ID: 192947 Sample Name: mbam.exe Cookbook: default.jbs Time: 17:39:15 Date: 01/12/2019 Version: 28.0.0 Lapis Lazuli Table of Contents

Table of Contents 2 Analysis Report mbam.exe 4 Overview 4 General Information 4 Detection 4 Confidence 4 Classification 5 Analysis Advice 5 Mitre Att&ck Matrix 6 Signature Overview 6 Cryptography: 6 Networking: 6 Key, Mouse, Clipboard, Microphone and Screen Capturing: 6 System Summary: 6 Data Obfuscation: 7 Malware Analysis System Evasion: 7 Anti Debugging: 7 Language, Device and Operating System Detection: 7 Lowering of HIPS / PFW / Operating System Security Settings: 7 Remote Access Functionality: 7 Behavior Graph 7 Simulations 8 Behavior and APIs 8 Antivirus, Machine Learning and Genetic Malware Detection 8 Initial Sample 8 Dropped Files 8 Unpacked PE Files 8 Domains 8 URLs 8 Yara Overview 9 Initial Sample 9 PCAP (Network Traffic) 9 Dropped Files 9 Memory Dumps 9 Unpacked PEs 9 Sigma Overview 9 Joe Sandbox View / Context 9 IPs 9 Domains 10 ASN 10 JA3 Fingerprints 10 Dropped Files 10 Screenshots 10 Thumbnails 10 Startup 11 Created / dropped Files 11 Domains and IPs 11 Contacted Domains 11 URLs from Memory and Binaries 11 Contacted IPs 13 Static File Info 13 General 13 File Icon 14 Static PE Info 14 General 14 Authenticode Signature 14 Entrypoint Preview 14 Rich Headers 15 Data Directories 15 Copyright Joe Security LLC 2019 Page 2 of 34 Sections 15 Resources 16 Imports 16 Version Infos 33 Possible Origin 34 Network Behavior 34 Code Manipulations 34 Statistics 34 System Behavior 34 Analysis Process: mbam.exe PID: 708 Parent PID: 4448 34 General 34 Disassembly 34 Code Analysis 34

Copyright Joe Security LLC 2019 Page 3 of 34 Analysis Report mbam.exe

Overview

General Information

Joe Sandbox Version: 28.0.0 Lapis Lazuli Analysis ID: 192947 Start date: 01.12.2019 Start time: 17:39:15 Joe Sandbox Product: CloudBasic Overall analysis duration: 0h 5m 46s Hypervisor based Inspection enabled: false Report type: light Sample file name: mbam.exe Cookbook file name: default.jbs Analysis system description: Windows 10 64 bit (version 1803) with Office 2016, Adobe Reader DC 19, Chrome 70, Firefox 63, Java 8.171, Flash 30.0.0.113 Number of analysed new started processes analysed: 5 Number of new started drivers analysed: 0 Number of existing processes analysed: 0 Number of existing drivers analysed: 0 Number of injected processes analysed: 0 Technologies: HCA enabled EGA enabled HDC enabled AMSI enabled Analysis stop reason: Timeout Detection: CLEAN Classification: clean4.winEXE@1/0@0/0 EGA Information: Failed HDC Information: Failed HCA Information: Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0 Cookbook Comments: Adjust boot time Enable AMSI Found application associated with file extension: .exe Warnings: Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, CompatTelRunner.exe Execution Graph export aborted for target mbam.exe, PID 708 because there are no executed function Report size exceeded maximum capacity and may have missing disassembly code.

Detection

Strategy Score Range Reporting Whitelisted Detection

Threshold 4 0 - 100 false

Confidence

Copyright Joe Security LLC 2019 Page 4 of 34 Strategy Score Range Further Analysis Required? Confidence

Threshold 3 0 - 5 true

Classification

Ransomware

Miner Spreading

mmaallliiiccciiioouusss

malicious

Evader Phishing

sssuusssppiiiccciiioouusss

suspicious

cccllleeaann

clean

Exploiter Banker

Spyware Trojan / Bot

Adware

Analysis Advice

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Copyright Joe Security LLC 2019 Page 5 of 34 Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Mitre Att&ck Matrix

Privilege Credential Lateral Command Initial Access Execution Persistence Escalation Defense Evasion Access Discovery Movement Collection Exfiltration and Control Impact Valid Accounts Command-Line Winlogon Access Token Access Token Input System Time Application Input Data Standard Data Interface 2 Helper DLL Manipulation 1 Manipulation 1 Capture 1 Discovery 1 Deployment Capture 1 Encrypted 1 Cryptographic Destruction Software Protocol 2 Replication Service Port Accessibility Deobfuscate/Decode Network Security Remote Data from Exfiltration Commonly Data Through Execution Monitors Features Files or Sniffing Software Services Removable Over Other Used Port 1 Encrypted Removable Information 1 Discovery 3 Media Network for Impact Media Medium External Windows Accessibility Path DLL Side- Input System Windows Data from Automated Custom Disk Remote Management Features Interception Loading 1 Capture Information Remote Network Exfiltration Cryptographic Structure Services Instrumentation Discovery 1 2 Management Shared Drive Protocol Wipe Drive-by Scheduled System DLL Search Obfuscated Files or Credentials System Logon Input Data Multiband Disk Compromise Task Firmware Order Hijacking Information 1 in Files Network Scripts Capture Encrypted Communication Content Configuration Wipe Discovery

Signature Overview

• Cryptography • Networking • Key, Mouse, Clipboard, Microphone and Screen Capturing • System Summary • Data Obfuscation • Malware Analysis System Evasion • Anti Debugging • Language, Device and Operating System Detection • Lowering of HIPS / PFW / Operating System Security Settings • Remote Access Functionality

Click to jump to signature section

Cryptography:

Uses Microsoft's Enhanced Cryptographic Provider

Networking:

Urls found in memory or binary data

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

System Summary:

Detected potential crypto function

Found potential string decryption / allocating functions

PE file contains strange resources

Tries to load missing DLLs

Classification label Copyright Joe Security LLC 2019 Page 6 of 34 Contains functionality to adjust token privileges (e.g. debug / backup)

Contains functionality to instantiate COM classes

PE file has an executable .text section and no other executable section

Reads software policies

Sample might require command line arguments

PE / OLE file has a valid certificate

PE file has a big code size

Submission file is bigger than most known malware samples

PE file has a big raw section

PE file imports many functions

PE file contains a mix of data directories often seen in goodware

Contains modern PE file flags such as dynamic base (ASLR) or NX

PE file contains a debug data directory

Binary contains paths to debug symbols

PE file contains a valid data directory to section mapping

Data Obfuscation:

PE file contains an invalid checksum

Malware Analysis System Evasion:

Program does not show much activity (idle)

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Program does not show much activity (idle)

Contains functionality to register its own exception handler

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Contains functionality to query local / system time

Lowering of HIPS / PFW / Operating System Security Settings:

AV process strings found (often used to terminate AV products)

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Behavior Graph

Copyright Joe Security LLC 2019 Page 7 of 34 Hide Legend Legend: Process Signature Created File DNS/IP Info Is Dropped

Is Windows Process

Behavior Graph Number of created Registry Values Number of created Files ID: 192947 Visual Basic Sample: mbam.exe Startdate: 01/12/2019 Delphi Architecture: WINDOWS Java Score: 4 .Net C# or VB.NET

C, C++ or other language

started Is malicious

Internet mbam.exe

Simulations

Behavior and APIs

No simulations

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source Detection Scanner Label Link mbam.exe 0% Virustotal Browse mbam.exe 0% Metadefender Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Copyright Joe Security LLC 2019 Page 8 of 34 Source Detection Scanner Label Link https://subscribe-staging.mwbsys.com/link/mbam3x?affiliate=%1&uuid=%2&x-source= 0% Avira URL Cloud safe https://ark.mwbsys.com/mbst/latest?lang=%1&affiliate=%2&x-source=mb4pchelp 0% Avira URL Cloud safe www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed 0% Virustotal Browse www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed 0% URL Reputation safe https://subscribe-staging.mwbsys.com/renew/%1/%2?x-source= 0% Virustotal Browse https://subscribe-staging.mwbsys.com/renew/%1/%2?x-source= 0% Avira URL Cloud safe https://subscribe-staging.mwbsys.com/link/retail?affiliate=%1&uuid=%2&x-source= 0% Virustotal Browse https://subscribe-staging.mwbsys.com/link/retail?affiliate=%1&uuid=%2&x-source= 0% Avira URL Cloud safe https://%1/api/sso/pk/%2/%3myaccount- 0% Avira URL Cloud safe stage.malwarebytes.commy.malwarebytes.comCustomProgressResultsM ocsp.thawte.com0 0% URL Reputation safe www.bohemiancoding.com/sketch 0% Virustotal Browse www.bohemiancoding.com/sketch 0% URL Reputation safe https://lic-iris-content-stage.mwbsys.com/mbam_modal_r01_protect_more.1.0.2.dll 0% Avira URL Cloud safe www.openswatchbook.org/uri/2009/osb 0% Virustotal Browse www.openswatchbook.org/uri/2009/osb 0% Avira URL Cloud safe https://subscribe-staging.mwbsys.com/link/whatisthis?affiliate=%1&uuid=%2&x-source= 0% Virustotal Browse https://subscribe-staging.mwbsys.com/link/whatisthis?affiliate=%1&uuid=%2&x-source= 0% Avira URL Cloud safe https://subscribe-staging.mwbsys.com/link/3xtrial?affiliate=%1&uuid=%2&x-source= 0% Virustotal Browse https://subscribe-staging.mwbsys.com/link/3xtrial?affiliate=%1&uuid=%2&x-source= 0% Avira URL Cloud safe https://lic-iris-content- 0% Avira URL Cloud safe stage.mwbsys.com/mbam_modal_r01_protect_more.1.0.2.dllControlValuecontrolle

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Sigma Overview

No Sigma rule has matched

Joe Sandbox View / Context

IPs

No context

Copyright Joe Security LLC 2019 Page 9 of 34 Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Screenshots

Thumbnails This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Copyright Joe Security LLC 2019 Page 10 of 34 Startup

System is w10x64 mbam.exe (PID: 708 cmdline: 'C:\Users\user\Desktop\mbam.exe' MD5: E14DDE2165D2D297D12C8898435285D1) cleanup

Created / dropped Files

No created / dropped files found

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name Source Malicious Antivirus Detection Reputation https://links.malwarebytes.com/mb4teams mbam.exe false high https://blog.malwarebytes.com mbam.exe false high

Copyright Joe Security LLC 2019 Page 11 of 34 Name Source Malicious Antivirus Detection Reputation https://www.malwarebytes.com/support/guides/mb/? mbam.exe false high lang= https://internal-staging- mbam.exe false high links.malwarebytes.com/link/3x_cart?affiliate=%1&uuid=%2&x- source= www.inkscape.org/) mbam.exe false high https://links.malwarebytes.com/mb4-lic- mbam.exe false high qtyMBAM403102The https://my-api.malwarebytes.com/trials/account_based mbam.exe false high https://links.malwarebytes.com/mb4learn mbam.exe false high https://blog.malwarebytes.com/detections/ mbam.exe false high https://links.malwarebytes.com/mb4securitynews? mbam.exe false high &lang=%1&affiliate=%2&x-source=mb4pchelp https://links.malwarebytes.com/mb4upgradepc/? mbam.exe false high MB4Windows=1&lang=%1&affiliate=%2&machine=%3&versio n=%4 https://subscribe-staging.mwbsys.com/link/mbam3x? mbam.exe false Avira URL Cloud: safe low affiliate=%1&uuid=%2&x-source= https://links.malwarebytes.com/link/mb3-business- mbam.exe false high products?affiliate=%1&uuid=%2 https://links.malwarebytes.com/link/mbam3x? mbam.exe false high affiliate=%1&uuid=%2&x-source= https://ark.mwbsys.com/mbst/latest? mbam.exe false Avira URL Cloud: safe low lang=%1&affiliate=%2&x-source=mb4pchelp https://links.malwarebytes.com/mb4globalstats mbam.exe false high https://sketchapp.com mbam.exe false high https://myaccount-api- mbam.exe false high stage.malwarebytes.com/marketing_preferences/subscribe mbam.exe false 0%, Virustotal, Browse low www.ascendercorp.com/http://www.ascendercorp.com/typede URL Reputation: safe signers.htmlLicensed crl.thawte.com/ThawteTimestampingCA.crl0 mbam.exe false high https://my- mbam.exe false high api.malwarebytes.com/marketing_preferences/subscribe https://links.malwarebytes.com/mb4pcguide? mbam.exe false high lang=%1&affiliate=%2&x-source=mb4pchelp https://links.malwarebytes.com/mb4-lab-news/ mbam.exe false high https://links.malwarebytes.com/mb4securitynews mbam.exe false high links.malwarebytes.com/staging-mb4-lab-news/ mbam.exe false high https://subscribe-staging.mwbsys.com/renew/%1/%2?x- mbam.exe false 0%, Virustotal, Browse low source= Avira URL Cloud: safe https://links.malwarebytes.com/mb4platforms/? mbam.exe false high MB4Windows=1&lang=%1&affiliate=%2&machine=%3&versio n=%4 https://subscribe-staging.mwbsys.com/link/retail? mbam.exe false 0%, Virustotal, Browse low affiliate=%1&uuid=%2&x-source= Avira URL Cloud: safe https://links.malwarebytes.com/link/retail? mbam.exe false high affiliate=%1&uuid=%2&x-source= https://myaccount-api- mbam.exe false high stage.malwarebytes.com/trials/account_based https://%1/api/sso/pk/%2/%3myaccount- mbam.exe false Avira URL Cloud: safe low stage.malwarebytes.commy.malwarebytes.comCustomProgre ssResultsM https://links.malwarebytes.com/mb4pcgethelp? mbam.exe false high lang=%1&affiliate=%2&x-source=mb4pchelp https://links.malwarebytes.com/mb4-mpa mbam.exe false high mbam.exe false high https://www.malwarebytes.com/pdf/guides/ThirdPartyLicenseS upplement.pdf www.apache.org/licenses/LICENSE-2.0 mbam.exe false high https://links.malwarebytes.com/link/3x_cart? mbam.exe false high affiliate=%1&uuid=%2&x-source= https://links.malwarebytes.com/renew/%1/%2?x-source= mbam.exe false high https://www.malwarebytes.com/privacy/#addendum mbam.exe false high https://links.malwarebytes.com/mb4lostkey mbam.exe false high ocsp.thawte.com0 mbam.exe false URL Reputation: safe unknown https://links.malwarebytes.com/mb4pcgethelp? mbam.exe false high lang=%1&affiliate=%2&x-source=mb4pchelphttps://links.mal www.bohemiancoding.com/sketch mbam.exe false 0%, Virustotal, Browse low URL Reputation: safe https://links.malwarebytes.com/mb4teams/? mbam.exe false high MB4Windows=1&lang=%1&affiliate=%2&machine=%3&versio n=%4&x-s

