0x747a 0x13d
_o__get_thread_local_invalid_parameter_handler 0x74c4 0x13e
_o__get_timezone 0x750d 0x13f
_o__get_tzname 0x7536 0x140
_o__get_wide_winmain_command_line 0x7570 0x141
_o__get_wpgmptr 0x75ab 0x142
_o__getc_nolock 0x75d4 0x143
_o__getch 0x75f7 0x144
_o__getch_nolock 0x761b 0x145
_o__getche 0x7640 0x146
_o__getche_nolock 0x7666 0x147
_o__getcwd 0x768c 0x148
_o__getdcwd 0x76ac 0x149
_o__getdiskfree 0x76d1 0x14a
_o__getdllprocaddr 0x76fd 0x14b
_o__getdrive 0x7726 0x14c
_o__getdrives 0x774a 0x14d
_o__getmbcp 0x776d 0x14e
_o__getsystime 0x7791 0x14f
_o__getw 0x77b2 0x150
_o__getwc_nolock 0x77d5 0x151
_o__getwch 0x77fa 0x152
_o__getwch_nolock 0x7820 0x153
_o__getwche 0x7847 0x154
_o__getwche_nolock 0x786f 0x155
_o__getws 0x7895 0x156
_o__getws_s 0x78b4 0x157
_o__gmtime32 0x78d6 0x158
_o__gmtime32_s 0x78fb 0x159
_o__gmtime64 0x7920 0x15a
_o__gmtime64_s 0x7945 0x15b
_o__heapchk 0x7969 0x15c
_o__heapmin 0x798a 0x15d
_o__hypot 0x79a9 0x15e
_o__hypotf 0x79c7 0x15f
_o__i64toa 0x79e6 0x160
_o__i64toa_s 0x7a07 0x161
_o__i64tow 0x7a28 0x162
_o__i64tow_s 0x7a49 0x163
_o__initialize_narrow_environment 0x7a81 0x164
_o__initialize_onexit_table 0x7ac8 0x165
_o__initialize_wide_environment 0x7b0d 0x166
_o__invalid_parameter_noinfo 0x7b53 0x167
_o__invalid_parameter_noinfo_noreturn 0x7b9f 0x168
_o__isatty 0x7bd9 0x169
_o__isctype 0x7bf9 0x16a
_o__isctype_l 0x7c1c 0x16b
_o__isleadbyte_l 0x7c44 0x16c
_o__ismbbalnum 0x7c6d 0x16d
_o__ismbbalnum_l 0x7c96 0x16e
_o__ismbbalpha 0x7cbf 0x16f
_o__ismbbalpha_l 0x7ce8 0x170
_o__ismbbblank 0x7d11 0x171
_o__ismbbblank_l 0x7d3a 0x172
_o__ismbbgraph 0x7d63 0x173
_o__ismbbgraph_l 0x7d8c 0x174
_o__ismbbkalnum 0x7db6 0x175
_o__ismbbkalnum_l 0x7de1 0x176
_o__ismbbkana 0x7e0a 0x177
_o__ismbbkana_l 0x7e31 0x178
_o__ismbbkprint 0x7e5a 0x179
_o__ismbbkprint_l 0x7e85 0x17a
_o__ismbbkpunct 0x7eb0 0x17b
_o__ismbbkpunct_l 0x7edb 0x17c
_o__ismbblead 0x7f04 0x17d
_o__ismbblead_l 0x7f2b 0x17e
_o__ismbbprint 0x7f53 0x17f
_o__ismbbprint_l 0x7f7c 0x180
_o__ismbbpunct 0x7fa5 0x181
_o__ismbbpunct_l 0x7fce 0x182
_o__ismbbtrail 0x7ff7 0x183
_o__ismbbtrail_l 0x8020 0x184
_o__ismbcalnum 0x8049 0x185
_o__ismbcalnum_l 0x8072 0x186
_o__ismbcalpha 0x809b 0x187
_o__ismbcalpha_l 0x80c4 0x188
_o__ismbcblank 0x80ed 0x189
_o__ismbcblank_l 0x8116 0x18a
_o__ismbcdigit 0x813f 0x18b
_o__ismbcdigit_l 0x8168 0x18c
_o__ismbcgraph 0x8191 0x18d
_o__ismbcgraph_l 0x81ba 0x18e
_o__ismbchira 0x81e2 0x18f
_o__ismbchira_l 0x8209 0x190
_o__ismbckata 0x8230 0x191
_o__ismbckata_l 0x8257 0x192
_o__ismbcl0 0x827c 0x193
_o__ismbcl0_l 0x829f 0x194
_o__ismbcl1 0x82c2 0x195
_o__ismbcl1_l 0x82e5 0x196
_o__ismbcl2 0x8308 0x197
_o__ismbcl2_l 0x832b 0x198
_o__ismbclegal 0x8351 0x199
_o__ismbclegal_l 0x837a 0x19a
_o__ismbclower 0x83a3 0x19b
_o__ismbclower_l 0x83cc 0x19c
_o__ismbcprint 0x83f5 0x19d
_o__ismbcprint_l 0x841e 0x19e
_o__ismbcpunct 0x8447 0x19f
_o__ismbcpunct_l 0x8470 0x1a0
_o__ismbcspace 0x8499 0x1a1
_o__ismbcspace_l 0x84c2 0x1a2
_o__ismbcsymbol 0x84ec 0x1a3
_o__ismbcsymbol_l 0x8517 0x1a4
_o__ismbcupper 0x8541 0x1a5
_o__ismbcupper_l 0x856a 0x1a6
_o__ismbslead 0x8592 0x1a7
_o__ismbslead_l 0x85b9 0x1a8
_o__ismbstrail 0x85e1 0x1a9
_o__ismbstrail_l 0x860a 0x1aa
_o__iswctype_l 0x8633 0x1ab
_o__itoa 0x8654 0x1ac
_o__itoa_s 0x8671 0x1ad
_o__itow 0x868e 0x1ae
_o__itow_s 0x86ab 0x1af
_o__j0 0x86c6 0x1b0
_o__j1 0x86dd 0x1b1
_o__jn 0x86f4 0x1b2
_o__kbhit 0x870e 0x1b3
_o__ld_int 0x872c 0x1b4
_o__ldclass 0x874c 0x1b5
_o__ldexp 0x876b 0x1b6
_o__ldlog 0x8788 0x1b7
_o__ldpcomp 0x87a7 0x1b8
_o__ldpoly 0x87c7 0x1b9
_o__ldscale 0x87e7 0x1ba
_o__ldsign 0x8807 0x1bb
_o__ldsin 0x8825 0x1bc
_o__ldtest 0x8843 0x1bd
_o__ldunscale 0x8865 0x1be
_o__lfind 0x8886 0x1bf
_o__lfind_s 0x88a5 0x1c0
_o__libm_sse2_acos_precise 0x88d5 0x1c1
_o__libm_sse2_asin_precise 0x8914 0x1c2
_o__libm_sse2_atan_precise 0x8953 0x1c3
_o__libm_sse2_cos_precise 0x8991 0x1c4
_o__libm_sse2_exp_precise 0x89ce 0x1c5
_o__libm_sse2_log10_precise 0x8a0d 0x1c6
_o__libm_sse2_log_precise 0x8a4c 0x1c7
_o__libm_sse2_pow_precise 0x8a89 0x1c8
_o__libm_sse2_sin_precise 0x8ac6 0x1c9
_o__libm_sse2_sqrt_precise 0x8b04 0x1ca
_o__libm_sse2_tan_precise 0x8b42 0x1cb
_o__loaddll 0x8b71 0x1cc
_o__localtime32 0x8b96 0x1cd
_o__localtime32_s 0x8bc1 0x1ce
_o__localtime64 0x8bec 0x1cf
_o__localtime64_s 0x8c17 0x1d0
_o__lock_file 0x8c40 0x1d1
_o__locking 0x8c63 0x1d2
_o__logb 0x8c81 0x1d3
_o__lsearch 0x8c9f 0x1d4
_o__lsearch_s 0x8cc2 0x1d5
_o__lseek 0x8ce3 0x1d6
_o__lseeki64 0x8d03 0x1d7
_o__ltoa 0x8d22 0x1d8
_o__ltoa_s 0x8d3f 0x1d9
_o__ltow 0x8d5c 0x1da
_o__ltow_s 0x8d79 0x1db
_o__makepath 0x8d9a 0x1dc
_o__makepath_s 0x8dbf 0x1dd
_o__malloc_base 0x8de7 0x1de
_o__mbbtombc 0x8e0d 0x1df
_o__mbbtombc_l 0x8e32 0x1e0
_o__mbbtype 0x8e56 0x1e1
_o__mbbtype_l 0x8e79 0x1e2
_o__mbccpy 0x8e9b 0x1e3
_o__mbccpy_l 0x8ebc 0x1e4
_o__mbccpy_s 0x8edf 0x1e5
_o__mbccpy_s_l 0x8f04 0x1e6
_o__mbcjistojms 0x8f2c 0x1e7
_o__mbcjistojms_l 0x8f57 0x1e8
_o__mbcjmstojis 0x8f82 0x1e9
_o__mbcjmstojis_l 0x8fad 0x1ea
_o__mbclen 0x8fd3 0x1eb
_o__mbclen_l 0x8ff4 0x1ec
_o__mbctohira 0x9018 0x1ed
_o__mbctohira_l 0x903f 0x1ee
_o__mbctokata 0x9066 0x1ef
_o__mbctokata_l 0x908d 0x1f0
_o__mbctolower 0x90b5 0x1f1
_o__mbctolower_l 0x90de 0x1f2
_o__mbctombb 0x9105 0x1f3
_o__mbctombb_l 0x912a 0x1f4
_o__mbctoupper 0x9151 0x1f5
_o__mbctoupper_l 0x917a 0x1f6
_o__mblen_l 0x91a0 0x1f7
_o__mbsbtype 0x91c2 0x1f8
_o__mbsbtype_l 0x91e7 0x1f9
_o__mbscat_s 0x920c 0x1fa
_o__mbscat_s_l 0x9231 0x1fb
_o__mbschr 0x9254 0x1fc
_o__mbschr_l 0x9275 0x1fd
_o__mbscmp 0x9296 0x1fe
_o__mbscmp_l 0x92b7 0x1ff
_o__mbscoll 0x92d9 0x200
_o__mbscoll_l 0x92fc 0x201
_o__mbscpy_s 0x9320 0x202
_o__mbscpy_s_l 0x9345 0x203
_o__mbscspn 0x9369 0x204
_o__mbscspn_l 0x938c 0x205
_o__mbsdec 0x93ae 0x206
_o__mbsdec_l 0x93cf 0x207
_o__mbsicmp 0x93f1 0x208
_o__mbsicmp_l 0x9414 0x209
_o__mbsicoll 0x9438 0x20a
_o__mbsicoll_l 0x945d 0x20b
_o__mbsinc 0x9480 0x20c
_o__mbsinc_l 0x94a1 0x20d
_o__mbslen 0x94c2 0x20e
_o__mbslen_l 0x94e3 0x20f
_o__mbslwr 0x9504 0x210
_o__mbslwr_l 0x9525 0x211
_o__mbslwr_s 0x9548 0x212
_o__mbslwr_s_l 0x956d 0x213
_o__mbsnbcat 0x9592 0x214
_o__mbsnbcat_l 0x95b7 0x215
_o__mbsnbcat_s 0x95de 0x216
_o__mbsnbcat_s_l 0x9607 0x217
_o__mbsnbcmp 0x962e 0x218
_o__mbsnbcmp_l 0x9653 0x219
_o__mbsnbcnt 0x9678 0x21a
_o__mbsnbcnt_l 0x969d 0x21b
_o__mbsnbcoll 0x96c3 0x21c
_o__mbsnbcoll_l 0x96ea 0x21d
_o__mbsnbcpy 0x9710 0x21e
_o__mbsnbcpy_l 0x9735 0x21f
_o__mbsnbcpy_s 0x975c 0x220
_o__mbsnbcpy_s_l 0x9785 0x221
_o__mbsnbicmp 0x97ad 0x222
_o__mbsnbicmp_l 0x97d4 0x223
_o__mbsnbicoll 0x97fc 0x224
_o__mbsnbicoll_l 0x9825 0x225
_o__mbsnbset 0x984c 0x226
_o__mbsnbset_l 0x9871 0x227
_o__mbsnbset_s 0x9898 0x228
_o__mbsnbset_s_l 0x98c1 0x229
_o__mbsncat 0x98e7 0x22a
_o__mbsncat_l 0x990a 0x22b
_o__mbsncat_s 0x992f 0x22c
_o__mbsncat_s_l 0x9956 0x22d
_o__mbsnccnt 0x997c 0x22e
_o__mbsnccnt_l 0x99a1 0x22f
_o__mbsncmp 0x99c5 0x230
_o__mbsncmp_l 0x99e8 0x231
_o__mbsncoll 0x9a0c 0x232
_o__mbsncoll_l 0x9a31 0x233
_o__mbsncpy 0x9a55 0x234
_o__mbsncpy_l 0x9a78 0x235
_o__mbsncpy_s 0x9a9d 0x236
_o__mbsncpy_s_l 0x9ac4 0x237
_o__mbsnextc 0x9aea 0x238
_o__mbsnextc_l 0x9b0f 0x239
_o__mbsnicmp 0x9b34 0x23a
_o__mbsnicmp_l 0x9b59 0x23b
_o__mbsnicoll 0x9b7f 0x23c
_o__mbsnicoll_l 0x9ba6 0x23d
_o__mbsninc 0x9bcb 0x23e
_o__mbsninc_l 0x9bee 0x23f
_o__mbsnlen 0x9c11 0x240
_o__mbsnlen_l 0x9c34 0x241
_o__mbsnset 0x9c57 0x242
_o__mbsnset_l 0x9c7a 0x243
_o__mbsnset_s 0x9c9f 0x244
_o__mbsnset_s_l 0x9cc6 0x245
_o__mbspbrk 0x9ceb 0x246
_o__mbspbrk_l 0x9d0e 0x247
_o__mbsrchr 0x9d31 0x248
_o__mbsrchr_l 0x9d54 0x249
_o__mbsrev 0x9d76 0x24a
_o__mbsrev_l 0x9d97 0x24b
_o__mbsset 0x9db8 0x24c
_o__mbsset_l 0x9dd9 0x24d
_o__mbsset_s 0x9dfc 0x24e
_o__mbsset_s_l 0x9e21 0x24f
_o__mbsspn 0x9e44 0x250
_o__mbsspn_l 0x9e65 0x251
_o__mbsspnp 0x9e87 0x252
_o__mbsspnp_l 0x9eaa 0x253
_o__mbsstr 0x9ecc 0x254
_o__mbsstr_l 0x9eed 0x255
_o__mbstok 0x9f0e 0x256
_o__mbstok_l 0x9f2f 0x257
_o__mbstok_s 0x9f52 0x258
_o__mbstok_s_l 0x9f77 0x259
_o__mbstowcs_l 0x9f9e 0x25a
_o__mbstowcs_s_l 0x9fc7 0x25b
_o__mbstrlen 0x9fee 0x25c
_o__mbstrlen_l 0xa013 0x25d
_o__mbstrnlen 0xa039 0x25e
_o__mbstrnlen_l 0xa060 0x25f
_o__mbsupr 0xa084 0x260
_o__mbsupr_l 0xa0a5 0x261
_o__mbsupr_s 0xa0c8 0x262
_o__mbsupr_s_l 0xa0ed 0x263
_o__mbtowc_l 0xa112 0x264
_o__memicmp 0xa134 0x265
_o__memicmp_l 0xa157 0x266
_o__mkdir 0xa178 0x267
_o__mkgmtime32 0xa19a 0x268
_o__mkgmtime64 0xa1c1 0x269
_o__mktemp 0xa1e4 0x26a
_o__mktemp_s 0xa205 0x26b
_o__mktime32 0xa228 0x26c
_o__mktime64 0xa24b 0x26d
_o__msize 0xa26b 0x26e
_o__nextafter 0xa28c 0x26f
_o__open_osfhandle 0xa2b6 0x270
_o__pclose 0xa2dd 0x271
_o__pipe 0xa2fa 0x272
_o__popen 0xa316 0x273
_o__purecall 0xa336 0x274
_o__putc_nolock 0xa35c 0x275
_o__putch 0xa37f 0x276
