Create Interactive Tour

Windows Analysis Report
PowerENGAGE.exe

Overview

General Information

Sample Name:	PowerENGAGE.exe
Analysis ID:	745760
MD5:	a3abbad183758271d44d984e67b04cf8
SHA1:	7b5daba95921611842f7685fe4547bdf0a10f6db
SHA256:	13fa73c3611fd90f071b61f6cab3fbb526e37588a27ba7a7c545e2392bcb3cb5

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Uses 32bit PE files

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

PE file contains sections with non-standard names

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Program does not show much activity (idle)

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample has functionality to log and monitor keystrokes, analyze it with the 'Simulates keyboard and window changes' cookbook

Process Tree

System is w7x64

PowerENGAGE.exe (PID: 1516 cmdline: C:\Users\user\Desktop\PowerENGAGE.exe MD5: A3ABBAD183758271D44D984E67B04CF8)

cleanup

Joe Sandbox Signatures

• Compliance
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• System Summary
• Data Obfuscation
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: PowerENGAGE.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: PowerENGAGE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\projects\electron-39ng6\out\R\electron.exe.pdb source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\projects\electron-39ng6\out\R\electron.exe.pdbp1$1$n source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp

Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: V8.MemoryExternalFragmentationTotalV8.MemoryHeapSampleTotalCommittedV8.MemoryHeapSampleTotalUsedV8.MemoryHeapUsedV8.MemoryHeapCommittedmail.google.com.gmaildocs.google.comdrive.google.com.docsplus.google.com.plusinbox.google.com.inboxcalendar.google.com.calendarwww.youtube.com.youtube.top10sina.com.cnfacebook.combaidu.comqq.comtwitter.comtaobao.comlive.comyahooamazonwikipediaRenderThreadImpl::InitRendererInitializeCompositorThreadScheduleIdleHandlerGetGpuFactories_IpcMessageHandlerClass::OnCreateNewSharedWorker5minOnProcessBackgrounded10min15min30minOnProcessPurgeAndSuspend60min90min%s.%sMemory.Experimental.Renderer.PartitionAlloc.AfterBackgroundedMemory.Experimental.Renderer.BlinkGC.AfterBackgroundedMemory.Experimental.Renderer.Malloc.AfterBackgroundedMemory.Experimental.Renderer.Discardable.AfterBackgroundedMemory.Experimental.Renderer.V8MainThreaIsolate.AfterBackgroundedMemory.Experimental.Renderer.TotalAllocated.AfterBackgroundedPurgeAndSuspend.Experimental.MemoryGrowth.PartitionAllocKBPurgeAndSuspend.Experimental.MemoryGrowth.BlinkGCKBPurgeAndSuspend.Experimental.MemoryGrowth.MallocKBPurgeAndSuspend.Experimental.MemoryGrowth.DiscardableKBPurgeAndSuspend.Experimental.MemoryGrowth.V8MainThreadIsolateKBPurgeAndSuspend.Experimental.MemoryGrowth.TotalAllocatedKBRenderThreadImpl::EstablishGpuChannelSyncnewframe_routing_idnewframe_proxy_idnewframe_opener_idnewframe_parent_idnewframe_widget_idnewframe_widget_hiddennewframe_replicated_originnewframe_oopifs_possibleNQE.RenderThreadNotifiedRenderThreadImpl::OnMemoryPressureOnPurgeMemoryMemory.Experimental.Renderer.PurgedMemoryRenderer::FILEBindOnTaskRunner equals www.youtube.com (Youtube)
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Source: PowerENGAGE.exe, 00000001.00000000.914020751.00000000027A4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://.css
Source: PowerENGAGE.exe, 00000001.00000000.914020751.00000000027A4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://.jpg
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://EVSecure-crl.geotrust.com/GeoTrustPCA.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://EVSecure-ocsp.geotrust.com0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://aia.startssl.com/certs/ca.crt0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://aia.startssl.com/certs/ca.crt02
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://aia1.wosign.com/ca1-class3-server.cer0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://aia1.wosign.com/ca1g2-server3.cer0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository/gd_intermediate.crt0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://certificates.godaddy.com/repository100.
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://certs.godaddy.com/repository/1301
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://certs.starfieldtech.com/repository/1402
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://clients3.google.com/cert_upload_json
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crbug.com/490015
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crbug.com/619103.
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crbug.com/619103.Subsequence
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.certum.pl/ca.crl0h
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl0
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/SecureCertificateServices.crl09
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.comodoca.com/TrustedCertificateServices.crl0:
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0;
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.entrust.net/g2ca.crl0;
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.entrust.net/rootca1.crl0;
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.geotrust.com/GeoTrustPCA-G3.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/gtglobal.crl04
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl0F
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.geotrust.com/crls/secureca.crl0N
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0V
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0=
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot-g2.crl0F
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.godaddy.com/gdroot.crl0F
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.godaddy.com/gds1-20
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.rootg2.amazontrust.com/rootg2.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.starfieldtech.com/sfroot-g2.crl0L
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.starfieldtech.com/sfroot.crl0L
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.startssl.com/sfsca.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.startssl.com/sfsca.crl0f
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePCA-G3.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.thawte.com/ThawtePremiumServerCA.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl.ws.symantec.com/universal-root.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crls1.wosign.com/ca1.crl0m
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crls1.wosign.com/ca1.crl0q
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://crt.rootg2.amazontrust.com/rootg2.cer0=
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://dev.chromium.org/throttling
Source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://exslt.org/common
Source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://exslt.org/commonc:
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://feross.org
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://foo.com
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://g.symcb.com/GeoTrustPCA-G3.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://g.symcb.com/crls/gtglobal.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://g.symcb.com/crls/gtglobal.crl0.
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://g.symcd.com0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://g.symcd.com0L
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://g1.symcb.com/GeoTrustPCA.crl0)
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://g1.symcb.com/crls/gtglobal.crl0/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://g2.symcb.com0G
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://g2.symcb.com0L
Source: PowerENGAGE.exe, 00000001.00000000.914020751.00000000027A4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://icl.com/saxon
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://isrg.trustid.ocsp.identrust.com0;
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://jsperf.com/call-apply-segu
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://l.twimg.com/i/hpkp_report
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://o.ss2.us/0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.digicert.com0K
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.digicert.com0M
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.entrust.net00
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.entrust.net02
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.geotrust.com0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.geotrust.com0L
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr10
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.godaddy.com/02
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.godaddy.com/05
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.godaddy.com/0J
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.rootg2.amazontrust.com08
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.starfieldtech.com/08
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.starfieldtech.com/0;
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.startssl.com/ca0-
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.startssl.com/ca00
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.startssl.com00
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.thawte.com0;
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp.ws.symantec.com0k
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp1.wosign.com/ca104
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://ocsp1.wosign.com/ca108
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://pca-g3-ocsp.geotrust.com0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://repository.certum.pl/ca.cer09
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://s.ss2.us/r.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://s2.symcb.com0k
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://stackoverflow.com/a/22747272/680742
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://subca.ocsp-certum.com0.
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://t.symcb.com/ThawtePCA.crl0)
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://t.symcd.com01
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0)
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://t2.symcb.com0;
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://t2.symcb.com0A
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc3986#section-2.1.
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc3986#section-2.1.Error
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://web-subframes.invalid
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://web-subframes.invalidcrash/browser-heap-overflow/browser-heap-underflow/browser-use-after-fre
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://wpad/wpad.dat
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://wpad/wpad.dat(
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://wpad/wpad.datFindProxyForURLWPAD
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.color.org
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.color.orgRegistryNameCatalogMetadatasRGB
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.digicert.com/CACerts/DigiCertHighAssuranceEVRootCA.crt0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ecma-international.org/ecma-262/5.1/#sec-10.4.2
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.entrust.net/CPS0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.entrust.net/rpa0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0)
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps06
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0;
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.geotrust.com/resources/cps0A
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.google.com/support/talk/bin/request.py
Source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.jclark.com/xt
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.keynectis.com/PC07
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.keynectis.com/PC08
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.startssl.com/intermediate.pdf0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.startssl.com/policy.pdf04
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.startssl.com/policy0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.startssl.com/sfsca.crl0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.startssl.com/sfsca.crt0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.symauth.com/rpa0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.symauth.com/rpa0)
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-time
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/abs-send-timeurn:3gpp:video-orientationhttp://www.ietf.
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/playout-delay
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-content-type
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.webrtc.org/experiments/rtp-hdrext/video-timing
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.wosign.com/policy/0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://x.ss2.us/x.cer0&
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/ISO-10646-UCS-4ISO-LATIN-1ISO
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/namespace
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://xmlsoft.org/XSLT/namespacehttp://icl.com/saxonhttp://www.jclark.com/xtorg.apache.xalan.xslt.e
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://android.com/pay
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://android.com/payhttps://google.com/paybasic-cardAt
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://asac.casa/expectstaple.jsp
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://azreport.report-uri.io/r/default/staple/reportOnly
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=695438.
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://certs.godaddy.com/repository/0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://certs.starfieldtech.com/repository/0
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome-devtools-frontend.appspot.com/
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chrome-devtools-frontend.appspot.com/paramsbrightray.devtools.preferencespartition.per_host_
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromium.googlesource.com/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://chromium.googlesource.com/chromium/src/
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://clients2.google.com/cr/reportdumps-dircrash_checkpoint.txtmax-reports$1CrashServiceWaitEvent
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://clients3.google.com/ct_upload
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://clients3.google.com/ct_uploadhttps://log.getdropbox.com/log/expectcthttps://tobiassachs.repo
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=437569#c2
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://crbug.com/338503)
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://crbug.com/338503)No
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://crbug.com/401439).
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://crbug.com/574343#c40
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.googleapis.com/aviator/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.googleapis.com/aviator/aviator.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.googleapis.com/icarus/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.googleapis.com/icarus/icarus.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.googleapis.com/pilot/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.googleapis.com/pilot/pilot.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.googleapis.com/rocketeer/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.googleapis.com/rocketeer/rocketeer.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.googleapis.com/skydiver/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.googleapis.com/skydiver/skydiver.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.izenpe.com/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.izenpe.com/izenpe1.ct.googleapis.com
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.startssl.com/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.startssl.com/startcom1.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.ws.symantec.com/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct.ws.symantec.com/symantec.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct1.digicert-ct.com/log/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct1.digicert-ct.com/log/digicert.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct2.digicert-ct.com/log/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ct2.digicert-ct.com/log/digicert2.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ctlog-gen2.api.venafi.com/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ctlog-gen2.api.venafi.com/venafi2.ct.googleapis.com0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ctlog.api.venafi.com/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ctlog.api.venafi.com/venafi.ct.googleapis.com
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ctlog.wosign.com/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ctlog.wosign.com/wosign1.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ctserver.cnnic.cn/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://ctserver.cnnic.cn/cnnic.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://developers.google.com/web/tools/chrome-devtools/profile/evaluate-performance/rail
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://developers.google.com/web/updates/2017/06/credential-management-updates
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/gh-pages/implementation-status.md
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/WebBluetoothCG/web-bluetooth/blob/gh-pages/implementation-status.mdBluetooth.APIU
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/beatgammit/base64-js/issues/42
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/feross/buffer/pull/97
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/joyent/node/issues/1707
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://github.com/substack/node-browserify#multiple-bundles
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://goo.gl/4NeimX
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://goo.gl/EGXzpw
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://goo.gl/EuHzyv
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://goo.gl/HxfxSQ
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://goo.gl/J6ASzs
Source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://goo.gl/LdLk22
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp, PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://goo.gl/Y0ZkNV).
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://goo.gl/Y0ZkNV).-so-so://PartitionAllocator::allocateVectorBacking
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://goo.gl/rStTGz
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://google.com/pay
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://log.certly.io/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://log.certly.io/certly.ct.googleapis.com
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://log.getdropbox.com/hpkp
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://log.getdropbox.com/log/expectct
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://log.getdropbox.com/log/ocsp_expect_staple
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://log.ncsccs.com/report/expectct
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://log.ncsccs.com/report/expectocsp
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://log.ncsccs.com/report/hpkp
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mammoth.ct.comodo.com/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mammoth.ct.comodo.com/comodo-mammoth.ct.googleapis.com)
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://matteomarescotti.report-uri.io/r/default/staple/reportOnly
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mikewest.github.io/cors-rfc1918/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://minecraft.report-uri.io/r/default/staple/reportOnly
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://mths.be/punycode
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://report.badssl.com/expect-staple
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://report.badssl.com/expect-staplehttps://log.getdropbox.com/log/ocsp_expect_staplehttps://repo
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://reporting.caddyserver.com/expect-staple
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sabre.ct.comodo.com/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sabre.ct.comodo.com/comodo-sabre.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://scotthelme.report-uri.io/r/default/staple/reportOnly
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sirius.ws.symantec.com/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://sirius.ws.symantec.com/symantec-sirius.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://staple.watch/cdn-cgi/beacon/expect-staple
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tobiassachs.report-uri.io/r/default/ct/reportOnly
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tobiassachs.report-uri.io/r/default/staple/reportOnly
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://vega.ws.symantec.com/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://vega.ws.symantec.com/symantec-vega.ct.googleapis.com0Y0
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://w3c.github.io/encrypted-media/#direct-individualization.
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://w3c.github.io/encrypted-media/#distinctive-identifier)
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://w3c.github.io/encrypted-media/#distinctive-permanent-
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://weeblr.report-uri.io/r/default/staple/reportOnly
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://wicg.github.io/cors-rfc1918/
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://wicg.github.io/reporting.
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.alphassl.com/repository/03
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/characteristics
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/descriptors
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.bluetooth.com/specifications/gatt/services
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5082396709879808
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5629582019395584.
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5644273861001216.Vibration.Contextc:
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5669008342777856
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5682658461876224.Blocked
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5709390967472128
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5718547946799104
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5735596811091968
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5738264052891648
Source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5745543795965952
Source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5745543795965952Registering
Source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5749447073988608
Source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/5749447073988608ssc_wheelHandling
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/feature/6451284559265792
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/features/%s
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/features/4668884095336448
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/features/4964279606312960
Source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/features/5093566007214080
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/features/5654810086866944
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/features/5689327799500800
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/features/5851021045661696.
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/features/6072546726248448
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/features/6107495151960064
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.chromestatus.com/features/6680566019653632
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.geotrust.com/resources/cps04
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.geotrust.com/resources/cps06
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.geotrust.com/resources/repository0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/speech-api/full-duplex/v1
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.google.com/speech-api/full-duplex/v1/down?/up?
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate0
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.thawte.com/cps0
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.thawte.com/cps0)
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.thawte.com/cps02
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.thawte.com/cps07
Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/.

Source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: GetRawInputData

Source: PowerENGAGE.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: InternalNameCompanyShortNameCompanyName\VarFileInfo\TranslationLegalCopyrightCommentsProductShortNameProductNamePrivateBuildLegalTrademarksFileDescriptionProductVersionLastChangeSpecialBuildOriginalFilenameFileVersion\StringFileInfo\%04x%04x\%lsOfficial BuildFailed to create a message-only window../../base/win/message_window.ccFailed to register the window class for a message-only windowC:\projects\libchromiumcontent-wqq1s\src\base/win/wrapped_window_proc.hChrome_MessageWindowOnDestructdisabled-by-default-toplevel.flow../../base/threading/sequenced_worker_pool.ccWorker%d[%d]SequencedWorkerPool::Inner::ThreadLoopSequencedWorkerPool.ShutdownDelayTimeSequencedWorkerPool::Inner::PostTaskStopSoon../../base/threading/thread.ccscoped_dirfaheiwur. Falling back to en-US.Failed to set the ICU default locale to ../../base/i18n/rtl.ccar-_eses-ESes-419es-MXund vs PowerENGAGE.exe

Source: C:\Users\user\Desktop\PowerENGAGE.exe

Section loaded: node.dll

Jump to behavior

Source: C:\Users\user\Desktop\PowerENGAGE.exe	Memory allocated: 77620000 page execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PowerENGAGE.exe	Memory allocated: 77740000 page execute and read and write			Jump to behavior

Source: C:\Users\user\Desktop\PowerENGAGE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: classification engine

Classification label: clean3.winEXE@1/0@0/0

Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: SELECT name FROM sqlite_master WHERE type='table';
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_content'(%s)("%s"CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));,arg HIDDENCREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);,schema HIDDENPRAGMA %Q.page_sizewinMapfile1winMapfile2

Source: PowerENGAGE.exe

Static file information: File size 49503232 > 1048576

Source: PowerENGAGE.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: PowerENGAGE.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x25a5600
Source: PowerENGAGE.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x7bac00
Source: PowerENGAGE.exe	Static PE information: Raw size of .reloc is bigger than: 0x100000 < 0x172e00

Source: PowerENGAGE.exe	Static PE information: More than 200 imports for node.dll
Source: PowerENGAGE.exe	Static PE information: More than 200 imports for KERNEL32.dll

Source: PowerENGAGE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PowerENGAGE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PowerENGAGE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PowerENGAGE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PowerENGAGE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PowerENGAGE.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PowerENGAGE.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: PowerENGAGE.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\projects\electron-39ng6\out\R\electron.exe.pdb source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\projects\electron-39ng6\out\R\electron.exe.pdbp1$1$n source: PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp

Source: PowerENGAGE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PowerENGAGE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PowerENGAGE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PowerENGAGE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PowerENGAGE.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: PowerENGAGE.exe	Static PE information: section name: _text32
Source: PowerENGAGE.exe	Static PE information: section name: .didat
Source: PowerENGAGE.exe	Static PE information: section name: .rodata
Source: PowerENGAGE.exe	Static PE information: section name: _RDATA