Copyright Joe Security LLC 2019 Page 12 of 34 Name Source Malicious Antivirus Detection Reputation mbam.exe false high https://blog.malwarebytes.com/detections/%QT_ANGLE_PLA TFORMwarp https://lic-iris-content- mbam.exe false Avira URL Cloud: safe low stage.mwbsys.com/mbam_modal_r01_protect_more.1.0.2.dll https://links.malwarebytes.com/mb4-lic-qty mbam.exe false high https://staging- mbam.exe false high www.malwarebytes.com/js/json/global_threat.json links.malwarebytes.com/staging-mb4-lab- mbam.exe false high news/https://links.malwarebytes.com/mb4globalstatshttp creativecommons.org/ns# mbam.exe false high www.openswatchbook.org/uri/2009/osb mbam.exe false 0%, Virustotal, Browse unknown Avira URL Cloud: safe https://subscribe-staging.mwbsys.com/link/whatisthis? mbam.exe false 0%, Virustotal, Browse low affiliate=%1&uuid=%2&x-source= Avira URL Cloud: safe https://subscribe-staging.mwbsys.com/link/3xtrial? mbam.exe false 0%, Virustotal, Browse low affiliate=%1&uuid=%2&x-source= Avira URL Cloud: safe https://links.malwarebytes.com/link/3xtrial? mbam.exe false high affiliate=%1&uuid=%2&x-source= https://links.malwarebytes.com/mb4mobile/? mbam.exe false high MB4Windows=1&lang=%1&affiliate=%2&machine=%3&versio n=%4&x- https://links.malwarebytes.com/link/3x_cart_trial? mbam.exe false high affiliate=%1&uuid=%2&x-source= sodipodi.sourceforge.net/DTD/sodipodi-0.dtd mbam.exe false high https://links.malwarebytes.com/mb4winactivation mbam.exe false high links.malwarebytes.com/link/home? mbam.exe false high MB4Windows=1&lang=%1&affiliate=%2&machine=%3&versio n=%4&x-so www.apache.org/licenses/LICENSE-2.0Digitized mbam.exe false high https://internal-staging- mbam.exe false high links.malwarebytes.com/link/3x_cart?affiliate=%1&uuid=%2&x- source=https://s https://links.malwarebytes.com/link/add-device? mbam.exe false high affiliate=%1&uuid=%2&x-source=add-device https://internal-staging-links.malwarebytes.com/link/mb3- mbam.exe false high business-products?affiliate=%1&uuid=%2 https://links.malwarebytes.com/link/whatisthis? mbam.exe false high affiliate=%1&uuid=%2&x-source= https://lic-iris-content- mbam.exe false Avira URL Cloud: safe low stage.mwbsys.com/mbam_modal_r01_protect_more.1.0.2.dll ControlValuecontrolle scripts.sil.org/OFL mbam.exe false high https://internal-staging-links.malwarebytes.com/link/add- mbam.exe false high device?affiliate=%1&uuid=%2&x-source=add-de www.inkscape.org/namespaces/inkscape mbam.exe false high https://internal-staging- mbam.exe false high links.malwarebytes.com/link/3x_cart_trial? affiliate=%1&uuid=%2&x-source= https://www.malwarebytes.com/eula mbam.exe false high

Contacted IPs

No contacted IP infos

Static File Info

General File type: PE32 executable (GUI) Intel 80386, for MS Windows Entropy (8bit): 6.8390244151579935 TrID: Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00% File name: mbam.exe File size: 16544280 MD5: e14dde2165d2d297d12c8898435285d1

Copyright Joe Security LLC 2019 Page 13 of 34 General SHA1: b0f1fa6e4718063955a12e9de9cb4864da0288c2 SHA256: 5fae91ec7b8ef514dc832f72f91de111dbd778c8d0005d7 aed995fbd8df3cdd7 SHA512: 4477857f64c91cd994be05002575936b469ad8fa049d148 1181b4de6cb50c49b6cb2d75deaaa24d33658b671fbacf9 080431f08a996c7ea106b98ef6651853be SSDEEP: 196608:IAZOL5X90Rh7uoB9H6+jDOdeTIPiEtHIeVCt4y tWIvk/99u/sR+2SiDbJ:IhL0r7z9a8qdMiiEtoeVC+ytk+be J File Content Preview: MZ...... @...... !..L.!Th is program cannot be run in DOS mode....$...... @.#...M B..MB..MB...B..MBV.IC..MBV.NC..MBV.HC .MBV.LC..M Ba.IC..MBa.KC..MBa.LC..MB..LC..MBh.LC..MB..LB..MB ..DC..MB...B..MB...B..M

File Icon

Icon Hash: 968eacb29296cc18

Static PE Info

General Entrypoint: 0x5bf2d3 Entrypoint Section: .text Digitally signed: true Imagebase: 0x400000 Subsystem: windows gui Image File Characteristics: 32BIT_MACHINE, EXECUTABLE_IMAGE DLL Characteristics: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT Time Stamp: 0x5DD59030 [Wed Nov 20 19:12:48 2019 UTC] TLS Callbacks: CLR (.Net) Version: OS Version Major: 6 OS Version Minor: 0 File Version Major: 6 File Version Minor: 0 Subsystem Version Major: 6 Subsystem Version Minor: 0 Import Hash: 6dddb5a2caca0d6968b620d901bf4382

Authenticode Signature

Signature Valid: true Signature Issuer: CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US Signature Validation Error: The operation completed successfully Error Number: 0 Not Before, Not After 7/2/2019 5:00:00 PM 8/20/2021 5:00:00 AM Subject Chain CN=Malwarebytes Inc, O=Malwarebytes Inc, L=Santa Clara, S=California, C=US Version: 3 Thumbprint MD5: D51B8AEBED6D1E6C35F2F6FB092C0224 Thumbprint SHA-1: 816BE9397F66D1A26EFA04035BCA3BB9E3779740 Thumbprint SHA-256: 642577228C33F97B53278CE40767DE78C84A663F269DB23FFB5538A31CD0FED5 Serial: 08A2EC4E78A09E174B192E5535984B59

Entrypoint Preview

Instruction call 00007F0F40968E18h jmp 00007F0F4096833Ch push ebp mov ebp, esp push 00000000h call dword ptr [0061F13Ch] push dword ptr [ebp+08h]

Copyright Joe Security LLC 2019 Page 14 of 34 Instruction call dword ptr [0061F138h] push C0000409h call dword ptr [0061F068h] push eax call dword ptr [0061F140h] pop ebp ret push ebp mov ebp, esp sub esp, 00000324h push 00000017h call 00007F0F40969C30h test eax, eax je 00007F0F40968507h push 00000002h pop ecx int 29h mov dword ptr [0134B7F8h], eax mov dword ptr [0134B7F4h], ecx mov dword ptr [0134B7F0h], edx mov dword ptr [0134B7ECh], ebx mov dword ptr [0134B7E8h], esi mov dword ptr [0134B7E4h], edi mov word ptr [0134B810h], ss mov word ptr [0134B804h], cs mov word ptr [0134B7E0h], ds mov word ptr [0134B7DCh], es mov word ptr [0134B7D8h], fs mov word ptr [0134B7D4h], gs pushfd pop dword ptr [0134B808h] mov eax, dword ptr [ebp+00h] mov dword ptr [0134B7FCh], eax mov eax, dword ptr [ebp+04h] mov dword ptr [0134B800h], eax lea eax, dword ptr [ebp+08h] mov dword ptr [0134B80Ch], eax mov eax, dword ptr [ebp-00000324h] mov dword ptr [0134B748h], 00010001h

Rich Headers

Programming Language: [IMP] VS2008 SP1 build 30729

Data Directories

Name Virtual Address Virtual Size Is in Section IMAGE_DIRECTORY_ENTRY_EXPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IMPORT 0xf2f1e4 0x21c .rdata IMAGE_DIRECTORY_ENTRY_RESOURCE 0xf50000 0x1c9e0 .rsrc IMAGE_DIRECTORY_ENTRY_EXCEPTION 0x0 0x0 IMAGE_DIRECTORY_ENTRY_SECURITY 0xfa0600 0x26c18 IMAGE_DIRECTORY_ENTRY_BASERELOC 0xf6d000 0x39564 .reloc IMAGE_DIRECTORY_ENTRY_DEBUG 0xed3310 0x54 .rdata IMAGE_DIRECTORY_ENTRY_COPYRIGHT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_GLOBALPTR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_TLS 0xed3408 0x18 .rdata IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG 0xed3368 0x40 .rdata IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_IAT 0x21f000 0x1e94 .rdata IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 0x0 0x0 IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR 0x0 0x0 IMAGE_DIRECTORY_ENTRY_RESERVED 0x0 0x0

Sections

Copyright Joe Security LLC 2019 Page 15 of 34 Name Virtual Address Virtual Size Raw Size Xored PE ZLIB Complexity File Type Entropy Characteristics .text 0x1000 0x21dbf2 0x21dc00 unknown unknown unknown unknown IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ .rdata 0x21f000 0xd25cc0 0xd25e00 unknown unknown unknown unknown IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_READ .data 0xf45000 0xad58 0x6800 False 0.226862980769 DOS executable (block device 5.24769923898 IMAGE_SCN_CNT_INITIALIZED driver\277DN\346@\273) _DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ .rsrc 0xf50000 0x1c9e0 0x1ca00 False 0.192804994541 data 3.85284238779 IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_READ .reloc 0xf6d000 0x39564 0x39600 False 0.585448154956 data 6.73805569022 IMAGE_SCN_CNT_INITIALIZED _DATA, IMAGE_SCN_MEM_DISCARDA BLE, IMAGE_SCN_MEM_READ

Resources

Name RVA Size Type Language Country RT_ICON 0xf502a0 0x2c24 PNG image data, 256 x 256, 8-bit/color RGBA, non- English United States interlaced RT_ICON 0xf52ec8 0x10828 dBase IV DBT, blocks size 0, block length 2048, next English United States free block index 40, next free block 0, next used block 0 RT_ICON 0xf636f0 0x4228 dBase IV DBT of \200.DBF, blocks size 0, block English United States length 16896, next free block index 40, next free block 4294959359, next used block 4278714367 RT_ICON 0xf67918 0x25a8 data English United States RT_ICON 0xf69ec0 0x10a8 data English United States RT_ICON 0xf6af68 0x988 data English United States RT_ICON 0xf6b8f0 0x6b8 data English United States RT_ICON 0xf6bfa8 0x468 GLS_BINARY_LSB_FIRST English United States RT_GROUP_ICON 0xf6c410 0x76 data English United States RT_VERSION 0xf6c488 0x2d4 data English United States RT_MANIFEST 0xf6c760 0x27e XML 1.0 document text English United States