_o__putch_nolock 0xa3a3 0x277
_o__putenv 0xa3c8 0x278
_o__putenv_s 0xa3e9 0x279
_o__putw 0xa408 0x27a
_o__putwc_nolock 0xa42b 0x27b
_o__putwch 0xa450 0x27c
_o__putwch_nolock 0xa476 0x27d
_o__putws 0xa49b 0x27e
_o__read 0xa4b7 0x27f
_o__realloc_base 0xa4da 0x280
_o__recalloc 0xa501 0x281
_o__register_onexit_function 0xa534 0x282
_o__resetstkoflw 0xa56b 0x283
_o__rmdir 0xa58f 0x284
_o__rmtmp 0xa5ac 0x285
_o__scalb 0xa5c9 0x286
_o__searchenv 0xa5ea 0x287
_o__searchenv_s 0xa611 0x288
_o__seh_filter_dll 0xa63d 0x289
_o__seh_filter_exe 0xa66c 0x28a
_o__set_abort_behavior 0xa69f 0x28b
_o__set_app_type 0xa6d0 0x28c
_o__set_doserrno 0xa6fb 0x28d
_o__set_errno 0xa723 0x28e
_o__set_fmode 0xa748 0x28f
_o__set_invalid_parameter_handler 0xa781 0x290
_o__set_new_handler 0xa7c0 0x291
_o__set_new_mode 0xa7ee 0x292
_o__set_thread_local_invalid_parameter_handler 0xa837 0x293
_o__seterrormode 0xa880 0x294
_o__setmbcp 0xa8a6 0x295
_o__setmode 0xa8c7 0x296
_o__setsystime 0xa8eb 0x297
_o__sleep 0xa90d 0x298
_o__sopen 0xa92a 0x299
_o__sopen_dispatch 0xa950 0x29a
_o__sopen_s 0xa978 0x29b
_o__spawnv 0xa998 0x29c
_o__spawnve 0xa9b8 0x29d
_o__spawnvp 0xa9d9 0x29e
_o__spawnvpe 0xa9fb 0x29f
_o__splitpath 0xaa1f 0x2a0
_o__splitpath_s 0xaa46 0x2a1
_o__stat32 0xaa6a 0x2a2
_o__stat32i64 0xaa8c 0x2a3
_o__stat64 0xaaae 0x2a4
_o__stat64i32 0xaad0 0x2a5
_o__strcoll_l 0xaaf5 0x2a6
_o__strdate 0xab18 0x2a7
_o__strdate_s 0xab3b 0x2a8
_o__strdup 0xab5d 0x2a9
_o__strerror 0xab7e 0x2aa
_o__strerror_s 0xaba3 0x2ab
_o__strftime_l 0xabca 0x2ac
_o__stricmp 0xabee 0x2ad
_o__stricmp_l 0xac11 0x2ae
_o__stricoll 0xac35 0x2af
_o__stricoll_l 0xac5a 0x2b0
_o__strlwr 0xac7d 0x2b1
_o__strlwr_l 0xac9e 0x2b2
_o__strlwr_s 0xacc1 0x2b3
_o__strlwr_s_l 0xace6 0x2b4
_o__strncoll 0xad0b 0x2b5
_o__strncoll_l 0xad30 0x2b6
_o__strnicmp 0xad55 0x2b7
_o__strnicmp_l 0xad7a 0x2b8
_o__strnicoll 0xada0 0x2b9
_o__strnicoll_l 0xadc7 0x2ba
_o__strnset_s 0xadee 0x2bb
_o__strset_s 0xae12 0x2bc
_o__strtime 0xae34 0x2bd
_o__strtime_s 0xae57 0x2be
_o__strtod_l 0xae7b 0x2bf
_o__strtof_l 0xae9e 0x2c0
_o__strtoi64 0xaec1 0x2c1
_o__strtoi64_l 0xaee6 0x2c2
_o__strtol_l 0xaf0b 0x2c3
_o__strtold_l 0xaf2f 0x2c4
_o__strtoll_l 0xaf54 0x2c5
_o__strtoui64 0xaf79 0x2c6
_o__strtoui64_l 0xafa0 0x2c7
_o__strtoul_l 0xafc7 0x2c8
_o__strtoull_l 0xafed 0x2c9
_o__strupr 0xb010 0x2ca
_o__strupr_l 0xb031 0x2cb
_o__strupr_s 0xb054 0x2cc
_o__strupr_s_l 0xb079 0x2cd
_o__strxfrm_l 0xb09f 0x2ce
_o__swab 0xb0bf 0x2cf
_o__tell 0xb0da 0x2d0
_o__telli64 0xb0f8 0x2d1
_o__timespec32_get 0xb120 0x2d2
_o__timespec64_get 0xb14f 0x2d3
_o__tolower 0xb177 0x2d4
_o__tolower_l 0xb19a 0x2d5
_o__toupper 0xb1bd 0x2d6
_o__toupper_l 0xb1e0 0x2d7
_o__towlower_l 0xb206 0x2d8
_o__towupper_l 0xb22d 0x2d9
_o__tzset 0xb24f 0x2da
_o__ui64toa 0xb26e 0x2db
_o__ui64toa_s 0xb291 0x2dc
_o__ui64tow 0xb2b4 0x2dd
_o__ui64tow_s 0xb2d7 0x2de
_o__ultoa 0xb2f8 0x2df
_o__ultoa_s 0xb317 0x2e0
_o__ultow 0xb336 0x2e1
_o__ultow_s 0xb355 0x2e2
_o__umask 0xb374 0x2e3
_o__umask_s 0xb393 0x2e4
_o__ungetc_nolock 0xb3ba 0x2e5
_o__ungetch 0xb3e1 0x2e6
_o__ungetch_nolock 0xb409 0x2e7
_o__ungetwc_nolock 0xb438 0x2e8
_o__ungetwch 0xb461 0x2e9
_o__ungetwch_nolock 0xb48b 0x2ea
_o__unlink 0xb4b3 0x2eb
_o__unloaddll 0xb4d5 0x2ec
_o__unlock_file 0xb4fc 0x2ed
_o__utime32 0xb521 0x2ee
_o__utime64 0xb542 0x2ef
_o__waccess 0xb563 0x2f0
_o__waccess_s 0xb586 0x2f1
_o__wasctime 0xb5aa 0x2f2
_o__wasctime_s 0xb5cf 0x2f3
_o__wchdir 0xb5f2 0x2f4
_o__wchmod 0xb611 0x2f5
_o__wcreat 0xb630 0x2f6
_o__wcreate_locale 0xb657 0x2f7
_o__wcscoll_l 0xb681 0x2f8
_o__wcsdup 0xb6a3 0x2f9
_o__wcserror 0xb6c4 0x2fa
_o__wcserror_s 0xb6e9 0x2fb
_o__wcsftime_l 0xb710 0x2fc
_o__wcsicmp 0xb734 0x2fd
_o__wcsicmp_l 0xb757 0x2fe
_o__wcsicoll 0xb77b 0x2ff
_o__wcsicoll_l 0xb7a0 0x300
_o__wcslwr 0xb7c3 0x301
_o__wcslwr_l 0xb7e4 0x302
_o__wcslwr_s 0xb807 0x303
_o__wcslwr_s_l 0xb82c 0x304
_o__wcsncoll 0xb851 0x305
_o__wcsncoll_l 0xb876 0x306
_o__wcsnicmp 0xb89b 0x307
_o__wcsnicmp_l 0xb8c0 0x308
_o__wcsnicoll 0xb8e6 0x309
_o__wcsnicoll_l 0xb90d 0x30a
_o__wcsnset 0xb932 0x30b
_o__wcsnset_s 0xb955 0x30c
_o__wcsset 0xb977 0x30d
_o__wcsset_s 0xb998 0x30e
_o__wcstod_l 0xb9bb 0x30f
_o__wcstof_l 0xb9de 0x310
_o__wcstoi64 0xba01 0x311
_o__wcstoi64_l 0xba26 0x312
_o__wcstol_l 0xba4b 0x313
_o__wcstold_l 0xba6f 0x314
_o__wcstoll_l 0xba94 0x315
_o__wcstombs_l 0xbaba 0x316
_o__wcstombs_s_l 0xbae3 0x317
_o__wcstoui64 0xbb0b 0x318
_o__wcstoui64_l 0xbb32 0x319
_o__wcstoul_l 0xbb59 0x31a
_o__wcstoull_l 0xbb7f 0x31b
_o__wcsupr 0xbba2 0x31c
_o__wcsupr_l 0xbbc3 0x31d
_o__wcsupr_s 0xbbe6 0x31e
_o__wcsupr_s_l 0xbc0b 0x31f
_o__wcsxfrm_l 0xbc31 0x320
_o__wctime32 0xbc55 0x321
_o__wctime32_s 0xbc7a 0x322
_o__wctime64 0xbc9f 0x323
_o__wctime64_s 0xbcc4 0x324
_o__wctomb_l 0xbce9 0x325
_o__wctomb_s_l 0xbd0e 0x326
_o__wdupenv_s 0xbd34 0x327
_o__wexecv 0xbd56 0x328
_o__wexecve 0xbd76 0x329
_o__wexecvp 0xbd97 0x32a
_o__wexecvpe 0xbdb9 0x32b
_o__wfdopen 0xbddb 0x32c
_o__wfindfirst32 0xbe01 0x32d
_o__wfindfirst32i64 0xbe2f 0x32e
_o__wfindfirst64 0xbe5d 0x32f
_o__wfindfirst64i32 0xbe8b 0x330
_o__wfindnext32 0xbeb8 0x331
_o__wfindnext32i64 0xbee4 0x332
_o__wfindnext64 0xbf10 0x333
_o__wfindnext64i32 0xbf3c 0x334
_o__wfopen 0xbf63 0x335
_o__wfopen_s 0xbf84 0x336
_o__wfreopen 0xbfa7 0x337
_o__wfreopen_s 0xbfcc 0x338
_o__wfsopen 0xbff0 0x339
_o__wfullpath 0xc013 0x33a
_o__wgetcwd 0xc036 0x33b
_o__wgetdcwd 0xc058 0x33c
_o__wgetenv 0xc07a 0x33d
_o__wgetenv_s 0xc09d 0x33e
_o__wmakepath 0xc0c2 0x33f
_o__wmakepath_s 0xc0e9 0x340
_o__wmkdir 0xc10d 0x341
_o__wmktemp 0xc12d 0x342
_o__wmktemp_s 0xc150 0x343
_o__wperror 0xc173 0x344
_o__wpopen 0xc193 0x345
_o__wputenv 0xc1b3 0x346
_o__wputenv_s 0xc1d6 0x347
_o__wremove 0xc1f9 0x348
_o__wrename 0xc21a 0x349
_o__write 0xc239 0x34a
_o__wrmdir 0xc257 0x34b
_o__wsearchenv 0xc27a 0x34c
_o__wsearchenv_s 0xc2a3 0x34d
_o__wsetlocale 0xc2cc 0x34e
_o__wsopen_dispatch 0xc2f8 0x34f
_o__wsopen_s 0xc322 0x350
_o__wspawnv 0xc344 0x351
_o__wspawnve 0xc366 0x352
_o__wspawnvp 0xc389 0x353
_o__wspawnvpe 0xc3ad 0x354
_o__wsplitpath 0xc3d3 0x355
_o__wsplitpath_s 0xc3fc 0x356
_o__wstat32 0xc422 0x357
_o__wstat32i64 0xc446 0x358
_o__wstat64 0xc46a 0x359
_o__wstat64i32 0xc48e 0x35a
_o__wstrdate 0xc4b3 0x35b
_o__wstrdate_s 0xc4d8 0x35c
_o__wstrtime 0xc4fd 0x35d
_o__wstrtime_s 0xc522 0x35e
_o__wsystem 0xc546 0x35f
_o__wtmpnam_s 0xc569 0x360
_o__wtof 0xc589 0x361
_o__wtof_l 0xc5a6 0x362
_o__wtoi 0xc5c3 0x363
_o__wtoi64 0xc5e0 0x364
_o__wtoi64_l 0xc601 0x365
_o__wtoi_l 0xc622 0x366
_o__wtol 0xc63f 0x367
_o__wtol_l 0xc65c 0x368
_o__wtoll 0xc67a 0x369
_o__wtoll_l 0xc699 0x36a
_o__wunlink 0xc6ba 0x36b
_o__wutime32 0xc6dc 0x36c
_o__wutime64 0xc6ff 0x36d
_o__y0 0xc71c 0x36e
_o__y1 0xc733 0x36f
_o__yn 0xc74a 0x370
_o_abort 0xc763 0x371
_o_acos 0xc77d 0x372
_o_acosh 0xc797 0x373
_o_acoshf 0xc7b3 0x374
_o_acoshl 0xc7d0 0x375
_o_asctime 0xc7ee 0x376
_o_asctime_s 0xc80f 0x377
_o_asin 0xc82d 0x378
_o_asinh 0xc847 0x379
_o_asinhf 0xc863 0x37a
_o_asinhl 0xc880 0x37b
_o_atan 0xc89b 0x37c
_o_atan2 0xc8b5 0x37d
_o_atanh 0xc8d0 0x37e
_o_atanhf 0xc8ec 0x37f
_o_atanhl 0xc909 0x380
_o_atof 0xc924 0x381
_o_atoi 0xc93d 0x382
_o_atol 0xc956 0x383
_o_atoll 0xc970 0x384
_o_bsearch 0xc98d 0x385
_o_bsearch_s 0xc9ae 0x386
_o_btowc 0xc9cd 0x387
_o_calloc 0xc9e9 0x388
_o_cbrt 0xca04 0x389
_o_cbrtf 0xca1e 0x38a
_o_ceil 0xca38 0x38b
_o_clearerr 0xca55 0x38c
_o_clearerr_s 0xca78 0x38d
_o_cos 0xca96 0x38e
_o_cosh 0xcaae 0x38f
_o_erf 0xcac6 0x390
_o_erfc 0xcade 0x391
_o_erfcf 0xcaf8 0x392
_o_erfcl 0xcb13 0x393
_o_erff 0xcb2d 0x394
_o_erfl 0xcb46 0x395
_o_exit 0xcb5f 0x396
_o_exp 0xcb77 0x397
_o_exp2 0xcb8f 0x398
_o_exp2f 0xcba9 0x399
_o_exp2l 0xcbc4 0x39a
_o_fabs 0xcbde 0x39b
_o_fclose 0xcbf9 0x39c
_o_feof 0xcc14 0x39d
_o_ferror 0xcc2f 0x39e
_o_fflush 0xcc4c 0x39f
_o_fgetc 0xcc68 0x3a0
_o_fgetpos 0xcc85 0x3a1
_o_fgets 0xcca2 0x3a2
_o_fgetwc 0xccbe 0x3a3
_o_fgetws 0xccdb 0x3a4
_o_floor 0xccf7 0x3a5
_o_fma 0xcd10 0x3a6
_o_fmaf 0xcd28 0x3a7
_o_fmal 0xcd41 0x3a8
_o_fmod 0xcd5a 0x3a9
_o_fopen 0xcd74 0x3aa
_o_fopen_s 0xcd91 0x3ab
_o_fputc 0xcdae 0x3ac
_o_fputs 0xcdc9 0x3ad
_o_fputwc 0xcde5 0x3ae
_o_fputws 0xce02 0x3af
_o_fread 0xce1e 0x3b0
_o_fread_s 0xce3b 0x3b1
_o_free 0xce57 0x3b2
_o_freopen 0xce73 0x3b3
_o_freopen_s 0xce94 0x3b4
_o_frexp 0xceb3 0x3b5
_o_fseek 0xcece 0x3b6
_o_fsetpos 0xceeb 0x3b7
_o_ftell 0xcf08 0x3b8
_o_fwrite 0xcf24 0x3b9
_o_getc 0xcf3f 0x3ba
_o_getchar 0xcf5b 0x3bb
_o_getenv 0xcf79 0x3bc
_o_getenv_s 0xcf98 0x3bd
_o_gets 0xcfb5 0x3be
_o_gets_s 0xcfd0 0x3bf
_o_getwc 0xcfec 0x3c0
_o_getwchar 0xd00a 0x3c1
_o_hypot 0xd028 0x3c2
_o_is_wctype 0xd047 0x3c3
_o_isalnum 0xd068 0x3c4
_o_isalpha 0xd087 0x3c5
_o_isblank 0xd0a6 0x3c6
_o_iscntrl 0xd0c5 0x3c7
_o_isdigit 0xd0e4 0x3c8