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: Gearway Electronics (Dong Guan) Co., Ltd.INGENICOSharp Corp.VMMobile Disk IIIBluetooth 2.0 adapter 100m CN-521v2 001 Backpack 40GB Hard DriveWG121(v1) 54 Mbps Wireless [Intersil ISL3886]USA-18X PDAInternal Keyboard/Trackpad (JIS)Nostromo 1745 GamePadPX-A650 [Stylus CX4700/CX4800/DX4800/DX4850]Savi Office Base Stationremote key/mouse/storage for P3 chipPhotoSmart 7345VMware Inc.ASUSTek Computer, Inc.MindShare, Inc.GDS-3000 OscilloscopePL512 Power Supply SystemG240 802.11bgWL-188 Wireless Network 300N USB AdapterBackPackWG121(v2) 54 Mbps Wireless [Intersil ISL3886]USA-28Xb PDA [no firmware]Aluminum Mini Keyboard (ANSI)Nostromo N50 GamePadPM-A750 [Stylus Photo RX520/RX530]USB DSP v4 Audio Interfaceremote storage for P3 chipDeskJet 630c
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: VMware Fusion 4 has corrupt rendering with Win Vista+
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: VMnet
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: VMware, Inc.
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: VMware Inc.
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: CONNECTION_UNKNOWNCONNECTION_ETHERNETCONNECTION_WIFICONNECTION_2GCONNECTION_3GCONNECTION_4GCONNECTION_NONECONNECTION_BLUETOOTHCONNECTION_INVALIDTeredo Tunneling Pseudo-InterfacevmnetNotifyObserversOfIPAddressChangeImplNotifyObserversOfConnectionTypeChangeImplNotifyObserversOfNetworkChangeImplNotifyObserversOfDNSChangeImplNotifyObserversOfMaxBandwidthChangeImpl
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: TMT Technology, Inc.Spyrus, Inc.Qemu Audio DeviceWL532U 802.11g Adapter8055 Experiment Interface Board (address=2)PicoScope 2000 series PC OscilloscopeFrontline Test Equipment Bluetooth DeviceAVerTVEfficient ADSL ModemVS-700 M23D Optical MouseDigital IXUS 55WingMan Formula ForceRemote NDIS Network DeviceHDM Interface
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: vmnet
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: Qemu Audio Device
Source: PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: Cannot handle request with protocol: Unable to create cache../../net/disk_cache/disk_cache.ccReporting.ReportOutcomeReporting.ReportDeliveredLatencyReporting.ReportDeliveredAttemptsWlanQueryInterfaceWlanSetInterfaceVMnetGetAdaptersAddresses failed: ../../net/base/network_interfaces_win.ccaddress_list b
Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: EADS Deutschland GmbHVMware, Inc.AGFA-Gevaert NVPhoto AIO Printer 922Sentech CameraEyeTV DiversityPSX Vibration Feedback ConverterGamtec.,Ltd SmartJoy PLUS AdapterCruzer MiniMC70 Rugged Mobile ComputerXR21V1410 USB-UART ICCanoScan D660UCatalinaExpert mouseCLOCK USB II
Source: PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: The Intel Mobile 945 Express family of chipsets is not compatible with WebGLNVIDIA GeForce FX Go5200 is assumed to be buggyDrivers older than 2009-01 on Windows are possibly unreliableS3 Trio (used in Virtual PC) is not compatibleParallels drivers older than 7 are buggyATI FireMV 2400 cards on Windows are buggyThe Intel GMA500 is too slow for Stage3DNVidia driver 8.15.11.8593 is crashy on WindowsHardware video decode is only supported in win7+6.1VMware Fusion 4 has corrupt rendering with Win Vista+NVIDIA driver 8.17.11.9621 is buggy with Stage3D baseline modeNVIDIA driver 8.17.11.8267 is buggy with Stage3D baseline modeAll Intel drivers before 8.15.10.2021 are buggy with Stage3D baseline modeNVIDIA GeForce 6200 LE is buggy with WebGLGPU access is blocked if users don't have proper graphics driver installed after Windows installationAccelerated video decode interferes with GPU sandbox on older Intel driversDisable GPU on all Windows versions prior to and including VistaIntel Graphics Media Accelerator 3150 causes the GPU process to hang running WebGLAccelerated video decode on Intel driver 10.18.10.3308 is incompatible with the GPU sandboxAccelerated video decode on AMD driver 13.152.1.8000 is incompatible with the GPU sandboxAccelerated video decode interferes with GPU sandbox on certain AMD driversAccelerated video decode interferes with GPU sandbox on certain NVIDIA driversAccelerated video decode does not work with the discrete GPU on AMD switchablesIntel driver version 8.15.10.1749 causes GPU process hangs.GPU rasterization should only be enabled on NVIDIA and Intel DX11+, and AMD RX-R2 GPUs for now.Some AMD drivers have rendering glitches with GPU RasterizationGPU rasterization is blacklisted on NVidia Fermi architecture for now.GPU Rasterization is disabled on pre-GCN AMD cardsMSAA and depth texture buggy on Adreno 3xx, also disable WebGL2Disable use of D3D11/WebGL2 on Windows Vista and lowerDisable D3D11/WebGL2 on older nVidia driversDisable use of D3D11/WebGL2 on Matrox video cardsDisable use of D3D11/WebGL2 on older AMD driversOld Intel drivers cannot reliably support D3D11/WebGL2Disable D3D11/WebGL2 on AMD switchable graphicsdisable-gpu-watchdoggpu-sandbox-start-earlyDirectCompositionOverlaysdisable-directwrite-for-uiheadless@

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: ProgmanApplicationFrameWindowWindows.UI.Core.CoreWindow0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Process Injection	11 Input Capture	1 Security Software Discovery	Remote Services	11 Input Capture	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 DLL Side-Loading	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PowerENGAGE.exe	0%	Virustotal		Browse
PowerENGAGE.exe	0%	Metadefender		Browse

Source	Detection	Scanner	Label	Link
http://www.startssl.com/policy.pdf04	0%	URL Reputation	safe
http://www.startssl.com/policy.pdf04	0%	URL Reputation	safe
http://www.color.org	0%	URL Reputation	safe
http://crbug.com/619103.	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://ct.startssl.com/	0%	Virustotal		Browse
http://crbug.com/619103.Subsequence	0%	Virustotal		Browse
http://www.startssl.com/policy0	0%	URL Reputation	safe
http://crl.rootg2.amazontrust.com/rootg2.crl0	0%	URL Reputation	safe
http://crbug.com/490015	0%	URL Reputation	safe
http://www.jclark.com/xt	0%	URL Reputation	safe
http://www.startssl.com/sfsca.crl0	0%	URL Reputation	safe
http://icl.com/saxon	0%	URL Reputation	safe
http://aia.startssl.com/certs/ca.crt02	0%	URL Reputation	safe
https://w3c.github.io/encrypted-media/#direct-individualization.	0%	URL Reputation	safe
https://wicg.github.io/cors-rfc1918/	0%	URL Reputation	safe
http://subca.ocsp-certum.com0.	0%	URL Reputation	safe
https://chrome-devtools-frontend.appspot.com/	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
https://log.getdropbox.com/hpkp	0%	URL Reputation	safe
https://crbug.com/401439).	0%	URL Reputation	safe
http://www.keynectis.com/PC08	0%	URL Reputation	safe
http://www.keynectis.com/PC07	0%	URL Reputation	safe
http://aia.startssl.com/certs/ca.crt0	0%	URL Reputation	safe
http://foo.com	0%	URL Reputation	safe
http://wpad/wpad.datFindProxyForURLWPAD	0%	Avira URL Cloud	safe
https://tobiassachs.report-uri.io/r/default/staple/reportOnly	0%	Virustotal		Browse
http://ocsp.rootca1.amazontrust.com0:	0%	Avira URL Cloud	safe
https://wicg.github.io/reporting.	0%	Avira URL Cloud	safe
http://html4/loose.dtd	0%	Avira URL Cloud	safe
https://tobiassachs.report-uri.io/r/default/ct/reportOnly	0%	Avira URL Cloud	safe
http://crbug.com/619103.Subsequence	0%	Avira URL Cloud	safe
http://xmlsoft.org/XSLT/ISO-10646-UCS-4ISO-LATIN-1ISO	0%	Avira URL Cloud	safe
https://ct2.digicert-ct.com/log/	0%	Avira URL Cloud	safe
https://ct.startssl.com/	0%	Avira URL Cloud	safe
https://tobiassachs.report-uri.io/r/default/staple/reportOnly	0%	Avira URL Cloud	safe
http://web-subframes.invalid	0%	Avira URL Cloud	safe
http://.css	0%	Avira URL Cloud	safe
https://azreport.report-uri.io/r/default/staple/reportOnly	0%	Avira URL Cloud	safe
http://ocsp.thawte.com0;	0%	Avira URL Cloud	safe
https://crbug.com/338503)	0%	Avira URL Cloud	safe
http://.jpg	0%	Avira URL Cloud	safe
http://xmlsoft.org/XSLT/namespacehttp://icl.com/saxonhttp://www.jclark.com/xtorg.apache.xalan.xslt.e	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com/speech-api/full-duplex/v1	PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	false		high
https://ct.startssl.com/	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/feross/buffer/pull/97	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.startssl.com/policy.pdf04	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://www.bluetooth.com/specifications/gatt/services	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
http://crbug.com/619103.Subsequence	PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://tobiassachs.report-uri.io/r/default/staple/reportOnly	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ocsp.starfieldtech.com/08	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://ocsp.starfieldtech.com/0;	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.ietf.org/id/draft-holmer-rmcat-transport-wide-cc-extensions-01	PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.color.org	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://dev.chromium.org/throttling	PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	false		high
https://sabre.ct.comodo.com/	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://repository.certum.pl/ca.cer09	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.google.com/speech-api/full-duplex/v1/down?/up?	PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	false		high
http://stackoverflow.com/a/22747272/680742	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.chromestatus.com/features/6072546726248448	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=695438.	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
http://xmlsoft.org/XSLT/ISO-10646-UCS-4ISO-LATIN-1ISO	PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.chromestatus.com/feature/5629582019395584.	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://clients3.google.com/ct_upload	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.certum.pl/CPS0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://chromium.googlesource.com/chromium/src/	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://l.twimg.com/i/hpkp_report	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://crbug.com/619103.	PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://exslt.org/common	PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://wpad/wpad.datFindProxyForURLWPAD	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	low
http://certs.godaddy.com/repository/1301	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.chromestatus.com/features/%s	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.alphassl.com/repository/03	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://ct2.digicert-ct.com/log/	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.startssl.com/policy0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://certs.godaddy.com/repository/0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://certificates.godaddy.com/repository/gd_intermediate.crt0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.symauth.com/cps0(	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.thawte.com/cps0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://google.com/pay	PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	false		high
https://wicg.github.io/reporting.	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.godaddy.com/gdroot-g2.crl0F	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://crl.rootg2.amazontrust.com/rootg2.crl0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa0)	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://code.google.com/p/chromium/issues/detail?id=25916	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
http://crbug.com/490015	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://www.jclark.com/xt	PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://www.startssl.com/sfsca.crl0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://ctlog.wosign.com/	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://icl.com/saxon	PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://aia.startssl.com/certs/ca.crt02	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://github.com/WebBluetoothCG/web-bluetooth/blob/gh-pages/implementation-status.md	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://github.com/WebBluetoothCG/web-bluetooth/blob/gh-pages/implementation-status.mdBluetooth.APIU	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://tobiassachs.report-uri.io/r/default/ct/reportOnly	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0;	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://goo.gl/rStTGz	PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	false		high
http://html4/loose.dtd	PowerENGAGE.exe, 00000001.00000000.914020751.00000000027A4000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	low
https://w3c.github.io/encrypted-media/#direct-individualization.	PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://certs.starfieldtech.com/repository/0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://aia1.wosign.com/ca1-class3-server.cer0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://web-subframes.invalid	PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	PowerENGAGE.exe, 00000001.00000000.914020751.00000000027A4000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	low
http://ocsp.thawte.com0;	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	low
https://mammoth.ct.comodo.com/	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://wicg.github.io/cors-rfc1918/	PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://subca.ocsp-certum.com0.	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://www.wosign.com/policy/0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://chrome-devtools-frontend.appspot.com/	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/g2ca.crl0;	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://subca.ocsp-certum.com01	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://azreport.report-uri.io/r/default/staple/reportOnly	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://developers.google.com/web/updates/2017/06/credential-management-updates	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
http://.jpg	PowerENGAGE.exe, 00000001.00000000.914020751.00000000027A4000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	low
https://www.chromestatus.com/feature/5745543795965952	PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.chromestatus.com/feature/5745543795965952Registering	PowerENGAGE.exe, 00000001.00000000.918733968.0000000002D71000.00000002.00000001.01000000.00000003.sdmp	false		high
http://xmlsoft.org/XSLT/namespacehttp://icl.com/saxonhttp://www.jclark.com/xtorg.apache.xalan.xslt.e	PowerENGAGE.exe, 00000001.00000000.916793209.0000000002AC3000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://android.com/pay	PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	false		high
https://xhr.spec.whatwg.org/.	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://log.getdropbox.com/hpkp	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://ctlog-gen2.api.venafi.com/	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://clients2.google.com/cr/reportdumps-dircrash_checkpoint.txtmax-reports$1CrashServiceWaitEvent	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
http://crls1.wosign.com/ca1.crl0m	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.bluetooth.com/specifications/gatt/descriptors	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://crbug.com/401439).	PowerENGAGE.exe, 00000001.00000000.913305798.0000000002672000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://goo.gl/EuHzyv	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.thawte.com/cps02	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.keynectis.com/PC08	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://www.chromestatus.com/features/5689327799500800	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
http://www.keynectis.com/PC07	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://android.com/payhttps://google.com/paybasic-cardAt	PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.thawte.com/cps0)	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://aia.startssl.com/certs/ca.crt0	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
http://foo.com	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false	URL Reputation: safe	unknown
https://goo.gl/Y0ZkNV).	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp, PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	false		high
http://crl.starfieldtech.com/sfroot.crl0L	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://crbug.com/338503)	PowerENGAGE.exe, 00000001.00000000.915014813.00000000028EC000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://www.bluetooth.com/specifications/gatt/characteristics	PowerENGAGE.exe, 00000001.00000000.917839123.0000000002C4C000.00000002.00000001.01000000.00000003.sdmp	false		high
http://crl.godaddy.com/gds1-20	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
https://www.thawte.com/cps07	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high
http://ocsp1.wosign.com/ca104	PowerENGAGE.exe, 00000001.00000000.914159301.00000000027D5000.00000002.00000001.01000000.00000003.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	745760
Start date and time:	2022-11-14 17:51:28 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PowerENGAGE.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.959451109787333
TrID:	Win32 Executable (generic) a (10002005/4) 99.55% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PowerENGAGE.exe
File size:	49503232
MD5:	a3abbad183758271d44d984e67b04cf8
SHA1:	7b5daba95921611842f7685fe4547bdf0a10f6db
SHA256:	13fa73c3611fd90f071b61f6cab3fbb526e37588a27ba7a7c545e2392bcb3cb5
SHA512:	ee89e1cc83b2cb5b5811b2d7705a45c3dfe2546b20a86975b815294864a27be6d9c446373016be9f80c0642aaaaf1060a3ce8d89ac88f59f4af3f747b3b4da91
SSDEEP:	786432:OSuoiyHo/HSDS8to1MQHN0rLVhNpTFjCe0y89MsPchC:OSuoiyHQ58to1Mm0f1jjCeQg
TLSH:	36B7AE23F4825075EAD341F2DAFD7A2AA6ACAA25033855D767DC0C859B704D3773A383
File Content Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$..........-...~...~...~..*~...~K.~~...~.!.....~.!.....~0&.....~.!.....~.!.....~.......~.......~G!.....~...~...~B!...\|.~B!...e.~.......

File Icon


Icon Hash:	e8b2e0cc6cc2b2e8

Static PE Info

General

Entrypoint:	0x25320f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x5B48FD07 [Fri Jul 13 19:27:03 2018 UTC]
TLS Callbacks:	0x616950, 0x19421d0
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	b0b17b5f3edf3e8ecb8a3d69c658863c

Entrypoint Preview

Instruction
call 00007F501CBC96B1h
jmp 00007F501CBC819Dh
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 02E78024h
je 00007F501CBC831Ch
push 0000000Ch
push esi
call 00007F501BD04A7Bh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [029B2378h]
push dword ptr [ebp+08h]
call dword ptr [029B26A0h]
push C0000409h
call dword ptr [029B238Ch]
push eax
call dword ptr [029B2708h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007F501CBC7DA0h
test eax, eax
je 00007F501CBC8317h
push 00000002h
pop ecx
int 29h
mov dword ptr [031C0030h], eax
mov dword ptr [031C002Ch], ecx
mov dword ptr [031C0028h], edx
mov dword ptr [031C0024h], ebx
mov dword ptr [031C0020h], esi
mov dword ptr [031C001Ch], edi
mov word ptr [031C0048h], ss
mov word ptr [031C003Ch], cs
mov word ptr [031C0018h], ds
mov word ptr [031C0014h], es
mov word ptr [031C0010h], fs
mov word ptr [031C000Ch], gs
pushfd
pop dword ptr [031C0040h]