Imports

DLL Import

Copyright Joe Security LLC 2019 Page 16 of 34 DLL Import Qt5Quick.dll ?window@QQuickItem@@QBEPAVQQuickWindow@@XZ, ? isVisible@QQuickItem@@QBE_NXZ, ? update@QQuickPaintedItem@@QAEXABVQRect@@@Z, ? setFlag@QQuickItem@@QAEXW4Flag@1@_N@Z, ??1QQuickPaintedItem@@UAE@XZ, ??0QQuickPaintedItem@@QAE@PAVQQuickItem@@@Z, ? visibleChanged@QQuickItem@@QAEXXZ, ?setHeight@QQuickItem@@QAEXN@Z, ? setWidth@QQuickItem@@QAEXN@Z, ?setY@QQuickItem@@QAEXN@Z, ? setX@QQuickItem@@QAEXN@Z, ?width@QQuickItem@@QBENXZ, ? height@QQuickItem@@QBENXZ, ?setVisible@QQuickItem@@QAEX_N@Z, ? activeFocusChanged@QQuickItem@@QAEX_N@Z, ? heightChanged@QQuickItem@@QAEXXZ, ?hasActiveFocus@QQuickItem@@QBE_NXZ, ? setParentItem@QQuickItem@@QAEXPAV1@@Z, ? parentItem@QQuickItem@@QBEPAV1@XZ, ?setEnabled@QQuickItem@@QAEX_N@Z, ??1QQuickItem@@UAE@XZ, ??0QQuickItem@@QAE@PAV0@@Z, ? qt_metacall@QQuickPaintedItem@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QQuickPaintedItem@@UAEPAXPBD@Z, ? staticMetaObject@QQuickPaintedItem@@2UQMetaObject@@B, ? qt_metacall@QQuickItem@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QQuickItem@@UAEPAXPBD@Z, ? componentComplete@QQuickItem@@MAEXXZ, ? releaseResources@QQuickPaintedItem@@MAEXXZ, ? updatePaintNode@QQuickPaintedItem@@MAEPAVQSGNode@@PAV2@PAUUpdatePaint NodeData@QQuickItem@@@Z, ? itemChange@QQuickPaintedItem@@MAEXW4ItemChange@QQuickItem@@ABTItemChan geData@3@@Z, ? textureProvider@QQuickPaintedItem@@UBEPAVQSGTextureProvider@@XZ, ? isTextureProvider@QQuickPaintedItem@@UBE_NXZ, ? classBegin@QQuickItem@@MAEXXZ, ?updatePolish@QQuickItem@@MAEXXZ, ? releaseResources@QQuickItem@@MAEXXZ, ? updatePaintNode@QQuickItem@@MAEPAVQSGNode@@PAV2@PAUUpdatePaintNodeDa ta@1@@Z, ?geometryChanged@QQuickItem@@MAEXABVQRectF@@0@Z, ? windowDeactivateEvent@QQuickItem@@MAEXXZ, ? childMouseEventFilter@QQuickItem@@MAE_NPAV1@PAVQEvent@@@Z, ? dropEvent@QQuickItem@@MAEXPAVQDropEvent@@@Z, ? dragLeaveEvent@QQuickItem@@MAEXPAVQDragLeaveEvent@@@Z, ? dragMoveEvent@QQuickItem@@MAEXPAVQDragMoveEvent@@@Z, ? dragEnterEvent@QQuickItem@@MAEXPAVQDragEnterEvent@@@Z, ? hoverLeaveEvent@QQuickItem@@MAEXPAVQHoverEvent@@@Z, ? hoverMoveEvent@QQuickItem@@MAEXPAVQHoverEvent@@@Z, ? hoverEnterEvent@QQuickItem@@MAEXPAVQHoverEvent@@@Z, ? touchEvent@QQuickItem@@MAEXPAVQTouchEvent@@@Z, ? wheelEvent@QQuickItem@@MAEXPAVQWheelEvent@@@Z, ? touchUngrabEvent@QQuickItem@@MAEXXZ, ? mouseUngrabEvent@QQuickItem@@MAEXXZ, ? mouseDoubleClickEvent@QQuickItem@@MAEXPAVQMouseEvent@@@Z, ? mouseReleaseEvent@QQuickItem@@MAEXPAVQMouseEvent@@@Z, ? mouseMoveEvent@QQuickItem@@MAEXPAVQMouseEvent@@@Z, ? mousePressEvent@QQuickItem@@MAEXPAVQMouseEvent@@@Z, ? focusOutEvent@QQuickItem@@MAEXPAVQFocusEvent@@@Z, ? focusInEvent@QQuickItem@@MAEXPAVQFocusEvent@@@Z, ? inputMethodEvent@QQuickItem@@MAEXPAVQInputMethodEvent@@@Z, ? keyReleaseEvent@QQuickItem@@MAEXPAVQKeyEvent@@@Z, ? keyPressEvent@QQuickItem@@MAEXPAVQKeyEvent@@@Z, ? itemChange@QQuickItem@@MAEXW4ItemChange@1@ABTItemChangeData@1@@Z, ? textureProvider@QQuickItem@@UBEPAVQSGTextureProvider@@XZ, ? isTextureProvider@QQuickItem@@UBE_NXZ, ?inputMethodQuery@QQuickItem@@UBE? AVQVariant@@W4InputMethodQuery@Qt@@@Z, ? contains@QQuickItem@@UBE_NABVQPointF@@@Z, ?clipRect@QQuickItem@@UBE? AVQRectF@@XZ, ?boundingRect@QQuickItem@@UBE?AVQRectF@@XZ, ? event@QQuickItem@@MAE_NPAVQEvent@@@Z, ?? 0QQuickWindow@@QAE@PAVQWindow@@@Z, ??1QQuickWindow@@UAE@XZ, ? focusObject@QQuickWindow@@UBEPAVQObject@@XZ, ? accessibleRoot@QQuickWindow@@UBEPAVQAccessibleInterface@@XZ, ? exposeEvent@QQuickWindow@@MAEXPAVQExposeEvent@@@Z, ? resizeEvent@QQuickWindow@@MAEXPAVQResizeEvent@@@Z, ? showEvent@QQuickWindow@@MAEXPAVQShowEvent@@@Z, ? hideEvent@QQuickWindow@@MAEXPAVQHideEvent@@@Z, ? focusInEvent@QQuickWindow@@MAEXPAVQFocusEvent@@@Z, ? focusOutEvent@QQuickWindow@@MAEXPAVQFocusEvent@@@Z, ? event@QQuickWindow@@MAE_NPAVQEvent@@@Z, ? keyPressEvent@QQuickWindow@@MAEXPAVQKeyEvent@@@Z, ? keyReleaseEvent@QQuickWindow@@MAEXPAVQKeyEvent@@@Z, ? mousePressEvent@QQuickWindow@@MAEXPAVQMouseEvent@@@Z, ? mouseReleaseEvent@QQuickWindow@@MAEXPAVQMouseEvent@@@Z, ? mouseDoubleClickEvent@QQuickWindow@@MAEXPAVQMouseEvent@@@Z, ? mouseMoveEvent@QQuickWindow@@MAEXPAVQMouseEvent@@@Z, ? wheelEvent@QQuickWindow@@MAEXPAVQWheelEvent@@@Z, ? qt_metacast@QQuickWindow@@UAEPAXPBD@Z, ? qt_metacall@QQuickWindow@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? staticMetaObject@QQuickItem@@2UQMetaObject@@B, ? contentItem@QQuickWindow@@QBEPAVQQuickItem@@XZ, ? setSceneGraphBackend@QQuickWindow@@SAXW4GraphicsApi@QSGRendererInterface @@@Z, ?setTextRenderType@QQuickWindow@@SAXW4TextRenderType@1@@Z, ? afterRendering@QQuickWindow@@QAEXXZ, ? staticMetaObject@QQuickWindow@@2UQMetaObject@@B Qt5Widgets.dll ?staticMetaObject@QMessageBox@@2UQMetaObject@@B, ? setFont@QToolTip@@SAXABVQFont@@@Z, ? showText@QToolTip@@SAXABVQPoint@@ABVQString@@PAVQWidget@@@Z, ? font@QApplication@@SA?AVQFont@@XZ, ? Copyright Joe Security LLC 2019 Page 17 of 34 DLL IsmtaptiocMrtetaObject@QPushButton@@2UQMetaObject@@B, ? staticMetaObject@QAbstractButton@@2UQMetaObject@@B, ? buttonClicked@QMessageBox@@QAEXPAVQAbstractButton@@@Z, ? defaultButton@QMessageBox@@QBEPAVQPushButton@@XZ, ? dragEnterEvent@QWidget@@MAEXPAVQDragEnterEvent@@@Z, ? actionEvent@QWidget@@MAEXPAVQActionEvent@@@Z, ? tabletEvent@QWidget@@MAEXPAVQTabletEvent@@@Z, ? moveEvent@QWidget@@MAEXPAVQMoveEvent@@@Z, ? paintEvent@QWidget@@MAEXPAVQPaintEvent@@@Z, ? leaveEvent@QWidget@@MAEXPAVQEvent@@@Z, ? enterEvent@QWidget@@MAEXPAVQEvent@@@Z, ? focusOutEvent@QWidget@@MAEXPAVQFocusEvent@@@Z, ? focusInEvent@QWidget@@MAEXPAVQFocusEvent@@@Z, ? geometry@QWidget@@QBEABVQRect@@XZ, ?isEnabled@QWidget@@QBE_NXZ, ? font@QWidget@@QBEABVQFont@@XZ, ?hasMouseTracking@QWidget@@QBE_NXZ, ? size@QWidget@@QBE?AVQSize@@XZ, ?parentWidget@QWidget@@QBEPAV1@XZ, ? setIcon@QAction@@QAEXABVQIcon@@@Z, ?text@QAction@@QBE?AVQString@@XZ, ?menu@QAction@@QBEPAVQMenu@@XZ, ? setShortcut@QAction@@QAEXABVQKeySequence@@@Z, ? setVisible@QAction@@QAEX_N@Z, ? metaObject@QWidget@@UBEPBUQMetaObject@@XZ, ? qt_metacast@QWidget@@UAEPAXPBD@Z, ? qt_metacall@QWidget@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ?? 0QWidget@@QAE@PAV0@V?$QFlags@W4WindowType@Qt@@@@@Z, ?? 1QWidget@@UAE@XZ, ?mapFromGlobal@QWidget@@QBE?AVQPoint@@ABV2@@Z, ? nativeParentWidget@QWidget@@QBEPAV1@XZ, ? palette@QWidget@@QBEABVQPalette@@XZ, ?backgroundRole@QWidget@@QBE? AW4ColorRole@QPalette@@XZ, ?foregroundRole@QWidget@@QBE? AW4ColorRole@QPalette@@XZ, ?windowTitle@QWidget@@QBE?AVQString@@XZ, ? isActiveWindow@QWidget@@QBE_NXZ, ?focusPolicy@QWidget@@QBE? AW4FocusPolicy@Qt@@XZ, ?setFocusProxy@QWidget@@QAEXPAV1@@Z, ? hide@QWidget@@QAEXXZ, ?resize@QWidget@@QAEXABVQSize@@@Z, ? actions@QWidget@@QBE?AV?$QList@PAVQAction@@@@XZ, ? find@QWidget@@SAPAV1@I@Z, ? activeModalWidget@QApplication@@SAPAVQWidget@@XZ, ? staticMetaObject@QMenuBar@@2UQMetaObject@@B, ? metaObject@QMenu@@UBEPBUQMetaObject@@XZ, ? qt_metacast@QMenu@@UAEPAXPBD@Z, ? qt_metacall@QMenu@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ?? 0QMenu@@QAE@PAVQWidget@@@Z, ??1QMenu@@UAE@XZ, ? addAction@QMenu@@QAEPAVQAction@@ABVQIcon@@ABVQString@@@Z, ? addAction@QMenu@@QAEPAVQAction@@ABVQString@@@Z, ? addMenu@QMenu@@QAEPAVQAction@@PAV1@@Z, ? addSeparator@QMenu@@QAEPAVQAction@@XZ, ?sizeHint@QMenu@@UBE? AVQSize@@XZ, ?setTitle@QMenu@@QAEXABVQString@@@Z, ? changeEvent@QMenu@@MAEXPAVQEvent@@@Z, ? keyPressEvent@QMenu@@MAEXPAVQKeyEvent@@@Z, ? mouseReleaseEvent@QMenu@@MAEXPAVQMouseEvent@@@Z, ? mousePressEvent@QMenu@@MAEXPAVQMouseEvent@@@Z, ? mouseMoveEvent@QMenu@@MAEXPAVQMouseEvent@@@Z, ? wheelEvent@QMenu@@MAEXPAVQWheelEvent@@@Z, ? enterEvent@QMenu@@MAEXPAVQEvent@@@Z, ? leaveEvent@QMenu@@MAEXPAVQEvent@@@Z, ? hideEvent@QMenu@@MAEXPAVQHideEvent@@@Z, ? paintEvent@QMenu@@MAEXPAVQPaintEvent@@@Z, ? actionEvent@QMenu@@MAEXPAVQActionEvent@@@Z, ? timerEvent@QMenu@@MAEXPAVQTimerEvent@@@Z, ? event@QMenu@@MAE_NPAVQEvent@@@Z, ? focusNextPrevChild@QMenu@@MAE_N_N@Z, ? isBlockedByModal@QApplicationPrivate@@SA_NPAVQWidget@@@Z, ? addAction@QMenuBar@@QAEPAVQAction@@ABVQString@@@Z, ? addMenu@QMenuBar@@QAEPAVQAction@@PAVQMenu@@@Z, ? addSeparator@QMenuBar@@QAEPAVQAction@@XZ, ? enterWhatsThisMode@QWhatsThis@@SAXXZ, ? leaveWhatsThisMode@QWhatsThis@@SAXXZ, ? staticMetaObject@QWidget@@2UQMetaObject@@B, ? qt_metacall@QFileSystemModel@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QFileSystemModel@@UAEPAXPBD@Z, ? staticMetaObject@QFileSystemModel@@2UQMetaObject@@B, ? setEscapeButton@QMessageBox@@QAEXW4StandardButton@1@@Z, ? flags@QFileSystemModel@@UBE?AV? $QFlags@W4ItemFlag@Qt@@@@ABVQModelIndex@@@Z, ? data@QFileSystemModel@@UBE?AVQVariant@@ABVQModelIndex@@H@Z, ? setHeightForWidth@QSizePolicy@@QAEX_N@Z, ? move@QWidget@@QAEXABVQPoint@@@Z, ?show@QWidget@@QAEXXZ, ? windowOpacity@QWidget@@QBENXZ, ?setWindowOpacity@QWidget@@QAEXN@Z, ? setFixedHeight@QWidget@@QAEXH@Z, ?setFixedWidth@QWidget@@QAEXH@Z, ? y@QWidget@@QBEHXZ, ?x@QWidget@@QBEHXZ, ?height@QWidget@@QBEHXZ, ? width@QWidget@@QBEHXZ, ? setWindowTitle@QMessageBox@@QAEXABVQString@@@Z, ? setButtonText@QMessageBox@@QAEXHABVQString@@@Z, ? setIcon@QMessageBox@@QAEXW4Icon@1@@Z, ? setText@QMessageBox@@QAEXABVQString@@@Z, ? setDefaultButton@QMessageBox@@QAEXW4StandardButton@1@@Z, ? setStandardButtons@QMessageBox@@QAEXV? $QFlags@W4StandardButton@QMessageBox@@@@@Z, ?? 1QMessageBox@@UAE@XZ, ??0QMessageBox@@QAE@PAVQWidget@@@Z, ? eventFilter@QDialog@@MAE_NPAVQObject@@PAVQEvent@@@Z, ? contextMenuEvent@QDialog@@MAEXPAVQContextMenuEvent@@@Z, ? resizeEvent@QDialog@@MAEXPAVQResizeEvent@@@Z, ?

Copyright Joe Security LLC 2019 Page 18 of 34 DLL IhmaspCohrtildren@QFileSystemModel@@UBE_NABVQModelIndex@@@Z, ? setFilter@QFileSystemModel@@QAEXV?$QFlags@W4Filter@QDir@@@@@Z, ? setRootPath@QFileSystemModel@@QAE?AVQModelIndex@@ABVQString@@@Z, ? setIconProvider@QFileSystemModel@@QAEXPAVQFileIconProvider@@@Z, ?? 0QFileSystemModel@@QAE@PAVQObject@@@Z, ?type@QFileIconProvider@@UBE? AVQString@@ABVQFileInfo@@@Z, ?icon@QFileIconProvider@@UBE? AVQIcon@@ABVQFileInfo@@@Z, ?icon@QFileIconProvider@@UBE? AVQIcon@@W4IconType@1@@Z, ?setOptions@QFileIconProvider@@QAEXV? $QFlags@W4Option@QFileIconProvider@@@@@Z, ??1QFileIconProvider@@UAE@XZ, ??0QFileIconProvider@@QAE@XZ, ? sort@QFileSystemModel@@UAEXHW4SortOrder@Qt@@@Z, ? canFetchMore@QFileSystemModel@@UBE_NABVQModelIndex@@@Z, ? fetchMore@QFileSystemModel@@UAEXABVQModelIndex@@@Z, ? supportedDropActions@QFileSystemModel@@UBE?AV? $QFlags@W4DropAction@Qt@@@@XZ, ? dropMimeData@QFileSystemModel@@UAE_NPBVQMimeData@@W4DropAction@Qt@@ HHABVQModelIndex@@@Z, ? mimeData@QFileSystemModel@@UBEPAVQMimeData@@ABV? $QList@VQModelIndex@@@@@Z, ?mimeTypes@QFileSystemModel@@UBE? AVQStringList@@XZ, ?headerData@QFileSystemModel@@UBE? AVQVariant@@HW4Orientation@Qt@@H@Z, ? setData@QFileSystemModel@@UAE_NABVQModelIndex@@ABVQVariant@@H@Z, ? columnCount@QFileSystemModel@@UBEHABVQModelIndex@@@Z, ? rowCount@QFileSystemModel@@UBEHABVQModelIndex@@@Z, ? sibling@QFileSystemModel@@UBE?AVQModelIndex@@HHABV2@@Z, ? parent@QFileSystemModel@@UBE?AVQModelIndex@@ABV2@@Z, ? index@QFileSystemModel@@UBE?AVQModelIndex@@HHABV2@@Z, ? timerEvent@QFileSystemModel@@MAEXPAVQTimerEvent@@@Z, ? event@QFileSystemModel@@MAE_NPAVQEvent@@@Z, ? index@QFileSystemModel@@QBE?AVQModelIndex@@ABVQString@@H@Z, ? window@QWidget@@QBEPAV1@XZ, ?winId@QWidget@@QBEIXZ, ? sizeHint@QWidget@@UBE?AVQSize@@XZ, ?minimumSizeHint@QWidget@@UBE? AVQSize@@XZ, ?resizeEvent@QWidget@@MAEXPAVQResizeEvent@@@Z, ?? 0QMainWindow@@QAE@PAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z, ??1QMainWindow@@UAE@XZ, ? createPopupMenu@QMainWindow@@UAEPAVQMenu@@XZ, ? contextMenuEvent@QMainWindow@@MAEXPAVQContextMenuEvent@@@Z, ? event@QMainWindow@@MAE_NPAVQEvent@@@Z, ? staticMetaObject@QMainWindow@@2UQMetaObject@@B, ? qt_metacast@QMainWindow@@UAEPAXPBD@Z, ? qt_metacall@QMainWindow@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ?? 0QApplication@@QAE@AAHPAPADH@Z, ??1QApplication@@UAE@XZ, ? notify@QApplication@@UAE_NPAVQObject@@PAVQEvent@@@Z, ? event@QApplication@@MAE_NPAVQEvent@@@Z, ? compressEvent@QApplication@@MAE_NPAVQEvent@@PAVQObject@@PAVQPostEvent List@@@Z, ?qt_metacast@QApplication@@UAEPAXPBD@Z, ? qt_metacall@QApplication@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? staticMetaObject@QApplication@@2UQMetaObject@@B, ? setAttribute@QWidget@@QAEXW4WidgetAttribute@Qt@@_N@Z, ? windowHandle@QWidget@@QBEPAVQWindow@@XZ, ?finished@QDialog@@QAEXH@Z, ?metaObject@QMessageBox@@UBEPBUQMetaObject@@XZ, ? qt_metacast@QMessageBox@@UAEPAXPBD@Z, ? qt_metacall@QMessageBox@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ?? 0QMessageBox@@QAE@W4Icon@0@ABVQString@@1V? $QFlags@W4StandardButton@QMessageBox@@@@PAVQWidget@@V? $QFlags@W4WindowType@Qt@@@@@Z, ? addButton@QMessageBox@@QAEPAVQPushButton@@ABVQString@@W4ButtonRole@1 @@Z, ?setDefaultButton@QMessageBox@@QAEXPAVQPushButton@@@Z, ? event@QMessageBox@@MAE_NPAVQEvent@@@Z, ? resizeEvent@QMessageBox@@MAEXPAVQResizeEvent@@@Z, ? showEvent@QMessageBox@@MAEXPAVQShowEvent@@@Z, ? keyPressEvent@QDialog@@MAEXPAVQKeyEvent@@@Z, ?reject@QDialog@@UAEXXZ, ?accept@QDialog@@UAEXXZ, ?done@QDialog@@UAEXH@Z, ? exec@QDialog@@UAEHXZ, ?open@QDialog@@UAEXXZ, ? minimumSizeHint@QDialog@@UBE?AVQSize@@XZ, ?sizeHint@QDialog@@UBE? AVQSize@@XZ, ?setVisible@QDialog@@UAEX_N@Z, ? focusNextPrevChild@QWidget@@MAE_N_N@Z, ?inputMethodQuery@QWidget@@UBE? AVQVariant@@W4InputMethodQuery@Qt@@@Z, ? inputMethodEvent@QWidget@@MAEXPAVQInputMethodEvent@@@Z, ? sharedPainter@QWidget@@MBEPAVQPainter@@XZ, ? redirected@QWidget@@MBEPAVQPaintDevice@@PAVQPoint@@@Z, ? initPainter@QWidget@@MBEXPAVQPainter@@@Z, ? metric@QWidget@@MBEHW4PaintDeviceMetric@QPaintDevice@@@Z, ? changeEvent@QWidget@@MAEXPAVQEvent@@@Z, ? nativeEvent@QWidget@@MAE_NABVQByteArray@@PAXPAJ@Z, ? hideEvent@QWidget@@MAEXPAVQHideEvent@@@Z, ? dropEvent@QWidget@@MAEXPAVQDropEvent@@@Z, ? dragLeaveEvent@QWidget@@MAEXPAVQDragLeaveEvent@@@Z, ? buttonRole@QMessageBox@@QBE?AW4ButtonRole@1@PAVQAbstractButton@@@Z, ? standardButton@QMessageBox@@QBE? AW4StandardButton@1@PAVQAbstractButton@@@Z, ? closeEvent@QMessageBox@@MAEXPAVQCloseEvent@@@Z, ? keyPressEvent@QMessageBox@@MAEXPAVQKeyEvent@@@Z, ? changeEvent@QMessageBox@@MAEXPAVQEvent@@@Z, ? information@QMessageBox@@SA? AW4StandardButton@1@PAVQWidget@@ABVQString@@1W421@2@Z, ? getOpenFileName@QFileDialog@@SA? AVQString@@PAVQWidget@@ABV2@11PAV2@V? $QFlags@W4Option@QFileDialog@@@@@Z, ?getExistingDirectory@QFileDialog@@SA? AVQString@@PAVQWidget@@ABV2@1V?$QFlags@W4Option@QFileDialog@@@@@Z, ?setInformativeText@QMessageBox@@QAEXABVQString@@@Z, ?? Copyright Joe Security LLC 2019 Page 19 of 34 DLL I0mQpSoizret Policy@@QAE@W4Policy@0@0W4ControlType@0@@Z, ? keyReleaseEvent@QWidget@@MAEXPAVQKeyEvent@@@Z, ? hasHeightForWidth@QSizePolicy@@QBE_NXZ, ? setHorizontalStretch@QSizePolicy@@QAEXH@Z, ? setVerticalStretch@QSizePolicy@@QAEXH@Z, ? setMinimumSize@QWidget@@QAEXABVQSize@@@Z, ? setFocusPolicy@QWidget@@QAEXW4FocusPolicy@Qt@@@Z, ? setVisible@QWidget@@UAEX_N@Z, ?sizePolicy@QWidget@@QBE? AVQSizePolicy@@XZ, ?setSizePolicy@QWidget@@QAEXVQSizePolicy@@@Z, ? keyPressEvent@QWidget@@MAEXPAVQKeyEvent@@@Z, ? closeEvent@QWidget@@MAEXPAVQCloseEvent@@@Z, ? contextMenuEvent@QWidget@@MAEXPAVQContextMenuEvent@@@Z, ? showEvent@QWidget@@MAEXPAVQShowEvent@@@Z, ? addWidget@QLayout@@QAEXPAVQWidget@@@Z, ?? 0QDialog@@QAE@PAVQWidget@@V?$QFlags@W4WindowType@Qt@@@@@Z, ?? 1QDialog@@UAE@XZ, ?showEvent@QDialog@@MAEXPAVQShowEvent@@@Z, ? setContentsMargins@QLayout@@QAEXHHHH@Z, ?geometry@QLayout@@UBE? AVQRect@@XZ, ?indexOf@QLayout@@UBEHPAVQWidget@@@Z, ? isEmpty@QLayout@@UBE_NXZ, ?controlTypes@QLayout@@UBE?AV? $QFlags@W4ControlType@QSizePolicy@@@@XZ, ?layout@QLayout@@UAEPAV1@XZ, ?childEvent@QLayout@@MAEXPAVQChildEvent@@@Z, ? widget@QLayoutItem@@UAEPAVQWidget@@XZ, ? spacerItem@QLayoutItem@@UAEPAVQSpacerItem@@XZ, ? addItem@QBoxLayout@@UAEXPAVQLayoutItem@@@Z, ? setSpacing@QBoxLayout@@QAEXH@Z, ?sizeHint@QBoxLayout@@UBE? AVQSize@@XZ, ?minimumSize@QBoxLayout@@UBE?AVQSize@@XZ, ? maximumSize@QBoxLayout@@UBE?AVQSize@@XZ, ? hasHeightForWidth@QBoxLayout@@UBE_NXZ, ? heightForWidth@QBoxLayout@@UBEHH@Z, ? minimumHeightForWidth@QBoxLayout@@UBEHH@Z, ? expandingDirections@QBoxLayout@@UBE?AV?$QFlags@W4Orientation@Qt@@@@XZ, ?invalidate@QBoxLayout@@UAEXXZ, ? itemAt@QBoxLayout@@UBEPAVQLayoutItem@@H@Z, ? takeAt@QBoxLayout@@UAEPAVQLayoutItem@@H@Z, ? count@QBoxLayout@@UBEHXZ, ? setGeometry@QBoxLayout@@UAEXABVQRect@@@Z, ? metaObject@QVBoxLayout@@UBEPBUQMetaObject@@XZ, ? qt_metacast@QVBoxLayout@@UAEPAXPBD@Z, ? qt_metacall@QVBoxLayout@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ?? 0QVBoxLayout@@QAE@PAVQWidget@@@Z, ??1QVBoxLayout@@UAE@XZ, ? staticMetaObject@QDialog@@2UQMetaObject@@B, ? qt_metacast@QDialog@@UAEPAXPBD@Z, ? qt_metacall@QDialog@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? setFont@QApplication@@SAXABVQFont@@PBD@Z, ? setWindowIcon@QApplication@@SAXABVQIcon@@@Z, ?exec@QApplication@@SAHXZ, ?critical@QMessageBox@@SA? AW4StandardButton@1@PAVQWidget@@ABVQString@@1V? $QFlags@W4StandardButton@QMessageBox@@@@W421@@Z, ?? 1QFileSystemModel@@UAE@XZ, ?devType@QWidget@@UBEHXZ, ? setWindowModality@QWidget@@QAEXW4WindowModality@Qt@@@Z, ? setWindowTitle@QWidget@@QAEXABVQString@@@Z, ?close@QWidget@@QAE_NXZ, ? heightForWidth@QWidget@@UBEHH@Z, ?hasHeightForWidth@QWidget@@UBE_NXZ, ? setWindowFlags@QWidget@@QAEXV?$QFlags@W4WindowType@Qt@@@@@Z, ? paintEngine@QWidget@@UBEPAVQPaintEngine@@XZ, ? event@QWidget@@MAE_NPAVQEvent@@@Z, ? mousePressEvent@QWidget@@MAEXPAVQMouseEvent@@@Z, ? mouseReleaseEvent@QWidget@@MAEXPAVQMouseEvent@@@Z, ? mouseDoubleClickEvent@QWidget@@MAEXPAVQMouseEvent@@@Z, ? mouseMoveEvent@QWidget@@MAEXPAVQMouseEvent@@@Z, ? wheelEvent@QWidget@@MAEXPAVQWheelEvent@@@Z, ? dragMoveEvent@QWidget@@MAEXPAVQDragMoveEvent@@@Z Qt5WinExtras.dll ?addItem@QWinJumpListCategory@@QAEXPAVQWinJumpListItem@@@Z, ? setTitle@QWinJumpListCategory@@QAEXABVQString@@@Z, ? setVisible@QWinJumpListCategory@@QAEX_N@Z, ?? 0QWinJumpListCategory@@QAE@ABVQString@@@Z, ? setArguments@QWinJumpListItem@@QAEXABVQStringList@@@Z, ? setTitle@QWinJumpListItem@@QAEXABVQString@@@Z, ? setIcon@QWinJumpListItem@@QAEXABVQIcon@@@Z, ? setFilePath@QWinJumpListItem@@QAEXABVQString@@@Z, ?? 0QWinJumpListItem@@QAE@W4Type@0@@Z, ? addCategory@QWinJumpList@@QAEXPAVQWinJumpListCategory@@@Z, ?? 1QWinJumpList@@UAE@XZ, ??0QWinJumpList@@QAE@PAVQObject@@@Z, ? qt_metacall@QWinJumpList@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QWinJumpList@@UAEPAXPBD@Z, ? metaObject@QWinJumpList@@UBEPBUQMetaObject@@XZ, ? setCurrentProcessExplicitAppUserModelID@QtWin@@YAXABVQString@@@Z Qt5Gui.dll ?geometry@QWindow@@QBE?AVQRect@@XZ, ?setPointSize@QFont@@QAEXH@Z, ?? 1QIcon@@QAE@XZ, ??0QIcon@@QAE@ABVQString@@@Z, ? staticMetaObject@QWindow@@2UQMetaObject@@B, ? screenChanged@QWindow@@QAEXPAVQScreen@@@Z, ? show@QWindow@@QAEXXZ, ?requestActivate@QWindow@@QAEXXZ, ? screen@QWindow@@QBEPAVQScreen@@XZ, ? staticMetaObject@QScreen@@2UQMetaObject@@B, ? staticMetaObject@QGuiApplication@@2UQMetaObject@@B, ?name@QScreen@@QBE? AVQString@@XZ, ? applicationStateChanged@QGuiApplication@@QAEXW4ApplicationState@Qt@@@Z, ?? 1QFont@@QAE@XZ, ??0QFont@@QAE@ABVQString@@HH_N@Z, ? addApplicationFont@QFontDatabase@@SAHABVQString@@@Z, ? globalShareContext@QOpenGLContext@@SAPAV1@XZ, ? create@QOpenGLContext@@QAE_NXZ, ?