_o_isgraph 0xd103 0x3c9
_o_isleadbyte 0xd125 0x3ca
_o_islower 0xd147 0x3cb
_o_isprint 0xd166 0x3cc
_o_ispunct 0xd185 0x3cd
_o_isspace 0xd1a4 0x3ce
_o_isupper 0xd1c3 0x3cf
_o_iswalnum 0xd1e3 0x3d0
_o_iswalpha 0xd204 0x3d1
_o_iswascii 0xd225 0x3d2
_o_iswblank 0xd246 0x3d3
_o_iswcntrl 0xd267 0x3d4
_o_iswctype 0xd288 0x3d5
_o_iswdigit 0xd2a9 0x3d6
_o_iswgraph 0xd2ca 0x3d7
_o_iswlower 0xd2eb 0x3d8
_o_iswprint 0xd30c 0x3d9
_o_iswpunct 0xd32d 0x3da
_o_iswspace 0xd34e 0x3db
_o_iswupper 0xd36f 0x3dc
_o_iswxdigit 0xd391 0x3dd
_o_isxdigit 0xd3b3 0x3de
_o_ldexp 0xd3d1 0x3df
_o_lgamma 0xd3ed 0x3e0
_o_lgammaf 0xd40b 0x3e1
_o_lgammal 0xd42a 0x3e2
_o_llrint 0xd448 0x3e3
_o_llrintf 0xd466 0x3e4
_o_llrintl 0xd485 0x3e5
_o_llround 0xd4a4 0x3e6
_o_llroundf 0xd4c4 0x3e7
_o_llroundl 0xd4e5 0x3e8
_o_localeconv 0xd508 0x3e9
_o_log 0xd526 0x3ea
_o_log10 0xd53f 0x3eb
_o_log1p 0xd55a 0x3ec
_o_log1pf 0xd576 0x3ed
_o_log1pl 0xd593 0x3ee
_o_log2 0xd5ae 0x3ef
_o_log2f 0xd5c8 0x3f0
_o_log2l 0xd5e3 0x3f1
_o_logb 0xd5fd 0x3f2
_o_logbf 0xd617 0x3f3
_o_logbl 0xd632 0x3f4
_o_lrint 0xd64d 0x3f5
_o_lrintf 0xd669 0x3f6
_o_lrintl 0xd686 0x3f7
_o_lround 0xd6a3 0x3f8
_o_lroundf 0xd6c1 0x3f9
_o_lroundl 0xd6e0 0x3fa
_o_malloc 0xd6fe 0x3fb
_o_mblen 0xd71a 0x3fc
_o_mbrlen 0xd736 0x3fd
_o_mbrtoc16 0xd755 0x3fe
_o_mbrtoc32 0xd776 0x3ff
_o_mbrtowc 0xd796 0x400
_o_mbsrtowcs 0xd7b7 0x401
_o_mbsrtowcs_s 0xd7dc 0x402
_o_mbstowcs 0xd800 0x403
_o_mbstowcs_s 0xd823 0x404
_o_mbtowc 0xd844 0x405
_o_memcpy_s 0xd863 0x406
_o_memset 0xd882 0x407
_o_modf 0xd89d 0x408
_o_nan 0xd8b5 0x409
_o_nanf 0xd8cd 0x40a
_o_nanl 0xd8e6 0x40b
_o_nearbyint 0xd904 0x40c
_o_nearbyintf 0xd928 0x40d
_o_nearbyintl 0xd94d 0x40e
_o_nextafter 0xd971 0x40f
_o_nextafterf 0xd995 0x410
_o_nextafterl 0xd9ba 0x411
_o_nexttoward 0xd9df 0x412
_o_nexttowardf 0xda05 0x413
_o_nexttowardl 0xda2c 0x414
_o_pow 0xda4b 0x415
_o_powf 0xda63 0x416
_o_putc 0xda7c 0x417
_o_putchar 0xda98 0x418
_o_puts 0xdab4 0x419
_o_putwc 0xdace 0x41a
_o_putwchar 0xdaec 0x41b
_o_qsort 0xdb0a 0x41c
_o_qsort_s 0xdb27 0x41d
_o_raise 0xdb44 0x41e
_o_rand 0xdb5e 0x41f
_o_rand_s 0xdb79 0x420
_o_realloc 0xdb97 0x421
_o_remainder 0xdbb8 0x422
_o_remainderf 0xdbdc 0x423
_o_remainderl 0xdc01 0x424
_o_remove 0xdc22 0x425
_o_remquo 0xdc3f 0x426
_o_remquof 0xdc5d 0x427
_o_remquol 0xdc7c 0x428
_o_rename 0xdc9a 0x429
_o_rewind 0xdcb7 0x42a
_o_rint 0xdcd2 0x42b
_o_rintf 0xdcec 0x42c
_o_rintl 0xdd07 0x42d
_o_round 0xdd22 0x42e
_o_roundf 0xdd3e 0x42f
_o_roundl 0xdd5b 0x430
_o_scalbln 0xdd79 0x431
_o_scalblnf 0xdd99 0x432
_o_scalblnl 0xddba 0x433
_o_scalbn 0xddd9 0x434
_o_scalbnf 0xddf7 0x435
_o_scalbnl 0xde16 0x436
_o_set_terminate 0xde3b 0x437
_o_setbuf 0xde5f 0x438
_o_setlocale 0xde7f 0x439
_o_setvbuf 0xdea0 0x43a
_o_sin 0xdebb 0x43b
_o_sinh 0xded3 0x43c
_o_sqrt 0xdeec 0x43d
_o_srand 0xdf06 0x43e
_o_strcat_s 0xdf24 0x43f
_o_strcoll 0xdf44 0x440
_o_strcpy_s 0xdf64 0x441
_o_strerror 0xdf85 0x442
_o_strerror_s 0xdfa8 0x443
_o_strftime 0xdfcb 0x444
_o_strncat_s 0xdfed 0x445
_o_strncpy_s 0xe010 0x446
_o_strtod 0xe030 0x447
_o_strtof 0xe04d 0x448
_o_strtok 0xe06a 0x449
_o_strtok_s 0xe089 0x44a
_o_strtol 0xe0a8 0x44b
_o_strtold 0xe0c6 0x44c
_o_strtoll 0xe0e5 0x44d
_o_strtoul 0xe104 0x44e
_o_strtoull 0xe124 0x44f
_o_system 0xe143 0x450
_o_tan 0xe15d 0x451
_o_tanh 0xe175 0x452
_o_terminate 0xe193 0x453
_o_tgamma 0xe1b3 0x454
_o_tgammaf 0xe1d1 0x455
_o_tgammal 0xe1f0 0x456
_o_tmpfile_s 0xe211 0x457
_o_tmpnam_s 0xe233 0x458
_o_tolower 0xe253 0x459
_o_toupper 0xe272 0x45a
_o_towlower 0xe292 0x45b
_o_towupper 0xe2b3 0x45c
_o_ungetc 0xe2d2 0x45d
_o_ungetwc 0xe2f0 0x45e
_o_wcrtomb 0xe30f 0x45f
_o_wcrtomb_s 0xe330 0x460
_o_wcscat_s 0xe352 0x461
_o_wcscoll 0xe372 0x462
_o_wcscpy 0xe390 0x463
_o_wcscpy_s 0xe3af 0x464
_o_wcsftime 0xe3d0 0x465
_o_wcsncat_s 0xe3f2 0x466
_o_wcsncpy_s 0xe415 0x467
_o_wcsrtombs 0xe438 0x468
_o_wcsrtombs_s 0xe45d 0x469
_o_wcstod 0xe47f 0x46a
_o_wcstof 0xe49c 0x46b
_o_wcstok 0xe4b9 0x46c
_o_wcstok_s 0xe4d8 0x46d
_o_wcstol 0xe4f7 0x46e
_o_wcstold 0xe515 0x46f
_o_wcstoll 0xe534 0x470
_o_wcstombs 0xe554 0x471
_o_wcstombs_s 0xe577 0x472
_o_wcstoul 0xe599 0x473
_o_wcstoull 0xe5b9 0x474
_o_wctob 0xe5d7 0x475
_o_wctomb 0xe5f3 0x476
_o_wctomb_s 0xe612 0x477
_o_wmemcpy_s 0xe634 0x478
_o_wmemmove_s 0xe658 0x479
_purecall 0xe679 0x47a
_seh_longjmp_unwind 0xe6a0 0x47b
_seh_longjmp_unwind4 0xe6d2 0x47c
_set_purecall_handler 0xe706 0x47d
_set_se_translator 0xe738 0x47e
_setjmp3 0xe75d 0x47f
longjmp 0xe777 0x480
memchr 0xe78f 0x481
memcmp 0xe7a6 0x482
memcpy 0xe7bd 0x483
memmove 0xe7d5 0x484
set_unexpected 0xe7f5 0x485
strchr 0xe814 0x486
strrchr 0xe82c 0x487
strstr 0xe844 0x488
unexpected 0xe85f 0x489
wcschr 0xe87a 0x48a
wcsrchr 0xe892 0x48b
wcsstr 0xe8aa 0x48c
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-process-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-process-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.80 KB
MD5 8d02dd4c29bd490e672d271700511371 Copy to Clipboard
SHA1 f3035a756e2e963764912c6b432e74615ae07011 Copy to Clipboard
SHA256 c03124ba691b187917ba79078c66e12cbf5387a3741203070ba23980aa471e8b Copy to Clipboard
SSDeep 192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x800
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2065-11-29 11:56:28+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x688 0x800 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.14
.rsrc 0x10002000 0x3f0 0x400 0xa00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (36)
»
Api name EAT Address Ordinal
_beep 0x12c8 0x1
_cwait 0x12de 0x2
_execl 0x12f5 0x3
_execle 0x130d 0x4
_execlp 0x1326 0x5
_execlpe 0x1340 0x6
_execv 0x1359 0x7
_execve 0x1371 0x8
_execvp 0x138a 0x9
_execvpe 0x13a4 0xa
_loaddll 0x13bf 0xb
_spawnl 0x13d9 0xc
_spawnle 0x13f3 0xd
_spawnlp 0x140e 0xe
_spawnlpe 0x142a 0xf
_spawnv 0x1445 0x10
_spawnve 0x145f 0x11
_spawnvp 0x147a 0x12
_spawnvpe 0x1496 0x13
_unloaddll 0x14b4 0x14
_wexecl 0x14d0 0x15
_wexecle 0x14ea 0x16
_wexeclp 0x1505 0x17
_wexeclpe 0x1521 0x18
_wexecv 0x153c 0x19
_wexecve 0x1556 0x1a
_wexecvp 0x1571 0x1b
_wexecvpe 0x158d 0x1c
_wspawnl 0x15a9 0x1d
_wspawnle 0x15c5 0x1e
_wspawnlp 0x15e2 0x1f
_wspawnlpe 0x1600 0x20
_wspawnv 0x161d 0x21
_wspawnve 0x1639 0x22
_wspawnvp 0x1656 0x23
_wspawnvpe 0x1674 0x24
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-runtime-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-runtime-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 22.30 KB
MD5 41a348f9bedc8681fb30fa78e45edb24 Copy to Clipboard
SHA1 66e76c0574a549f293323dd6f863a8a5b54f3f9b Copy to Clipboard
SHA256 c9bbc07a033bab6a828ecc30648b501121586f6f53346b1cd0649d7b648ea60b Copy to Clipboard
SSDeep 384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7 Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x1600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1974-05-31 18:06:00+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x15d5 0x1600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.89
.rsrc 0x10003000 0x3f0 0x400 0x1800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (107)
»
Api name EAT Address Ordinal
_Exit 0x158e 0x1
__control87_2 0x15ab 0x2
__doserrno 0x15cd 0x3
__fpe_flt_rounds 0x15f2 0x4
__fpecode 0x1616 0x5
__p___argc 0x1634 0x6
__p___argv 0x1653 0x7
__p___wargv 0x1673 0x8
__p__acmdln 0x1694 0x9
__p__pgmptr 0x16b5 0xa
__p__wcmdln 0x16d6 0xb
__p__wpgmptr 0x16f8 0xc
__pxcptinfoptrs 0x171e 0xd
__sys_errlist 0x1745 0xe
__sys_nerr 0x1767 0xf
__threadhandle 0x178a 0x10
__threadid 0x17ad 0x11
__wcserror 0x17cc 0x12
__wcserror_s 0x17ed 0x13
_assert 0x180b 0x14
_beginthread 0x1829 0x15
_beginthreadex 0x184e 0x16
_c_exit 0x186e 0x17
_cexit 0x1886 0x18
_clearfp 0x189f 0x19
_configure_narrow_argv 0x18c8 0x1a
_configure_wide_argv 0x18fd 0x1b
_control87 0x1926 0x1c
_controlfp 0x1945 0x1d
_controlfp_s 0x1966 0x1e
_crt_at_quick_exit 0x198f 0x1f
_crt_atexit 0x19b7 0x20
_crt_debugger_hook 0x19df 0x21
_endthread 0x1a06 0x22
_endthreadex 0x1a27 0x23
_errno 0x1a44 0x24
_execute_onexit_table 0x1a6a 0x25
_exit 0x1a8f 0x26
_fpieee_flt 0x1aaa 0x27
_fpreset 0x1ac8 0x28
_get_doserrno 0x1ae8 0x29
_get_errno 0x1b0a 0x2a
_get_initial_narrow_environment 0x1b3e 0x2b
_get_initial_wide_environment 0x1b85 0x2c
_get_invalid_parameter_handler 0x1bcb 0x2d
_get_narrow_winmain_command_line 0x1c14 0x2e
_get_pgmptr 0x1c4a 0x2f
_get_terminate 0x1c6e 0x30
_get_thread_local_invalid_parameter_handler 0x1cb2 0x31
_get_wide_winmain_command_line 0x1d06 0x32
_get_wpgmptr 0x1d3b 0x33
_getdllprocaddr 0x1d61 0x34
_getpid 0x1d82 0x35
_initialize_narrow_environment 0x1db2 0x36
_initialize_onexit_table 0x1df3 0x37
_initialize_wide_environment 0x1e32 0x38
_initterm 0x1e62 0x39
_initterm_e 0x1e81 0x3a
_invalid_parameter_noinfo 0x1eb0 0x3b