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[ASM] VS2015 UPD3 build 24213
[ C ] VS2015 UPD3.1 build 24215
[C++] VS2015 UPD3.1 build 24215
[IMP] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2d56cc0	0x614	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d572d4	0x384	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2dda000	0x1636c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2df1000	0x172cb8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2cf0350	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2cf03a4	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2a78118	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x25b2000	0x2204	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2d55b18	0x280	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x25a5460	0x25a5600	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
_text32	0x25a7000	0xa788	0xa800	False	0.3611653645833333	data	6.245345212296657	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x25b2000	0x7babe4	0x7bac00	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d6d000	0x674f8	0x3f800	False	0.3221618171751969	data	4.774290268799417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x2dd5000	0x1ec	0x200	False	0.5390625	data	4.309791331091148	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x2dd6000	0x1d	0x200	False	0.04296875	data	0.1364637916558982	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rodata	0x2dd7000	0x1de0	0x1e00	False	0.22513020833333333	data	4.020726696473838	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x2dd9000	0x120	0x200	False	0.0703125	data	0.3232550539007212	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2dda000	0x1636c	0x16400	False	0.29098270716292135	data	4.1273413306685205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2df1000	0x172cb8	0x172e00	False	0.5368901668351871	data	6.689858467798755	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x2dda9d0	0x134	data	English	United States
RT_CURSOR	0x2ddab04	0x134	data	English	United States
RT_CURSOR	0x2ddac38	0x134	Targa image data - RLE 64 x 65536 x 1 +32 "\001"	English	United States
RT_CURSOR	0x2ddad6c	0x134	data	English	United States
RT_CURSOR	0x2ddaea0	0x3c	data	English	United States
RT_CURSOR	0x2ddaedc	0x134	data	English	United States
RT_CURSOR	0x2ddb010	0xcac	data	English	United States
RT_CURSOR	0x2ddbcbc	0x134	data	English	United States
RT_CURSOR	0x2ddbdf0	0xcac	data	English	United States
RT_CURSOR	0x2ddca9c	0x10ac	Targa image data 64 x 65536 x 1 +32 " "	English	United States
RT_CURSOR	0x2dddb48	0x10ac	Targa image data 64 x 65536 x 1 +32 " "	English	United States
RT_CURSOR	0x2ddebf4	0x10ac	Targa image data 64 x 65536 x 1 +32 " "	English	United States
RT_CURSOR	0x2ddfca0	0x10ac	Targa image data 64 x 65536 x 1 +32 " "	English	United States
RT_CURSOR	0x2de0d4c	0x10ac	Targa image data 64 x 65536 x 1 +32 " "	English	United States
RT_CURSOR	0x2de1df8	0x10ac	Targa image data 64 x 65536 x 1 +32 " "	English	United States
RT_CURSOR	0x2de2ea4	0x10ac	Targa image data 64 x 65536 x 1 +32 " "	English	United States
RT_CURSOR	0x2de3f50	0x10ac	Targa image data 64 x 65536 x 1 +32 " "	English	United States
RT_CURSOR	0x2de4ffc	0x10ac	Targa image data 64 x 65536 x 1 +32 " "	English	United States
RT_CURSOR	0x2de60a8	0x134	Targa image data - RGB - RLE 64 x 65536 x 1 +32 "\001"	English	United States
RT_CURSOR	0x2de61dc	0x134	Targa image data - Mono 64 x 65536 x 1 +32 "\001"	English	United States
RT_CURSOR	0x2de6310	0x134	data	English	United States
RT_CURSOR	0x2de6444	0x134	data	English	United States
RT_ICON	0x2de6578	0x528	Device independent bitmap graphic, 16 x 32 x 32, image size 1280	English	United States
RT_ICON	0x2de6aa0	0x1428	Device independent bitmap graphic, 32 x 64 x 32, image size 5120	English	United States
RT_ICON	0x2de7ec8	0x2d28	Device independent bitmap graphic, 48 x 96 x 32, image size 11520	English	United States
RT_ICON	0x2deabf0	0x4a13	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_GROUP_CURSOR	0x2def604	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def618	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def62c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def640	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def654	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def668	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States
RT_GROUP_CURSOR	0x2def68c	0x22	Lotus unknown worksheet or configuration, revision 0x2	English	United States
RT_GROUP_CURSOR	0x2def6b0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def6c4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def6d8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def6ec	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def700	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def714	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def728	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def73c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def750	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def764	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def778	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def78c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_CURSOR	0x2def7a0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States
RT_GROUP_ICON	0x2def7b4	0x3e	data	English	United States
RT_VERSION	0x2def7f4	0x330	data	English	United States
RT_MANIFEST	0x2defb24	0x848	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2060), with CRLF line terminators	English	United States