Copyright Joe Security LLC 2019 Page 20 of 34 DLL IsmetpSocrrteen@QOpenGLContext@@QAEXPAVQScreen@@@Z, ? setShareContext@QOpenGLContext@@QAEXPAV1@@Z, ? setFormat@QOpenGLContext@@QAEXABVQSurfaceFormat@@@Z, ?? 1QOpenGLContext@@UAE@XZ, ??0QOpenGLContext@@QAE@PAVQObject@@@Z, ? defaultFormat@QSurfaceFormat@@SA?AV1@XZ, ??1QSurfaceFormat@@QAE@XZ, ? primaryScreen@QGuiApplication@@SAPAVQScreen@@XZ, ? setTransientParent@QWindow@@QAEXPAV1@@Z, ? openUrl@QDesktopServices@@SA_NABVQUrl@@@Z, ? windowPos@QMouseEvent@@QBEABVQPointF@@XZ, ? logicalDpiX@QPaintDevice@@QBEHXZ, ? surfaceHandle@QWindow@@EBEPAVQPlatformSurface@@XZ, ? nativeEvent@QWindow@@MAE_NABVQByteArray@@PAXPAJ@Z, ? tabletEvent@QWindow@@MAEXPAVQTabletEvent@@@Z, ? touchEvent@QWindow@@MAEXPAVQTouchEvent@@@Z, ? moveEvent@QWindow@@MAEXPAVQMoveEvent@@@Z, ? visibleChanged@QWindow@@QAEX_N@Z, ?close@QWindow@@QAE_NXZ, ? flags@QWindow@@QBE?AV?$QFlags@W4WindowType@Qt@@@@XZ, ? setFlags@QWindow@@QAEXV?$QFlags@W4WindowType@Qt@@@@@Z, ? format@QWindow@@UBE?AVQSurfaceFormat@@XZ, ?surfaceType@QWindow@@UBE? AW4SurfaceType@QSurface@@XZ, ?size@QWindow@@UBE?AVQSize@@XZ, ?? 0QWindow@@QAE@PAVQScreen@@@Z, ??1QWindow@@UAE@XZ, ? metaObject@QWindow@@UBEPBUQMetaObject@@XZ, ? qt_metacast@QWindow@@UAEPAXPBD@Z, ? qt_metacall@QWindow@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? event@QWindow@@MAE_NPAVQEvent@@@Z, ? accessibleRoot@QWindow@@UBEPAVQAccessibleInterface@@XZ, ? focusObject@QWindow@@UBEPAVQObject@@XZ, ? exposeEvent@QWindow@@MAEXPAVQExposeEvent@@@Z, ? resizeEvent@QWindow@@MAEXPAVQResizeEvent@@@Z, ? focusInEvent@QWindow@@MAEXPAVQFocusEvent@@@Z, ? focusOutEvent@QWindow@@MAEXPAVQFocusEvent@@@Z, ? showEvent@QWindow@@MAEXPAVQShowEvent@@@Z, ? hideEvent@QWindow@@MAEXPAVQHideEvent@@@Z, ? keyPressEvent@QWindow@@MAEXPAVQKeyEvent@@@Z, ? keyReleaseEvent@QWindow@@MAEXPAVQKeyEvent@@@Z, ? mousePressEvent@QWindow@@MAEXPAVQMouseEvent@@@Z, ? mouseReleaseEvent@QWindow@@MAEXPAVQMouseEvent@@@Z, ? mouseDoubleClickEvent@QWindow@@MAEXPAVQMouseEvent@@@Z, ? mouseMoveEvent@QWindow@@MAEXPAVQMouseEvent@@@Z, ? wheelEvent@QWindow@@MAEXPAVQWheelEvent@@@Z, ? setOverrideCursor@QGuiApplication@@SAXABVQCursor@@@Z, ?? 0QCursor@@QAE@W4CursorShape@Qt@@@Z, ??1QCursor@@QAE@XZ, ? restoreOverrideCursor@QGuiApplication@@SAXXZ, ? clipboard@QGuiApplication@@SAPAVQClipboard@@XZ, ? setText@QClipboard@@QAEXABVQString@@W4Mode@1@@Z, ?? 4QColor@@QAEAAV0@$$QAV0@@Z, ?winId@QWindow@@QBEIXZ, ? key@QKeyEvent@@QBEHXZ, ?button@QMouseEvent@@QBE? AW4MouseButton@Qt@@XZ, ?screens@QGuiApplication@@SA?AV? $QList@PAVQScreen@@@@XZ, ?pos@QCursor@@SA? AVQPoint@@PBVQScreen@@@Z, ?availableGeometry@QScreen@@QBE? AVQRect@@XZ, ?width@QWindow@@QBEHXZ, ?height@QWindow@@QBEHXZ, ? setX@QWindow@@QAEXH@Z, ?setY@QWindow@@QAEXH@Z, ?? 0QColor@@QAE@XZ, ??0QColor@@QAE@ABV0@@Z, ?? 8QColor@@QBE_NABV0@@Z, ??4QColor@@QAEAAV0@ABV0@@Z, ? setRenderHints@QPainter@@QAEXV?$QFlags@W4RenderHint@QPainter@@@@_N@Z, ?fillRect@QPainter@@QAEXABVQRectF@@ABVQColor@@@Z, ? platformNativeInterface@QGuiApplication@@SAPAVQPlatformNativeInterface@@XZ, ?? 1QStatusTipEvent@@UAE@XZ, ??0QStatusTipEvent@@QAE@ABVQString@@@Z, ? qt_pixmapToWinHBITMAP@@YAPAUHBITMAP__@@ABVQPixmap@@H@Z, ?? 1QPainter@@QAE@XZ, ??0QPainter@@QAE@PAVQPaintDevice@@@Z, ? isEmpty@QKeySequence@@QBE_NXZ, ??1QKeySequence@@QAE@XZ, ?? 0QKeySequence@@QAE@XZ, ?? 0QKeySequence@@QAE@ABVQString@@W4SequenceFormat@0@@Z, ? blue@QColor@@QBEHXZ, ?green@QColor@@QBEHXZ, ?red@QColor@@QBEHXZ, ?? 0QColor@@QAE@W4GlobalColor@Qt@@@Z, ??0QColor@@QAE@HHHH@Z, ?? 4QFont@@QAEAAV0@$$QAV0@@Z, ??4QCursor@@QAEAAV0@$$QAV0@@Z, ?? 4QPixmap@@QAEAAV0@$$QAV0@@Z, ??0QColor@@QAE@$$QAV0@@Z, ? setBold@QFont@@QAEX_N@Z, ?italic@QFont@@QBE_NXZ, ?? 0QCursor@@QAE@$$QAV0@@Z, ??0QFont@@QAE@ABV0@@Z, ?? 0QFont@@QAE@XZ, ?family@QFont@@QBE?AVQString@@XZ, ? pointSize@QFont@@QBEHXZ, ?weight@QFont@@QBEHXZ, ? underline@QFont@@QBE_NXZ, ?setUnderline@QFont@@QAEX_N@Z, ? strikeOut@QFont@@QBE_NXZ, ?setStrikeOut@QFont@@QAEX_N@Z, ?? 0QPixmap@@QAE@ABV0@@Z, ??0QCursor@@QAE@ABV0@@Z, ?? 0QCursor@@QAE@XZ, ?shape@QCursor@@QBE?AW4CursorShape@Qt@@XZ, ? logicalDpiY@QPaintDevice@@QBEHXZ, ??0QRegion@@QAE@$$QAV0@@Z, ? isActive@QHighDpiScaling@@SA_NXZ, ??0QRegion@@QAE@ABV0@@Z, ?? 0QRegion@@QAE@XZ, ??1QRegion@@QAE@XZ, ? begin@QRegion@@QBEPBVQRect@@XZ, ?end@QRegion@@QBEPBVQRect@@XZ, ?? YQRegion@@QAEAAV0@ABVQRect@@@Z, ?m_active@QHighDpiScaling@@0_NA, ? shared_empty@QRegion@@0UQRegionData@1@B, ? scaleAndOrigin@QHighDpiScaling@@SA? AUScaleAndOrigin@1@PBVQWindow@@PAVQPoint@@@Z, ? devicePixelRatioF@QPaintDevice@@QBENXZ, ? color@QPalette@@QBEABVQColor@@W4ColorRole@1@@Z, ?? 4QKeySequence@@QAEAAV0@$$QAV0@@Z, ? drawPixmap@QPainter@@QAEXHHABVQPixmap@@@Z, ?? 0QIcon@@QAE@ABVQPixmap@@@Z, ??BQFont@@QBE?AVQVariant@@XZ, ? reason@QFocusEvent@@QBE?AW4FocusReason@Qt@@XZ, ? showModalWindow@QGuiApplicationPrivate@@SAXPAVQWindow@@@Z, ? hideModalWindow@QGuiApplicationPrivate@@SAXPAVQWindow@@@Z, ? Copyright Joe Security LLC 2019 Page 21 of 34 DLL Iqmt_ppoixrmt apFromWinHBITMAP@@YA?AVQPixmap@@PAUHBITMAP__@@H@Z, ?? 0QMouseEvent@@QAE@W4Type@QEvent@@ABVQPointF@@1W4MouseButton@Qt@ @V?$QFlags@W4MouseButton@Qt@@@@V? $QFlags@W4KeyboardModifier@Qt@@@@@Z, ??1QMouseEvent@@UAE@XZ, ?? 0QPixmap@@QAE@ABVQSize@@@Z, ??0QPixmap@@QAE@XZ, ?? 1QPixmap@@UAE@XZ, ?isNull@QPixmap@@QBE_NXZ, ?width@QPixmap@@QBEHXZ, ?height@QPixmap@@QBEHXZ, ?fill@QPixmap@@QAEXABVQColor@@@Z, ? setDevicePixelRatio@QPixmap@@QAEXN@Z Qt5Qml.dll ?engine@QQmlContext@@QBEPAVQQmlEngine@@XZ, ? contextForObject@QQmlEngine@@SAPAVQQmlContext@@PBVQObject@@@Z, ? qmlContext@QtQml@@YAPAVQQmlContext@@PBVQObject@@@Z, ? setData@QQmlComponent@@QAEXABVQByteArray@@ABVQUrl@@@Z, ?? 0QQmlComponent@@QAE@PAVQQmlEngine@@PAVQObject@@@Z, ? qmlEngine@QtQml@@YAPAVQQmlEngine@@PBVQObject@@@Z, ? qdeclarativeelement_destructor@QQmlPrivate@@YAXPAVQObject@@@Z, ? toBool@QJSValue@@QBE_NXZ, ??0QJSValue@@QAE@H@Z, ? qmlregister@QQmlPrivate@@YAHW4RegistrationType@1@PAX@Z, ? qmlunregister@QQmlPrivate@@YAXW4RegistrationType@1@I@Z, ?? 4QJSValue@@QAEAAV0@$$QAV0@@Z, ??0QJSValue@@QAE@_N@Z, ?? 0QJSValue@@QAE@ABV0@@Z, ??0QJSValue@@QAE@W4SpecialValue@0@@Z, ?? 4QJSValue@@QAEAAV0@ABV0@@Z, ?isCallable@QJSValue@@QBE_NXZ, ? call@QJSValue@@QAE?AV1@ABV?$QList@VQJSValue@@@@@Z, ?? 0QQmlError@@QAE@ABV0@@Z, ??1QQmlError@@QAE@XZ, ? toString@QQmlError@@QBE?AVQString@@XZ, ??1QJSValue@@QAE@XZ, ? qt_metacast@QQmlComponent@@UAEPAXPBD@Z, ? qt_metacall@QQmlComponent@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ?? 0QQmlComponent@@QAE@PAVQQmlEngine@@ABVQString@@W4CompilationMode@0 @PAVQObject@@@Z, ??1QQmlComponent@@UAE@XZ, ? errors@QQmlComponent@@QBE?AV?$QList@VQQmlError@@@@XZ, ? create@QQmlComponent@@UAEPAVQObject@@PAVQQmlContext@@@Z, ? beginCreate@QQmlComponent@@UAEPAVQObject@@PAVQQmlContext@@@Z, ? completeCreate@QQmlComponent@@UAEXXZ, ??0QQmlParserStatus@@QAE@XZ, ?? 1QQmlParserStatus@@UAE@XZ, ? rootContext@QQmlEngine@@QBEPAVQQmlContext@@XZ, ?? 0QQmlApplicationEngine@@QAE@PAVQObject@@@Z, ?? 1QQmlApplicationEngine@@UAE@XZ, ? load@QQmlApplicationEngine@@QAEXABVQUrl@@@Z, ? objectCreated@QQmlApplicationEngine@@QAEXPAVQObject@@ABVQUrl@@@Z, ? staticMetaObject@QQmlApplicationEngine@@2UQMetaObject@@B, ? setContextProperty@QQmlContext@@QAEXABVQString@@ABVQVariant@@@Z, ? metaObject@QQmlComponent@@UBEPBUQMetaObject@@XZ, ? setContextProperty@QQmlContext@@QAEXABVQString@@PAVQObject@@@Z