_invalid_parameter_noinfo_noreturn 0x1ef6 0x3c
_invoke_watson 0x1f31 0x3d
_query_app_type 0x1f59 0x3e
_register_onexit_function 0x1f8c 0x3f
_register_thread_local_exe_atexit_callback 0x1fda 0x40
_resetstkoflw 0x201c 0x41
_seh_filter_dll 0x2043 0x42
_seh_filter_exe 0x206c 0x43
_set_abort_behavior 0x2099 0x44
_set_app_type 0x20c4 0x45
_set_controlfp 0x20ea 0x46
_set_doserrno 0x2110 0x47
_set_errno 0x2132 0x48
_set_error_mode 0x2156 0x49
_set_invalid_parameter_handler 0x218e 0x4a
_set_new_handler 0x21c7 0x4b
_set_thread_local_invalid_parameter_handler 0x220d 0x4c
_seterrormode 0x2250 0x4d
_sleep 0x226e 0x4e
_statusfp 0x2288 0x4f
_statusfp2 0x22a6 0x50
_strerror 0x22c4 0x51
_strerror_s 0x22e3 0x52
_wassert 0x2301 0x53
_wcserror 0x231d 0x54
_wcserror_s 0x233c 0x55
_wperror 0x235a 0x56
_wsystem 0x2375 0x57
abort 0x238d 0x58
exit 0x23a1 0x59
feclearexcept 0x23bd 0x5a
fegetenv 0x23dd 0x5b
fegetexceptflag 0x23ff 0x5c
fegetround 0x2423 0x5d
feholdexcept 0x2444 0x5e
fesetenv 0x2463 0x5f
fesetexceptflag 0x2485 0x60
fesetround 0x24a9 0x61
fetestexcept 0x24ca 0x62
perror 0x24e7 0x63
quick_exit 0x2502 0x64
raise 0x251c 0x65
set_terminate 0x2539 0x66
signal 0x2557 0x67
strerror 0x2570 0x68
strerror_s 0x258d 0x69
system 0x25a8 0x6a
terminate 0x25c2 0x6b
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-stdio-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-stdio-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 23.80 KB
MD5 fefb98394cb9ef4368da798deab00e21 Copy to Clipboard
SHA1 316d86926b558c9f3f6133739c1a8477b9e60740 Copy to Clipboard
SHA256 b1e702b840aebe2e9244cd41512d158a43e6e9516cd2015a84eb962fa3ff0df7 Copy to Clipboard
SSDeep 384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x1c00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2089-07-13 01:51:24+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1b61 0x1c00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.96
.rsrc 0x10003000 0x3f0 0x400 0x1e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (159)
»
Api name EAT Address Ordinal
__acrt_iob_func 0x178e 0x1
__p__commode 0x17b4 0x2
__p__fmode 0x17d5 0x3
__stdio_common_vfprintf 0x1801 0x4
__stdio_common_vfprintf_p 0x183c 0x5
__stdio_common_vfprintf_s 0x1879 0x6
__stdio_common_vfscanf 0x18b3 0x7
__stdio_common_vfwprintf 0x18ec 0x8
__stdio_common_vfwprintf_p 0x1929 0x9
__stdio_common_vfwprintf_s 0x1968 0xa
__stdio_common_vfwscanf 0x19a4 0xb
__stdio_common_vsnprintf_s 0x19e0 0xc
__stdio_common_vsnwprintf_s 0x1a20 0xd
__stdio_common_vsprintf 0x1a5d 0xe
__stdio_common_vsprintf_p 0x1a98 0xf
__stdio_common_vsprintf_s 0x1ad5 0x10
__stdio_common_vsscanf 0x1b0f 0x11
__stdio_common_vswprintf 0x1b48 0x12
__stdio_common_vswprintf_p 0x1b85 0x13
__stdio_common_vswprintf_s 0x1bc4 0x14
__stdio_common_vswscanf 0x1c00 0x15
_chsize 0x1c29 0x16
_chsize_s 0x1c44 0x17
_close 0x1c5e 0x18
_commit 0x1c76 0x19
_creat 0x1c8e 0x1a
_dup 0x1ca3 0x1b
_dup2 0x1cb7 0x1c
_eof 0x1ccb 0x1d
_fclose_nolock 0x1ce8 0x1e
_fcloseall 0x1d0b 0x1f
_fflush_nolock 0x1d2e 0x20
_fgetc_nolock 0x1d54 0x21
_fgetchar 0x1d75 0x22
_fgetwc_nolock 0x1d97 0x23
_fgetwchar 0x1dba 0x24
_filelength 0x1dda 0x25
_filelengthi64 0x1dfe 0x26
_fileno 0x1e1e 0x27
_flushall 0x1e39 0x28
_fputc_nolock 0x1e5a 0x29
_fputchar 0x1e7b 0x2a
_fputwc_nolock 0x1e9d 0x2b
_fputwchar 0x1ec0 0x2c
_fread_nolock 0x1ee2 0x2d
_fread_nolock_s 0x1f09 0x2e
_fseek_nolock 0x1f30 0x2f
_fseeki64 0x1f51 0x30
_fseeki64_nolock 0x1f75 0x31
_fsopen 0x1f97 0x32
_ftell_nolock 0x1fb6 0x33
_ftelli64 0x1fd7 0x34
_ftelli64_nolock 0x1ffb 0x35
_fwrite_nolock 0x2024 0x36
_get_fmode 0x2047 0x37
_get_osfhandle 0x206a 0x38
_get_printf_count_output 0x209b 0x39
_get_stream_buffer_pointers 0x20d9 0x3a
_getc_nolock 0x210b 0x3b
_getcwd 0x2129 0x3c
_getdcwd 0x2143 0x3d
_getmaxstdio 0x2162 0x3e
_getw 0x217e 0x3f
_getwc_nolock 0x219b 0x40
_getws 0x21b9 0x41
_getws_s 0x21d2 0x42
_isatty 0x21ec 0x43
_kbhit 0x2204 0x44
_locking 0x221d 0x45
_lseek 0x2236 0x46
_lseeki64 0x2250 0x47
_mktemp 0x226b 0x48
_mktemp_s 0x2286 0x49
_open 0x229f 0x4a
_open_osfhandle 0x22be 0x4b
_pclose 0x22df 0x4c
_pipe 0x22f6 0x4d
_popen 0x230c 0x4e
_putc_nolock 0x2329 0x4f
_putw 0x2345 0x50
_putwc_nolock 0x2362 0x51
_putws 0x2380 0x52
_read 0x2396 0x53
_rmtmp 0x23ac 0x54
_set_fmode 0x23c7 0x55
_set_printf_count_output 0x23f4 0x56
_setmaxstdio 0x2423 0x57
_setmode 0x2442 0x58
_sopen 0x245b 0x59
_sopen_dispatch 0x247b 0x5a
_sopen_s 0x249d 0x5b
_tell 0x24b5 0x5c
_telli64 0x24cd 0x5d
_tempnam 0x24e8 0x5e
_ungetc_nolock 0x2509 0x5f
_ungetwc_nolock 0x2531 0x60
_wcreat 0x2552 0x61
_wfdopen 0x256c 0x62
_wfopen 0x2586 0x63
_wfopen_s 0x25a1 0x64
_wfreopen 0x25be 0x65
_wfreopen_s 0x25dd 0x66
_wfsopen 0x25fb 0x67
_wmktemp 0x2616 0x68
_wmktemp_s 0x2633 0x69
_wopen 0x264e 0x6a
_wpopen 0x2666 0x6b
_write 0x267e 0x6c
_wsopen 0x2696 0x6d
_wsopen_dispatch 0x26b8 0x6e
_wsopen_s 0x26dc 0x6f
_wtempnam 0x26f9 0x70
_wtmpnam 0x2715 0x71
_wtmpnam_s 0x2732 0x72
clearerr 0x274f 0x73
clearerr_s 0x276c 0x74
fclose 0x2787 0x75
feof 0x279c 0x76
ferror 0x27b1 0x77
fflush 0x27c8 0x78
fgetc 0x27de 0x79
fgetpos 0x27f5 0x7a
fgets 0x280c 0x7b
fgetwc 0x2822 0x7c
fgetws 0x2839 0x7d
fopen 0x284f 0x7e
fopen_s 0x2866 0x7f
fputc 0x287d 0x80
fputs 0x2892 0x81
fputwc 0x28a8 0x82
fputws 0x28bf 0x83
fread 0x28d5 0x84
fread_s 0x28ec 0x85
freopen 0x2905 0x86
freopen_s 0x2920 0x87
fseek 0x2939 0x88
fsetpos 0x2950 0x89
ftell 0x2967 0x8a
fwrite 0x297d 0x8b
getc 0x2992 0x8c
getchar 0x29a8 0x8d
gets 0x29be 0x8e
gets_s 0x29d3 0x8f
getwc 0x29e9 0x90
getwchar 0x2a01 0x91
putc 0x2a18 0x92
putchar 0x2a2e 0x93
puts 0x2a44 0x94
putwc 0x2a58 0x95
putwchar 0x2a70 0x96
rewind 0x2a89 0x97
setbuf 0x2aa0 0x98
setvbuf 0x2ab8 0x99
tmpfile 0x2ad1 0x9a
tmpfile_s 0x2aec 0x9b
tmpnam 0x2b06 0x9c
tmpnam_s 0x2b1f 0x9d
ungetc 0x2b38 0x9e
ungetwc 0x2b50 0x9f
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-string-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-string-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 22.94 KB
MD5 404604cd100a1e60dfdaf6ecf5ba14c0 Copy to Clipboard
SHA1 58469835ab4b916927b3cabf54aee4f380ff6748 Copy to Clipboard
SHA256 73cc56f20268bfb329ccd891822e2e70dd70fe21fc7101deb3fa30c34a08450c Copy to Clipboard
SSDeep 384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x1c00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2014-06-23 05:32:49+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x1bef 0x1c00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.9
.rsrc 0x10003000 0x3f0 0x400 0x1e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (178)
»
Api name EAT Address Ordinal
__isascii 0x1857 0x1
__iscsym 0x1873 0x2
__iscsymf 0x188f 0x3
__iswcsym 0x18ac 0x4
__iswcsymf 0x18ca 0x5
__strncnt 0x18e8 0x6
__wcsncnt 0x1905 0x7
_isalnum_l 0x1923 0x8
_isalpha_l 0x1942 0x9
_isblank_l 0x1961 0xa
_iscntrl_l 0x1980 0xb
_isctype 0x199d 0xc
_isctype_l 0x19ba 0xd
_isdigit_l 0x19d9 0xe
_isgraph_l 0x19f8 0xf
_isleadbyte_l 0x1a1a 0x10
_islower_l 0x1a3c 0x11
_isprint_l 0x1a5b 0x12
_ispunct_l 0x1a7a 0x13
_isspace_l 0x1a99 0x14
_isupper_l 0x1ab8 0x15
_iswalnum_l 0x1ad8 0x16
_iswalpha_l 0x1af9 0x17
_iswblank_l 0x1b1a 0x18
_iswcntrl_l 0x1b3b 0x19
_iswcsym_l 0x1b5b 0x1a
_iswcsymf_l 0x1b7b 0x1b
_iswctype_l 0x1b9c 0x1c
_iswdigit_l 0x1bbd 0x1d
_iswgraph_l 0x1bde 0x1e
_iswlower_l 0x1bff 0x1f
_iswprint_l 0x1c20 0x20
_iswpunct_l 0x1c41 0x21
_iswspace_l 0x1c62 0x22
_iswupper_l 0x1c83 0x23
_iswxdigit_l 0x1ca5 0x24
_isxdigit_l 0x1cc7 0x25
_memccpy 0x1ce5 0x26
_memicmp 0x1d00 0x27
_memicmp_l 0x1d1d 0x28
_strcoll_l 0x1d3c 0x29
_strdup 0x1d58 0x2a
_stricmp 0x1d72 0x2b
_stricmp_l 0x1d8f 0x2c
_stricoll 0x1dad 0x2d
_stricoll_l 0x1dcc 0x2e
_strlwr 0x1de9 0x2f
_strlwr_l 0x1e04 0x30
_strlwr_s 0x1e21 0x31
_strlwr_s_l 0x1e40 0x32
_strncoll 0x1e5f 0x33
_strncoll_l 0x1e7e 0x34
_strnicmp 0x1e9d 0x35
_strnicmp_l 0x1ebc 0x36
_strnicoll 0x1edc 0x37
_strnicoll_l 0x1efd 0x38
_strnset 0x1f1c 0x39
_strnset_s 0x1f39 0x3a
_strrev 0x1f55 0x3b
_strset 0x1f6e 0x3c
_strset_s 0x1f89 0x3d
_strupr 0x1fa4 0x3e
_strupr_l 0x1fbf 0x3f
_strupr_s 0x1fdc 0x40
_strupr_s_l 0x1ffb 0x41
_strxfrm_l 0x201b 0x42
_tolower 0x2038 0x43
_tolower_l 0x2055 0x44
_toupper 0x2072 0x45
_toupper_l 0x208f 0x46
_towlower_l 0x20af 0x47
_towupper_l 0x20d0 0x48
_wcscoll_l 0x20f0 0x49
_wcsdup 0x210c 0x4a
_wcsicmp 0x2126 0x4b
_wcsicmp_l 0x2143 0x4c
_wcsicoll 0x2161 0x4d
_wcsicoll_l 0x2180 0x4e
_wcslwr 0x219d 0x4f
_wcslwr_l 0x21b8 0x50
_wcslwr_s 0x21d5 0x51
_wcslwr_s_l 0x21f4 0x52
_wcsncoll 0x2213 0x53
_wcsncoll_l 0x2232 0x54
_wcsnicmp 0x2251 0x55
_wcsnicmp_l 0x2270 0x56
_wcsnicoll 0x2290 0x57
_wcsnicoll_l 0x22b1 0x58
_wcsnset 0x22d0 0x59
_wcsnset_s 0x22ed 0x5a
_wcsrev 0x2309 0x5b
_wcsset 0x2322 0x5c
_wcsset_s 0x233d 0x5d
_wcsupr 0x2358 0x5e
_wcsupr_l 0x2373 0x5f
_wcsupr_s 0x2390 0x60
_wcsupr_s_l 0x23af 0x61