Imports

DLL	Import
node.dll	?Value@Boolean@v8@@QBE_NXZ, ?New@Uint8Array@v8@@SA?AV?$Local@VUint8Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z, ?Copy@Buffer@node@@YA?AV?$MaybeLocal@VObject@v8@@@v8@@PAVIsolate@4@PBDI@Z, ?GetContents@ArrayBuffer@v8@@QAE?AVContents@12@XZ, ?NewInstance@ObjectTemplate@v8@@QAE?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?SetInternalFieldCount@ObjectTemplate@v8@@QAEXH@Z, ?SetAlignedPointerInInternalField@Object@v8@@QAEXHPAX@Z, ?New@ArrayBuffer@v8@@SA?AV?$Local@VArrayBuffer@v8@@@2@PAVIsolate@2@I@Z, ?IsRegExp@Value@v8@@QBE_NXZ, ?IsDate@Value@v8@@QBE_NXZ, ?HasCaught@TryCatch@v8@@QBE_NXZ, ?CreationContext@Object@v8@@QAE?AV?$Local@VContext@v8@@@2@XZ, ?ClearWeak@V8@v8@@CAPAXPAPAVObject@internal@2@@Z, ??1TryCatch@v8@@QAE@XZ, ??0TryCatch@v8@@QAE@XZ, ?InstanceTemplate@FunctionTemplate@v8@@QAE?AV?$Local@VObjectTemplate@v8@@@2@XZ, ?Escape@EscapableHandleScope@v8@@AAEPAPAVObject@internal@2@PAPAV342@@Z, ??0EscapableHandleScope@v8@@QAE@PAVIsolate@1@@Z, ?PrototypeTemplate@FunctionTemplate@v8@@QAE?AV?$Local@VObjectTemplate@v8@@@2@XZ, ??1Utf8Value@String@v8@@QAE@XZ, ??0Utf8Value@String@v8@@QAE@V?$Local@VValue@v8@@@2@@Z, ?SetClassName@FunctionTemplate@v8@@QAEXV?$Local@VString@v8@@@2@@Z, ?Delete@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z, ?Clone@Object@v8@@QAE?AV?$Local@VObject@v8@@@2@XZ, ?LowMemoryNotification@Isolate@v8@@QAEXXZ, ?MakeCallback@node@@YA?AV?$MaybeLocal@VValue@v8@@@v8@@PAVIsolate@3@V?$Local@VObject@v8@@@3@PBDHPAV?$Local@VValue@v8@@@3@Uasync_context@1@@Z, node_module_register, uv_backend_timeout, uv_stop, ?Value@Int32@v8@@QBEHXZ, ?Value@Number@v8@@QBENXZ, ?GetIdentityHash@Object@v8@@QAEHXZ, uv_loop_init, ?HasRealIndexedProperty@Object@v8@@QAE_NI@Z, ?HasInstance@Buffer@node@@YA_NV?$Local@VValue@v8@@@v8@@@Z, ?Data@Buffer@node@@YAPADV?$Local@VValue@v8@@@v8@@@Z, ?Length@Buffer@node@@YAIV?$Local@VValue@v8@@@v8@@@Z, ?ToInt32@Value@v8@@QBE?AV?$Local@VInt32@v8@@@2@XZ, ?ToNumber@Value@v8@@QBE?AV?$Local@VNumber@v8@@@2@XZ, ?ToBoolean@Value@v8@@QBE?AV?$Local@VBoolean@v8@@@2@XZ, uv_sem_init, uv_thread_join, uv_is_closing, uv_walk, uv_sem_post, uv_thread_create, ?g_upstream_node_mode@node@@3_NA, ?g_standalone_mode@node@@3_NA, ?New@Date@v8@@SA?AV?$Local@VValue@v8@@@2@PAVIsolate@2@N@Z, ?ReThrow@TryCatch@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ, uv_sem_destroy, ?IsActive@Locker@v8@@SA_NXZ, ?SetMicrotasksPolicy@Isolate@v8@@QAEXW4MicrotasksPolicy@2@@Z, uv_loop_close, uv_sem_wait, ?ReportExternalAllocationLimitReached@Isolate@v8@@AAEXXZ, ?get_builtin_module@node@@YAPAUnode_module@1@PBD@Z, ?New@Buffer@node@@YA?AV?$MaybeLocal@VObject@v8@@@v8@@PAVIsolate@4@I@Z, ?Set@Object@v8@@QAE_NIV?$Local@VValue@v8@@@2@@Z, ?New@Buffer@node@@YA?AV?$MaybeLocal@VObject@v8@@@v8@@PAVIsolate@4@PADIP6AX1PAX@Z2@Z, ?AdjustAmountOfExternalAllocatedMemory@Isolate@v8@@QAE_J_J@Z, ?GetConstructorName@Object@v8@@QAE?AV?$Local@VString@v8@@@2@XZ, ?New@Date@v8@@SA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@N@Z, ?ToObject@Value@v8@@QBE?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?Run@Script@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ, ?HasPrivate@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VPrivate@v8@@@2@@Z, ?SetPrivate@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VPrivate@v8@@@2@V?$Local@VValue@v8@@@2@@Z, ?IdleNotificationDeadline@Isolate@v8@@QAE_NN@Z, ?Has@Object@v8@@QAE_NV?$Local@VValue@v8@@@2@@Z, ?GetPrivate@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VPrivate@v8@@@2@@Z, ?RequestGarbageCollectionForTesting@Isolate@v8@@QAEXW4GarbageCollectionType@12@@Z, ?NewFromTwoByte@String@v8@@SA?AV?$Local@VString@v8@@@2@PAVIsolate@2@PBGW4NewStringType@12@H@Z, ?New@Array@v8@@SA?AV?$Local@VArray@v8@@@2@PAVIsolate@2@H@Z, ?GetHeapProfiler@Isolate@v8@@QAEPAVHeapProfiler@2@XZ, ?ForApi@Private@v8@@SA?AV?$Local@VPrivate@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z, ?Global@Context@v8@@QAE?AV?$Local@VObject@v8@@@2@XZ, ?ToString@Value@v8@@QBE?AV?$Local@VString@v8@@@2@XZ, ?Call@Function@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@HQAV52@@Z, ?Compile@Script@v8@@SA?AV?$Local@VScript@v8@@@2@V?$Local@VString@v8@@@2@PAVScriptOrigin@2@@Z, ?Run@Script@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?GetIsolate@Context@v8@@QAEPAVIsolate@2@XZ, ?ToObject@Value@v8@@QBE?AV?$Local@VObject@v8@@@2@XZ, ?Get@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@I@Z, ?TakeHeapSnapshot@HeapProfiler@v8@@QAEPBVHeapSnapshot@2@PAVActivityControl@2@PAVObjectNameResolver@12@@Z, ?Data@Buffer@node@@YAPADV?$Local@VObject@v8@@@v8@@@Z, ?Get@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@@Z, ?GetOwnPropertyNames@Object@v8@@QAE?AV?$Local@VArray@v8@@@2@XZ, ?Length@Array@v8@@QBEIXZ, ?New@Object@v8@@SA?AV?$Local@VObject@v8@@@2@PAVIsolate@2@@Z, ?SetPrototype@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z, ?NewInstance@ObjectTemplate@v8@@QAE?AV?$Local@VObject@v8@@@2@XZ, ?ToDetailString@Value@v8@@QBE?AV?$Local@VString@v8@@@2@PAVIsolate@2@@Z, ?TypeError@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z, ?Error@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z, ?ThrowException@Isolate@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@@Z, ?New@ObjectTemplate@v8@@SA?AV?$Local@VObjectTemplate@v8@@@2@XZ, ?MakeWeak@V8@v8@@CAXPAPAVObject@internal@2@PAXP6AXABV?$WeakCallbackInfo@X@2@@ZW4WeakCallbackType@2@@Z, ?New@External@v8@@SA?AV?$Local@VExternal@v8@@@2@PAVIsolate@2@PAX@Z, ?ToString@Value@v8@@QBE?AV?$MaybeLocal@VString@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?SetAccessorProperty@Template@v8@@QAEXV?$Local@VName@v8@@@2@V?$Local@VFunctionTemplate@v8@@@2@1W4PropertyAttribute@2@W4AccessControl@2@@Z, ?Set@Template@v8@@QAEXV?$Local@VName@v8@@@2@V?$Local@VData@v8@@@2@W4PropertyAttribute@2@@Z, ?IsUint8Array@Value@v8@@QBE_NXZ, uscript_getScript_59, uscript_getCode_59, uscript_getName_59, ?normalize@Normalizer@icu_59@@SAXABVUnicodeString@2@W4UNormalizationMode@@HAAV32@AAW4UErrorCode@@@Z, ??1UnicodeString@icu_59@@UAE@XZ, ??0UnicodeString@icu_59@@QAE@XZ, ??0UnicodeString@icu_59@@QAE@CVConstChar16Ptr@1@H@Z, ??1StringCharacterIterator@icu_59@@UAE@XZ, ??0StringCharacterIterator@icu_59@@QAE@ABVUnicodeString@1@@Z, ?next@UCharCharacterIterator@icu_59@@UAE_SXZ, ?first@UCharCharacterIterator@icu_59@@UAE_SXZ, u_isalpha_59, ?New@Number@v8@@SA?AV?$Local@VNumber@v8@@@2@PAVIsolate@2@N@Z, ?Utf8Length@String@v8@@QBEHXZ, ?WriteUtf8@String@v8@@QBEHPADHPAHH@Z, ?NewFromUtf8@String@v8@@SA?AV?$Local@VString@v8@@@2@PAVIsolate@2@PBDW4NewStringType@12@H@Z, udata_setCommonData_59, ubrk_getRuleStatus_59, ubrk_isBoundary_59, ubrk_openRules_59, ubrk_first_59, ubrk_setText_59, ubrk_close_59, ubrk_next_59, ubrk_open_59, u_getIntPropertyValue_59, ?createCanonical@Locale@icu_59@@SA?AV12@PBD@Z, ?setDefault@Locale@icu_59@@SAXABV12@AAW4UErrorCode@@@Z, ?getDefault@Locale@icu_59@@SAABV12@XZ, ??1Locale@icu_59@@UAE@XZ, ??0Locale@icu_59@@QAE@PBD000@Z, ?getUS@Locale@icu_59@@SAABV12@XZ, ??0ResourceConstraints@v8@@QAE@XZ, ?ConfigureDefaults@ResourceConstraints@v8@@QAEX_K0@Z, ?New@Isolate@v8@@SAPAV12@ABUCreateParams@12@@Z, ?Dispose@Isolate@v8@@QAEXXZ, ?GetCodeRange@Isolate@v8@@QAEXPAPAXPAI@Z, ??1SnapshotCreator@v8@@QAE@XZ, ?SetNativesDataBlob@V8@v8@@SAXPAVStartupData@2@@Z, ?SetSnapshotDataBlob@V8@v8@@SAXPAVStartupData@2@@Z, ?Initialize@V8@v8@@SA_NXZ, ?SetEntropySource@V8@v8@@SAXP6A_NPAEI@Z@Z, ?IsArrayBuffer@Value@v8@@QBE_NXZ, ?IsArrayBufferView@Value@v8@@QBE_NXZ, ?IsExternal@ArrayBuffer@v8@@QBE_NXZ, ?Externalize@ArrayBuffer@v8@@QAE?AVContents@12@XZ, ?Buffer@ArrayBufferView@v8@@QAE?AV?$Local@VArrayBuffer@v8@@@2@XZ, ?ByteOffset@ArrayBufferView@v8@@QAEIXZ, ?ByteLength@ArrayBufferView@v8@@QAEIXZ, ?Free@Allocator@ArrayBuffer@v8@@UAEXPAXIW4AllocationMode@123@@Z, ?Reserve@Allocator@ArrayBuffer@v8@@UAEPAXI@Z, ?SetProtection@Allocator@ArrayBuffer@v8@@UAEXPAXIW4Protection@123@@Z, ??_7Allocator@ArrayBuffer@v8@@6B@, u_getPropertyValueEnum_59, u_iscntrl_59, u_charType_59, ?PerformCheckpoint@MicrotasksScope@v8@@SAXPAVIsolate@2@@Z, ?Enter@Isolate@v8@@QAEXXZ, ?Exit@Isolate@v8@@QAEXXZ, ??0HeapStatistics@v8@@QAE@XZ, ??0HeapSpaceStatistics@v8@@QAE@XZ, ??0HeapObjectStatistics@v8@@QAE@XZ, ??0HeapCodeStatistics@v8@@QAE@XZ, ?GetHeapStatistics@Isolate@v8@@QAEXPAVHeapStatistics@2@@Z, ?NumberOfHeapSpaces@Isolate@v8@@QAEIXZ, ?GetHeapSpaceStatistics@Isolate@v8@@QAE_NPAVHeapSpaceStatistics@2@I@Z, ?NumberOfTrackedHeapObjectTypes@Isolate@v8@@QAEIXZ, ?GetHeapObjectStatisticsAtLastGC@Isolate@v8@@QAE_NPAVHeapObjectStatistics@2@I@Z, ?GetHeapCodeAndMetadataStatistics@Isolate@v8@@QAE_NPAVHeapCodeStatistics@2@@Z, ?MemoryPressureNotification@Isolate@v8@@QAEXW4MemoryPressureLevel@2@@Z, ?DumpAndResetStats@Isolate@v8@@QAEXXZ, ?SetCreateHistogramFunction@Isolate@v8@@QAEXP6APAXPBDHHI@Z@Z, ?SetAddHistogramSampleFunction@Isolate@v8@@QAEXP6AXPAXH@Z@Z, ?IsolateInForegroundNotification@Isolate@v8@@QAEXXZ, ?IsolateInBackgroundNotification@Isolate@v8@@QAEXXZ, ?SetRAILMode@Isolate@v8@@QAEXW4RAILMode@2@@Z, ?ToBoolean@Value@v8@@QBE?AV?$Local@VBoolean@v8@@@2@PAVIsolate@2@@Z, ?ToObject@Value@v8@@QBE?AV?$Local@VObject@v8@@@2@PAVIsolate@2@@Z, ?ToInt32@Value@v8@@QBE?AV?$Local@VInt32@v8@@@2@PAVIsolate@2@@Z, ?CreateDataProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@V?$Local@VValue@v8@@@2@@Z, ?CreateDataProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@IV?$Local@VValue@v8@@@2@@Z, ?CopyContents@ArrayBufferView@v8@@QAEIPAXI@Z, ?ValueOf@Date@v8@@QBENXZ, ??0TryCatch@v8@@QAE@PAVIsolate@1@@Z, ?RemovePrototype@FunctionTemplate@v8@@QAEXXZ, ?Set@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@IV?$Local@VValue@v8@@@2@@Z, ?CopyPersistent@V8@v8@@CAPAPAVObject@internal@2@PAPAV342@@Z, ?DefineOwnProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@V?$Local@VValue@v8@@@2@W4PropertyAttribute@2@@Z, ?Get@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@I@Z, ?GetScriptOrigin@Function@v8@@QBE?AVScriptOrigin@2@XZ, ?GetFunction@FunctionTemplate@v8@@QAE?AV?$MaybeLocal@VFunction@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?New@ArrayBuffer@v8@@SA?AV?$Local@VArrayBuffer@v8@@@2@PAVIsolate@2@PAXIW4ArrayBufferCreationMode@2@@Z, ?IsBooleanObject@Value@v8@@QBE_NXZ, ?IsNumberObject@Value@v8@@QBE_NXZ, ?IsStringObject@Value@v8@@QBE_NXZ, ?ToNumber@Value@v8@@QBE?AV?$Local@VNumber@v8@@@2@PAVIsolate@2@@Z, ?ToString@Value@v8@@QBE?AV?$Local@VString@v8@@@2@PAVIsolate@2@@Z, ?HasRealNamedCallbackProperty@Object@v8@@QAE_NV?$Local@VString@v8@@@2@@Z, ?Get@Message@v8@@QBE?AV?$Local@VString@v8@@@2@XZ, ?Message@TryCatch@v8@@QBE?AV?$Local@VMessage@v8@@@2@XZ, ?ReferenceError@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z, ??0UnicodeString@icu_59@@QAE@PB_S@Z, u_isspace_59, ?createWordInstance@BreakIterator@icu_59@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z, ?setIndex@UCharCharacterIterator@icu_59@@UAE_SH@Z, ?current@UCharCharacterIterator@icu_59@@UBE_SXZ, ?previous@UCharCharacterIterator@icu_59@@UAE_SXZ, ?hasPrevious@UCharCharacterIterator@icu_59@@UAECXZ, ??_7UnicodeString@icu_59@@6B@, ?setIndex32@UCharCharacterIterator@icu_59@@UAEHH@Z, ?BooleanValue@Value@v8@@QBE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@@Z, ?IntegerValue@Value@v8@@QBE?AV?$Maybe@_J@2@V?$Local@VContext@v8@@@2@@Z, ?NewFromUtf8@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PBDW4NewStringType@2@H@Z, ?Value@Uint32@v8@@QBEIXZ, ?SetAlignedPointerInInternalFields@Object@v8@@QAEXHQAHQAPAX@Z, ?InternalFieldCount@ObjectTemplate@v8@@QAEHXZ, ?New@ObjectTemplate@v8@@SA?AV?$Local@VObjectTemplate@v8@@@2@PAVIsolate@2@V?$Local@VFunctionTemplate@v8@@@2@@Z, ?SetNamedPropertyHandler@ObjectTemplate@v8@@QAEXP6AXV?$Local@VString@v8@@@2@ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX0V?$Local@VValue@v8@@@2@1@ZP6AX0ABV?$PropertyCallbackInfo@VInteger@v8@@@2@@ZP6AX0ABV?$PropertyCallbackInfo@VBoolean@v8@@@2@@ZP6AXABV?$PropertyCallbackInfo@VArray@v8@@@2@@Z3@Z, ?SetAlignedPointerInEmbedderData@Context@v8@@QAEXHPAX@Z, ?New@Resolver@Promise@v8@@SA?AV?$Local@VResolver@Promise@v8@@@3@PAVIsolate@3@@Z, ?GetPromise@Resolver@Promise@v8@@QAE?AV?$Local@VPromise@v8@@@3@XZ, ?Resolve@Resolver@Promise@v8@@QAEXV?$Local@VValue@v8@@@3@@Z, ?Reject@Resolver@Promise@v8@@QAEXV?$Local@VValue@v8@@@3@@Z, ?Length@String@v8@@QBEHXZ, ?Delete@Object@v8@@QAE_NV?$Local@VValue@v8@@@2@@Z, ?GetPropertyNames@Object@v8@@QAE?AV?$Local@VArray@v8@@@2@XZ, ucnv_setFromUCallBack_59, ucnv_fromUChars_59, ucnv_cbFromUWriteBytes_59, uidna_openUTS46_59, uidna_nameToASCII_59, ublock_getCode_59, ubidi_reorderLogical_59, ubidi_reorderVisual_59, uscript_getShortName_59, uscript_getScriptExtensions_59, utf8_nextCharSafeBody_59, u_errorName_59, u_foldCase_59, uregex_open_59, uregex_close_59, uregex_setText_59, uregex_matches_59, u_strToUpper_59, u_strToLower_59, u_strToUTF8_59, ucol_open_59, ucol_close_59, ucol_strcoll_59, ubrk_current_59, ??2UMemory@icu_59@@SAPAXI@Z, ??3UMemory@icu_59@@SAXPAX@Z, ??0UnicodeSet@icu_59@@QAE@ABVUnicodeString@1@AAW4UErrorCode@@@Z, ??1UnicodeSet@icu_59@@UAE@XZ, ?freeze@UnicodeSet@icu_59@@QAEPAVUnicodeFunctor@2@XZ, ?spanUTF8@UnicodeSet@icu_59@@QBEHPBDHW4USetSpanCondition@@@Z, ??8UnicodeSet@icu_59@@UBECABV01@@Z, ?add@UnicodeSet@icu_59@@UAEAAV12@HH@Z, ?addAll@UnicodeSet@icu_59@@UAEAAV12@ABV12@@Z, ?addMatchSetTo@UnicodeSet@icu_59@@UBEXAAV12@@Z, ?clear@UnicodeSet@icu_59@@UAEAAV12@XZ, ?clone@UnicodeSet@icu_59@@UBEPAVUnicodeFunctor@2@XZ, ?compact@UnicodeSet@icu_59@@UAEAAV12@XZ, ?complement@UnicodeSet@icu_59@@UAEAAV12@HH@Z, ?complement@UnicodeSet@icu_59@@UAEAAV12@XZ, ?complementAll@UnicodeSet@icu_59@@UAEAAV12@ABV12@@Z, ?contains@UnicodeSet@icu_59@@UBECH@Z, ?contains@UnicodeSet@icu_59@@UBECHH@Z, ?containsAll@UnicodeSet@icu_59@@UBECABV12@@Z, ?getDynamicClassID@UnicodeSet@icu_59@@UBEPAXXZ, ?getRangeCount@UnicodeSet@icu_59@@UBEHXZ, ?getRangeEnd@UnicodeSet@icu_59@@UBEHH@Z, ?getRangeStart@UnicodeSet@icu_59@@UBEHH@Z, ?isEmpty@UnicodeSet@icu_59@@UBECXZ, ?matches@UnicodeSet@icu_59@@UAE?AW4UMatchDegree@2@ABVReplaceable@2@AAHHC@Z, ?matchesIndexValue@UnicodeSet@icu_59@@EBECE@Z, ?remove@UnicodeSet@icu_59@@UAEAAV12@HH@Z, ?removeAll@UnicodeSet@icu_59@@UAEAAV12@ABV12@@Z, ?removeAllStrings@UnicodeSet@icu_59@@UAEAAV12@XZ, ?retain@UnicodeSet@icu_59@@UAEAAV12@HH@Z, ?retainAll@UnicodeSet@icu_59@@UAEAAV12@ABV12@@Z, ?setData@UnicodeFilter@icu_59@@UAEXPBVTransliterationRuleData@2@@Z, ?size@UnicodeSet@icu_59@@UBEHXZ, ?toMatcher@UnicodeFilter@icu_59@@UBEPAVUnicodeMatcher@2@XZ, ?toPattern@UnicodeSet@icu_59@@UBEAAVUnicodeString@2@AAV32@C@Z, ?toReplacer@UnicodeFunctor@icu_59@@UBEPAVUnicodeReplacer@2@XZ, ubidi_open_59, ubidi_close_59, ubidi_setPara_59, ubidi_countRuns_59, ubidi_getVisualRun_59, ?createDefault@TimeZone@icu_59@@SAPAV12@XZ, u_charMirror_59, u_getCombiningClass_59, unorm2_getNFCInstance_59, unorm2_getRawDecomposition_59, unorm2_composePair_59, unorm_normalize_59, u_countChar32_59, u_strToUTF32_59, ucnv_open_59, ucnv_close_59, ucnv_toAlgorithmic_59, ?Compile@Script@v8@@SA?AV?$MaybeLocal@VScript@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@PAVScriptOrigin@2@@Z, ?GetLineNumber@Message@v8@@QBE?AV?$Maybe@H@2@V?$Local@VContext@v8@@@2@@Z, ?IsTrue@Value@v8@@QBE_NXZ, ?Write@String@v8@@QBEHPAGHHH@Z, ?NewFromTwoByte@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PBGW4NewStringType@2@H@Z, ?NewExternalTwoByte@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PAVExternalStringResource@12@@Z, ?NewExternalOneByte@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PAVExternalOneByteStringResource@12@@Z, ?TerminateExecution@Isolate@v8@@QAEXXZ, ??1Unlocker@v8@@QAE@XZ, ?Initialize@Unlocker@v8@@AAEXPAVIsolate@2@@Z, ?Dispose@ExternalStringResourceBase@String@v8@@MAEXXZ, ?IsCompressible@ExternalStringResourceBase@String@v8@@UBE_NXZ, ??_7ExternalStringResourceBase@String@v8@@6B@, ??_7ExternalStringResource@String@v8@@6B@, ??_7ExternalOneByteStringResource@String@v8@@6B@, ?length@UnicodeString@icu_59@@QBEHXZ, ?getBuffer@UnicodeString@icu_59@@QBEPB_SXZ, ?getAvailableLocales@DateFormat@icu_59@@SAPBVLocale@2@AAH@Z, ??0DateFormatSymbols@icu_59@@QAE@ABVLocale@1@AAW4UErrorCode@@@Z, ??1DateFormatSymbols@icu_59@@UAE@XZ, ?getShortMonths@DateFormatSymbols@icu_59@@QBEPBVUnicodeString@2@AAH@Z, ?ToBoolean@Value@v8@@QBE?AV?$MaybeLocal@VBoolean@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?ToNumber@Value@v8@@QBE?AV?$MaybeLocal@VNumber@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?ToInt32@Value@v8@@QBE?AV?$MaybeLocal@VInt32@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?GetToStringTag@Symbol@v8@@SA?AV?$Local@VSymbol@v8@@@2@PAVIsolate@2@@Z, ?GetPropertyNames@Object@v8@@QAE?AV?$MaybeLocal@VArray@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?GetPrototype@Object@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ, ?SetCallHandler@FunctionTemplate@v8@@QAEXP6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@@Z, ?SetAccessor@ObjectTemplate@v8@@QAEXV?$Local@VString@v8@@@2@P6AX0ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX0V?$Local@VValue@v8@@@2@ABV?$PropertyCallbackInfo@X@2@@Z3W4AccessControl@2@W4PropertyAttribute@2@V?$Local@VAccessorSignature@v8@@@2@@Z, ?New@Signature@v8@@SA?AV?$Local@VSignature@v8@@@2@PAVIsolate@2@V?$Local@VFunctionTemplate@v8@@@2@@Z, ?Exception@TryCatch@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ, ?GetIsolate@Object@v8@@QAEPAVIsolate@2@XZ, UCNV_FROM_U_CALLBACK_STOP_59, UCNV_FROM_U_CALLBACK_SKIP_59, UCNV_FROM_U_CALLBACK_SUBSTITUTE_59, ucnv_getSubstChars_59, ucnv_setSubstString_59, ucol_getStrength_59, ucol_setStrength_59, usearch_open_59, usearch_close_59, usearch_getMatchedLength_59, usearch_getCollator_59, usearch_first_59, usearch_next_59, usearch_reset_59, ??1ByteSink@icu_59@@UAE@XZ, ?toUTF8@UnicodeString@icu_59@@QBEXAAVByteSink@2@@Z, ??4UnicodeString@icu_59@@QAEAAV01@ABV01@@Z, ?detectHostTimeZone@TimeZone@icu_59@@SAPAV12@XZ, ?adoptDefault@TimeZone@icu_59@@SAXPAV12@@Z, ?Flush@ByteSink@icu_59@@UAEXXZ, ?GetAppendBuffer@ByteSink@icu_59@@UAEPADHHPADHPAH@Z, u_charDirection_59, u_tolower_59, u_toupper_59, u_memcasecmp_59, u_strFoldCase_59, ?FindInstanceInPrototypeChain@Object@v8@@QAE?AV?$Local@VObject@v8@@@2@V?$Local@VFunctionTemplate@v8@@@2@@Z, ?HasInstance@FunctionTemplate@v8@@QAE_NV?