Copyright Joe Security LLC 2019 Page 22 of 34 DLL Import Qt5Network.dll ?setHeader@QNetworkRequest@@QAEXW4KnownHeaders@1@ABVQVariant@@@Z, ? protocol@QHostAddress@@QBE?AW4NetworkLayerProtocol@QAbstractSocket@@XZ, ?? 1QHostAddress@@QAE@XZ, ??0QHostAddress@@QAE@ABVQString@@@Z, ? isNull@QHostAddress@@QBE_NXZ, ? setAttribute@QNetworkRequest@@QAEXW4Attribute@1@ABVQVariant@@@Z, ? setDefaultConfiguration@QSslConfiguration@@SAXABV1@@Z, ? setPeerVerifyMode@QSslConfiguration@@QAEXW4PeerVerifyMode@QSslSocket@@@Z, ??1QSslConfiguration@@QAE@XZ, ?defaultConfiguration@QSslConfiguration@@SA? AV1@XZ, ??0QNetworkRequest@@QAE@ABVQUrl@@@Z, ?? 1QNetworkRequest@@QAE@XZ, ? staticMetaObject@QNetworkAccessManager@@2UQMetaObject@@B, ? url@QNetworkReply@@QBE?AVQUrl@@XZ, ?attribute@QNetworkReply@@QBE? AVQVariant@@W4Attribute@QNetworkRequest@@@Z, ? finished@QNetworkAccessManager@@QAEXPAVQNetworkReply@@@Z, ? user@QNetworkProxy@@QBE?AVQString@@XZ, ?password@QNetworkProxy@@QBE? AVQString@@XZ, ?applicationProxy@QNetworkProxy@@SA?AV1@XZ, ?? 0QLocalSocket@@QAE@PAVQObject@@@Z, ??1QLocalSocket@@UAE@XZ, ? connectToServer@QLocalSocket@@QAEXABVQString@@V? $QFlags@W4OpenModeFlag@QIODevice@@@@@Z, ? waitForConnected@QLocalSocket@@QAE_NH@Z, ? staticMetaObject@QLocalServer@@2UQMetaObject@@B, ? newConnection@QLocalServer@@QAEXXZ, ?? 0QLocalServer@@QAE@PAVQObject@@@Z, ??1QLocalServer@@UAE@XZ, ? close@QLocalServer@@QAEXXZ, ?isListening@QLocalServer@@QBE_NXZ, ? listen@QLocalServer@@QAE_NABVQString@@@Z, ? removeServer@QLocalServer@@SA_NABVQString@@@Z, ? error@QNetworkReply@@QBE?AW4NetworkError@1@XZ, ? finished@QNetworkReply@@QAEXXZ, ? staticMetaObject@QNetworkReply@@2UQMetaObject@@B, ? metaObject@QNetworkAccessManager@@UBEPBUQMetaObject@@XZ, ? qt_metacast@QNetworkAccessManager@@UAEPAXPBD@Z, ? qt_metacall@QNetworkAccessManager@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ??0QNetworkAccessManager@@QAE@PAVQObject@@@Z, ? get@QNetworkAccessManager@@QAEPAVQNetworkReply@@ABVQNetworkRequest@@ @Z, ? post@QNetworkAccessManager@@QAEPAVQNetworkReply@@ABVQNetworkRequest@ @ABVQByteArray@@@Z, ? createRequest@QNetworkAccessManager@@MAEPAVQNetworkReply@@W4Operation@1 @ABVQNetworkRequest@@PAVQIODevice@@@Z, ?? 4QNetworkProxy@@QAEAAV0@$$QAV0@@Z, ?? 1QNetworkAccessManager@@UAE@XZ, ? setApplicationProxy@QNetworkProxy@@SAXABV1@@Z, ? port@QNetworkProxy@@QBEGXZ, ?setPort@QNetworkProxy@@QAEXG@Z, ? hostName@QNetworkProxy@@QBE?AVQString@@XZ, ? setHostName@QNetworkProxy@@QAEXABVQString@@@Z, ? setPassword@QNetworkProxy@@QAEXABVQString@@@Z, ? setUser@QNetworkProxy@@QAEXABVQString@@@Z, ?type@QNetworkProxy@@QBE? AW4ProxyType@1@XZ, ?setType@QNetworkProxy@@QAEXW4ProxyType@1@@Z, ?? 1QNetworkProxy@@QAE@XZ, ??4QNetworkProxy@@QAEAAV0@ABV0@@Z, ?? 0QNetworkProxy@@QAE@XZ, ?? 0QNetworkProxy@@QAE@W4ProxyType@0@ABVQString@@G11@Z, ?? 0QNetworkProxy@@QAE@ABV0@@Z, ??9QNetworkProxy@@QBE_NABV0@@Z Qt5Core.dll ?split@QByteArray@@QBE?AV?$QList@VQByteArray@@@@D@Z, ? replace@QByteArray@@QAEAAV1@HHPBD@Z, ?number@QByteArray@@SA? AV1@HH@Z, ?prepend@QByteArray@@QAEAAV1@ABV1@@Z, ? chop@QByteArray@@QAEXH@Z, ?endsWith@QByteArray@@QBE_ND@Z, ? endsWith@QByteArray@@QBE_NPBD@Z, ?startsWith@QByteArray@@QBE_NPBD@Z, ? lastIndexOf@QByteArray@@QBEHDH@Z, ?indexOf@QByteArray@@QBEHDH@Z, ? number@QByteArray@@SA?AV1@IH@Z, ?receivers@QObject@@IBEHPBD@Z, ? value@QMetaClassInfo@@QBEPBDXZ, ?methodSignature@QMetaMethod@@QBE? AVQByteArray@@XZ, ?typeName@QMetaMethod@@QBEPBDXZ, ? methodType@QMetaMethod@@QBE?AW4MethodType@1@XZ, ? qstrcmp@@YAHPBD0@Z, ? qt_metacall@QAbstractTableModel@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QAbstractTableModel@@UAEPAXPBD@Z, ? staticMetaObject@QAbstractTableModel@@2UQMetaObject@@B, ?? 0QPoint@@QAE@XZ, ?setRight@QRectF@@QAEXN@Z, ? setBottom@QRectF@@QAEXN@Z, ? rowsRemoved@QAbstractItemModel@@QAEXABVQModelIndex@@HHUQPrivateSignal@1 @@Z, ?sortRole@QSortFilterProxyModel@@QBEHXZ, ?setX@QPoint@@QAEXH@Z, ? setY@QPoint@@QAEXH@Z, ?typeName@QMetaType@@SAPBDH@Z, ? sortOrder@QSortFilterProxyModel@@QBE?AW4SortOrder@Qt@@XZ, ? toString@QTime@@QBE?AVQString@@W4DateFormat@Qt@@@Z, ? QStringList_join@QtPrivate@@YA?AVQString@@PBVQStringList@@PBVQChar@@H@Z, ?x@QRectF@@QBENXZ, ?setLeft@QRectF@@QAEXN@Z, ?y@QRectF@@QBENXZ, ? setTop@QRectF@@QAEXN@Z, ?insert@QByteArray@@QAEAAV1@HPBD@Z, ? indexOf@QByteArray@@QBEHPBDH@Z, ?remove@QString@@QAEAAV1@HH@Z, ? append@QString@@QAEAAV1@VQLatin1String@@@Z, ? endsWith@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z, ? left@QString@@QBE?AV1@H@Z, ? lastIndexOf@QString@@QBEHVQLatin1String@@HW4CaseSensitivity@Qt@@@Z, ? indexOf@QString@@QBEHVQLatin1String@@HW4CaseSensitivity@Qt@@@Z, ? truncate@QString@@QAEXH@Z, ??0QString@@QAE@VQChar@@@Z, ? create@QMetaType@@SAPAXHPBX@Z, ? type@QMetaType@@SAHABVQByteArray@@@Z, ? isEnumType@QMetaProperty@@QBE_NXZ, ?userType@QMetaProperty@@QBEHXZ, ? type@QMetaProperty@@QBE?AW4Type@QVariant@@XZ, ? typeName@QMetaProperty@@QBEPBDXZ, ?name@QMetaProperty@@QBEPBDXZ, ? normalizedSignature@QMetaObject@@SA?AVQByteArray@@PBD@Z, ? Copyright Joe Security LLC 2019 Page 23 of 34 DLL IcmlapssoIrntfo@QMetaObject@@QBE?AVQMetaClassInfo@@H@Z, ? property@QMetaObject@@QBE?AVQMetaProperty@@H@Z, ? method@QMetaObject@@QBE?AVQMetaMethod@@H@Z, ? indexOfClassInfo@QMetaObject@@QBEHPBD@Z, ? indexOfProperty@QMetaObject@@QBEHPBD@Z, ? indexOfSlot@QMetaObject@@QBEHPBD@Z, ? indexOfSignal@QMetaObject@@QBEHPBD@Z, ? propertyCount@QMetaObject@@QBEHXZ, ?enumeratorCount@QMetaObject@@QBEHXZ, ?methodCount@QMetaObject@@QBEHXZ, ?propertyOffset@QMetaObject@@QBEHXZ, ? methodOffset@QMetaObject@@QBEHXZ, ? keyToValue@QMetaEnum@@QBEHPBDPA_N@Z, ??0QBitArray@@QAE@H_N@Z, ?? MQUuid@@QBE_NABV0@@Z, ?isNull@QUuid@@QBE_NXZ, ?? 0QUuid@@QAE@ABVQString@@@Z, ?data@QVariant@@QAEPAXXZ, ? nameToType@QVariant@@SA?AW4Type@1@PBD@Z, ? typeName@QVariant@@QBEPBDXZ, ??0QVariant@@QAE@HPBX@Z, ? writeBlob@QMetaStringTable@@QBEXPAD@Z, ? blobSize@QMetaStringTable@@QBEHXZ, ? enter@QMetaStringTable@@QAEHABVQByteArray@@@Z, ?? 0QMetaStringTable@@QAE@ABVQByteArray@@@Z, ?childGroups@QSettings@@QBE? AVQStringList@@XZ, ?endGroup@QSettings@@QAEXXZ, ? beginGroup@QSettings@@QAEXABVQString@@@Z, ? qHash@@YAIABVQByteArray@@I@Z, ?qHash@@YAIABVQUuid@@I@Z, ?? 1QMetaStringTable@@QAE@XZ, ??1QMutexLocker@@QAE@XZ, ?? 0QMutexLocker@@QAE@PAVQBasicMutex@@@Z, ? isValid@QMetaProperty@@QBE_NXZ, ??AQBitArray@@QAE?AVQBitRef@@H@Z, ?? 4QBitRef@@QAEAAV0@_N@Z, ??BQBitRef@@QBE_NXZ, ?? 0QBitRef@@AAE@AAVQBitArray@@H@Z, ??1QBitArray@@QAE@XZ, ?? 4QBitArray@@QAEAAV0@$$QAV0@@Z, ??0QBitArray@@QAE@XZ, ?? BQUuid@@QBE?AU_GUID@@XZ, ??4QUuid@@QAEAAV0@ABU_GUID@@@Z, ?? 0QUuid@@QAE@XZ, ?isDetached@QVariant@@QBE_NXZ, ? data_ptr@QVariant@@QAEAAUPrivate@1@XZ, ?signalsBlocked@QObject@@QBE_NXZ, ?contains@QString@@QBE_NVQLatin1String@@W4CaseSensitivity@Qt@@@Z, ? arg@QString@@QBE?AV1@IHHVQChar@@@Z, ? unicode@QString@@QBEPBVQChar@@XZ, ?fromLatin1@QString@@SA? AV1@ABVQByteArray@@@Z, ??0QEventLoop@@QAE@PAVQObject@@@Z, ?? 0QRectF@@QAE@XZ, ?toTime@QVariant@@QBE?AVQTime@@XZ, ? toPoint@QVariant@@QBE?AVQPoint@@XZ, ?toRect@QVariant@@QBE? AVQRect@@XZ, ?toSize@QVariant@@QBE?AVQSize@@XZ, ? count@QByteArray@@QBEHXZ, ?isNull@QDate@@QBE_NXZ, ? isValid@QDate@@QBE_NXZ, ?minJd@QDate@@CA_JXZ, ?maxJd@QDate@@CA_JXZ, ?isNull@QTime@@QBE_NXZ, ?noquote@QDebug@@QAEAAV1@XZ, ? isValid@QTime@@QBE_NXZ, ?hour@QTime@@QBEHXZ, ?minute@QTime@@QBEHXZ, ?second@QTime@@QBEHXZ, ?msec@QTime@@QBEHXZ, ??0QVariant@@QAE@ABV? $QList@VQVariant@@@@@Z, ??0QVariant@@QAE@M@Z, ?? 0QVariant@@QAE@_J@Z, ??0QVariant@@QAE@W4Type@0@@Z, ? convert@QVariant@@QAE_NH@Z, ?toDouble@QVariant@@QBENPA_N@Z, ? isNull@QDateTime@@QBE_NXZ, ?time@QDateTime@@QBE?AVQTime@@XZ, ? month@QDate@@QBEHXZ, ?day@QDate@@QBEHXZ, ? resize@QByteArray@@QAEXH@Z, ??0QSizeF@@QAE@ABVQSize@@@Z, ?? 0QSizeF@@QAE@NN@Z, ?toSize@QSizeF@@QBE?AVQSize@@XZ, ? toPoint@QPointF@@QBE?AVQPoint@@XZ, ?left@QRect@@QBEHXZ, ? top@QRect@@QBEHXZ, ?topLeft@QRect@@QBE?AVQPoint@@XZ, ?? 0QByteArray@@QAE@UQByteArrayDataPtr@@@Z, ?? 0QPointF@@QAE@ABVQPoint@@@Z, ?isWidgetType@QObject@@QBE_NXZ, ? disconnect@QObject@@QBE_NPBDPBV1@0@Z, ?inherits@QObject@@QBE_NPBD@Z, ??0QSize@@QAE@XZ, ?isValid@QSize@@QBE_NXZ, ?width@QSize@@QBEHXZ, ? height@QSize@@QBEHXZ, ??0QRect@@QAE@ABVQPoint@@ABVQSize@@@Z, ? x@QRect@@QBEHXZ, ?y@QRect@@QBEHXZ, ?size@QRect@@QBE?AVQSize@@XZ, ?timerId@QTimerEvent@@QBEHXZ, ? sendEvent@QCoreApplication@@SA_NPAVQObject@@PAVQEvent@@@Z, ? postEvent@QCoreApplication@@SAXPAVQObject@@PAVQEvent@@H@Z, ? qt_qFindChild_helper@@YAPAVQObject@@PBV1@ABVQString@@ABUQMetaObject@@ V?$QFlags@W4FindChildOption@Qt@@@@@Z, ??0QEvent@@QAE@W4Type@0@@Z, ??1QEvent@@UAE@XZ, ?connect@QMetaObject@@SA? AVConnection@1@PBVQObject@@H0HHPAH@Z, ? lastIndexOf@QString@@QBEHABVQRegularExpression@@H@Z, ? right@QString@@QBE?AV1@H@Z, ??8QString@@QBE_NVQLatin1String@@@Z, ? startTimer@QObject@@QAEHHW4TimerType@Qt@@@Z, ? killTimer@QObject@@QAEXH@Z, ?removeEventFilter@QObject@@QAEXPAV1@@Z, ? toLatin1@QChar@@QBEDXZ, ?toLower@QByteArray@@QGBE?AV1@XZ, ? data@QByteArray@@QBEPBDXZ, ?constData@QByteArray@@QBEPBDXZ, ?? 0QByteRef@@AAE@AAVQByteArray@@H@Z, ??BQByteRef@@QBEDXZ, ?? 4QByteRef@@QAEAAV0@D@Z, ??AQByteArray@@QAE?AVQByteRef@@H@Z, ?? YQByteArray@@QAEAAV0@D@Z, ??YQByteArray@@QAEAAV0@PBD@Z, ?? YQByteArray@@QAEAAV0@ABV0@@Z, ?contains@QByteArray@@QBE_ND@Z, ? contains@QByteArray@@QBE_NPBD@Z, ?replace@QByteArray@@QAEAAV1@PBD0@Z, ?toUpper@QString@@QHAE?AV1@XZ, ?? YQString@@QAEAAV0@VQLatin1String@@@Z, ?toLatin1@QString@@QGBE? AVQByteArray@@XZ, ?toLatin1@QString@@QHAE?AVQByteArray@@XZ, ? interval@QTimer@@QBEHXZ, ??0QRect@@QAE@XZ, ??0QPointF@@QAE@NN@Z, ? installNativeEventFilter@QAbstractEventDispatcher@@QAEXPAVQAbstractNativeEventFilter @@@Z, ?bottom@QRect@@QBEHXZ, ?y@QPoint@@QBEHXZ, ? right@QRect@@QBEHXZ, ?x@QPoint@@QBEHXZ, ? instance@QAbstractEventDispatcher@@SAPAV1@PAVQThread@@@Z, ? removeNativeEventFilter@QAbstractEventDispatcher@@QAEXPAVQAbstractNativeEventFilt er@@@Z, ?height@QRectF@@QBENXZ, ?width@QRectF@@QBENXZ, ? top@QRectF@@QBENXZ, ?left@QRectF@@QBENXZ, ??0QRectF@@QAE@NNNN@Z, ? filterRole@QSortFilterProxyModel@@QBEHXZ, ? sourceModel@QAbstractProxyModel@@QBEPAVQAbstractItemModel@@XZ, ? invalidateFilter@QSortFilterProxyModel@@IAEXXZ, ?