_wcsxfrm_l 0x23cf 0x62
_wctype 0x23eb 0x63
is_wctype 0x2406 0x64
isalnum 0x2421 0x65
isalpha 0x243a 0x66
isblank 0x2453 0x67
iscntrl 0x246c 0x68
isdigit 0x2485 0x69
isgraph 0x249e 0x6a
isleadbyte 0x24ba 0x6b
islower 0x24d6 0x6c
isprint 0x24ef 0x6d
ispunct 0x2508 0x6e
isspace 0x2521 0x6f
isupper 0x253a 0x70
iswalnum 0x2554 0x71
iswalpha 0x256f 0x72
iswascii 0x258a 0x73
iswblank 0x25a5 0x74
iswcntrl 0x25c0 0x75
iswctype 0x25db 0x76
iswdigit 0x25f6 0x77
iswgraph 0x2611 0x78
iswlower 0x262c 0x79
iswprint 0x2647 0x7a
iswpunct 0x2662 0x7b
iswspace 0x267d 0x7c
iswupper 0x2698 0x7d
iswxdigit 0x26b4 0x7e
isxdigit 0x26d0 0x7f
mblen 0x26e8 0x80
mbrlen 0x26fe 0x81
memcpy_s 0x2717 0x82
memmove_s 0x2733 0x83
memset 0x274d 0x84
strcat 0x2764 0x85
strcat_s 0x277d 0x86
strcmp 0x2796 0x87
strcoll 0x27ae 0x88
strcpy 0x27c6 0x89
strcpy_s 0x27df 0x8a
strcspn 0x27f9 0x8b
strlen 0x2811 0x8c
strncat 0x2829 0x8d
strncat_s 0x2844 0x8e
strncmp 0x285f 0x8f
strncpy 0x2878 0x90
strncpy_s 0x2893 0x91
strnlen 0x28ae 0x92
strpbrk 0x28c7 0x93
strspn 0x28df 0x94
strtok 0x28f6 0x95
strtok_s 0x290f 0x96
strxfrm 0x2929 0x97
tolower 0x2942 0x98
toupper 0x295b 0x99
towctrans 0x2976 0x9a
towlower 0x2992 0x9b
towupper 0x29ad 0x9c
wcscat 0x29c6 0x9d
wcscat_s 0x29df 0x9e
wcscmp 0x29f8 0x9f
wcscoll 0x2a10 0xa0
wcscpy 0x2a28 0xa1
wcscpy_s 0x2a41 0xa2
wcscspn 0x2a5b 0xa3
wcslen 0x2a73 0xa4
wcsncat 0x2a8b 0xa5
wcsncat_s 0x2aa6 0xa6
wcsncmp 0x2ac1 0xa7
wcsncpy 0x2ada 0xa8
wcsncpy_s 0x2af5 0xa9
wcsnlen 0x2b10 0xaa
wcspbrk 0x2b29 0xab
wcsspn 0x2b41 0xac
wcstok 0x2b58 0xad
wcstok_s 0x2b71 0xae
wcsxfrm 0x2b8b 0xaf
wctype 0x2ba3 0xb0
wmemcpy_s 0x2bbd 0xb1
wmemmove_s 0x2bdb 0xb2
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-time-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-time-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 20.30 KB
MD5 849f2c3ebf1fcba33d16153692d5810f Copy to Clipboard
SHA1 1f8eda52d31512ebfdd546be60990b95c8e28bfb Copy to Clipboard
SHA256 69885fd581641b4a680846f93c2dd21e5dd8e3ba37409783bc5b3160a919cb5d Copy to Clipboard
SSDeep 384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0 Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0xe00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2008-12-22 15:31:44+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xcbd 0xe00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.68
.rsrc 0x10002000 0x3f0 0x400 0x1000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (72)
»
Api name EAT Address Ordinal
_Getdays 0x1420 0x1
_Getmonths 0x143d 0x2
_Gettnames 0x145c 0x3
_Strftime 0x147a 0x4
_W_Getdays 0x1498 0x5
_W_Getmonths 0x14b9 0x6
_W_Gettnames 0x14dc 0x7
_Wcsftime 0x14fc 0x8
__daylight 0x151a 0x9
__dstbias 0x1538 0xa
__timezone 0x1556 0xb
__tzname 0x1573 0xc
_ctime32 0x158e 0xd
_ctime32_s 0x15ab 0xe
_ctime64 0x15c8 0xf
_ctime64_s 0x15e5 0x10
_difftime32 0x1605 0x11
_difftime64 0x1626 0x12
_ftime32 0x1644 0x13
_ftime32_s 0x1661 0x14
_ftime64 0x167e 0x15
_ftime64_s 0x169b 0x16
_futime32 0x16b9 0x17
_futime64 0x16d6 0x18
_get_daylight 0x16f7 0x19
_get_dstbias 0x171b 0x1a
_get_timezone 0x173f 0x1b
_get_tzname 0x1762 0x1c
_getsystime 0x1783 0x1d
_gmtime32 0x17a2 0x1e
_gmtime32_s 0x17c1 0x1f
_gmtime64 0x17e0 0x20
_gmtime64_s 0x17ff 0x21
_localtime32 0x1821 0x22
_localtime32_s 0x1846 0x23
_localtime64 0x186b 0x24
_localtime64_s 0x1890 0x25
_mkgmtime32 0x18b4 0x26
_mkgmtime64 0x18d5 0x27
_mktime32 0x18f4 0x28
_mktime64 0x1911 0x29
_setsystime 0x1930 0x2a
_strdate 0x194e 0x2b
_strdate_s 0x196b 0x2c
_strftime_l 0x198b 0x2d
_strtime 0x19a9 0x2e
_strtime_s 0x19c6 0x2f
_time32 0x19e2 0x30
_time64 0x19fb 0x31
_timespec32_get 0x1a1c 0x32
_timespec64_get 0x1a45 0x33
_tzset 0x1a65 0x34
_utime32 0x1a7e 0x35
_utime64 0x1a99 0x36
_wasctime 0x1ab5 0x37
_wasctime_s 0x1ad4 0x38
_wcsftime_l 0x1af5 0x39
_wctime32 0x1b14 0x3a
_wctime32_s 0x1b33 0x3b
_wctime64 0x1b52 0x3c
_wctime64_s 0x1b71 0x3d
_wstrdate 0x1b90 0x3e
_wstrdate_s 0x1baf 0x3f
_wstrtime 0x1bce 0x40
_wstrtime_s 0x1bed 0x41
_wutime32 0x1c0c 0x42
_wutime64 0x1c29 0x43
asctime 0x1c44 0x44
asctime_s 0x1c5f 0x45
clock 0x1c78 0x46
strftime 0x1c90 0x47
wcsftime 0x1cab 0x48
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-crt-utility-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-crt-utility-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 b52a0ca52c9c207874639b62b6082242 Copy to Clipboard
SHA1 6fb845d6a82102ff74bd35f42a2844d8c450413b Copy to Clipboard
SHA256 a1d1d6b0cb0a8421d7c0d1297c4c389c95514493cd0a386b49dc517ac1b9a2b0 Copy to Clipboard
SSDeep 192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2105-09-06 09:19:26+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x56e 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.51
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (30)
»
Api name EAT Address Ordinal
_abs64 0x128d 0x1
_byteswap_uint64 0x12ae 0x2
_byteswap_ulong 0x12d8 0x3
_byteswap_ushort 0x1302 0x4
_lfind 0x1323 0x5
_lfind_s 0x133c 0x6
_lrotl 0x1355 0x7
_lrotr 0x136c 0x8
_lsearch 0x1385 0x9
_lsearch_s 0x13a2 0xa
_rotl 0x13bc 0xb
_rotl64 0x13d3 0xc
_rotr 0x13ea 0xd
_rotr64 0x1401 0xe
_swab 0x1418 0xf
abs 0x142b 0x10
bsearch 0x1440 0x11
bsearch_s 0x145b 0x12
div 0x1472 0x13
imaxabs 0x1487 0x14
imaxdiv 0x14a0 0x15
labs 0x14b6 0x16
ldiv 0x14c9 0x17
llabs 0x14dd 0x18
lldiv 0x14f2 0x19
qsort 0x1507 0x1a
qsort_s 0x151e 0x1b
rand 0x1534 0x1c
rand_s 0x1549 0x1d
srand 0x155f 0x1e
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-file-l1-2-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-file-l1-2-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 e2f648ae40d234a3892e1455b4dbbe05 Copy to Clipboard
SHA1 d9d750e828b629cfb7b402a3442947545d8d781b Copy to Clipboard
SHA256 c8c499b012d0d63b7afc8b4ca42d6d996b2fcf2e8b5f94cacfbec9e6f33e8a03 Copy to Clipboard
SSDeep 192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2010-09-03 20:48:21+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x23c 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.19
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (4)
»
Api name EAT Address Ordinal
CreateFile2 0x116c 0x1
GetTempPathW 0x118e 0x2
GetVolumeNameForVolumeMountPointW 0x11c6 0x3
GetVolumePathNamesForVolumeNameW 0x1212 0x4
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-file-l2-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-file-l2-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 e479444bdd4ae4577fd32314a68f5d28 Copy to Clipboard
SHA1 77edf9509a252e886d4da388bf9c9294d95498eb Copy to Clipboard
SHA256 c85dc081b1964b77d289aac43cc64746e7b141d036f248a731601eb98f827719 Copy to Clipboard
SSDeep 192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7 Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2036-05-22 06:29:08+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x37d 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.64
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (11)
»
Api name EAT Address Ordinal
CopyFile2 0x11b0 0x1
CopyFileExW 0x11cf 0x2
CreateDirectoryExW 0x11f7 0x3
CreateHardLinkW 0x1223 0x4
CreateSymbolicLinkW 0x1250 0x5
GetFileInformationByHandleEx 0x128a 0x6
MoveFileExW 0x12bc 0x7
MoveFileWithProgressW 0x12e7 0x8
ReOpenFile 0x1311 0x9
ReadDirectoryChangesW 0x133b 0xa
ReplaceFileW 0x1367 0xb
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-handle-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-handle-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 6db54065b33861967b491dd1c8fd8595 Copy to Clipboard
SHA1 ed0938bbc0e2a863859aad64606b8fc4c69b810a Copy to Clipboard
SHA256 945cc64ee04b1964c1f9fcdc3124dd83973d332f5cfb696cdf128ca5c4cbd0e5 Copy to Clipboard
SSDeep 384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2008-02-02 03:17:29+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x25f 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.24
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (5)
»
Api name EAT Address Ordinal
CloseHandle 0x1188 0x1
CompareObjectHandles 0x11b2 0x2
DuplicateHandle 0x11e0 0x3
GetHandleInformation 0x120e 0x4
SetHandleInformation 0x1241 0x5
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-heap-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-heap-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 17.80 KB
MD5 2ea3901d7b50bf6071ec8732371b821c Copy to Clipboard
SHA1 e7be926f0f7d842271f7edc7a4989544f4477da7 Copy to Clipboard
SHA256 44f6df4280c8ecc9c6e609b1a4bfee041332d337d84679cfe0d6678ce8f2998a Copy to Clipboard
SSDeep 192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x400
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2071-09-01 04:16:53+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x3f8 0x400 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.93