$Local@VValue@v8@@@2@@Z, ?SetEmbedderHeapTracer@Isolate@v8@@QAEXPAVEmbedderHeapTracer@2@@Z, ?AddBeforeCallEnteredCallback@Isolate@v8@@QAEXP6AXPAV12@@Z@Z, ?RemoveBeforeCallEnteredCallback@Isolate@v8@@QAEXP6AXPAV12@@Z@Z, ?AddMicrotasksCompletedCallback@Isolate@v8@@QAEXP6AXPAV12@@Z@Z, ?RemoveMicrotasksCompletedCallback@Isolate@v8@@QAEXP6AXPAV12@@Z@Z, ?RegisterExternallyReferencedObject@V8@v8@@CAXPAPAVObject@internal@2@PAVIsolate@42@@Z, ?ContainsOnlyOneByte@String@v8@@QBE_NXZ, ?WriteOneByte@String@v8@@QBEHPAEHHH@Z, ?MakeExternal@String@v8@@QAE_NPAVExternalStringResource@12@@Z, ?MakeExternal@String@v8@@QAE_NPAVExternalOneByteStringResource@12@@Z, ?CanMakeExternal@String@v8@@QAE_NXZ, ?EnqueueMicrotask@Isolate@v8@@QAEXP6AXPAX@Z0@Z, ?DetachGlobal@Context@v8@@QAEXXZ, UCNV_TO_U_CALLBACK_STOP_59, UCNV_FROM_U_CALLBACK_ESCAPE_59, ucnv_setSubstChars_59, ucnv_getName_59, ucnv_setToUCallBack_59, ucnv_fromUnicode_59, ucnv_toUnicode_59, ucnv_countAvailable_59, ucnv_getAvailableName_59, ucnv_countAliases_59, ucnv_getAlias_59, ucnv_getStandardName_59, ucnv_setFallback_59, ?MakeWeak@V8@v8@@CAXPAPAPAVObject@internal@2@@Z, ?Reset@TryCatch@v8@@QAEXXZ, uloc_setKeywordValue_59, ?getTraditionalChinese@Locale@icu_59@@SAABV12@XZ, ??8Locale@icu_59@@QBECABV01@@Z, utrie2_openFromSerialized_59, ??0UnicodeString@icu_59@@QAE@PBDHW4EInvariant@01@@Z, utext_close_59, utext_openUChars_59, utext_setup_59, ?createLineInstance@BreakIterator@icu_59@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z, ?createCharacterInstance@BreakIterator@icu_59@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z, ?createSentenceInstance@BreakIterator@icu_59@@SAPAV12@ABVLocale@2@AAW4UErrorCode@@@Z, ??0RuleBasedBreakIterator@icu_59@@QAE@ABVUnicodeString@1@AAUUParseError@@AAW4UErrorCode@@@Z, ??1RuleBasedBreakIterator@icu_59@@UAE@XZ, ??8RuleBasedBreakIterator@icu_59@@UBECABVBreakIterator@1@@Z, ?adoptText@RuleBasedBreakIterator@icu_59@@UAEXPAVCharacterIterator@2@@Z, ?clone@RuleBasedBreakIterator@icu_59@@UBEPAVBreakIterator@2@XZ, ?createBufferClone@RuleBasedBreakIterator@icu_59@@UAEPAVBreakIterator@2@PAXAAHAAW4UErrorCode@@@Z, ?current@RuleBasedBreakIterator@icu_59@@UBEHXZ, ?first@RuleBasedBreakIterator@icu_59@@UAEHXZ, ?following@RuleBasedBreakIterator@icu_59@@UAEHH@Z, ?getBinaryRules@RuleBasedBreakIterator@icu_59@@UAEPBEAAI@Z, ?getDynamicClassID@RuleBasedBreakIterator@icu_59@@UBEPAXXZ, ?getRuleStatus@RuleBasedBreakIterator@icu_59@@UBEHXZ, ?getRuleStatusVec@RuleBasedBreakIterator@icu_59@@UAEHPAHHAAW4UErrorCode@@@Z, ?getRules@RuleBasedBreakIterator@icu_59@@UBEABVUnicodeString@2@XZ, ?getText@RuleBasedBreakIterator@icu_59@@UBEAAVCharacterIterator@2@XZ, ?getUText@RuleBasedBreakIterator@icu_59@@UBEPAUUText@@PAU3@AAW4UErrorCode@@@Z, ?hashCode@RuleBasedBreakIterator@icu_59@@UBEHXZ, ?isBoundary@RuleBasedBreakIterator@icu_59@@UAECH@Z, ?last@RuleBasedBreakIterator@icu_59@@UAEHXZ, ?next@RuleBasedBreakIterator@icu_59@@UAEHH@Z, ?next@RuleBasedBreakIterator@icu_59@@UAEHXZ, ?preceding@RuleBasedBreakIterator@icu_59@@UAEHH@Z, ?previous@RuleBasedBreakIterator@icu_59@@UAEHXZ, ?refreshInputText@RuleBasedBreakIterator@icu_59@@UAEAAV12@PAUUText@@AAW4UErrorCode@@@Z, ?setText@RuleBasedBreakIterator@icu_59@@UAEXABVUnicodeString@2@@Z, ?setText@RuleBasedBreakIterator@icu_59@@UAEXPAUUText@@AAW4UErrorCode@@@Z, ?NewInstance@Function@v8@@QBE?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@HQAV?$Local@VValue@v8@@@2@@Z, ?IsDead@Isolate@v8@@QAE_NXZ, ?RangeError@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z, ?SyntaxError@Exception@v8@@SA?AV?$Local@VValue@v8@@@2@V?$Local@VString@v8@@@2@@Z, ?IsExecutionTerminating@Isolate@v8@@QAE_NXZ, u_hasBinaryProperty_59, u_getBidiPairedBracket_59, ?IncreaseHeapLimitForDebugging@Isolate@v8@@QAEXXZ, ?IsRunningMicrotasks@MicrotasksScope@v8@@SA_NPAVIsolate@2@@Z, ubidi_getDirection_59, ubidi_getParaLevel_59, ubidi_getLogicalRun_59, u_totitle_59, u_ispunct_59, ?SetAllowAtomicsWait@Isolate@v8@@QAEX_N@Z, ?IsHeapLimitIncreasedForDebugging@Isolate@v8@@QAE_NXZ, ?SetErrorMessageForCodeGenerationFromStrings@Context@v8@@QAEXV?$Local@VString@v8@@@2@@Z, ?AllowCodeGenerationFromStrings@Context@v8@@QAEX_N@Z, ?GetExtrasBindingObject@Context@v8@@QAE?AV?$Local@VObject@v8@@@2@XZ, ?Evaluate@Module@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?VisitWeakHandles@Isolate@v8@@QAEXPAVPersistentHandleVisitor@2@@Z, ?VisitHandlesWithClassIds@Isolate@v8@@QAEXPAVPersistentHandleVisitor@2@@Z, ?SetFailedAccessCheckCallbackFunction@Isolate@v8@@QAEXP6AXV?$Local@VObject@v8@@@2@W4AccessType@2@V?$Local@VValue@v8@@@2@@Z@Z, ?AddMessageListenerWithErrorLevel@Isolate@v8@@QAE_NP6AXV?$Local@VMessage@v8@@@2@V?$Local@VValue@v8@@@2@@ZH1@Z, ?SetWasmInstanceCallback@Isolate@v8@@QAEXP6A_NABV?$FunctionCallbackInfo@VValue@v8@@@2@@Z@Z, ?SetWasmModuleCallback@Isolate@v8@@QAEXP6A_NABV?$FunctionCallbackInfo@VValue@v8@@@2@@Z@Z, ?SetAllowCodeGenerationFromStringsCallback@Isolate@v8@@QAEXP6A_NV?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@@Z@Z, ?SetOOMErrorHandler@Isolate@v8@@QAEXP6AXPBD_N@Z@Z, ?SetStackLimit@Isolate@v8@@QAEXI@Z, ?ContextDisposedNotification@Isolate@v8@@QAEH_N@Z, ?SetUseCounterCallback@Isolate@v8@@QAEXP6AXPAV12@W4UseCounterFeature@12@@Z@Z, ?SetPromiseRejectCallback@Isolate@v8@@QAEXP6AXVPromiseRejectMessage@2@@Z@Z, ?AddGCEpilogueCallback@Isolate@v8@@QAEXP6AXPAV12@W4GCType@2@W4GCCallbackFlags@2@@Z1@Z, ?AddGCPrologueCallback@Isolate@v8@@QAEXP6AXPAV12@W4GCType@2@W4GCCallbackFlags@2@@Z1@Z, ?GetEnteredContext@Isolate@v8@@QAE?AV?$Local@VContext@v8@@@2@XZ, ?InContext@Isolate@v8@@QAE_NXZ, ?NumberOfPhantomHandleResetsSinceLastCall@Isolate@v8@@QAEIXZ, ?SetGetRetainerInfosCallback@HeapProfiler@v8@@QAEXP6A?AURetainerInfos@12@PAVIsolate@2@@Z@Z, ?SetWrapperClassInfoProvider@HeapProfiler@v8@@QAEXGP6APAVRetainedObjectInfo@2@GV?$Local@VValue@v8@@@2@@Z@Z, ?GetCachedData@StreamedSource@ScriptCompiler@v8@@QBEPBUCachedData@23@XZ, ??1CachedData@ScriptCompiler@v8@@QAE@XZ, ??0CachedData@ScriptCompiler@v8@@QAE@PBEHW4BufferPolicy@012@@Z, ?CompileFunctionInContext@ScriptCompiler@v8@@SA?AV?$Local@VFunction@v8@@@2@PAVIsolate@2@PAVSource@12@V?$Local@VContext@v8@@@2@IQAV?$Local@VString@v8@@@2@IQAV?$Local@VObject@v8@@@2@@Z, ?CompileModule@ScriptCompiler@v8@@SA?AV?$MaybeLocal@VModule@v8@@@2@PAVIsolate@2@PAVSource@12@@Z, ?CachedDataVersionTag@ScriptCompiler@v8@@SAIXZ, ?Compile@ScriptCompiler@v8@@SA?AV?$MaybeLocal@VScript@v8@@@2@V?$Local@VContext@v8@@@2@PAVSource@12@W4CompileOptions@12@@Z, ?Compile@ScriptCompiler@v8@@SA?AV?$MaybeLocal@VScript@v8@@@2@V?$Local@VContext@v8@@@2@PAVStreamedSource@12@V?$Local@VString@v8@@@2@ABVScriptOrigin@2@@Z, ?CreateMessage@Exception@v8@@SA?AV?$Local@VMessage@v8@@@2@PAVIsolate@2@V?$Local@VValue@v8@@@2@@Z, ?GetScriptName@UnboundScript@v8@@QAE?AV?$Local@VValue@v8@@@2@XZ, ?GetCurrentDepth@MicrotasksScope@v8@@SAHPAVIsolate@2@@Z, ?ByteLength@ArrayBuffer@v8@@QBEIXZ, ?Uint32Value@Value@v8@@QBE?AV?$Maybe@I@2@V?$Local@VContext@v8@@@2@@Z, ?IsWebAssemblyCompiledModule@Value@v8@@QBE_NXZ, ?IsSharedArrayBuffer@Value@v8@@QBE_NXZ, ?ReadRawBytes@ValueDeserializer@v8@@QAE_NIPAPBX@Z, ?ReadDouble@ValueDeserializer@v8@@QAE_NPAN@Z, ?ReadUint64@ValueDeserializer@v8@@QAE_NPA_K@Z, ?ReadUint32@ValueDeserializer@v8@@QAE_NPAI@Z, ?GetWireFormatVersion@ValueDeserializer@v8@@QBEIXZ, ?SetExpectInlineWasm@ValueDeserializer@v8@@QAEX_N@Z, ?SetSupportsLegacyWireFormat@ValueDeserializer@v8@@QAEX_N@Z, ?TransferSharedArrayBuffer@ValueDeserializer@v8@@QAEXIV?$Local@VSharedArrayBuffer@v8@@@2@@Z, ?TransferArrayBuffer@ValueDeserializer@v8@@QAEXIV?$Local@VArrayBuffer@v8@@@2@@Z, ?ReadValue@ValueDeserializer@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?ReadHeader@ValueDeserializer@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@@Z, ??1ValueDeserializer@v8@@QAE@XZ, ??0ValueDeserializer@v8@@QAE@PAVIsolate@1@PBEIPAVDelegate@01@@Z, ?IsOpaque@Message@v8@@QBE_NXZ, ?IsSharedCrossOrigin@Message@v8@@QBE_NXZ, ?ErrorLevel@Message@v8@@QBEHXZ, ?SetVerbose@TryCatch@v8@@QAEX_N@Z, ?CanContinue@TryCatch@v8@@QBE_NXZ, ?GetUnboundScript@Script@v8@@QAE?AV?$Local@VUnboundScript@v8@@@2@XZ, ?CallAsConstructor@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@HQAV?$Local@VValue@v8@@@2@@Z, ?SetAccessor@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@P6AX1ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX1V?$Local@VValue@v8@@@2@ABV?$PropertyCallbackInfo@X@2@@ZV?$MaybeLocal@VValue@v8@@@2@W4AccessControl@2@W4PropertyAttribute@2@@Z, ?WriteRawBytes@ValueSerializer@v8@@QAEXPBXI@Z, ?WriteDouble@ValueSerializer@v8@@QAEXN@Z, ?WriteUint64@ValueSerializer@v8@@QAEX_K@Z, ?WriteUint32@ValueSerializer@v8@@QAEXI@Z, ?TransferArrayBuffer@ValueSerializer@v8@@QAEXIV?$Local@VArrayBuffer@v8@@@2@@Z, ?Release@ValueSerializer@v8@@QAE?AU?$pair@PAEI@std@@XZ, ?WriteValue@ValueSerializer@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z, ?WriteHeader@ValueSerializer@v8@@QAEXXZ, ??1ValueSerializer@v8@@QAE@XZ, ??0ValueSerializer@v8@@QAE@PAVIsolate@1@PAVDelegate@01@@Z, ?SetName@Function@v8@@QAEXV?$Local@VString@v8@@@2@@Z, ?New@Function@v8@@SA?AV?$MaybeLocal@VFunction@v8@@@2@V?$Local@VContext@v8@@@2@P6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@HW4ConstructorBehavior@2@@Z, ?GetWasmWireBytes@WasmCompiledModule@v8@@QAE?AV?$Local@VString@v8@@@2@XZ, ?FromTransferrableModule@WasmCompiledModule@v8@@SA?AV?$MaybeLocal@VWasmCompiledModule@v8@@@2@PAVIsolate@2@ABVTransferrableModule@12@@Z, ?GetTransferrableModule@WasmCompiledModule@v8@@QAE?AVTransferrableModule@12@XZ, ??_7Delegate@ValueDeserializer@v8@@6B@, ??_7PersistentHandleVisitor@v8@@6B@, ??_7Delegate@ValueSerializer@v8@@6B@, ?UseDefaultSecurityToken@Context@v8@@QAEXXZ, ?SetSecurityToken@Context@v8@@QAEXV?$Local@VValue@v8@@@2@@Z, ?NewRemoteContext@Context@v8@@SA?AV?$MaybeLocal@VObject@v8@@@2@PAVIsolate@2@V?$Local@VObjectTemplate@v8@@@2@V?$MaybeLocal@VValue@v8@@@2@@Z, ?InstantiateModule@Module@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@P6A?AV?$MaybeLocal@VModule@v8@@@2@0V?$Local@VString@v8@@@2@V?$Local@VModule@v8@@@2@@Z@Z, ?GetIdentityHash@Module@v8@@QBEHXZ, ?GetModuleRequestLocation@Module@v8@@QBE?AVLocation@2@H@Z, ?GetModuleRequest@Module@v8@@QBE?AV?$Local@VString@v8@@@2@H@Z, ?GetModuleRequestsLength@Module@v8@@QBEHXZ, ?GetException@Module@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ, ?GetStatus@Module@v8@@QBE?AW4Status@12@XZ, ?Reject@Resolver@Promise@v8@@QAE?AV?$Maybe@_N@3@V?$Local@VContext@v8@@@3@V?$Local@VValue@v8@@@3@@Z, ?Resolve@Resolver@Promise@v8@@QAE?AV?$Maybe@_N@3@V?$Local@VContext@v8@@@3@V?$Local@VValue@v8@@@3@@Z, ?New@Resolver@Promise@v8@@SA?AV?$MaybeLocal@VResolver@Promise@v8@@@3@V?$Local@VContext@v8@@@3@@Z, ?HasHandler@Promise@v8@@QAE_NXZ, ?Then@Promise@v8@@QAE?AV?$MaybeLocal@VPromise@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VFunction@v8@@@2@@Z, ?Catch@Promise@v8@@QAE?AV?$MaybeLocal@VPromise@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VFunction@v8@@@2@@Z, ?Value@Integer@v8@@QBE_JXZ, ?GetEnteredOrMicrotaskContext@Isolate@v8@@QAE?AV?$Local@VContext@v8@@@2@XZ, ?RegisterExtension@v8@@YAXPAVExtension@1@@Z, ??1StreamedSource@ScriptCompiler@v8@@QAE@XZ, ??0StreamedSource@ScriptCompiler@v8@@QAE@PAVExternalSourceStream@12@W4Encoding@012@@Z, ?ResetToBookmark@ExternalSourceStream@ScriptCompiler@v8@@UAEXXZ, ?SetBookmark@ExternalSourceStream@ScriptCompiler@v8@@UAE_NXZ, ?StartStreamingScript@ScriptCompiler@v8@@SAPAVScriptStreamingTask@12@PAVIsolate@2@PAVStreamedSource@12@W4CompileOptions@12@@Z, ?New@RegExp@v8@@SA?AV?$MaybeLocal@VRegExp@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VString@v8@@@2@W4Flags@12@@Z, ?SetLazyDataProperty@Template@v8@@QAEXV?$Local@VName@v8@@@2@P6AX0ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@W4PropertyAttribute@2@@Z, ?SetNativeDataProperty@Template@v8@@QAEXV?$Local@VName@v8@@@2@P6AX0ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX0V?$Local@VValue@v8@@@2@ABV?$PropertyCallbackInfo@X@2@@Z3W4PropertyAttribute@2@V?$Local@VAccessorSignature@v8@@@2@W4AccessControl@2@@Z, ?GetScriptId@StackFrame@v8@@QBEHXZ, ?ReadOnlyPrototype@FunctionTemplate@v8@@QAEXXZ, ?SetAcceptAnyReceiver@FunctionTemplate@v8@@QAEX_N@Z, ?Inherit@FunctionTemplate@v8@@QAEXV?$Local@VFunctionTemplate@v8@@@2@@Z, ?NewRemoteInstance@FunctionTemplate@v8@@QAE?AV?$MaybeLocal@VObject@v8@@@2@XZ, ?NewWithCache@FunctionTemplate@v8@@SA?AV?$Local@VFunctionTemplate@v8@@@2@PAVIsolate@2@P6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VPrivate@v8@@@2@V?$Local@VValue@v8@@@2@V?$Local@VSignature@v8@@@2@H@Z, ?Int32Value@Value@v8@@QBE?AV?$Maybe@H@2@V?$Local@VContext@v8@@@2@@Z, ?NumberValue@Value@v8@@QBE?AV?$Maybe@N@2@V?$Local@VContext@v8@@@2@@Z, ?ToArrayIndex@Value@v8@@QBE?AV?$MaybeLocal@VUint32@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?IsPromise@Value@v8@@QBE_NXZ, ?GetStartColumn@Message@v8@@QBE?AV?$Maybe@H@2@V?$Local@VContext@v8@@@2@@Z, ?GetStackTrace@Message@v8@@QBE?AV?$Local@VStackTrace@v8@@@2@XZ, ?GetScriptOrigin@Message@v8@@QBE?AVScriptOrigin@2@XZ, ?Concat@String@v8@@SA?AV?$Local@VString@v8@@@2@V32@0@Z, ?Parse@JSON@v8@@SA?AV?$MaybeLocal@VValue@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z, ?GetFrameCount@StackTrace@v8@@QBEHXZ, ?GetFrame@StackTrace@v8@@QBE?AV?$Local@VStackFrame@v8@@@2@I@Z, ?IsConstructor@Object@v8@@QAE_NXZ, ?GetRealNamedPropertyInPrototypeChain@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@@Z, ?HasOwnProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@@Z, ?GetOwnPropertyNames@Object@v8@@QAE?AV?$MaybeLocal@VArray@v8@@@2@V?$Local@VContext@v8@@@2@@Z, ?DeletePrivate@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VPrivate@v8@@@2@@Z, ?SetNativeDataProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@P6AX1ABV?$PropertyCallbackInfo@VValue@v8@@@2@@ZP6AX1V?$Local@VValue@v8@@@2@ABV?$PropertyCallbackInfo@X@2@@Z4W4PropertyAttribute@2@@Z, ?SetAccessorProperty@Object@v8@@QAEXV?$Local@VName@v8@@@2@V?$Local@VFunction@v8@@@2@1W4PropertyAttribute@2@W4AccessControl@2@@Z, ?GetPropertyAttributes@Object@v8@@QAE?AV?$Maybe@W4PropertyAttribute@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z, ?GetIterator@Symbol@v8@@SA?AV?$Local@VSymbol@v8@@@2@PAVIsolate@2@@Z, ?ScriptId@Function@v8@@QBEHXZ, ?GetScriptColumnNumber@Function@v8@@QBEHXZ, ?GetScriptLineNumber@Function@v8@@QBEHXZ, ??_7ExternalSourceStream@ScriptCompiler@v8@@6B@, ??_7RetainedObjectInfo@v8@@6B@, ?GetSizeInBytes@RetainedObjectInfo@v8@@UAEHXZ, usearch_setOffset_59, uset_add_59, uset_contains_59, uset_addRange_59, uset_addAll_59, uset_openPattern_59, uset_close_59, usearch_setText_59, usearch_setPattern_59, ??1DisallowJavascriptExecutionScope@Isolate@v8@@QAE@XZ, ??0DisallowJavascriptExecutionScope@Isolate@v8@@QAE@PAV12@W4OnFailure@012@@Z, ?RequestInterrupt@Isolate@v8@@QAEXP6AXPAV12@PAX@Z1@Z, ?GetCpuProfiler@Isolate@v8@@QAEPAVCpuProfiler@2@XZ, ?CreateHandle@HandleScope@v8@@CAPAPAVObject@internal@2@PAVHeapObject@42@PAV342@@Z, ?Create@TracingCpuProfiler@v8@@SA?AV?$unique_ptr@VTracingCpuProfiler@v8@@U?$default_delete@VTracingCpuProfiler@v8@@@std@@@std@@PAVIsolate@2@@Z, ?SlowGetInternalField@Object@v8@@AAE?AV?$Local@VValue@v8@@@2@H@Z, ?GetDebugName@Function@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ, ?CollectSample@CpuProfiler@v8@@QAEXXZ, ??_7Inspectable@V8InspectorSession@v8_inspector@@6B@, ??_7Channel@V8Inspector@v8_inspector@@6B@, ?create@StringBuffer@v8_inspector@@SA?AV?$unique_ptr@VStringBuffer@v8_inspector@@U?$default_delete@VStringBuffer@v8_inspector@@@std@@@std@@ABVStringView@2@@Z, ?create@V8Inspector@v8_inspector@@SA?AV?$unique_ptr@VV8Inspector@v8_inspector@@U?$default_delete@VV8Inspector@v8_inspector@@@std@@@std@@PAVIsolate@v8@@PAVV8InspectorClient@2@@Z, ?canDispatchMethod@V8InspectorSession@v8_inspector@@SA_NABVStringView@2@@Z, ?EventListener@ReasonEnum@Paused@API@Debugger@protocol@v8_inspector@@3PBDB, ?XHR@ReasonEnum@Paused@API@Debugger@protocol@v8_inspector@@3PBDB, ?DOM@ReasonEnum@Paused@API@Debugger@protocol@v8_inspector@@3PBDB, ?executionContextId@V8ContextInfo@v8_inspector@@SAHV?$Local@VContext@v8@@@v8@@@Z, ??_7V8InspectorClient@v8_inspector@@6B@, ?maxAsyncCallStackDepthChanged@V8InspectorClient@v8_inspector@@UAEXH@Z, ?canExecuteScripts@V8InspectorClient@v8_inspector@@UAE_NH@Z, ?consoleClear@V8InspectorClient@v8_inspector@@UAEXH@Z, ?memoryInfo@V8InspectorClient@v8_inspector@@UAE?AV?$MaybeLocal@VValue@v8@@@v8@@PAVIsolate@4@V?$Local@VContext@v8@@@4@@Z, ?consoleAPIMessage@V8InspectorClient@v8_inspector@@UAEXHW4MessageErrorLevel@Isolate@v8@@ABVStringView@2@1IIPAVV8StackTrace@2@@Z, ?endEnsureAllContextsInGroup@V8InspectorClient@v8_inspector@@UAEXH@Z, ?beginEnsureAllContextsInGroup@V8InspectorClient@v8_inspector@@UAEXH@Z, ?ensureDefaultContextInGroup@V8InspectorClient@v8_inspector@@UAE?AV?$Local@VContext@v8@@@v8@@H@Z, ?unmuteMetrics@V8InspectorClient@v8_inspector@@UAEXH@Z, ?muteMetrics@V8InspectorClient@v8_inspector@@UAEXH@Z, ?runIfWaitingForDebugger@V8InspectorClient@v8_inspector@@UAEXH@Z, ?quitMessageLoopOnPause@V8InspectorClient@v8_inspector@@UAEXXZ, ?runMessageLoopOnPause@V8InspectorClient@v8_inspector@@UAEXH@Z, ??0V8ContextInfo@v8_inspector@@QAE@V?$Local@VContext@v8@@@v8@@HABVStringView@1@@Z, ?GetName@Function@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ, u_isprint_59, ?createUTS46Instance@IDNA@icu_59@@SAPAV12@IAAW4UErrorCode@@@Z, ??0UnicodeString@icu_59@@QAE@PB_WH@Z, ?New@Uint8Array@v8@@SA?AV?$Local@VUint8Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z, ?New@Uint8ClampedArray@v8@@SA?AV?$Local@VUint8ClampedArray@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z, ?New@Uint8ClampedArray@v8@@SA?AV?$Local@VUint8ClampedArray@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z, ?New@DataView@v8@@SA?AV?$Local@VDataView@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z, ?New@Int8Array@v8@@SA?AV?$Local@VInt8Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z, ?New@Int8Array@v8@@SA?AV?$Local@VInt8Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z, ?New@Float32Array@v8@@SA?AV?$Local@VFloat32Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z, ?New@Float32Array@v8@@SA?AV?$Local@VFloat32Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z, ?Neuter@ArrayBuffer@v8@@QAEXXZ, ?IsNeuterable@ArrayBuffer@v8@@QBE_NXZ, ?New@Float64Array@v8@@SA?AV?$Local@VFloat64Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z, ?New@Float64Array@v8@@SA?AV?$Local@VFloat64Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z, ?New@Uint16Array@v8@@SA?AV?$Local@VUint16Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z, ?New@Uint16Array@v8@@SA?AV?$Local@VUint16Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z, ?New@SharedArrayBuffer@v8@@SA?AV?$Local@VSharedArrayBuffer@v8@@@2@PAVIsolate@2@PAXIW4ArrayBufferCreationMode@2@@Z, ?New@Int32Array@v8@@SA?AV?$Local@VInt32Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z, ?New@Int32Array@v8@@SA?AV?$Local@VInt32Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z, ?New@Int16Array@v8@@SA?AV?