Copyright Joe Security LLC 2019 Page 24 of 34 DLL Iqmt_pmoertacall@QSortFilterProxyModel@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QSortFilterProxyModel@@UAEPAXPBD@Z, ? staticMetaObject@QSortFilterProxyModel@@2UQMetaObject@@B, ? escape@QRegExp@@SA?AVQString@@ABV2@@Z, ?? 0QRegExp@@QAE@ABVQString@@W4CaseSensitivity@Qt@@W4PatternSyntax@0@@ Z, ?qResourceFeatureZlib@@YAEXZ, ?fromLocalFile@QUrl@@SA? AV1@ABVQString@@@Z, ??6QTextStream@@QAEAAV0@ABVQString@@@Z, ? errorString@QIODevice@@QBE?AVQString@@XZ, ?warning@QMessageLogger@@QBE? AVQDebug@@XZ, ?exists@QDir@@QBE_NABVQString@@@Z, ? tempPath@QDir@@SA?AVQString@@XZ, ?invalidate@QElapsedTimer@@QAEXXZ, ? isValid@QElapsedTimer@@QBE_NXZ, ?flags@QAbstractTableModel@@UBE?AV? $QFlags@W4ItemFlag@Qt@@@@ABVQModelIndex@@@Z, ? dropMimeData@QAbstractTableModel@@UAE_NPBVQMimeData@@W4DropAction@Qt@ @HHABVQModelIndex@@@Z, ? hasChildren@QAbstractTableModel@@EBE_NABVQModelIndex@@@Z, ? sibling@QAbstractTableModel@@UBE?AVQModelIndex@@HHABV2@@Z, ? parent@QAbstractTableModel@@EBE?AVQModelIndex@@ABV2@@Z, ? endsWith@QString@@QBE_NVQChar@@W4CaseSensitivity@Qt@@@Z, ? qEnvironmentVariable@@YA?AVQString@@PBDABV1@@Z, ?dir@QFileInfo@@QBE? AVQDir@@XZ, ?canonicalPath@QDir@@QBE?AVQString@@XZ, ? isDir@QFileInfo@@QBE_NXZ, ?topLevelDomain@QUrl@@QBE?AVQString@@V? $QFlags@W4ComponentFormattingOption@QUrl@@@@@Z, ? indexOf@QString@@QBEHABVQRegularExpression@@H@Z, ?host@QUrl@@QBE? AVQString@@V?$QFlags@W4ComponentFormattingOption@QUrl@@@@@Z, ? isValid@QUrl@@QBE_NXZ, ?fromUserInput@QUrl@@SA?AV1@ABVQString@@@Z, ? index@QAbstractTableModel@@UBE?AVQModelIndex@@HHABV2@@Z, ? split@QString@@QBE? AVQStringList@@VQChar@@W4SplitBehavior@1@W4CaseSensitivity@Qt@@@Z, ?? 1QAbstractTableModel@@UAE@XZ, ?? 0QAbstractTableModel@@QAE@PAVQObject@@@Z, ? toUInt@QString@@QBEIPA_NH@Z, ?number@QString@@SA?AV1@IH@Z, ? setPermissions@QFile@@UAE_NV?$QFlags@W4Permission@QFileDevice@@@@@Z, ? permissions@QFile@@UBE?AV?$QFlags@W4Permission@QFileDevice@@@@XZ, ? resize@QFile@@UAE_N_J@Z, ?writeData@QFileDevice@@MAE_JPBD_J@Z, ? readLineData@QFileDevice@@MAE_JPAD_J@Z, ? readData@QFileDevice@@MAE_JPAD_J@Z, ? waitForBytesWritten@QIODevice@@UAE_NH@Z, ? waitForReadyRead@QIODevice@@UAE_NH@Z, ? canReadLine@QIODevice@@UBE_NXZ, ?bytesToWrite@QIODevice@@UBE_JXZ, ? bytesAvailable@QIODevice@@UBE_JXZ, ?reset@QIODevice@@UAE_NXZ, ? atEnd@QFileDevice@@UBE_NXZ, ?seek@QFileDevice@@UAE_N_J@Z, ? size@QFile@@UBE_JXZ, ?pos@QFileDevice@@UBE_JXZ, ? isSequential@QFileDevice@@UBE_NXZ, ? qt_metacall@QFile@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QFile@@UAEPAXPBD@Z, ? metaObject@QFile@@UBEPBUQMetaObject@@XZ, ?fileName@QFile@@UBE? AVQString@@XZ, ?flush@QFileDevice@@QAE_NXZ, ? remove@QDir@@QAE_NABVQString@@@Z, ?? 0QFile@@QAE@ABVQString@@PAVQObject@@@Z, ? writableLocation@QStandardPaths@@SA?AVQString@@W4StandardLocation@1@@Z, ? compare@QString@@QBEHABV1@W4CaseSensitivity@Qt@@@Z, ? processEvents@QCoreApplication@@SAXV? $QFlags@W4ProcessEventsFlag@QEventLoop@@@@@Z, ? append@QString@@QAEAAV1@PBD@Z, ? lessThan@QSortFilterProxyModel@@MBE_NABVQModelIndex@@0@Z, ? filterAcceptsColumn@QSortFilterProxyModel@@MBE_NHABVQModelIndex@@@Z, ? mapSelectionFromSource@QSortFilterProxyModel@@UBE? AVQItemSelection@@ABV2@@Z, ? mapSelectionToSource@QSortFilterProxyModel@@UBE? AVQItemSelection@@ABV2@@Z, ?mapFromSource@QSortFilterProxyModel@@UBE? AVQModelIndex@@ABV2@@Z, ?mapToSource@QSortFilterProxyModel@@UBE? AVQModelIndex@@ABV2@@Z, ?revert@QAbstractProxyModel@@UAEXXZ, ? submit@QAbstractProxyModel@@UAE_NXZ, ?span@QSortFilterProxyModel@@UBE? AVQSize@@ABVQModelIndex@@@Z, ?match@QSortFilterProxyModel@@UBE?AV? $QList@VQModelIndex@@@@ABVQModelIndex@@HABVQVariant@@HV? $QFlags@W4MatchFlag@Qt@@@@@Z, ?buddy@QSortFilterProxyModel@@UBE? AVQModelIndex@@ABV2@@Z, ?flags@QSortFilterProxyModel@@UBE?AV? $QFlags@W4ItemFlag@Qt@@@@ABVQModelIndex@@@Z, ? canFetchMore@QSortFilterProxyModel@@UBE_NABVQModelIndex@@@Z, ? fetchMore@QSortFilterProxyModel@@UAEXABVQModelIndex@@@Z, ? removeColumns@QSortFilterProxyModel@@UAE_NHHABVQModelIndex@@@Z, ? removeRows@QSortFilterProxyModel@@UAE_NHHABVQModelIndex@@@Z, ? insertColumns@QSortFilterProxyModel@@UAE_NHHABVQModelIndex@@@Z, ? insertRows@QSortFilterProxyModel@@UAE_NHHABVQModelIndex@@@Z, ? supportedDragActions@QAbstractProxyModel@@UBE?AV? $QFlags@W4DropAction@Qt@@@@XZ, ? supportedDropActions@QSortFilterProxyModel@@UBE?AV? $QFlags@W4DropAction@Qt@@@@XZ, ? dropMimeData@QSortFilterProxyModel@@UAE_NPBVQMimeData@@W4DropAction@Qt@ @HHABVQModelIndex@@@Z, ? canDropMimeData@QAbstractProxyModel@@UBE_NPBVQMimeData@@W4DropAction@ Qt@@HHABVQModelIndex@@@Z, ? mimeData@QSortFilterProxyModel@@UBEPAVQMimeData@@ABV? $QList@VQModelIndex@@@@@Z, ?mimeTypes@QSortFilterProxyModel@@UBE? AVQStringList@@XZ, ? setItemData@QAbstractProxyModel@@UAE_NABVQModelIndex@@ABV? $QMap@HVQVariant@@@@@Z, ?itemData@QAbstractProxyModel@@UBE?AV? $QMap@HVQVariant@@@@ABVQModelIndex@@@Z, ? setHeaderData@QSortFilterProxyModel@@UAE_NHW4Orientation@Qt@@ABVQVariant@ @H@Z, ?headerData@QSortFilterProxyModel@@UBE? AVQVariant@@HW4Orientation@Qt@@H@Z, ? Copyright Joe Security LLC 2019 Page 25 of 34 DLL IsmetpDoartta@QSortFilterProxyModel@@UAE_NABVQModelIndex@@ABVQVariant@@H@Z, ? data@QSortFilterProxyModel@@UBE?AVQVariant@@ABVQModelIndex@@H@Z, ? hasChildren@QSortFilterProxyModel@@UBE_NABVQModelIndex@@@Z, ? columnCount@QSortFilterProxyModel@@UBEHABVQModelIndex@@@Z, ? rowCount@QSortFilterProxyModel@@UBEHABVQModelIndex@@@Z, ? sibling@QSortFilterProxyModel@@UBE?AVQModelIndex@@HHABV2@@Z, ? parent@QSortFilterProxyModel@@UBE?AVQModelIndex@@ABV2@@Z, ? index@QSortFilterProxyModel@@UBE?AVQModelIndex@@HHABV2@@Z, ? convertFromAscii@QAbstractConcatenable@@KAXDAAPAVQChar@@@Z, ? exactMatch@QRegExp@@QBE_NABVQString@@@Z, ? setPattern@QRegExp@@QAEXABVQString@@@Z, ? setPatternSyntax@QRegExp@@QAEXW4PatternSyntax@1@@Z, ?? 1QRegExp@@QAE@XZ, ??0QRegExp@@QAE@XZ, ?windowsVersion@QSysInfo@@SA? AW4WinVersion@1@XZ, ??0QUnhandledException@@QAE@XZ, ? internalId@QModelIndex@@QBEIXZ, ? start@QThreadPool@@QAEXPAVQRunnable@@H@Z, ?? 0QFutureInterfaceBase@@QAE@ABV0@@Z, ? reportStarted@QFutureInterfaceBase@@QAEXXZ, ? setRunnable@QFutureInterfaceBase@@QAEXPAVQRunnable@@@Z, ? setThreadPool@QFutureInterfaceBase@@QAEXPAVQThreadPool@@@Z, ?? 1QRunnable@@UAE@XZ, ??_7QRunnable@@6B@, ??0QRunnable@@QAE@XZ, ?? 0QFutureInterfaceBase@@QAE@W4State@0@@Z, ? globalInstance@QThreadPool@@SAPAV1@XZ, ??1QFutureInterfaceBase@@UAE@XZ, ? selectedIndexes@QItemSelectionModel@@QBE?AV?$QList@VQModelIndex@@@@XZ, ? isValid@QVariant@@QBE_NXZ, ?filePath@QFileInfo@@QBE?AVQString@@XZ, ? contains@QString@@QBE_NABVQRegularExpression@@@Z, ?? 4QRegularExpression@@QAEAAV0@$$QAV0@@Z, ?? 0QRegularExpression@@QAE@XZ, ??1QUnhandledException@@UAE@XZ, ? reportException@QFutureInterfaceBase@@QAEXABVQException@@@Z, ? reportFinished@QFutureInterfaceBase@@QAEXXZ, ? isCanceled@QFutureInterfaceBase@@QBE_NXZ, ?data@QModelIndex@@QBE? AVQVariant@@H@Z, ?roleNames@QAbstractItemModel@@UBE?AV? $QHash@HVQByteArray@@@@XZ, ?fromNativeSeparators@QDir@@SA? AVQString@@ABV2@@Z, ?addYears@QDateTime@@QBE?AV1@H@Z, ? year@QDate@@QBEHXZ, ?rootPath@QDir@@SA?AVQString@@XZ, ? prepend@QString@@QAEAAV1@ABV1@@Z, ? remove@QString@@QAEAAV1@ABV1@W4CaseSensitivity@Qt@@@Z, ? swap@QString@@QAEXAAV1@@Z, ?remove@QListData@@QAEXHH@Z, ? startsWith@QString@@QBE_NABV1@W4CaseSensitivity@Qt@@@Z, ?? OQDateTime@@QBE_NABV0@@Z, ?addDays@QDateTime@@QBE?AV1@_J@Z, ? lastIndexOf@QString@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z, ?? 8QModelIndex@@QBE_NABV0@@Z, ??9QModelIndex@@QBE_NABV0@@Z, ? parent@QModelIndex@@QBE?AV1@XZ, ?empty@? $QList@VQItemSelectionRange@@@@QBE_NXZ, ?isEmpty@? $QList@VQItemSelectionRange@@@@QBE_NXZ, ? rowsInserted@QAbstractItemModel@@QAEXABVQModelIndex@@HHUQPrivateSignal@1 @@Z, ?? 0QItemSelectionModel@@QAE@PAVQAbstractItemModel@@PAVQObject@@@Z, ?? 1QItemSelectionModel@@UAE@XZ, ? model@QItemSelectionModel@@QAEPAVQAbstractItemModel@@XZ, ? setCurrentIndex@QItemSelectionModel@@UAEXABVQModelIndex@@V? $QFlags@W4SelectionFlag@QItemSelectionModel@@@@@Z, ? select@QItemSelectionModel@@UAEXABVQItemSelection@@V? $QFlags@W4SelectionFlag@QItemSelectionModel@@@@@Z, ? select@QItemSelectionModel@@UAEXABVQModelIndex@@V? $QFlags@W4SelectionFlag@QItemSelectionModel@@@@@Z, ? clear@QItemSelectionModel@@UAEXXZ, ?reset@QItemSelectionModel@@UAEXXZ, ? clearCurrentIndex@QItemSelectionModel@@UAEXXZ, ? selectionChanged@QItemSelectionModel@@QAEXABVQItemSelection@@0@Z, ? modelChanged@QItemSelectionModel@@QAEXPAVQAbstractItemModel@@@Z, ?? 8QVariant@@QBE_NABV0@@Z, ??9QVariant@@QBE_NABV0@@Z, ?? MQVariant@@QBE_NABV0@@Z, ??NQVariant@@QBE_NABV0@@Z, ?? OQVariant@@QBE_NABV0@@Z, ??PQVariant@@QBE_NABV0@@Z, ?? 0QUrl@@QAE@$$QAV0@@Z, ??0QUrl@@QAE@XZ, ?? 4QUrl@@QAEAAV0@ABV0@@Z, ?toString@QUrl@@QBE?AVQString@@V? $QUrlTwoFlags@W4UrlFormattingOption@QUrl@@W4ComponentFormattingOption@2@@ @@Z, ?isEmpty@QUrl@@QBE_NXZ, ?clear@QUrl@@QAEXXZ, ?? 9QUrl@@QBE_NABV0@@Z, ?toUrl@QVariant@@QBE?AVQUrl@@XZ, ? metaObject@QTimer@@UBEPBUQMetaObject@@XZ, ? qt_metacast@QTimer@@UAEPAXPBD@Z, ? qt_metacall@QTimer@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? timerEvent@QTimer@@MAEXPAVQTimerEvent@@@Z, ? qUnregisterResourceData@@YA_NHPBE00@Z, ??0QByteArray@@QAE@$$QAV0@@Z, ? length@QByteArray@@QBEHXZ, ?size@QByteArray@@QBEHXZ, ? at@QByteArray@@QBEDH@Z, ?begin@QByteArray@@QAEPADXZ, ? begin@QByteArray@@QBEPBDXZ, ??0QByteArray@@QAE@HD@Z, ? left@QByteArray@@QBE?AV1@H@Z, ?right@QByteArray@@QBE?AV1@H@Z, ? mid@QByteArray@@QBE?AV1@HH@Z, ?truncate@QByteArray@@QAEXH@Z, ? prepend@QByteArray@@QAEAAV1@D@Z, ?insert@QByteArray@@QAEAAV1@HD@Z, ? remove@QByteArray@@QAEAAV1@HH@Z, ? replace@QByteArray@@QAEAAV1@HHABV1@@Z, ?isNull@QByteArray@@QBE_NXZ, ? qt_metacast@QAbstractItemModel@@UAEPAXPBD@Z, ? qt_metacall@QAbstractItemModel@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ?? 0QItemSelection@@QAE@ABV0@@Z, ? qt_metacast@QItemSelectionModel@@UAEPAXPBD@Z, ? qt_metacall@QItemSelectionModel@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? staticMetaObject@QItemSelectionModel@@2UQMetaObject@@B, ? staticMetaObject@QAbstractItemModel@@2UQMetaObject@@B, ? section@QString@@QBE?AV1@VQChar@@HHV? $QFlags@W4SectionFlag@QString@@@@@Z, ??0QVariant@@QAE@_K@Z, ?