.rsrc 0x10002000 0x3f0 0x400 0x600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (16)
»
Api name EAT Address Ordinal
GetProcessHeap 0x11e7 0x1
GetProcessHeaps 0x120f 0x2
HeapAlloc 0x1232 0x3
HeapCompact 0x1251 0x4
HeapCreate 0x1271 0x5
HeapDestroy 0x1291 0x6
HeapFree 0x12af 0x7
HeapLock 0x12ca 0x8
HeapQueryInformation 0x12f1 0x9
HeapReAlloc 0x131b 0xa
HeapSetInformation 0x1343 0xb
HeapSize 0x1368 0xc
HeapSummary 0x1386 0xd
HeapUnlock 0x13a6 0xe
HeapValidate 0x13c7 0xf
HeapWalk 0x13e6 0x10
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-interlocked-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-interlocked-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 17.44 KB
MD5 d97a1cb141c6806f0101a5ed2673a63d Copy to Clipboard
SHA1 d31a84c1499a9128a8f0efea4230fcfa6c9579be Copy to Clipboard
SHA256 deccd75fc3fc2bb31338b6fe26deffbd7914c6cd6a907e76fd4931b7d141718c Copy to Clipboard
SSDeep 192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2052-12-12 20:31:39+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x414 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.88
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (11)
»
Api name EAT Address Ordinal
InitializeSListHead 0x11d1 0x1
InterlockedCompareExchange 0x124c 0x3
InterlockedCompareExchange64 0x120b 0x2
InterlockedDecrement 0x1285 0x4
InterlockedExchange 0x12b7 0x5
InterlockedExchangeAdd 0x12eb 0x6
InterlockedFlushSList 0x1321 0x7
InterlockedIncrement 0x1355 0x8
InterlockedPopEntrySList 0x138c 0x9
InterlockedPushEntrySList 0x13c8 0xa
QueryDepthSList 0x13fb 0xb
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-libraryloader-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-libraryloader-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 d0873e21721d04e20b6ffb038accf2f1 Copy to Clipboard
SHA1 9e39e505d80d67b347b19a349a1532746c1f7f88 Copy to Clipboard
SHA256 bb25ccf8694d1fcfce85a7159dcf6985fdb54728d29b021cb3d14242f65909ce Copy to Clipboard
SSDeep 384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2027-07-04 17:26:46+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x50b 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.54
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (18)
»
Api name EAT Address Ordinal
DisableThreadLibraryCalls 0x121f 0x1
FindResourceExW 0x1252 0x2
FindStringOrdinal 0x127d 0x3
FreeLibrary 0x12a4 0x4
FreeLibraryAndExitThread 0x12d2 0x5
FreeResource 0x1301 0x6
GetModuleFileNameA 0x132a 0x7
GetModuleFileNameW 0x1359 0x8
GetModuleHandleA 0x1386 0x9
GetModuleHandleExA 0x13b3 0xa
GetModuleHandleExW 0x13e2 0xb
GetModuleHandleW 0x140f 0xc
GetProcAddress 0x1438 0xd
LoadLibraryExA 0x145f 0xe
LoadLibraryExW 0x1486 0xf
LoadResource 0x14ab 0x10
LockResource 0x14ce 0x11
SizeofResource 0x14f3 0x12
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-localization-l1-2-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-localization-l1-2-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 20.30 KB
MD5 eff11130bfe0d9c90c0026bf2fb219ae Copy to Clipboard
SHA1 cf4c89a6e46090d3d8feeb9eb697aea8a26e4088 Copy to Clipboard
SHA256 03ad57c24ff2cf895b5f533f0ecbd10266fd8634c6b9053cc9cb33b814ad5d97 Copy to Clipboard
SSDeep 384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0xe00
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2099-12-20 04:00:19+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0xdc7 0xe00 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 5.23
.rsrc 0x10002000 0x3f0 0x400 0x1000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (59)
»
Api name EAT Address Ordinal
ConvertDefaultLocale 0x13b3 0x1
EnumSystemGeoID 0x13e1 0x2
EnumSystemLocalesA 0x140d 0x3
EnumSystemLocalesW 0x143c 0x4
FindNLSString 0x1466 0x5
FindNLSStringEx 0x148d 0x6
FormatMessageA 0x14b5 0x7
FormatMessageW 0x14dc 0x8
GetACP 0x14fb 0x9
GetCPInfo 0x1515 0xa
GetCPInfoExW 0x1535 0xb
GetCalendarInfoEx 0x155d 0xc
GetCalendarInfoW 0x1589 0xd
GetFileMUIInfo 0x15b2 0xe
GetFileMUIPath 0x15d9 0xf
GetGeoInfoW 0x15fd 0x10
GetLocaleInfoA 0x1621 0x11
GetLocaleInfoEx 0x1649 0x12
GetLocaleInfoW 0x1671 0x13
GetNLSVersion 0x1697 0x14
GetNLSVersionEx 0x16be 0x15
GetOEMCP 0x16e0 0x16
GetProcessPreferredUILanguages 0x1711 0x17
GetSystemDefaultLCID 0x174e 0x18
GetSystemDefaultLangID 0x1783 0x19
GetSystemPreferredUILanguages 0x17c1 0x1a
GetThreadLocale 0x17f8 0x1b
GetThreadPreferredUILanguages 0x182f 0x1c
GetThreadUILanguage 0x186a 0x1d
GetUILanguageInfo 0x1899 0x1e
GetUserDefaultLCID 0x18c7 0x1f
GetUserDefaultLangID 0x18f8 0x20
GetUserDefaultLocaleName 0x192f 0x21
GetUserGeoID 0x195e 0x22
GetUserPreferredUILanguages 0x1990 0x23
IdnToAscii 0x19c0 0x24
IdnToUnicode 0x19e1 0x25
IsDBCSLeadByte 0x1a06 0x26
IsDBCSLeadByteEx 0x1a2f 0x27
IsNLSDefinedString 0x1a5c 0x28
IsValidCodePage 0x1a88 0x29
IsValidLanguageGroup 0x1ab6 0x2a
IsValidLocale 0x1ae2 0x2b
IsValidLocaleName 0x1b0b 0x2c
IsValidNLSVersion 0x1b38 0x2d
LCMapStringA 0x1b60 0x2e
LCMapStringEx 0x1b84 0x2f
LCMapStringW 0x1ba8 0x30
LocaleNameToLCID 0x1bcf 0x31
ResolveLocaleName 0x1bfb 0x32
SetCalendarInfoW 0x1c27 0x33
SetLocaleInfoW 0x1c50 0x34
SetProcessPreferredUILanguages 0x1c87 0x35
SetThreadLocale 0x1cbf 0x36
SetThreadPreferredUILanguages 0x1cf6 0x37
SetThreadUILanguage 0x1d31 0x38
SetUserGeoID 0x1d5b 0x39
VerLanguageNameA 0x1d82 0x3a
VerLanguageNameW 0x1dad 0x3b
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
api-ms-win-core-memory-l1-1-0.dll Embedded File Binary
clean
Known to be clean.
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\api-ms-win-core-memory-l1-1-0.dll (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\uS0wV5wY9qH3\pB4pD1lB4sD3.zip
MIME Type application/vnd.microsoft.portable-executable
File Size 18.30 KB
MD5 d500d9e24f33933956df0e26f087fd91 Copy to Clipboard
SHA1 6c537678ab6cfd6f3ea0dc0f5abefd1c4924f0c0 Copy to Clipboard
SHA256 bb33a9e906a5863043753c44f6f8165afe4d5edb7e55efa4c7e6e1ed90778eca Copy to Clipboard
SSDeep 384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x10000000
Size Of Code 0x600
Size Of Initialized Data 0x400
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 1991-05-07 00:38:52+00:00
Version Information (8)
»
CompanyName Microsoft Corporation
FileDescription ApiSet Stub DLL
FileVersion 10.0.16299.15 (WinBuild.160101.0800)
InternalName apisetstub
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename apisetstub
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.16299.15
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x10001000 0x46c 0x600 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 4.11
.rsrc 0x10002000 0x3f0 0x400 0x800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 3.3
Exports (16)
»
Api name EAT Address Ordinal
CreateFileMappingW 0x11fd 0x1
FlushViewOfFile 0x1229 0x2
MapViewOfFile 0x1250 0x3
MapViewOfFileEx 0x1277 0x4
OpenFileMappingW 0x12a1 0x5
ReadProcessMemory 0x12cd 0x6
UnmapViewOfFile 0x12f8 0x7
VirtualAlloc 0x131e 0x8
VirtualAllocEx 0x1343 0x9
VirtualFree 0x1367 0xa
VirtualFreeEx 0x138a 0xb
VirtualProtect 0x13b0 0xc
VirtualProtectEx 0x13d9 0xd
VirtualQuery 0x1400 0xe
VirtualQueryEx 0x1425 0xf
WriteProcessMemory 0x1450 0x10
Digital Signature Information
»
Verification Status Valid
Certificate: Microsoft Corporation
»
Issued by Microsoft Corporation
Parent Certificate Microsoft Code Signing PCA
Country Name US
Valid From 2017-08-11 22:11 (UTC+2)
Valid Until 2018-08-11 22:11 (UTC+2)
Algorithm sha1_rsa
Serial Number 33 00 00 01 78 25 5A B5 CD 23 C6 5F 95 00 01 00 00 01 78
Thumbprint 49 D5 9D 86 50 5D 82 94 2A 07 63 88 69 3F 4F B7 B2 12 54 EE
Certificate: Microsoft Code Signing PCA
»
Issued by Microsoft Code Signing PCA
Country Name US
Valid From 2010-09-01 00:19 (UTC+2)
Valid Until 2020-09-01 00:29 (UTC+2)
Algorithm sha1_rsa
Serial Number 61 33 26 1A 00 00 00 00 00 31
Thumbprint 3C AF 9B A2 DB 55 70 CA F7 69 42 FF 99 10 1B 99 38 88 E2 57
C:\Users\RDhJ0CNFevzX\AppData\LocalLow\A6vWooljZhq.zip Dropped File ZIP
clean
...
»
MIME Type application/zip
File Size 961 Bytes
MD5 d8fd8712b01fd876499e8da286870bb8 Copy to Clipboard
SHA1 5fda1eaec83be6c3b1cd26237f4b8b25d6e79cc1 Copy to Clipboard
SHA256 08782169eff8a56b193ef2c9e63edd9001d43111dd7f29c62c242eff5aa14e51 Copy to Clipboard
SSDeep 24:9njoNVRIX4GaSAFzAoVGn9QpxplsP0mwYY3GDoPk3:9njYLIX41VFz8PP5pDn Copy to Clipboard
ImpHash -
Archive Information
»
Number of Files 2
Number of Folders 1
Size of Packed Archive Contents 671 Bytes
Size of Unpacked Archive Contents 1.11 KB
File Format zip
Contents (2)
»
File Name Packed Size Unpacked Size Compression Is Encrypted Modify Time Severity Recursively Submitted Actions
System Info.txt 584 Bytes 998 Bytes Deflate False 2021-09-28 02:01 (UTC+2)
Clean
-
...
mails/outlook.txt 87 Bytes 134 Bytes Deflate False 2021-09-28 02:01 (UTC+2)
Clean
-
...