$Local@VInt16Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z, ?New@Int16Array@v8@@SA?AV?$Local@VInt16Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z, ?New@Uint32Array@v8@@SA?AV?$Local@VUint32Array@v8@@@2@V?$Local@VArrayBuffer@v8@@@2@II@Z, ?New@Uint32Array@v8@@SA?AV?$Local@VUint32Array@v8@@@2@V?$Local@VSharedArrayBuffer@v8@@@2@II@Z, ?fromJSONString@StackTrace@API@Runtime@protocol@v8_inspector@@SA?AV?$unique_ptr@VStackTrace@API@Runtime@protocol@v8_inspector@@U?$default_delete@VStackTrace@API@Runtime@protocol@v8_inspector@@@std@@@std@@ABVStringView@5@@Z, ?HasOwnProperty@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@I@Z, ?New@Function@v8@@SA?AV?$Local@VFunction@v8@@@2@PAVIsolate@2@P6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@H@Z, ??0WasmModuleObjectBuilder@v8@@QAE@PAVIsolate@1@@Z, ?OnBytesReceived@WasmModuleObjectBuilder@v8@@QAEXPBEI@Z, ?Finish@WasmModuleObjectBuilder@v8@@QAE?AV?$MaybeLocal@VWasmCompiledModule@v8@@@2@XZ, ??1WasmModuleObjectBuilder@v8@@QAE@XZ, ?SetWasmCompileStreamingCallback@Isolate@v8@@QAEXP6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@Z@Z, ?Set@Map@v8@@QAE?AV?$MaybeLocal@VMap@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@1@Z, ?New@Map@v8@@SA?AV?$Local@VMap@v8@@@2@PAVIsolate@2@@Z, ?DateTimeConfigurationChangeNotification@Date@v8@@SAXPAVIsolate@2@@Z, ?createTimeZone@TimeZone@icu_59@@SAPAV12@ABVUnicodeString@2@@Z, ?Stringify@JSON@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VObject@v8@@@2@V?$Local@VString@v8@@@2@@Z, ?IsFunction@Value@v8@@QBE_NXZ, ?IsArray@Value@v8@@QBE_NXZ, ?IsObject@Value@v8@@QBE_NXZ, ?IsBoolean@Value@v8@@QBE_NXZ, ?IsNumber@Value@v8@@QBE_NXZ, ?IsExternal@Value@v8@@QBE_NXZ, ?IsInt32@Value@v8@@QBE_NXZ, ?IsUint32@Value@v8@@QBE_NXZ, ?BooleanValue@Value@v8@@QBE_NXZ, ?NumberValue@Value@v8@@QBENXZ, ?IntegerValue@Value@v8@@QBE_JXZ, ?Uint32Value@Value@v8@@QBEIXZ, ?Int32Value@Value@v8@@QBEHXZ, ?New@Integer@v8@@SA?AV?$Local@VInteger@v8@@@2@PAVIsolate@2@H@Z, ?NewFromUnsigned@Integer@v8@@SA?AV?$Local@VInteger@v8@@@2@PAVIsolate@2@I@Z, uv_timer_start, uv_timer_stop, uv_timer_init, uv_unref, uv_async_init, uv_async_send, uv_close, ?Call@Function@v8@@QAE?AV?$Local@VValue@v8@@@2@V32@HQAV32@@Z, ?Get@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z, ?Has@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z, ?GetCurrent@Isolate@v8@@SAPAV12@XZ, ?RunMicrotasks@Isolate@v8@@QAEXXZ, ?SetFatalErrorHandler@Isolate@v8@@QAEXP6AXPBD0@Z@Z, ??0Scope@Isolate@v8@@QAE@PAV12@@Z, ?CreatePlatform@node@@YAPAVNodePlatform@1@HPAUuv_loop_s@@PAVTracingController@v8@@@Z, ?SetFlagsFromString@V8@v8@@SAXPBDH@Z, ?InitializePlatform@V8@v8@@SAXPAVPlatform@2@@Z, ?GlobalizeReference@V8@v8@@CAPAPAVObject@internal@2@PAVIsolate@42@PAPAV342@@Z, ?Initialize@Locker@v8@@AAEXPAVIsolate@2@@Z, ??0HandleScope@v8@@QAE@PAVIsolate@1@@Z, ?New@Context@v8@@SA?AV?$Local@VContext@v8@@@2@PAVIsolate@2@PAVExtensionConfiguration@2@V?$MaybeLocal@VObjectTemplate@v8@@@2@V?$MaybeLocal@VValue@v8@@@2@@Z, ?Enter@Context@v8@@QAEXXZ, ??1DebugOptions@node@@QAE@XZ, ??0DebugOptions@node@@QAE@XZ, ?ParseOption@DebugOptions@node@@QAE_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z, ?Start@Agent@inspector@node@@QAE_NPAVNodePlatform@3@PBDABVDebugOptions@3@@Z, ??1Scope@Isolate@v8@@QAE@XZ, uv_default_loop, uv_setup_args, uv_loop_alive, ?FreeEnvironment@node@@YAXPAVEnvironment@1@@Z, ?EmitExit@node@@YAHPAVEnvironment@1@@Z, ?Init@node@@YAXPAHPAPBD0PAPAPBD@Z, ?LoadEnvironment@node@@YAXPAVEnvironment@1@@Z, ?CreateEnvironment@node@@YAPAVEnvironment@1@PAVIsolateData@1@V?$Local@VContext@v8@@@v8@@HPBQBDH2@Z, ?EmitBeforeExit@node@@YAXPAVEnvironment@1@@Z, ?RunAtExit@node@@YAXPAVEnvironment@1@@Z, uv_run, ?Set@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@1@Z, ?Set@Object@v8@@QAE_NV?$Local@VValue@v8@@@2@0@Z, ?InternalFieldCount@Object@v8@@QAEHXZ, ?SlowGetAlignedPointerFromInternalField@Object@v8@@AAEPAXH@Z, ?NewFromOneByte@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PAVIsolate@2@PBEW4NewStringType@2@H@Z, ??0Value@String@v8@@QAE@V?$Local@VValue@v8@@@2@@Z, ??1Value@String@v8@@QAE@XZ, ?Dispose@V8@v8@@SA_NXZ, ?DisposeGlobal@V8@v8@@CAXPAPAVObject@internal@2@@Z, ?Eternalize@V8@v8@@CAPAVValue@2@PAVIsolate@2@PAV32@@Z, ?FromJustIsNothing@V8@v8@@CAXXZ, ?New@FunctionTemplate@v8@@SA?AV?$Local@VFunctionTemplate@v8@@@2@PAVIsolate@2@P6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@V?$Local@VSignature@v8@@@2@HW4ConstructorBehavior@2@@Z, ?ToLocalEmpty@V8@v8@@CAXXZ, ??0MicrotasksScope@v8@@QAE@PAVIsolate@1@W4Type@01@@Z, ??1MicrotasksScope@v8@@QAE@XZ, ?GetFunction@FunctionTemplate@v8@@QAE?AV?$Local@VFunction@v8@@@2@XZ, ??1Locker@v8@@QAE@XZ, ??1HandleScope@v8@@QAE@XZ, ?CreateHandle@HandleScope@v8@@KAPAPAVObject@internal@2@PAVIsolate@42@PAV342@@Z, ?GetCurrentContext@Isolate@v8@@QAE?AV?$Local@VContext@v8@@@2@XZ, ?New@Private@v8@@SA?AV?$Local@VPrivate@v8@@@2@PAVIsolate@2@V?$Local@VString@v8@@@2@@Z, ?Value@External@v8@@QBEPAXXZ, ?hashCode@UnicodeSet@icu_59@@UBEHXZ, ?containsNone@UnicodeSet@icu_59@@QBECABVUnicodeString@2@@Z, ?createInstance@Collator@icu_59@@SAPAV12@AAW4UErrorCode@@@Z, ?createInstance@NumberFormat@icu_59@@SAPAV12@AAW4UErrorCode@@@Z, ?format@NumberFormat@icu_59@@QBEAAVUnicodeString@2@NAAV32@@Z, ?format@NumberFormat@icu_59@@QBEAAVUnicodeString@2@_JAAV32@@Z, ??0UnicodeString@icu_59@@QAE@PBD@Z, ?createDateTimeInstance@DateFormat@icu_59@@SAPAV12@W4EStyle@12@0ABVLocale@2@@Z, ?format@DateFormat@icu_59@@QBEAAVUnicodeString@2@NAAV32@@Z, ucnv_cbToUWriteUChars_59, UCNV_TO_U_CALLBACK_SKIP_59, ucnv_toUChars_59, ucnv_getMaxCharSize_59, ubidi_openSized_59, ?getID@TimeZone@icu_59@@QBEAAVUnicodeString@2@AAV32@@Z, uidna_labelToUnicode_59, ??0UnicodeSet@icu_59@@QAE@XZ, ??4UnicodeSet@icu_59@@QAEAAV01@ABV01@@Z, ?containsAll@UnicodeSet@icu_59@@QBECABVUnicodeString@2@@Z, ?span@UnicodeSet@icu_59@@QBEHABVUnicodeString@2@HW4USetSpanCondition@@@Z, ?add@UnicodeSet@icu_59@@QAEAAV12@H@Z, ?remove@UnicodeSet@icu_59@@QAEAAV12@H@Z, ?setToStart@CharacterIterator@icu_59@@QAEHXZ, ?next32PostInc@UCharCharacterIterator@icu_59@@UAEHXZ, ?hasNext@UCharCharacterIterator@icu_59@@UAECXZ, ??0RegexMatcher@icu_59@@QAE@ABVUnicodeString@1@IAAW4UErrorCode@@@Z, ??1RegexMatcher@icu_59@@UAE@XZ, ?createFromRules@Transliterator@icu_59@@SAPAV12@ABVUnicodeString@2@0W4UTransDirection@@AAUUParseError@@AAW4UErrorCode@@@Z, uspoof_open_59, uspoof_setChecks_59, uspoof_getChecks_59, uspoof_setRestrictionLevel_59, uspoof_setAllowedUnicodeSet_59, uspoof_check_59, ?uspoof_getSkeletonUnicodeString_59@@YAAAVUnicodeString@icu_59@@PBUUSpoofChecker@@IABV12@AAV12@PAW4UErrorCode@@@Z, uspoof_getInclusionUnicodeSet_59, uspoof_getRecommendedUnicodeSet_59, ?appendReplacement@RegexMatcher@icu_59@@UAEAAV12@AAVUnicodeString@2@ABV32@AAW4UErrorCode@@@Z, ?appendReplacement@RegexMatcher@icu_59@@UAEAAV12@PAUUText@@0AAW4UErrorCode@@@Z, ?appendTail@RegexMatcher@icu_59@@UAEAAVUnicodeString@2@AAV32@@Z, ?appendTail@RegexMatcher@icu_59@@UAEPAUUText@@PAU3@AAW4UErrorCode@@@Z, ?end64@RegexMatcher@icu_59@@UBE_JAAW4UErrorCode@@@Z, ?end64@RegexMatcher@icu_59@@UBE_JHAAW4UErrorCode@@@Z, ?end@RegexMatcher@icu_59@@UBEHAAW4UErrorCode@@@Z, ?end@RegexMatcher@icu_59@@UBEHHAAW4UErrorCode@@@Z, ?find@RegexMatcher@icu_59@@UAECAAW4UErrorCode@@@Z, ?find@RegexMatcher@icu_59@@UAECXZ, ?find@RegexMatcher@icu_59@@UAEC_JAAW4UErrorCode@@@Z, ?getDynamicClassID@RegexMatcher@icu_59@@UBEPAXXZ, ?getFindProgressCallback@RegexMatcher@icu_59@@UAEXAAP6ACPBX_J@ZAAPBXAAW4UErrorCode@@@Z, ?getInput@RegexMatcher@icu_59@@UBEPAUUText@@PAU3@AAW4UErrorCode@@@Z, ?getMatchCallback@RegexMatcher@icu_59@@UAEXAAP6ACPBXH@ZAAPBXAAW4UErrorCode@@@Z, ?getStackLimit@RegexMatcher@icu_59@@UBEHXZ, ?getTimeLimit@RegexMatcher@icu_59@@UBEHXZ, ?group@RegexMatcher@icu_59@@UBE?AVUnicodeString@2@AAW4UErrorCode@@@Z, ?group@RegexMatcher@icu_59@@UBE?AVUnicodeString@2@HAAW4UErrorCode@@@Z, ?group@RegexMatcher@icu_59@@UBEPAUUText@@HPAU3@AA_JAAW4UErrorCode@@@Z, ?group@RegexMatcher@icu_59@@UBEPAUUText@@PAU3@AA_JAAW4UErrorCode@@@Z, ?groupCount@RegexMatcher@icu_59@@UBEHXZ, ?hasAnchoringBounds@RegexMatcher@icu_59@@UBECXZ, ?hasTransparentBounds@RegexMatcher@icu_59@@UBECXZ, ?hitEnd@RegexMatcher@icu_59@@UBECXZ, ?input@RegexMatcher@icu_59@@UBEABVUnicodeString@2@XZ, ?inputText@RegexMatcher@icu_59@@UBEPAUUText@@XZ, ?lookingAt@RegexMatcher@icu_59@@UAECAAW4UErrorCode@@@Z, ?lookingAt@RegexMatcher@icu_59@@UAEC_JAAW4UErrorCode@@@Z, ?matches@RegexMatcher@icu_59@@UAECAAW4UErrorCode@@@Z, ?matches@RegexMatcher@icu_59@@UAEC_JAAW4UErrorCode@@@Z, ?pattern@RegexMatcher@icu_59@@UBEABVRegexPattern@2@XZ, ?refreshInputText@RegexMatcher@icu_59@@UAEAAV12@PAUUText@@AAW4UErrorCode@@@Z, ?region@RegexMatcher@icu_59@@UAEAAV12@_J00AAW4UErrorCode@@@Z, ?region@RegexMatcher@icu_59@@UAEAAV12@_J0AAW4UErrorCode@@@Z, ?regionEnd64@RegexMatcher@icu_59@@UBE_JXZ, ?regionEnd@RegexMatcher@icu_59@@UBEHXZ, ?regionStart64@RegexMatcher@icu_59@@UBE_JXZ, ?regionStart@RegexMatcher@icu_59@@UBEHXZ, ?replaceAll@RegexMatcher@icu_59@@UAE?AVUnicodeString@2@ABV32@AAW4UErrorCode@@@Z, ?replaceAll@RegexMatcher@icu_59@@UAEPAUUText@@PAU3@0AAW4UErrorCode@@@Z, ?replaceFirst@RegexMatcher@icu_59@@UAE?AVUnicodeString@2@ABV32@AAW4UErrorCode@@@Z, ?replaceFirst@RegexMatcher@icu_59@@UAEPAUUText@@PAU3@0AAW4UErrorCode@@@Z, ?requireEnd@RegexMatcher@icu_59@@UBECXZ, ?reset@RegexMatcher@icu_59@@UAEAAV12@ABVUnicodeString@2@@Z, ?reset@RegexMatcher@icu_59@@UAEAAV12@PAUUText@@@Z, ?reset@RegexMatcher@icu_59@@UAEAAV12@XZ, ?reset@RegexMatcher@icu_59@@UAEAAV12@_JAAW4UErrorCode@@@Z, ?setFindProgressCallback@RegexMatcher@icu_59@@UAEXP6ACPBX_J@Z0AAW4UErrorCode@@@Z, ?setMatchCallback@RegexMatcher@icu_59@@UAEXP6ACPBXH@Z0AAW4UErrorCode@@@Z, ?setStackLimit@RegexMatcher@icu_59@@UAEXHAAW4UErrorCode@@@Z, ?setTimeLimit@RegexMatcher@icu_59@@UAEXHAAW4UErrorCode@@@Z, ?split@RegexMatcher@icu_59@@UAEHABVUnicodeString@2@QAV32@HAAW4UErrorCode@@@Z, ?split@RegexMatcher@icu_59@@UAEHPAUUText@@QAPAU3@HAAW4UErrorCode@@@Z, ?start64@RegexMatcher@icu_59@@UBE_JAAW4UErrorCode@@@Z, ?start64@RegexMatcher@icu_59@@UBE_JHAAW4UErrorCode@@@Z, ?start@RegexMatcher@icu_59@@UBEHAAW4UErrorCode@@@Z, ?start@RegexMatcher@icu_59@@UBEHHAAW4UErrorCode@@@Z, ?useAnchoringBounds@RegexMatcher@icu_59@@UAEAAV12@C@Z, ?useTransparentBounds@RegexMatcher@icu_59@@UAEAAV12@C@Z, ucnv_convertEx_59, u_isalnum_59, ?StrictEquals@Value@v8@@QBE_NV?$Local@VValue@v8@@@2@@Z, ?Delete@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@I@Z, ?SetIntegrityLevel@Object@v8@@QAE?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@W4IntegrityLevel@2@@Z, ?SetInternalField@Object@v8@@QAEXHV?$Local@VValue@v8@@@2@@Z, ?GetBoundFunction@Function@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ, ucol_getFunctionalEquivalent_59, ucol_setAttribute_59, ucol_getAttribute_59, ?IsFloat32Array@Value@v8@@QBE_NXZ, ?IsUint16Array@Value@v8@@QBE_NXZ, ?IsUint8ClampedArray@Value@v8@@QBE_NXZ, ?IsName@Value@v8@@QBE_NXZ, ?GetOwnPropertyNames@Object@v8@@QAE?AV?$MaybeLocal@VArray@v8@@@2@V?$Local@VContext@v8@@@2@W4PropertyFilter@2@@Z, ?GetOwnPropertyDescriptor@Object@v8@@QAE?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VName@v8@@@2@@Z, ?Length@TypedArray@v8@@QAEIXZ, ?SetIntrinsicDataProperty@Template@v8@@QAEXV?$Local@VName@v8@@@2@W4Intrinsic@2@W4PropertyAttribute@2@@Z, ?SetLength@FunctionTemplate@v8@@QAEXH@Z, ?IsDataView@Value@v8@@QBE_NXZ, ?IsFloat64Array@Value@v8@@QBE_NXZ, ?IsInt32Array@Value@v8@@QBE_NXZ, ?IsUint32Array@Value@v8@@QBE_NXZ, ?IsInt16Array@Value@v8@@QBE_NXZ, ?IsInt8Array@Value@v8@@QBE_NXZ, ?Externalize@SharedArrayBuffer@v8@@QAE?AVContents@12@XZ, ?IsExternal@SharedArrayBuffer@v8@@QBE_NXZ, ?writable@PropertyDescriptor@v8@@QBE_NXZ, ?configurable@PropertyDescriptor@v8@@QBE_NXZ, ?set_configurable@PropertyDescriptor@v8@@QAEX_N@Z, ?enumerable@PropertyDescriptor@v8@@QBE_NXZ, ?set_enumerable@PropertyDescriptor@v8@@QAEX_N@Z, ?has_set@PropertyDescriptor@v8@@QBE_NXZ, ?has_get@PropertyDescriptor@v8@@QBE_NXZ, ?value@PropertyDescriptor@v8@@QBE?AV?$Local@VValue@v8@@@2@XZ, ??1PropertyDescriptor@v8@@QAE@XZ, ??0PropertyDescriptor@v8@@QAE@V?$Local@VValue@v8@@@1@_N@Z, ?IsCallable@Object@v8@@QAE_NXZ, ?GetUnscopables@Symbol@v8@@SA?AV?$Local@VSymbol@v8@@@2@PAVIsolate@2@@Z, ?GetToPrimitive@Symbol@v8@@SA?AV?$Local@VSymbol@v8@@@2@PAVIsolate@2@@Z, ?SetImmutableProto@ObjectTemplate@v8@@QAEXXZ, ?SetAccessCheckCallbackAndHandler@ObjectTemplate@v8@@QAEXP6A_NV?$Local@VContext@v8@@@2@V?$Local@VObject@v8@@@2@V?$Local@VValue@v8@@@2@@ZABUNamedPropertyHandlerConfiguration@2@ABUIndexedPropertyHandlerConfiguration@2@2@Z, ?MarkAsUndetectable@ObjectTemplate@v8@@QAEXXZ, ?SetCallAsFunctionHandler@ObjectTemplate@v8@@QAEXP6AXABV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@@Z, ?SetHandler@ObjectTemplate@v8@@QAEXABUNamedPropertyHandlerConfiguration@2@@Z, ?SetHandler@ObjectTemplate@v8@@QAEXABUIndexedPropertyHandlerConfiguration@2@@Z, ?Exit@Context@v8@@QAEXXZ
COMCTL32.dll	InitCommonControlsEx
COMDLG32.dll	ChooseColorW, PrintDlgExW, GetOpenFileNameW, GetSaveFileNameW
WININET.dll	HttpAddRequestHeadersW, InternetReadFile, HttpOpenRequestW, InternetConnectW, InternetCloseHandle, HttpSendRequestW, InternetCrackUrlW, HttpQueryInfoW, InternetOpenW, InternetQueryDataAvailable
UIAutomationCore.DLL	UiaClientsAreListening
ffmpeg.dll	avformat_find_stream_info, av_read_frame, av_seek_frame, av_buffer_create, av_buffer_get_opaque, av_packet_unref, av_init_packet, avcodec_decode_video2, avcodec_flush_buffers, av_image_check_size, av_dict_get, avcodec_find_decoder, avcodec_free_context, av_new_packet, av_packet_get_side_data, av_packet_split_side_data, av_packet_copy_props, avcodec_descriptor_get, av_samples_get_buffer_size, av_strerror, av_rescale_q, avcodec_parameters_to_context, avcodec_align_dimensions, avcodec_open2, avcodec_decode_audio4, av_get_cpu_flags, av_log_set_level, av_frame_unref, av_frame_free, av_frame_alloc, av_get_bytes_per_sample, avformat_close_input, avformat_open_input, avformat_free_context, avformat_alloc_context, av_rdft_init, av_register_all, avio_alloc_context, av_lockmgr_register, av_dict_free, av_dict_set, av_free, av_malloc, av_rdft_calc, av_rdft_end, avcodec_alloc_context3
dxgi.dll	CreateDXGIFactory1
ADVAPI32.dll	StartTraceW, CryptSignHashW, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetSecurityDescriptorSacl, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, CreateProcessAsUserW, RegEnumValueW, RegDeleteValueW, RegSetValueExW, RegEnumKeyExW, RegCreateKeyExW, RegDeleteKeyW, RegQueryInfoKeyW, RegNotifyChangeKeyValue, InitializeAcl, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, GetTokenInformation, ConvertSidToStringSidW, OpenProcessToken, SystemFunction036, ImpersonateAnonymousToken, RevertToSelf, OpenTraceW, ControlTraceW, ProcessTrace, CloseTrace, GetAce, GetKernelObjectSecurity, GetLengthSid, SetKernelObjectSecurity, SetTokenInformation, SetSecurityInfo, ConvertStringSidToSidW, RegDisablePredefinedCache, CopySid, CreateWellKnownSid, CreateRestrictedToken, DuplicateToken, DuplicateTokenEx, EqualSid, LookupPrivilegeValueW, SetThreadToken, SetEntriesInAclW, GetSecurityInfo, CryptReleaseContext, CryptSetHashParam, CryptGetHashParam, CryptCreateHash, CryptDestroyHash
IPHLPAPI.DLL	NotifyAddrChange, GetAdaptersAddresses, CancelIPChangeNotify
PSAPI.DLL	GetPerformanceInfo, GetProcessMemoryInfo, QueryWorkingSet, EnumProcessModules, QueryWorkingSetEx, GetModuleInformation
SHELL32.dll	CommandLineToArgvW, GetCurrentProcessExplicitAppUserModelID, SHGetFolderPathW, SetCurrentProcessExplicitAppUserModelID, ShellExecuteW, SHCreateItemFromParsingName, SHGetDesktopFolder, SHAddToRecentDocs, SHGetFileInfoW, Shell_NotifyIconW, Shell_NotifyIconGetRect, ShellExecuteExW, SHChangeNotify, SHGetKnownFolderPath, SHGetPropertyStoreForWindow, DragQueryFileW, SHGetSpecialFolderPathW, SHGetPathFromIDListW, SHBrowseForFolderW, SHFileOperationW
USER32.dll	GetMessageW, DefWindowProcW, PostMessageW, CreateWindowExW, RegisterClassExW, DispatchMessageW, TranslateMessage, PostQuitMessage, UpdateWindow, UnregisterClassW, GetWindowThreadProcessId, EnumThreadWindows, ChangeWindowMessageFilterEx, IsWindowVisible, EnableWindow, EnableMenuItem, SetWindowLongW, FlashWindowEx, SetRectEmpty, TrackMouseEvent, IsWindowEnabled, SetWindowDisplayAffinity, SetClassLongW, SendMessageW, CopyIcon, AdjustWindowRectEx, GetSystemMenu, GetMenuItemInfoW, GetWindowLongW, RegisterHotKey, FillRect, DeferWindowPos, GetActiveWindow, SetPropW, GetForegroundWindow, RemovePropW, FindWindowExW, GetQueueStatus, MsgWaitForMultipleObjectsEx, LoadImageW, GetCursorPos, GetSystemMetrics, CloseClipboard, GetClipboardSequenceNumber, SetClipboardData, GetClipboardData, RegisterClipboardFormatW, EmptyClipboard, IsClipboardFormatAvailable, DrawIconEx, UnregisterHotKey, IsWindow, SendMessageTimeoutW, AllowSetForegroundWindow, PtInRect, CreateIconIndirect, GetIconInfo, MapVirtualKeyW, EnumDisplayDevicesW, WindowFromPoint, MonitorFromRect, GetMonitorInfoW, EnumDisplayMonitors, GetAncestor, SetWindowPos, TrackPopupMenu, MapWindowPoints, IsRectEmpty, GetDesktopWindow, GetClassNameW, GetCapture, ShowCursor, SetCursorPos, ClientToScreen, GetClientRect, SetWindowsHookExW, UnhookWindowsHookEx, CallNextHookEx, ScreenToClient, PeekMessageW, DestroyIcon, GetWindowRect, RegisterWindowMessageW, DestroyWindow, GetKeyState, SetForegroundWindow, SystemParametersInfoW, MonitorFromWindow, MessageBeep, SetFocus, OpenClipboard, EnumWindows, LoadIconW, ReleaseDC, KillTimer, EndDeferWindowPos, SetTimer, BeginDeferWindowPos, DrawEdge, GetDC, MonitorFromPoint, DrawTextW, UpdateLayeredWindow, LoadCursorW, UpdateLayeredWindowIndirect, GetSysColor, DrawFrameControl, SetThreadDesktop, MessageBoxA, BringWindowToTop, EnumDisplaySettingsExW, GetLayeredWindowAttributes, UnregisterPowerSettingNotification, RegisterPowerSettingNotification, PostThreadMessageW, UnregisterDeviceNotification, RegisterDeviceNotificationW, DefRawInputProc, GetRawInputDeviceList, RegisterRawInputDevices, GetRawInputDeviceInfoW, GetRawInputData, MoveWindow, RegisterClassW, GetProcessWindowStation, SetProcessWindowStation, CreateWindowStationW, GetThreadDesktop, CreateDesktopW, SetCaretPos, DestroyCaret, CreateCaret, GetKeyboardLayoutList, GetKeyboardLayoutNameW, FindWindowW, CallWindowProcW, CloseWindowStation, IsChild, GetUserObjectInformationW, CloseDesktop, OpenInputDesktop, GetCursorInfo, SetParent, GetAsyncKeyState, GetDoubleClickTime, ClipCursor, GetGuiResources, GetWindow, EnumChildWindows, GetParent, OffsetRect, IntersectRect, SetCursor, GetWindowTextLengthW, GetWindowTextW, SetWindowTextW, RedrawWindow, GetWindowRgn, SetWindowRgn, EndPaint, BeginPaint, GetWindowDC, SetMenuDefaultItem, ReleaseCapture, SetCapture, RegisterTouchWindow, CloseTouchInputHandle, GetFocus, IsZoomed, IsIconic, SetWindowPlacement, GetWindowPlacement, ShowWindow, GetMessageTime, GetMessagePos, GetClassInfoExW, GetPropW, NotifyWinEvent, CharNextW, SetKeyboardState, GetKeyboardState, GetKeyboardLayout, ToUnicodeEx, GetMessageExtraInfo, EnumDisplaySettingsW, PrintWindow, MessageBoxW, InvalidateRect, InflateRect, InvertRect, FrameRect, DrawFocusRect, GetSysColorBrush, SetLayeredWindowAttributes