Copyright Joe Security LLC 2019 Page 26 of 34 DLL IvmalpuoeTrtoKey@QMetaEnum@@QBEPBDH@Z, ?exists@QFileInfo@@QBE_NXZ, ? lastModified@QFileInfo@@QBE?AVQDateTime@@XZ, ? indexOfEnumerator@QMetaObject@@QBEHPBD@Z, ? enumerator@QMetaObject@@QBE?AVQMetaEnum@@H@Z, ? data@QArrayData@@QBEPBXXZ, ?category@QChar@@QBE?AW4Category@1@XZ, ? unicode@QChar@@QBEGXZ, ?isSpace@QChar@@QBE_NXZ, ? insert@QString@@QAEAAV1@HABV1@@Z, ?? YQString@@QAEAAV0@ABVQStringRef@@@Z, ?? 0QString@@QAE@VQLatin1String@@@Z, ?at@QString@@QBE?BVQChar@@H@Z, ? clear@QString@@QAEXXZ, ??1QStringRef@@QAE@XZ, ?? 0QVariant@@QAE@$$QAV0@@Z, ?readAll@QTextStream@@QAE?AVQString@@XZ, ?? 4QVariant@@QAEAAV0@ABV0@@Z, ?canConvert@QVariant@@QBE_NH@Z, ? isNull@QVariant@@QBE_NXZ, ?toMap@QVariant@@QBE?AV? $QMap@VQString@@VQVariant@@@@XZ, ?toHash@QVariant@@QBE?AV? $QHash@VQString@@VQVariant@@@@XZ, ? indexOf@QString@@QBEHVQChar@@HW4CaseSensitivity@Qt@@@Z, ? midRef@QString@@QBE?AVQStringRef@@HH@Z, ? replace@QString@@QAEAAV1@VQLatin1String@@0W4CaseSensitivity@Qt@@@Z, ? replace@QString@@QAEAAV1@HHABV1@@Z, ?repeated@QString@@QBE?AV1@H@Z, ?mid@QContainerImplHelper@QtPrivate@@SA?AW4CutResult@12@HPAH0@Z, ?? 0QDate@@QAE@XZ, ?toDateTime@QVariant@@QBE?AVQDateTime@@XZ, ? getAndRef@ExternalRefCountData@QtSharedPointer@@SAPAU12@PBVQObject@@@Z, ?connectImpl@QObject@@CA? AVConnection@QMetaObject@@PBV1@PAPAX01PAVQSlotObjectBase@QtPrivate@@W4 ConnectionType@Qt@@PBHPBU3@@Z, ? disconnectNotify@QObject@@MAEXABVQMetaMethod@@@Z, ? connectNotify@QObject@@MAEXABVQMetaMethod@@@Z, ? customEvent@QObject@@MAEXPAVQEvent@@@Z, ? childEvent@QObject@@MAEXPAVQChildEvent@@@Z, ? timerEvent@QObject@@MAEXPAVQTimerEvent@@@Z, ? deleteLater@QObject@@QAEXXZ, ? eventFilter@QObject@@UAE_NPAV1@PAVQEvent@@@Z, ? event@QObject@@UAE_NPAVQEvent@@@Z, ??1QObject@@UAE@XZ, ?? 0QObject@@QAE@PAV0@@Z, ??4QString@@QAEAAV0@ABV0@@Z, ?? 1Connection@QMetaObject@@QAE@XZ, ?height@QRect@@QBEHXZ, ? width@QRect@@QBEHXZ, ??0QPoint@@QAE@HH@Z, ??1QString@@QAE@XZ, ?? 0QString@@QAE@XZ, ??0QString@@QAE@ABV0@@Z, ? captured@QRegularExpressionMatch@@QBE?AVQString@@H@Z, ? hasMatch@QRegularExpressionMatch@@QBE_NXZ, ?? 1QRegularExpressionMatch@@QAE@XZ, ? updateDirection@QAbstractAnimation@@MAEXW4Direction@1@@Z, ? start@QAbstractAnimation@@QAEXW4DeletionPolicy@1@@Z, ? connect@QObject@@SA? AVConnection@QMetaObject@@PBV1@PBD01W4ConnectionType@Qt@@@Z, ?? 0QByteArray@@QAE@PBDH@Z, ?debug@QMessageLogger@@QBE?AVQDebug@@XZ, ?remove@QString@@QAEAAV1@VQChar@@W4CaseSensitivity@Qt@@@Z, ?? 1QDebug@@QAE@XZ, ?tr@QMetaObject@@QBE?AVQString@@PBD0H@Z, ? currentDateTime@QDateTime@@SA?AV1@XZ, ??1QDateTime@@QAE@XZ, ? createUuid@QUuid@@SA?AV1@XZ, ?toString@QUuid@@QBE?AVQString@@XZ, ?? 1QVariant@@QAE@XZ, ??0QVariant@@QAE@N@Z, ? interpolated@QVariantAnimation@@MBE?AVQVariant@@ABV2@0N@Z, ? updateCurrentTime@QVariantAnimation@@MAEXH@Z, ? setDuration@QVariantAnimation@@QAEXH@Z, ? duration@QVariantAnimation@@UBEHXZ, ? setEndValue@QVariantAnimation@@QAEXABVQVariant@@@Z, ? setStartValue@QVariantAnimation@@QAEXABVQVariant@@@Z, ? match@QRegularExpression@@QBE? AVQRegularExpressionMatch@@ABVQString@@HW4MatchType@1@V? $QFlags@W4MatchOption@QRegularExpression@@@@@Z, ?? 1QRegularExpression@@QAE@XZ, ??0QRegularExpression@@QAE@ABVQString@@V? $QFlags@W4PatternOption@QRegularExpression@@@@@Z, ? updateState@QPropertyAnimation@@MAEXW4State@QAbstractAnimation@@0@Z, ? updateCurrentValue@QPropertyAnimation@@MAEXABVQVariant@@@Z, ? event@QPropertyAnimation@@MAE_NPAVQEvent@@@Z, ?? 1QPropertyAnimation@@UAE@XZ, ?? 0QPropertyAnimation@@QAE@PAVQObject@@ABVQByteArray@@0@Z, ? qt_metacall@QPropertyAnimation@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QPropertyAnimation@@UAEPAXPBD@Z, ? metaObject@QPropertyAnimation@@UBEPBUQMetaObject@@XZ, ?? 6QDebug@@QAEAAV0@ABVQString@@@Z, ??6QDebug@@QAEAAV0@PBD@Z, ? isEmpty@QString@@QBE_NXZ, ??0QString@@QAE@PBD@Z, ?? 4QString@@QAEAAV0@$$QAV0@@Z, ??1QByteArray@@QAE@XZ, ?? 0QChar@@QAE@H@Z, ? invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDW4ConnectionType@Qt@@V QGenericArgument@@333333333@Z, ??0QGenericArgument@@QAE@PBDPBX@Z, ?? 0QMessageLogger@@QAE@PBDH0@Z, ?shared_null@QListData@@2UData@1@B, ? absoluteFilePath@QFileInfo@@QBE?AVQString@@XZ, ??1QFileInfo@@QAE@XZ, ?? 0QFileInfo@@QAE@ABVQString@@@Z, ?applicationDirPath@QCoreApplication@@SA? AVQString@@XZ, ?append@QListData@@QAEPAPAXXZ, ? dispose@QListData@@SAXPAUData@1@@Z, ?realloc@QListData@@QAEXH@Z, ? detach_grow@QListData@@QAEPAUData@1@PAHH@Z, ? detach@QListData@@QAEPAUData@1@H@Z, ?end@QListData@@QBEPAPAXXZ, ? begin@QListData@@QBEPAPAXXZ, ?dispose@QListData@@QAEXXZ, ? fromUtf8@QString@@SA?AV1@PBDH@Z, ??YQString@@QAEAAV0@ABV0@@Z, ?? 0QString@@QAE@$$QAV0@@Z, ? sort@QSortFilterProxyModel@@UAEXHW4SortOrder@Qt@@@Z, ? setSortRole@QSortFilterProxyModel@@QAEXH@Z, ? setSourceModel@QSortFilterProxyModel@@UAEXPAVQAbstractItemModel@@@Z, ?? 1QSortFilterProxyModel@@UAE@XZ, ?? 0QSortFilterProxyModel@@QAE@PAVQObject@@@Z, ? setProperty@QObject@@QAE_NPBDABVQVariant@@@Z, ? Copyright Joe Security LLC 2019 Page 27 of 34 DLL Idmispconrtnect@QObject@@SA_NABVConnection@QMetaObject@@@Z, ? installEventFilter@QObject@@QAEXPAV1@@Z, ?objectName@QObject@@QBE? AVQString@@XZ, ?append@QByteArray@@QAEAAV1@D@Z, ? append@QByteArray@@QAEAAV1@PBD@Z, ? append@QByteArray@@QAEAAV1@PBDH@Z, ?msleep@QThread@@SAXK@Z, ? staticMetaObject@QCoreApplication@@2UQMetaObject@@B, ??1QTimer@@UAE@XZ, ? qputenv@@YA_NPBDABVQByteArray@@@Z, ??1QAbstractListModel@@UAE@XZ, ? staticQtMetaObject@QObject@@1UQMetaObject@@B, ? unregisterConverterFunction@QMetaType@@SAXHH@Z, ? registerConverterFunction@QMetaType@@SA_NPBUAbstractConverterFunction@QtPrivate @@HH@Z, ?hasRegisteredConverterFunction@QMetaType@@SA_NHH@Z, ? registerNormalizedTypedef@QMetaType@@SAHABVQByteArray@@H@Z, ? registerNormalizedType@QMetaType@@SAHABVQByteArray@@P6AXPAX@ZP6APAX1P BX@ZHV?$QFlags@W4TypeFlag@QMetaType@@@@PBUQMetaObject@@@Z, ?? 0Connection@QMetaObject@@QAE@XZ, ?normalizedType@QMetaObject@@SA? AVQByteArray@@PBD@Z, ?className@QMetaObject@@QBEPBDXZ, ? startDetached@QProcess@@SA_NABVQString@@@Z, ? free_helper@QHashData@@QAEXP6AXPAUNode@1@@Z@Z, ?? 0QVariant@@QAE@ABVQString@@@Z, ?elapsed@QElapsedTimer@@QBE_JXZ, ? start@QElapsedTimer@@QAEXXZ, ? aboutToQuit@QCoreApplication@@QAEXUQPrivateSignal@1@@Z, ? quit@QCoreApplication@@SAXXZ, ? installNativeEventFilter@QCoreApplication@@QAEXPAVQAbstractNativeEventFilter@@@Z, ?translate@QCoreApplication@@SA?AVQString@@PBD00H@Z, ? setAttribute@QCoreApplication@@SAXW4ApplicationAttribute@Qt@@_N@Z, ?? 1QUrl@@QAE@XZ, ??0QUrl@@QAE@ABVQString@@W4ParsingMode@0@@Z, ? deallocate@QArrayData@@SAXPAU1@II@Z, ?self@QCoreApplication@@0PAV1@A, ?? 0QElapsedTimer@@QAE@XZ, ?instance@QCoreApplication@@SAPAV1@XZ, ?? 6QDebug@@QAEAAV0@_J@Z, ??9QString@@QBE_NPBD@Z, ?? 8QString@@QBE_NPBD@Z, ??0QString@@QAE@UQStringDataPtr@@@Z, ?? YQString@@QAEAAV0@PBD@Z, ?reserve@QByteArray@@QAEXH@Z, ?? 0QByteArray@@QAE@XZ, ?data@QArrayData@@QAEPAXXZ, ?? 4Connection@QMetaObject@@QAEAAV01@$$QAV01@@Z, ? qt_metacall@QObject@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QObject@@UAEPAXPBD@Z, ? activate@QMetaObject@@SAXPAVQObject@@PBU1@HPAPAX@Z, ? dynamicMetaObject@QObjectData@@QBEPAUQMetaObject@@XZ, ? staticMetaObject@QObject@@2UQMetaObject@@B, ?unlock@QMutex@@QAEXXZ, ? lock@QMutex@@QAEXXZ, ??1QMutex@@QAE@XZ, ?? 0QMutex@@QAE@W4RecursionMode@0@@Z, ?sender@QObject@@IBEPAV1@XZ, ? property@QObject@@QBE?AVQVariant@@PBD@Z, ? warning@QMessageLogger@@QBAXPBDZZ, ?wait@QThread@@QAE_NK@Z, ? start@QThread@@QAEXW4Priority@1@@Z, ? event@QThread@@UAE_NPAVQEvent@@@Z, ?isRunning@QThread@@QBE_NXZ, ?? 1QThread@@UAE@XZ, ??0QThread@@QAE@PAVQObject@@@Z, ? qt_metacall@QThread@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QThread@@UAEPAXPBD@Z, ? staticMetaObject@QThread@@2UQMetaObject@@B, ?toString@QVariant@@QBE? AVQString@@XZ, ?toBool@QVariant@@QBE_NXZ, ?toInt@QVariant@@QBEHPA_N@Z, ??0QVariant@@QAE@H@Z, ??0QVariant@@QAE@I@Z, ??0QVariant@@QAE@_N@Z, ? wakeOne@QWaitCondition@@QAEXXZ, ? wait@QWaitCondition@@QAE_NPAVQMutex@@K@Z, ??1QWaitCondition@@QAE@XZ, ??0QWaitCondition@@QAE@XZ, ??0QVariant@@QAE@XZ, ?connect@QObject@@QBE? AVConnection@QMetaObject@@PBV1@PBD1W4ConnectionType@Qt@@@Z, ? toStdWString@QString@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V? $allocator@_W@2@@std@@XZ, ?fromWCharArray@QString@@SA?AV1@PB_WH@Z, ? toLocal8Bit@QString@@QHAE?AVQByteArray@@XZ, ?toLocal8Bit@QString@@QGBE? AVQByteArray@@XZ, ?data@QByteArray@@QAEPADXZ, ?? 8@YA_NABVQString@@0@Z, ?fromMSecsSinceEpoch@QDateTime@@SA?AV1@_J@Z, ??4QDateTime@@QAEAAV0@ABV0@@Z, ??0QDateTime@@QAE@XZ, ?? 0QDateTime@@QAE@ABV0@@Z, ?cmp@QVariant@@QBE_NABV1@@Z, ? toULongLong@QVariant@@QBE_KPA_N@Z, ?toLongLong@QVariant@@QBE_JPA_N@Z, ?toUInt@QVariant@@QBEIPA_N@Z, ??0QVariant@@QAE@ABV0@@Z, ?? 0QUuid@@QAE@ABU_GUID@@@Z, ??9QDateTime@@QBE_NABV0@@Z, ?? 4QDateTime@@QAEAAV0@$$QAV0@@Z, ? invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDVQGenericArgument@@22222 2222@Z, ??M@YA_NABVQString@@0@Z, ??0QDate@@QAE@HHH@Z, ? setTimeSpec@QDateTime@@QAEXW4TimeSpec@Qt@@@Z, ?? 0QDateTime@@QAE@ABVQDate@@ABVQTime@@W4TimeSpec@Qt@@@Z, ?? 0QDateTime@@QAE@$$QAV0@@Z, ??0QTime@@QAE@HHHH@Z, ? toUpper@QString@@QGBE?AV1@XZ, ?fromString@QDateTime@@SA? AV1@ABVQString@@W4DateFormat@Qt@@@Z, ?toStringList@QVariant@@QBE? AVQStringList@@XZ, ??4QString@@QAEAAV0@PBD@Z, ?toList@QVariant@@QBE?AV? $QList@VQVariant@@@@XZ, ?isEmpty@QListData@@QBE_NXZ, ? setQObjectShared@ExternalRefCountData@QtSharedPointer@@QAEXPBVQObject@@_N @Z, ?currentDateTimeUtc@QDateTime@@SA?AV1@XZ, ?? MQDateTime@@QBE_NABV0@@Z, ? nextNode@QHashData@@SAPAUNode@1@PAU21@@Z, ? detach_helper@QHashData@@QAEPAU1@P6AXPAUNode@1@PAX@ZP6AX0@ZHH@Z, ?freeNode@QHashData@@QAEXPAX@Z, ?allocateNode@QHashData@@QAEPAXH@Z, ??0QVariant@@QAE@ABVQDateTime@@@Z, ?qHash@@YAIABVQString@@I@Z, ? shared_null@QHashData@@2U1@B, ?firstNode@QHashData@@QAEPAUNode@1@XZ, ?hasShrunk@QHashData@@QAEXXZ, ?willGrow@QHashData@@QAE_NXZ, ? mid@QString@@QBE?AV1@HH@Z, ? indexOf@QString@@QBEHABV1@HW4CaseSensitivity@Qt@@@Z, ?? 0QVariant@@QAE@ABVQStringList@@@Z, ? invokeMethod@QMetaObject@@SA_NPAVQObject@@PBDVQGenericReturnArgument@@ VQGenericArgument@@333333333@Z, ?? 0QGenericReturnArgument@@QAE@PBDPAX@Z, ? setParent@QObject@@QAEXPAV1@@Z, ?toObject@QJsonValue@@QBE?