System Info.txt Embedded File Text
clean
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\LocalLow\yH9tY9hO9gL5 (Dropped File)
Parent File C:\Users\RDhJ0CNFevzX\AppData\LocalLow\A6vWooljZhq.zip
MIME Type text/plain
File Size 998 Bytes
MD5 6f6915a73ac91f220d401d0b67aae7f9 Copy to Clipboard
SHA1 991e6b93c604067f76816d398c4a411dafdc9fb8 Copy to Clipboard
SHA256 10f8180b85d290bdf4e44253d9972e45cb0b3053f402a79a441a832e6a29e8c4 Copy to Clipboard
SSDeep 24:m9S+K23TP2eB6SeARBqhKQa76xCjk/R8iP17PHwr:eSQ3TP2GRBgBCjk/RN52 Copy to Clipboard
ImpHash -
C:\Users\RDhJ0CNFevzX\AppData\LocalLow\sqlite3.dll Downloaded File Binary
clean
Known to be clean.
...
»
MIME Type application/vnd.microsoft.portable-executable
File Size 895.25 KB
MD5 f964811b68f9f1487c2b41e1aef576ce Copy to Clipboard
SHA1 b423959793f14b1416bc3b7051bed58a1034025f Copy to Clipboard
SHA256 83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7 Copy to Clipboard
SSDeep 24576:BJDwWdxW2SBNTjlY24eJoyGttl3+FZVpsq/2W:BJDvx0BY24eJoyctl3+FTX Copy to Clipboard
ImpHash 596770193a7f877d586dad91b1eeebc1 Copy to Clipboard
PE Information
»
Image Base 0x61e00000
Entry Point 0x61e01400
Size Of Code 0x95a00
Size Of Initialized Data 0xb0400
Size Of Uninitialized Data 0xa00
File Type FileType.dll
Subsystem Subsystem.windows_cui
Machine Type MachineType.i386
Compile Timestamp 2019-02-25 16:34:31+00:00
Version Information (8)
»
CompanyName SQLite Development Team
FileDescription SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine.
FileVersion 3.27.2
InternalName sqlite3
LegalCopyright http://www.sqlite.org/copyright.html
ProductName SQLite
ProductVersion 3.27.2
SourceId 2019-02-25 16:06:06 bd49a8271d650fa89e446b42e513b595a717b9212c91dd384aab871fc1d0f6d7
Sections (18)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x61e01000 0x95858 0x95a00 0x600 IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 6.41
.data 0x61e97000 0x1bfc 0x1c00 0x96000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 3.79
.rdata 0x61e99000 0x11f14 0x12000 0x97c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ 6.39
.bss 0x61eab000 0x828 0x0 0x0 IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.0
.edata 0x61eac000 0x209d 0x2200 0xa9c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ 5.31
.idata 0x61eaf000 0xc48 0xe00 0xabe00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 4.88
.CRT 0x61eb0000 0x2c 0x200 0xacc00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.21
.tls 0x61eb1000 0x20 0x200 0xace00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.26
.rsrc 0x61eb2000 0x4a8 0x600 0xad000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 2.85
.reloc 0x61eb3000 0x33bc 0x3400 0xad600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.52
/4 0x61eb7000 0x2d8 0x400 0xb0a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 1.87
/19 0x61eb8000 0x98d8 0x9a00 0xb0e00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 6.07
/31 0x61ec2000 0x1af5 0x1c00 0xba800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 4.56
/45 0x61ec4000 0x1a80 0x1c00 0xbc400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 5.6
/57 0x61ec6000 0x8bc 0xa00 0xbe000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 4.58
/70 0x61ec7000 0x269 0x400 0xbea00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 3.56
/81 0x61ec8000 0x1cd3 0x1e00 0xbee00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 3.29
/92 0x61eca000 0x290 0x400 0xc0c00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 1.76
Imports (2)
»
KERNEL32.dll (79)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
AreFileApisANSI - 0x61eaf1f0 0xaf03c 0xabe3c 0x15
CloseHandle - 0x61eaf1f4 0xaf040 0xabe40 0x53
CreateFileA - 0x61eaf1f8 0xaf044 0xabe44 0x8b
CreateFileMappingA - 0x61eaf1fc 0xaf048 0xabe48 0x8c
CreateFileMappingW - 0x61eaf200 0xaf04c 0xabe4c 0x8f
CreateFileW - 0x61eaf204 0xaf050 0xabe50 0x92
CreateMutexW - 0x61eaf208 0xaf054 0xabe54 0xa1
DeleteCriticalSection - 0x61eaf20c 0xaf058 0xabe58 0xd4
DeleteFileA - 0x61eaf210 0xaf05c 0xabe5c 0xd6
DeleteFileW - 0x61eaf214 0xaf060 0xabe60 0xd9
EnterCriticalSection - 0x61eaf218 0xaf064 0xabe64 0xf0
FlushFileBuffers - 0x61eaf21c 0xaf068 0xabe68 0x15a
FlushViewOfFile - 0x61eaf220 0xaf06c 0xabe6c 0x15d
FormatMessageA - 0x61eaf224 0xaf070 0xabe70 0x160
FormatMessageW - 0x61eaf228 0xaf074 0xabe74 0x161
FreeLibrary - 0x61eaf22c 0xaf078 0xabe78 0x165
GetCurrentProcess - 0x61eaf230 0xaf07c 0xabe7c 0x1c5
GetCurrentProcessId - 0x61eaf234 0xaf080 0xabe80 0x1c6
GetCurrentThreadId - 0x61eaf238 0xaf084 0xabe84 0x1ca
GetDiskFreeSpaceA - 0x61eaf23c 0xaf088 0xabe88 0x1d1
GetDiskFreeSpaceW - 0x61eaf240 0xaf08c 0xabe8c 0x1d4
GetFileAttributesA - 0x61eaf244 0xaf090 0xabe90 0x1e7
GetFileAttributesExW - 0x61eaf248 0xaf094 0xabe94 0x1e9
GetFileAttributesW - 0x61eaf24c 0xaf098 0xabe98 0x1ec
GetFileSize - 0x61eaf250 0xaf09c 0xabe9c 0x1f2
GetFullPathNameA - 0x61eaf254 0xaf0a0 0xabea0 0x1fa
GetFullPathNameW - 0x61eaf258 0xaf0a4 0xabea4 0x1fd
GetLastError - 0x61eaf25c 0xaf0a8 0xabea8 0x204
GetModuleHandleA - 0x61eaf260 0xaf0ac 0xabeac 0x216
GetProcAddress - 0x61eaf264 0xaf0b0 0xabeb0 0x246
GetProcessHeap - 0x61eaf268 0xaf0b4 0xabeb4 0x24b
GetSystemInfo - 0x61eaf26c 0xaf0b8 0xabeb8 0x276
GetSystemTime - 0x61eaf270 0xaf0bc 0xabebc 0x27a
GetSystemTimeAsFileTime - 0x61eaf274 0xaf0c0 0xabec0 0x27c
GetTempPathA - 0x61eaf278 0xaf0c4 0xabec4 0x288
GetTempPathW - 0x61eaf27c 0xaf0c8 0xabec8 0x289
GetTickCount - 0x61eaf280 0xaf0cc 0xabecc 0x298
GetVersionExA - 0x61eaf284 0xaf0d0 0xabed0 0x2a7
GetVersionExW - 0x61eaf288 0xaf0d4 0xabed4 0x2a8
HeapAlloc - 0x61eaf28c 0xaf0d8 0xabed8 0x2d1
HeapCompact - 0x61eaf290 0xaf0dc 0xabedc 0x2d2
HeapCreate - 0x61eaf294 0xaf0e0 0xabee0 0x2d3
HeapDestroy - 0x61eaf298 0xaf0e4 0xabee4 0x2d5
HeapFree - 0x61eaf29c 0xaf0e8 0xabee8 0x2d7
HeapReAlloc - 0x61eaf2a0 0xaf0ec 0xabeec 0x2db
HeapSize - 0x61eaf2a4 0xaf0f0 0xabef0 0x2dd
HeapValidate - 0x61eaf2a8 0xaf0f4 0xabef4 0x2e1
InitializeCriticalSection - 0x61eaf2ac 0xaf0f8 0xabef8 0x2ec
InterlockedCompareExchange - 0x61eaf2b0 0xaf0fc 0xabefc 0x2f3
LeaveCriticalSection - 0x61eaf2b4 0xaf100 0xabf00 0x327
LoadLibraryA - 0x61eaf2b8 0xaf104 0xabf04 0x32a
LoadLibraryW - 0x61eaf2bc 0xaf108 0xabf08 0x32d
LocalFree - 0x61eaf2c0 0xaf10c 0xabf0c 0x337
LockFile - 0x61eaf2c4 0xaf110 0xabf10 0x340
LockFileEx - 0x61eaf2c8 0xaf114 0xabf14 0x341
MapViewOfFile - 0x61eaf2cc 0xaf118 0xabf18 0x345
MultiByteToWideChar - 0x61eaf2d0 0xaf11c 0xabf1c 0x356
OutputDebugStringA - 0x61eaf2d4 0xaf120 0xabf20 0x378
OutputDebugStringW - 0x61eaf2d8 0xaf124 0xabf24 0x379
QueryPerformanceCounter - 0x61eaf2dc 0xaf128 0xabf28 0x397
ReadFile - 0x61eaf2e0 0xaf12c 0xabf2c 0x3b1
SetEndOfFile - 0x61eaf2e4 0xaf130 0xabf30 0x41c
SetFilePointer - 0x61eaf2e8 0xaf134 0xabf34 0x42e
SetUnhandledExceptionFilter - 0x61eaf2ec 0xaf138 0xabf38 0x46c
Sleep - 0x61eaf2f0 0xaf13c 0xabf3c 0x479
SystemTimeToFileTime - 0x61eaf2f4 0xaf140 0xabf40 0x484
TerminateProcess - 0x61eaf2f8 0xaf144 0xabf44 0x487
TlsGetValue - 0x61eaf2fc 0xaf148 0xabf48 0x48e
TryEnterCriticalSection - 0x61eaf300 0xaf14c 0xabf4c 0x496
UnhandledExceptionFilter - 0x61eaf304 0xaf150 0xabf50 0x49b
UnlockFile - 0x61eaf308 0xaf154 0xabf54 0x49c
UnlockFileEx - 0x61eaf30c 0xaf158 0xabf58 0x49d
UnmapViewOfFile - 0x61eaf310 0xaf15c 0xabf5c 0x49e
VirtualProtect - 0x61eaf314 0xaf160 0xabf60 0x4bb
VirtualQuery - 0x61eaf318 0xaf164 0xabf64 0x4be
WaitForSingleObject - 0x61eaf31c 0xaf168 0xabf68 0x4c7
WaitForSingleObjectEx - 0x61eaf320 0xaf16c 0xabf6c 0x4c8
WideCharToMultiByte - 0x61eaf324 0xaf170 0xabf70 0x4df
WriteFile - 0x61eaf328 0xaf174 0xabf74 0x4f3
msvcrt.dll (28)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
__dllonexit - 0x61eaf330 0xaf17c 0xabf7c 0x37
__setusermatherr - 0x61eaf334 0xaf180 0xabf80 0x6b
_amsg_exit - 0x61eaf338 0xaf184 0xabf84 0x8e
_beginthreadex - 0x61eaf33c 0xaf188 0xabf88 0x9b
_endthreadex - 0x61eaf340 0xaf18c 0xabf8c 0xcc
_errno - 0x61eaf344 0xaf190 0xabf90 0xcf
_initterm - 0x61eaf348 0xaf194 0xabf94 0x12f
_iob - 0x61eaf34c 0xaf198 0xabf98 0x133
_lock - 0x61eaf350 0xaf19c 0xabf9c 0x194
_onexit - 0x61eaf354 0xaf1a0 0xabfa0 0x231
localtime - 0x61eaf358 0xaf1a4 0xabfa4 0x2bf
calloc - 0x61eaf35c 0xaf1a8 0xabfa8 0x32a
fprintf - 0x61eaf360 0xaf1ac 0xabfac 0x344
free - 0x61eaf364 0xaf1b0 0xabfb0 0x34b
fwrite - 0x61eaf368 0xaf1b4 0xabfb4 0x356
malloc - 0x61eaf36c 0xaf1b8 0xabfb8 0x382
memcmp - 0x61eaf370 0xaf1bc 0xabfbc 0x389
memmove - 0x61eaf374 0xaf1c0 0xabfc0 0x38b
qsort - 0x61eaf378 0xaf1c4 0xabfc4 0x398
realloc - 0x61eaf37c 0xaf1c8 0xabfc8 0x39c
strcmp - 0x61eaf380 0xaf1cc 0xabfcc 0x3b0
strcspn - 0x61eaf384 0xaf1d0 0xabfd0 0x3b4
strlen - 0x61eaf388 0xaf1d4 0xabfd4 0x3b7
strncmp - 0x61eaf38c 0xaf1d8 0xabfd8 0x3ba
strrchr - 0x61eaf390 0xaf1dc 0xabfdc 0x3be
_unlock - 0x61eaf394 0xaf1e0 0xabfe0 0x3e6
abort - 0x61eaf398 0xaf1e4 0xabfe4 0x438
vfprintf - 0x61eaf39c 0xaf1e8 0xabfe8 0x453
Exports (265)
»
Api name EAT Address Ordinal
sqlite3_aggregate_context 0x1cfd1 0x1
sqlite3_aggregate_count 0x3269 0x2