USERENV.dll	CreateEnvironmentBlock, DestroyEnvironmentBlock
WS2_32.dll	WSAGetLastError, WSALookupServiceNextW, WSALookupServiceEnd, bind, setsockopt, shutdown, WSACloseEvent, WSACreateEvent, WSAEnumNetworkEvents, WSAEventSelect, WSAGetOverlappedResult, WSAIoctl, WSAResetEvent, WSASend, getpeername, ntohl, recvfrom, sendto, WSARecvFrom, WSASendTo, WSASocketW, getaddrinfo, freeaddrinfo, htons, ntohs, send, WSASetEvent, WSAWaitForMultipleEvents, WSALookupServiceBeginW, htonl, ioctlsocket, recv, listen, accept, WSAStartup, gethostname, getsockopt, WSASetServiceW, closesocket, connect, getsockname, socket
dbghelp.dll	SymFromAddr, SymGetModuleBase64, SymSetSearchPathW, SymSetOptions, SymGetLineFromAddr64, SymGetSearchPathW, SymInitialize, SymFunctionTableAccess64, StackWalk64
dwmapi.dll	DwmIsCompositionEnabled, DwmSetWindowAttribute, DwmGetCompositionTimingInfo, DwmDefWindowProc, DwmExtendFrameIntoClientArea
GDI32.dll	CreateRectRgnIndirect, SwapBuffers, EnumFontFamiliesExW, GetFontData, CreateFontIndirectA, GetCharWidthW, GetOutlineTextMetricsW, CreateFontA, CreatePen, EnumFontFamiliesExA, GetClipBox, GetObjectType, LineTo, SetPolyFillMode, BeginPath, CloseFigure, EndPath, FillPath, SelectClipPath, SetRectRgn, StrokeAndFillPath, StrokePath, ChoosePixelFormat, ExtCreatePen, MoveToEx, PolyBezierTo, GetTextFaceA, GetClipRgn, GetRegionData, SetTextAlign, GdiComment, GetCurrentObject, SetDCPenColor, SetROP2, SetDCBrushColor, SetArcDirection, SetBrushOrgEx, RemoveFontMemResourceEx, GetGlyphOutlineW, GetCharABCWidthsW, GetGlyphIndicesW, GetTextExtentPointI, GetFontUnicodeRanges, AddFontMemResourceEx, WidenPath, SetPixelFormat, CombineRgn, GetRgnBox, GetICMProfileW, IntersectClipRect, GetTextFaceW, SetMapMode, CreateFontW, SetBkColor, SelectClipRgn, CreateRectRgn, SetAbortProc, EndDoc, StartDocW, CreateDCW, CancelDC, EndPage, StartPage, SaveDC, RestoreDC, SetDIBits, CreateBitmap, GdiAlphaBlend, SetDIBitsToDevice, SetWorldTransform, GetWorldTransform, SetEnhMetaFileBits, PlayEnhMetaFileRecord, PlayEnhMetaFile, GetEnhMetaFileHeader, GetEnhMetaFileBits, EnumEnhMetaFile, StretchDIBits, ModifyWorldTransform, SetGraphicsMode, CreateDIBSection, StretchBlt, CreateDIBitmap, GdiFlush, GetDIBits, GetTextMetricsW, GetTextExtentPoint32W, SetTextColor, SetBkMode, SetStretchBltMode, BitBlt, CreateCompatibleBitmap, CreateCompatibleDC, GetDeviceCaps, DeleteDC, GetObjectW, SelectObject, CloseEnhMetaFile, CreateEnhMetaFileW, DeleteEnhMetaFile, DeleteObject, GetStockObject, EqualRgn, ExtEscape, CreateFontIndirectW, ExtTextOutW, SetMiterLimit, CreateSolidBrush
USP10.dll	ScriptStringAnalyse, ScriptStringFree, ScriptStringOut, ScriptItemize, ScriptFreeCache, ScriptShape
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINSPOOL.DRV	GetPrinterW, DocumentPropertiesW, DeviceCapabilitiesW, ClosePrinter, OpenPrinterW, EnumPrintersW, GetPrinterDriverW
ncrypt.dll	NCryptFreeObject, NCryptSignHash
DWrite.dll	DWriteCreateFactory
MSVCP140.dll	?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z, ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@, ??_7ios_base@std@@6B@, ?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z, ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z, ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z, ?sync_with_stdio@ios_base@std@@SA_N_N@Z, ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z, ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z, ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ, ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z, ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z, ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z, ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z, ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ, ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z, ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z, ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ, ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ, ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z, ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z, ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z, ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z, ??Bid@locale@std@@QAEIXZ, ?always_noconv@codecvt_base@std@@QBE_NXZ, ?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z, ?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z, ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z, ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z, ?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z, ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ, ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z, ?_Xbad_function_call@std@@YAXXZ, ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ, ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ, ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z, ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z, ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ, ?_Gninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ, ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ, ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z, ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ, ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ, ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ, ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A, ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z, ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ, ??0_Lockit@std@@QAE@H@Z, ??1_Lockit@std@@QAE@XZ, ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ, ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ, ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ, ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z, ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z, ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z, ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z, ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ, ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ, ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ, ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z, ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ, _Dtest, ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z, ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ, ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ, ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z, ?_BADOFF@std@@3_JB, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z, ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z, ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z, ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ, ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z, ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z, _FDtest, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z, ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z, ?classic@locale@std@@SAABV12@XZ, _Query_perf_counter, _Query_perf_frequency, ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z, ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z, ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ, ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ, ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z, ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z, ?uncaught_exception@std@@YA_NXZ, ?_Xlength_error@std@@YAXPBD@Z, ?_Xout_of_range@std@@YAXPBD@Z, ?_Xbad_alloc@std@@YAXXZ, ?__ExceptionPtrDestroy@@YAXPAX@Z, ?__ExceptionPtrCopy@@YAXPAXPBX@Z, ?__ExceptionPtrToBool@@YA_NPBX@Z, ?__ExceptionPtrRethrow@@YAXPBX@Z, ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z, ?_XGetLastError@std@@YAXXZ, ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z, _Mtx_init_in_situ, _Mtx_destroy_in_situ, _Mtx_lock, _Mtx_unlock, ?_Throw_C_error@std@@YAXH@Z, ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z, ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z, ?__ExceptionPtrCreate@@YAXPAX@Z
KERNEL32.dll	CreateNamedPipeW, RegisterWaitForSingleObject, WriteFile, EnterCriticalSection, ReadFile, GetProcessTimes, GetSystemTimeAsFileTime, ReadProcessMemory, UnregisterWaitEx, UnregisterWait, GetTickCount, GetModuleHandleExW, GetModuleFileNameW, lstrlenW, ReleaseMutex, CreateFileW, CreateMutexW, GetCurrentProcessId, FormatMessageW, GetSystemDirectoryW, GetVolumeInformationW, LoadLibraryW, OpenProcess, SetLastError, PostQueuedCompletionStatus, GetQueuedCompletionStatus, GetErrorMode, SetErrorMode, FreeLibrary, CreateSemaphoreW, OpenThread, VirtualQueryEx, SetUnhandledExceptionFilter, SetNamedPipeHandleState, WaitForMultipleObjects, GetProcAddress, TransactNamedPipe, GetCurrentProcess, GetModuleHandleW, DeleteFileW, SetEvent, Sleep, QueueUserWorkItem, CloseHandle, CreateEventW, WaitForSingleObject, ReleaseSRWLockExclusive, DeleteCriticalSection, LocalFree, DecodePointer, RaiseException, FlushInstructionCache, EncodePointer, LoadLibraryExA, VirtualProtect, InterlockedPushEntrySList, InterlockedPopEntrySList, InitializeSListHead, GetTimeFormatW, GetDateFormatW, QueueUserAPC, SleepEx, LocaleNameToLCID, GetTimeZoneInformation, GetSystemPowerStatus, PowerClearRequest, PowerSetRequest, PowerCreateRequest, IsWow64Process, FindNextFileA, FindFirstFileExA, GetSystemDirectoryA, LeaveCriticalSection, GetACP, GetWindowsDirectoryA, GetComputerNameExW, LocalAlloc, RemoveVectoredExceptionHandler, AddVectoredExceptionHandler, SleepConditionVariableCS, SearchPathW, DebugBreak, QueryUnbiasedInterruptTime, GetThreadTimes, WaitCommEvent, SetCommTimeouts, SetCommState, SetCommMask, SetCommBreak, DisconnectNamedPipe, GetCommState, WaitNamedPipeW, GetSystemTime, MultiByteToWideChar, WideCharToMultiByte, SetInformationJobObject, SetHandleInformation, SetPriorityClass, GetStdHandle, AssignProcessToJobObject, AttachConsole, CreateProcessW, AllocConsole, TlsSetValue, TlsAlloc, TlsFree, OutputDebugStringA, GetLocalTime, GetCurrentDirectoryW, FormatMessageA, SetEnvironmentVariableW, GetEnvironmentVariableW, RtlCaptureStackBackTrace, GetCurrentThread, CreateDirectoryW, QueryDosDeviceW, GetLongPathNameW, RemoveDirectoryW, GetTempPathW, GetVolumePathNameW, GetFileAttributesW, UnmapViewOfFile, SetFileAttributesW, GetFileAttributesExW, SetCurrentDirectoryW, MoveFileExW, ReplaceFileW, CopyFileW, CreateFileMappingW, MapViewOfFile, MoveFileW, HeapLock, HeapWalk, GetProcessIoCounters, GetSystemInfo, GlobalMemoryStatusEx, HeapUnlock, SetThreadPriority, GetThreadPriority, GetThreadId, IsDebuggerPresent, GetDiskFreeSpaceExW, ExpandEnvironmentStringsW, GetModuleHandleA, InitializeCriticalSection, GetCurrentThreadId, SwitchToThread, DuplicateHandle, GetLastError, InitializeCriticalSectionEx, GetCommandLineW, TryAcquireSRWLockExclusive, AcquireSRWLockExclusive, UnlockFileEx, GetFullPathNameA, SetFilePointer, CreateToolhelp32Snapshot, Process32NextW, Process32FirstW, GetPriorityClass, GetExitCodeProcess, QueryThreadCycleTime, TzSpecificLocalTimeToSystemTime, FileTimeToSystemTime, QueryPerformanceFrequency, SystemTimeToFileTime, SystemTimeToTzSpecificLocalTime, QueryPerformanceCounter, TlsGetValue, GetFileSizeEx, SetFileTime, LockFile, SetEndOfFile, GetFileInformationByHandle, UnlockFile, SetFilePointerEx, FlushFileBuffers, GetVersionExW, GetNativeSystemInfo, VirtualQuery, GetUserDefaultLangID, GetModuleHandleExA, FindFirstFileExW, ResetEvent, GetOverlappedResult, ConnectNamedPipe, RtlCaptureContext, ReleaseSemaphore, GetProcessId, SuspendThread, ResumeThread, CreateThread, PurgeComm, FindNextFileW, FindClose, VirtualFree, VirtualAlloc, FlushViewOfFile, HeapSetInformation, GetWindowsDirectoryW, CreateIoCompletionPort, SizeofResource, LockResource, LoadResource, FindResourceW, WakeAllConditionVariable, WakeConditionVariable, InitializeConditionVariable, SleepConditionVariableSRW, ReleaseSRWLockShared, AcquireSRWLockShared, LoadLibraryExW, VirtualProtectEx, WriteProcessMemory, GlobalAlloc, GlobalSize, GlobalUnlock, GlobalLock, GlobalFree, GetLocaleInfoW, VirtualAllocEx, GetPrivateProfileStringW, ExitProcess, InitializeCriticalSectionAndSpinCount, lstrcmpiW, TerminateJobObject, HeapDestroy, GetUserDefaultLCID, IsProcessInJob, QueryInformationJobObject, InitOnceExecuteOnce, InitializeSRWLock, GetFileType, ProcessIdToSessionId, UnhandledExceptionFilter, GetStartupInfoW, GetUserDefaultUILanguage, PeekNamedPipe, GetEnvironmentVariableA, lstrcmpiA, FindFirstChangeNotificationW, FindCloseChangeNotification, GetProcessHandleCount, GetProcessHeaps, SignalObjectAndWait, GetProcessHeap, GetFileSize, LockFileEx, HeapCompact, HeapAlloc, HeapReAlloc, DeleteFileA, WaitForSingleObjectEx, LoadLibraryA, CreateFileA, OutputDebugStringW, GetFileAttributesA, GetDiskFreeSpaceA, GetTempPathA, HeapSize, TerminateProcess, IsProcessorFeaturePresent, GetDiskFreeSpaceW, GetFullPathNameW, HeapFree, HeapCreate, AreFileApisANSI, TryEnterCriticalSection, FindFirstFileW, EnumSystemLocalesEx, VirtualFreeEx, CreateJobObjectW, CreateRemoteThread, CancelIo, ClearCommBreak, ClearCommError, EscapeCommFunction, GetCommModemStatus, HeapValidate
ole32.dll	CoCreateGuid, CLSIDFromString, RegisterDragDrop, OleUninitialize, OleInitialize, OleDuplicateData, DoDragDrop, RevokeDragDrop, CoTaskMemRealloc, ReleaseStgMedium, GetHGlobalFromStream, CreateStreamOnHGlobal, CoTaskMemAlloc, PropVariantClear, CoCreateInstance, CoInitializeEx, CoUninitialize, CoTaskMemFree
OLEAUT32.dll	VariantClear, SysFreeString, VariantInit, SysAllocString, LoadRegTypeLib, LoadTypeLib, SysStringLen, VarUI4FromStr
SHLWAPI.dll	PathFindFileNameW, PathFindExtensionW, PathMatchSpecW, PathRemoveExtensionW
MSIMG32.dll	AlphaBlend
UxTheme.dll	IsAppThemed
VCRUNTIME140.dll	_set_purecall_handler, memcpy, memset, memcmp, longjmp, _setjmp3, strstr, __std_type_info_compare, memchr, __std_exception_copy, __std_exception_destroy, _purecall, wcsstr, strchr, _except_handler4_common, _CxxThrowException, strrchr, __CxxFrameHandler3, __vcrt_InitializeCriticalSectionEx, memmove
api-ms-win-crt-string-l1-1-0.dll	strcpy_s, strcat_s, wcscpy_s, wcspbrk, wcsncpy_s, wcsncpy, iswspace, isspace, wmemcpy_s, isdigit, isalpha, strnlen, islower, strncpy, strncmp, _strnicmp, strspn, isxdigit, _wcsicmp, _wcsdup, toupper, _wcslwr, iswdigit, _strupr, _strlwr, iswcntrl, isalnum, _strdup, isprint, _stricmp, tolower, strcspn, isupper, _wcsnicmp, wcsnlen, strncpy_s, wcsncmp
api-ms-win-crt-environment-l1-1-0.dll	getenv_s, getenv
api-ms-win-crt-heap-l1-1-0.dll	_aligned_free, _aligned_malloc, _get_heap_handle, realloc, malloc, _callnewh, _set_new_mode, calloc, free, _recalloc, _msize
api-ms-win-crt-runtime-l1-1-0.dll	_beginthread, strerror, _initterm, terminate, _initterm_e, _set_invalid_parameter_handler, _invalid_parameter_noinfo_noreturn, _c_exit, _register_thread_local_exe_atexit_callback, _controlfp_s, _initialize_wide_environment, _configure_wide_argv, _errno, _set_app_type, _seh_filter_exe, _invalid_parameter_noinfo, __fpe_flt_rounds, _set_new_handler, _endthread, _cexit, _exit, _set_abort_behavior, signal, _beginthreadex, _initialize_onexit_table, _register_onexit_function, abort, exit, _crt_atexit, _get_wide_winmain_command_line
api-ms-win-crt-stdio-l1-1-0.dll	ftell, __stdio_common_vsnprintf_s, _dup2, _fileno, _get_osfhandle, freopen, ferror, fputc, fputs, fgets, _wfopen_s, __stdio_common_vsnwprintf_s, __stdio_common_vfprintf, __acrt_iob_func, __stdio_common_vswprintf_s, _wfopen, fread, _wfsopen, _open_osfhandle, _close, __stdio_common_vswprintf, _ftelli64, __stdio_common_vsscanf, fseek, _getcwd, _get_stream_buffer_pointers, _fsopen, getc, _fseeki64, fsetpos, ungetc, clearerr, setvbuf, fgetpos, __stdio_common_vsprintf_s, fgetc, fwrite, ungetwc, fgetwc, fputwc, __p__commode, fclose, _set_fmode, fopen, __stdio_common_vsprintf, __stdio_common_vfscanf, fflush
api-ms-win-crt-convert-l1-1-0.dll	strtod, _wtoi, _i64tow_s, wcstol, atoi, _strtoui64, _itoa_s, strtol, strtoll, strtoul, atol, _itoa, atof, _fcvt
api-ms-win-crt-filesystem-l1-1-0.dll	_unlock_file, _stat64i32, _lock_file, _wfullpath, _mkdir, remove, _wstat64i32
api-ms-win-crt-math-l1-1-0.dll	llroundf, llround, modf, _CIatan2, lround, frexp, _hypotf, cbrt, nextafter, _fdsign, trunc, _libm_sse2_exp_precise, _fdclass, _nextafter, _finite, _libm_sse2_sin_precise, _libm_sse2_cos_precise, _CIfmod, roundf, round, _libm_sse2_pow_precise, _libm_sse2_log_precise, floor, ceil, lroundf, fminf, _except1, _libm_sse2_sqrt_precise, _libm_sse2_acos_precise, _fdtest, __setusermatherr, ldexp, _libm_sse2_asin_precise, _CItanh, _libm_sse2_atan_precise, fmaxf, _fdopen, log2f, copysign, _j0, _dtest, log2, truncf, nextafterf, _libm_sse2_tan_precise, copysignf, hypot, _dclass, _isnan, _dsign, acoshf, asinhf, atanhf, exp2f, _CIcosh, _CIsinh, nanf, _libm_sse2_log10_precise
api-ms-win-crt-utility-l1-1-0.dll	bsearch, srand, rand, rand_s, qsort
api-ms-win-crt-time-l1-1-0.dll	wcsftime, _get_timezone, _gmtime64, _ftime64, _mktime64, _localtime64_s, _time64, _localtime64, _gmtime64_s
api-ms-win-crt-locale-l1-1-0.dll	setlocale, _configthreadlocale
IMM32.dll	ImmSetCompositionWindow, ImmNotifyIME, ImmSetOpenStatus, ImmSetConversionStatus, ImmGetConversionStatus, ImmGetCompositionStringW, ImmAssociateContextEx, ImmReleaseContext, ImmGetContext, ImmSetCandidateWindow
OLEACC.dll	AccessibleObjectFromWindow, CreateStdAccessibleObject, LresultFromObject
WINMM.dll	midiInStart, waveOutPrepareHeader, waveOutUnprepareHeader, waveOutWrite, waveOutPause, waveOutClose, waveOutReset, midiInAddBuffer, midiInUnprepareHeader, midiInPrepareHeader, midiInClose, midiInOpen, midiInGetDevCapsW, midiInGetNumDevs, midiOutReset, timeEndPeriod, midiOutLongMsg, midiOutShortMsg, midiOutUnprepareHeader, midiOutPrepareHeader, midiOutClose, waveOutOpen, waveOutRestart, midiOutOpen, midiOutGetDevCapsW, midiOutGetNumDevs, waveInMessage, waveInGetNumDevs, waveOutGetNumDevs, timeBeginPeriod, timeGetTime, midiInReset