sqlite3_auto_extension 0x90b9b 0x3
sqlite3_backup_finish 0x48a41 0x4
sqlite3_backup_init 0x48595 0x5
sqlite3_backup_pagecount 0x2dd3 0x6
sqlite3_backup_remaining 0x2dc8 0x7
sqlite3_backup_step 0x46614 0x8
sqlite3_bind_blob 0x285a8 0x9
sqlite3_bind_blob64 0x285cf 0xa
sqlite3_bind_double 0x286d1 0xb
sqlite3_bind_int 0x28785 0xc
sqlite3_bind_int64 0x28736 0xd
sqlite3_bind_null 0x287ab 0xe
sqlite3_bind_parameter_count 0x32a7 0xf
sqlite3_bind_parameter_index 0x14101 0x10
sqlite3_bind_parameter_name 0x32b9 0x11
sqlite3_bind_pointer 0x287dc 0x12
sqlite3_bind_text 0x28616 0x13
sqlite3_bind_text16 0x286aa 0x14
sqlite3_bind_text64 0x2863d 0x15
sqlite3_bind_value 0x288c6 0x16
sqlite3_bind_zeroblob 0x28859 0x17
sqlite3_bind_zeroblob64 0x289ad 0x18
sqlite3_blob_bytes 0x336c 0x19
sqlite3_blob_close 0x49c3d 0x1a
sqlite3_blob_open 0x7db1d 0x1b
sqlite3_blob_read 0x4b75a 0x1c
sqlite3_blob_reopen 0x7e28c 0x1d
sqlite3_blob_write 0x4c52b 0x1e
sqlite3_busy_handler 0x51bb 0x1f
sqlite3_busy_timeout 0xc01e 0x20
sqlite3_cancel_auto_extension 0x3e6a 0x21
sqlite3_changes 0x50d5 0x22
sqlite3_clear_bindings 0x10449 0x23
sqlite3_close 0x48c3b 0x24
sqlite3_close_v2 0x48c49 0x25
sqlite3_collation_needed 0x54dd 0x26
sqlite3_collation_needed16 0x5521 0x27
sqlite3_column_blob 0x22a25 0x28
sqlite3_column_bytes 0x227fb 0x29
sqlite3_column_bytes16 0x228cf 0x2a
sqlite3_column_count 0x3277 0x2b
sqlite3_column_database_name 0xa836 0x2c
sqlite3_column_database_name16 0xa851 0x2d
sqlite3_column_decltype 0xa800 0x2e
sqlite3_column_decltype16 0xa81b 0x2f
sqlite3_column_double 0x182be 0x30
sqlite3_column_int 0x100af 0x31
sqlite3_column_int64 0x100db 0x32
sqlite3_column_name 0xa7ca 0x33
sqlite3_column_name16 0xa7e5 0x34
sqlite3_column_origin_name 0xa8a2 0x35
sqlite3_column_origin_name16 0xa8bd 0x36
sqlite3_column_table_name 0xa86c 0x37
sqlite3_column_table_name16 0xa887 0x38
sqlite3_column_text 0x22c40 0x39
sqlite3_column_text16 0x24166 0x3a
sqlite3_column_type 0x1018f 0x3b
sqlite3_column_value 0x1015d 0x3c
sqlite3_commit_hook 0x538d 0x3d
sqlite3_compileoption_get 0x55f7 0x3e
sqlite3_compileoption_used 0x8cf2 0x3f
sqlite3_complete 0x4d99 0x40
sqlite3_complete16 0x90d41 0x41
sqlite3_config 0x18b34 0x42
sqlite3_context_db_handle 0x3206 0x43
sqlite3_create_collation 0x291df 0x44
sqlite3_create_collation16 0x29216 0x45
sqlite3_create_collation_v2 0x29188 0x46
sqlite3_create_function 0x28ed3 0x47
sqlite3_create_function16 0x28fa5 0x48
sqlite3_create_function_v2 0x28f1a 0x49
sqlite3_create_module 0x25458 0x4a
sqlite3_create_module_v2 0x25477 0x4b
sqlite3_create_window_function 0x28f60 0x4c
sqlite3_data_count 0x328c 0x4d
sqlite3_data_directory 0xab020 0x4e
sqlite3_db_cacheflush 0x4604e 0x4f
sqlite3_db_config 0x1434e 0x50
sqlite3_db_filename 0x10ae1 0x51
sqlite3_db_handle 0x32d6 0x52
sqlite3_db_mutex 0x502a 0x53
sqlite3_db_readonly 0x55d4 0x54
sqlite3_db_release_memory 0x13d4e 0x55
sqlite3_db_status 0x15600 0x56
sqlite3_declare_vtab 0x74e3f 0x57
sqlite3_enable_load_extension 0x18aee 0x58
sqlite3_enable_shared_cache 0x2885 0x59
sqlite3_errcode 0x282dc 0x5a
sqlite3_errmsg 0x2834f 0x5b
sqlite3_errmsg16 0x29291 0x5c
sqlite3_errstr 0xc015 0x5d
sqlite3_exec 0x62fbd 0x5e
sqlite3_expanded_sql 0x316e7 0x5f
sqlite3_expired 0x3182 0x60
sqlite3_extended_errcode 0x28317 0x61
sqlite3_extended_result_codes 0x5576 0x62
sqlite3_file_control 0x13f68 0x63
sqlite3_finalize 0x49b4c 0x64
sqlite3_free 0x9d7b 0x65
sqlite3_free_table 0x9f3f 0x66
sqlite3_fts3_may_be_corrupt 0x98540 0x67
sqlite3_fts5_may_be_corrupt 0x98418 0x68
sqlite3_get_autocommit 0x5565 0x69
sqlite3_get_auxdata 0x322e 0x6a
sqlite3_get_table 0x769cb 0x6b
sqlite3_global_recover 0x91b97 0x6c
sqlite3_initialize 0x18d2b 0x6d
sqlite3_interrupt 0x527e 0x6e
sqlite3_keyword_check 0x106d6 0x6f
sqlite3_keyword_count 0x48da 0x70
sqlite3_keyword_name 0x48a5 0x71
sqlite3_last_insert_rowid 0x5092 0x72
sqlite3_libversion 0x500c 0x73
sqlite3_libversion_number 0x5016 0x74
sqlite3_limit 0x54a6 0x75
sqlite3_load_extension 0x39c8b 0x76
sqlite3_log 0x251b7 0x77
sqlite3_malloc 0x19270 0x78
sqlite3_malloc64 0x19b3a 0x79
sqlite3_memory_alarm 0x1850c 0x7a
sqlite3_memory_highwater 0x253a6 0x7b
sqlite3_memory_used 0x25376 0x7c
sqlite3_mprintf 0x386e4 0x7d
sqlite3_msize 0x1799 0x7e
sqlite3_mutex_alloc 0x19241 0x7f
sqlite3_mutex_enter 0x1743 0x80
sqlite3_mutex_free 0x1730 0x81
sqlite3_mutex_leave 0x176b 0x82
sqlite3_mutex_try 0x1756 0x83
sqlite3_next_stmt 0x331f 0x84
sqlite3_open 0x91aca 0x85
sqlite3_open16 0x91afd 0x86
sqlite3_open_v2 0x91ae5 0x87
sqlite3_os_end 0x18add 0x88
sqlite3_os_init 0x1917a 0x89
sqlite3_overload_function 0x3a40c 0x8a
sqlite3_prepare 0x71d36 0x8b
sqlite3_prepare16 0x72921 0x8c
sqlite3_prepare16_v2 0x72948 0x8d
sqlite3_prepare16_v3 0x7296f 0x8e
sqlite3_prepare_v2 0x71f09 0x8f
sqlite3_prepare_v3 0x72219 0x90
sqlite3_profile 0x5339 0x91
sqlite3_progress_handler 0x5210 0x92
sqlite3_randomness 0x3cd83 0x93
sqlite3_realloc 0x1b913 0x94
sqlite3_realloc64 0x1cd49 0x95
sqlite3_release_memory 0x1788 0x96
sqlite3_reset 0x4c5c9 0x97
sqlite3_reset_auto_extension 0x90c2d 0x98
sqlite3_result_blob 0x1e411 0x99
sqlite3_result_blob64 0x1e96d 0x9a
sqlite3_result_double 0x13bc9 0x9b
sqlite3_result_error 0x1dabb 0x9c
sqlite3_result_error16 0x1dfa1 0x9d
sqlite3_result_error_code 0x1dfca 0x9e
sqlite3_result_error_nomem 0x10274 0x9f
sqlite3_result_error_toobig 0x1e32d 0xa0
sqlite3_result_int 0x10200 0xa1
sqlite3_result_int64 0x1023b 0xa2
sqlite3_result_null 0x10266 0xa3
sqlite3_result_pointer 0x106fc 0xa4
sqlite3_result_subtype 0x31e2 0xa5
sqlite3_result_text 0x1e4d2 0xa6
sqlite3_result_text16 0x1e967 0xa7
sqlite3_result_text16be 0x1e929 0xa8
sqlite3_result_text16le 0x1e948 0xa9
sqlite3_result_text64 0x1e9a9 0xaa
sqlite3_result_value 0x1f419 0xab
sqlite3_result_zeroblob 0x10be9 0xac
sqlite3_result_zeroblob64 0x104b9 0xad
sqlite3_rollback_hook 0x5411 0xae
sqlite3_rtree_geometry_callback 0x91b9e 0xaf
sqlite3_rtree_query_callback 0x91c1c 0xb0
sqlite3_set_authorizer 0x3912 0xb1
sqlite3_set_auxdata 0x11b80 0xb2
sqlite3_set_last_insert_rowid 0x50a0 0xb3
sqlite3_shutdown 0x90c80 0xb4
sqlite3_sleep 0x190e0 0xb5
sqlite3_snprintf 0x2248e 0xb6
sqlite3_soft_heap_limit 0x37bdc 0xb7
sqlite3_soft_heap_limit64 0x37b38 0xb8
sqlite3_sourceid 0x7b8e 0xb9
sqlite3_sql 0x3358 0xba
sqlite3_status 0x2531e 0xbb
sqlite3_status64 0x2528e 0xbc
sqlite3_step 0x62355 0xbd
sqlite3_stmt_busy 0x3300 0xbe
sqlite3_stmt_readonly 0x32e6 0xbf
sqlite3_stmt_status 0x1372f 0xc0
sqlite3_str_append 0x20e27 0xc1
sqlite3_str_appendall 0x20e5c 0xc2
sqlite3_str_appendchar 0x20d83 0xc3
sqlite3_str_appendf 0x28a1c 0xc4
sqlite3_str_errcode 0x17b8 0xc5
sqlite3_str_finish 0x11da6 0xc6
sqlite3_str_length 0x17cd 0xc7
sqlite3_str_new 0x19b60 0xc8
sqlite3_str_reset 0xf982 0xc9
sqlite3_str_value 0x17de 0xca
sqlite3_str_vappendf 0x20ff6 0xcb
sqlite3_strglob 0x99be 0xcc
sqlite3_stricmp 0x196b 0xcd
sqlite3_strlike 0x99d9 0xce
sqlite3_strnicmp 0x1991 0xcf
sqlite3_system_errno 0x5495 0xd0
sqlite3_table_column_metadata 0x766e4 0xd1
sqlite3_temp_directory 0xab024 0xd2
sqlite3_test_control 0x90653 0xd3
sqlite3_thread_cleanup 0x5571 0xd4
sqlite3_threadsafe 0x5020 0xd5
sqlite3_total_changes 0x50e0 0xd6
sqlite3_trace 0x5290 0xd7
sqlite3_trace_v2 0x52e1 0xd8
sqlite3_transfer_bindings 0x10599 0xd9
sqlite3_update_hook 0x53cf 0xda
sqlite3_uri_boolean 0x8cbf 0xdb
sqlite3_uri_int64 0xe89b 0xdc
sqlite3_uri_parameter 0x8c6d 0xdd
sqlite3_user_data 0x31f8 0xde
sqlite3_value_blob 0x2296e 0xdf
sqlite3_value_bytes 0x227ed 0xe0
sqlite3_value_bytes16 0x228be 0xe1
sqlite3_value_double 0x182b5 0xe2
sqlite3_value_dup 0x1f1ea 0xe3
sqlite3_value_free 0x10687 0xe4
sqlite3_value_int 0xb0c7 0xe5
sqlite3_value_int64 0xb0d4 0xe6
sqlite3_value_nochange 0x31c9 0xe7
sqlite3_value_numeric_type 0x18353 0xe8
sqlite3_value_pointer 0xe6e6 0xe9
sqlite3_value_subtype 0x319f 0xea
sqlite3_value_text 0x22935 0xeb
sqlite3_value_text16 0x24192 0xec
sqlite3_value_text16be 0x24144 0xed
sqlite3_value_text16le 0x24155 0xee
sqlite3_value_type 0x31b4 0xef
sqlite3_version 0xaa660 0xf0
sqlite3_vfs_find 0x1907d 0xf1
sqlite3_vfs_register 0x19117 0xf2
sqlite3_vfs_unregister 0x19201 0xf3
sqlite3_vmprintf 0x37c00 0xf4
sqlite3_vsnprintf 0x22432 0xf5
sqlite3_vtab_collation 0x2b98e 0xf6
sqlite3_vtab_config 0x25495 0xf7
sqlite3_vtab_nochange 0x3213 0xf8
sqlite3_vtab_on_conflict 0x4134 0xf9
sqlite3_wal_autocheckpoint 0xc074 0xfa
sqlite3_wal_checkpoint 0x491b7 0xfb
sqlite3_wal_checkpoint_v2 0x49173 0xfc
sqlite3_wal_hook 0x5453 0xfd
sqlite3_win32_is_nt 0x18690 0xfe
sqlite3_win32_mbcs_to_utf8 0x90a3c 0xff
sqlite3_win32_mbcs_to_utf8_v2 0x90a65 0x100
sqlite3_win32_set_directory 0x90b95 0x101
sqlite3_win32_set_directory16 0x90b49 0x102
sqlite3_win32_set_directory8 0x90ada 0x103
sqlite3_win32_sleep 0x18575 0x104
sqlite3_win32_unicode_to_utf8 0x90a1b 0x105
sqlite3_win32_utf8_to_mbcs 0x90a8b 0x106
sqlite3_win32_utf8_to_mbcs_v2 0x90ab4 0x107
sqlite3_win32_utf8_to_unicode 0x909fa 0x108
sqlite3_win32_write_debug 0x18513 0x109
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image