Exports

Name	Ordinal	Address
GetHandleVerifier	1	0x620cd0
IsSandboxedProcess	2	0x1537f80
_register_atom_browser_app_	3	0x29b427c
_register_atom_browser_auto_updater_	4	0x29b42ac
_register_atom_browser_browser_view_	5	0x29b42c4
_register_atom_browser_content_tracing_	6	0x29b42b0
_register_atom_browser_debugger_	7	0x29b42a8
_register_atom_browser_desktop_capturer_	8	0x29b42e4
_register_atom_browser_dialog_	9	0x29b42ec
_register_atom_browser_download_item_	10	0x29b429c
_register_atom_browser_global_shortcut_	11	0x29b42b4
_register_atom_browser_in_app_purchase_	12	0x29b42d0
_register_atom_browser_menu_	13	0x29b4288
_register_atom_browser_net_	14	0x29b42d4
_register_atom_browser_power_monitor_	15	0x29b42bc
_register_atom_browser_power_save_blocker_	16	0x29b4294
_register_atom_browser_protocol_	17	0x29b4280
_register_atom_browser_render_process_preferences_	18	0x29b42dc
_register_atom_browser_session_	19	0x29b428c
_register_atom_browser_system_preferences_	20	0x29b42e0
_register_atom_browser_tray_	21	0x29b42cc
_register_atom_browser_web_contents_	22	0x29b4278
_register_atom_browser_web_view_manager_	23	0x29b4298
_register_atom_browser_window_	24	0x29b42a4
_register_atom_common_asar_	25	0x29b42b8
_register_atom_common_clipboard_	26	0x29b4290
_register_atom_common_crash_reporter_	27	0x29b4284
_register_atom_common_native_image_	28	0x29b42a0
_register_atom_common_notification_	29	0x29b42d8
_register_atom_common_screen_	30	0x29b42e8
_register_atom_common_shell_	31	0x29b42c0
_register_atom_common_v8_util_	32	0x29b42f0
_register_atom_renderer_ipc_	33	0x29b4274
_register_atom_renderer_web_frame_	34	0x29b42c8

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

• PowerENGAGE.exe

Click to jump to process

Memory Usage

• PowerENGAGE.exe

Click to jump to process

Target ID:	1
Start time:	17:52:15
Start date:	14/11/2022
Path:	C:\Users\user\Desktop\PowerENGAGE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PowerENGAGE.exe
Imagebase:	0xc0000
File size:	49503232 bytes
MD5 hash:	A3ABBAD183758271D44D984E67B04CF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PowerENGAGE.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: PowerENGAGE.exePID: 1516, Parent PID: 1860

General

File Activities

File Opened

File Attributes Queried

Volume Information Queried

Section Activities

Sections loaded by Windows

Registry Activities

Windows Analysis Report
PowerENGAGE.exe