Copyright Joe Security LLC 2019 Page 28 of 34 DLL IAmVpQoJrstonObject@@XZ, ?toArray@QJsonValue@@QBE?AVQJsonArray@@XZ, ? toString@QJsonValue@@QBE?AVQString@@XZ, ?toInt@QJsonValue@@QBEHH@Z, ? toBool@QJsonValue@@QBE_N_N@Z, ??1QJsonValue@@QAE@XZ, ? value@QJsonObject@@QBE?AVQJsonValue@@ABVQString@@@Z, ? isEmpty@QJsonObject@@QBE_NXZ, ??1QJsonObject@@QAE@XZ, ? at@QJsonArray@@QBE?AVQJsonValue@@H@Z, ??1QJsonArray@@QAE@XZ, ? object@QJsonDocument@@QBE?AVQJsonObject@@XZ, ? isEmpty@QJsonDocument@@QBE_NXZ, ?fromJson@QJsonDocument@@SA? AV1@ABVQByteArray@@PAUQJsonParseError@@@Z, ?? 1QJsonDocument@@QAE@XZ, ?remove@QListData@@QAEXH@Z, ? erase@QListData@@QAEPAPAXPAPAX@Z, ?end@QJsonArray@@QBE? AVconst_iterator@1@XZ, ?begin@QJsonArray@@QBE?AVconst_iterator@1@XZ, ? isUndefined@QJsonValue@@QBE_NXZ, ?at@QListData@@QBEPAPAXH@Z, ? size@QListData@@QBEHXZ, ?fromStdString@QString@@SA?AV1@ABV? $basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z, ? toStdString@QString@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V? $allocator@D@2@@std@@XZ, ??AQString@@QBE?BVQChar@@I@Z, ? toUtf8@QString@@QGBE?AVQByteArray@@XZ, ?size@QString@@QBEHXZ, ? msecsTo@QDateTime@@QBE_JABV1@@Z, ? toMSecsSinceEpoch@QDateTime@@QBE_JXZ, ? setObjectName@QObject@@QAEXABVQString@@@Z, ??6QDebug@@QAEAAV0@H@Z, ?ignore@QEvent@@QAEXXZ, ?disconnect@QObject@@SA_NPBV1@PBD01@Z, ? fromRawData@QByteArray@@SA?AV1@PBDH@Z, ? startsWith@QByteArray@@QBE_NABV1@@Z, ?clear@QByteArray@@QAEXXZ, ?? 4QByteArray@@QAEAAV0@ABV0@@Z, ? append@QString@@QAEAAV1@VQChar@@@Z, ? append@QString@@QAEAAV1@ABV1@@Z, ?toString@QDateTime@@QBE? AVQString@@ABV2@@Z, ?offsetFromUtc@QDateTime@@QBEHXZ, ? toLocalTime@QDateTime@@QBE?AV1@XZ, ?parent@QObject@@QBEPAV1@XZ, ? arg@QString@@QBE?AV1@HHHVQChar@@@Z, ?? 4QString@@QAEAAV0@ABVQByteArray@@@Z, ??0QByteArray@@QAE@ABV0@@Z, ??BQByteArray@@QBEPBDXZ, ?isEmpty@QByteArray@@QBE_NXZ, ?? 0QChar@@QAE@D@Z, ?toInt@QString@@QBEHPA_NH@Z, ?split@QString@@QBE? AVQStringList@@ABV1@W4SplitBehavior@1@W4CaseSensitivity@Qt@@@Z, ?? 0QVariant@@QAE@PBD@Z, ?value@QSettings@@QBE? AVQVariant@@ABVQString@@ABV2@@Z, ??1QSettings@@UAE@XZ, ?? 0QSettings@@QAE@ABVQString@@W4Format@0@PAVQObject@@@Z, ?? 0QSize@@QAE@HH@Z, ??0QJsonValue@@QAE@_N@Z, ?? 0QJsonValue@@QAE@ABVQString@@@Z, ?? 0QJsonValue@@QAE@ABVQJsonArray@@@Z, ?? 0QJsonValue@@QAE@ABVQJsonObject@@@Z, ??0QJsonValue@@QAE@ABV0@@Z, ? hasChildren@QAbstractListModel@@EBE_NABVQModelIndex@@@Z, ? parent@QAbstractListModel@@EBE?AVQModelIndex@@ABV2@@Z, ? flags@QAbstractListModel@@UBE?AV? $QFlags@W4ItemFlag@Qt@@@@ABVQModelIndex@@@Z, ? dropMimeData@QAbstractListModel@@UAE_NPBVQMimeData@@W4DropAction@Qt@@ HHABVQModelIndex@@@Z, ?sibling@QAbstractListModel@@UBE? AVQModelIndex@@HHABV2@@Z, ?index@QAbstractListModel@@UBE? AVQModelIndex@@HHABV2@@Z, ??0QAbstractListModel@@QAE@PAVQObject@@@Z, ?arg@QString@@QBE?AV1@ABV1@HVQChar@@@Z, ? shared_null@QArrayData@@2QBU1@B, ?toArray@QJsonValueRef@@QBE? AVQJsonArray@@XZ, ?dateFormat@QLocale@@QBE? AVQString@@W4FormatType@1@@Z, ??1QLocale@@QAE@XZ, ?? 0QLocale@@QAE@XZ, ?toString@QDate@@QBE?AVQString@@ABV2@@Z, ? daysTo@QDateTime@@QBE_JABV1@@Z, ?toString@QDateTime@@QBE? AVQString@@W4DateFormat@Qt@@@Z, ?date@QDateTime@@QBE?AVQDate@@XZ, ? rehash@QHashData@@QAEXH@Z, ??0QVariant@@QAE@ABVQJsonArray@@@Z, ? qBadAlloc@@YAXXZ, ??AQJsonObject@@QAE? AVQJsonValueRef@@ABVQString@@@Z, ? endResetModel@QAbstractItemModel@@IAEXXZ, ? beginResetModel@QAbstractItemModel@@IAEXXZ, ? endRemoveRows@QAbstractItemModel@@IAEXXZ, ? beginRemoveRows@QAbstractItemModel@@IAEXABVQModelIndex@@HH@Z, ? endInsertRows@QAbstractItemModel@@IAEXXZ, ? beginInsertRows@QAbstractItemModel@@IAEXABVQModelIndex@@HH@Z, ? revert@QAbstractItemModel@@UAEXXZ, ?submit@QAbstractItemModel@@UAE_NXZ, ? dataChanged@QAbstractItemModel@@QAEXABVQModelIndex@@0ABV? $QVector@H@@@Z, ?span@QAbstractItemModel@@UBE? AVQSize@@ABVQModelIndex@@@Z, ?match@QAbstractItemModel@@UBE?AV? $QList@VQModelIndex@@@@ABVQModelIndex@@HABVQVariant@@HV? $QFlags@W4MatchFlag@Qt@@@@@Z, ?buddy@QAbstractItemModel@@UBE? AVQModelIndex@@ABV2@@Z, ? sort@QAbstractItemModel@@UAEXHW4SortOrder@Qt@@@Z, ? canFetchMore@QAbstractItemModel@@UBE_NABVQModelIndex@@@Z, ? fetchMore@QAbstractItemModel@@UAEXABVQModelIndex@@@Z, ? moveColumns@QAbstractItemModel@@UAE_NABVQModelIndex@@HH0H@Z, ? moveRows@QAbstractItemModel@@UAE_NABVQModelIndex@@HH0H@Z, ? removeColumns@QAbstractItemModel@@UAE_NHHABVQModelIndex@@@Z, ? removeRows@QAbstractItemModel@@UAE_NHHABVQModelIndex@@@Z, ? insertColumns@QAbstractItemModel@@UAE_NHHABVQModelIndex@@@Z, ? insertRows@QAbstractItemModel@@UAE_NHHABVQModelIndex@@@Z, ? supportedDragActions@QAbstractItemModel@@UBE?AV? $QFlags@W4DropAction@Qt@@@@XZ, ? supportedDropActions@QAbstractItemModel@@UBE?AV? $QFlags@W4DropAction@Qt@@@@XZ, ? canDropMimeData@QAbstractItemModel@@UBE_NPBVQMimeData@@W4DropAction@Qt @@HHABVQModelIndex@@@Z, ? mimeData@QAbstractItemModel@@UBEPAVQMimeData@@ABV? $QList@VQModelIndex@@@@@Z, ?mimeTypes@QAbstractItemModel@@UBE? AVQStringList@@XZ, ? setItemData@QAbstractItemModel@@UAE_NABVQModelIndex@@ABV? Copyright Joe Security LLC 2019 Page 29 of 34 DLL I$mQpMoarpt @HVQVariant@@@@@Z, ?itemData@QAbstractItemModel@@UBE?AV? $QMap@HVQVariant@@@@ABVQModelIndex@@@Z, ? setHeaderData@QAbstractItemModel@@UAE_NHW4Orientation@Qt@@ABVQVariant@@ H@Z, ?headerData@QAbstractItemModel@@UBE? AVQVariant@@HW4Orientation@Qt@@H@Z, ??0QJsonArray@@QAE@XZ, ?? 0QJsonArray@@QAE@ABV0@@Z, ?allocate@QArrayData@@SAPAU1@IIIV? $QFlags@W4AllocationOption@QArrayData@@@@@Z, ? append@QListData@@QAEPAPAXABU1@@Z, ??0QJsonObject@@QAE@V? $initializer_list@U?$QPair@VQString@@VQJsonValue@@@@@std@@@Z, ? push_back@QJsonArray@@QAEXABVQJsonValue@@@Z, ? count@QJsonArray@@QBEHXZ, ?toString@QJsonValueRef@@QBE?AVQString@@XZ, ? toBool@QJsonValueRef@@QBE_NXZ, ?toUTC@QDateTime@@QBE?AV1@XZ, ? isValid@QModelIndex@@QBE_NXZ, ?row@QModelIndex@@QBEHXZ, ?? 0QModelIndex@@QAE@XZ, ?sharedNull@QArrayData@@SAPAU1@XZ, ?? 0QChar@@QAE@UQLatin1Char@@@Z, ?utf16@QString@@QBEPBGXZ, ? applicationName@QCoreApplication@@SA?AVQString@@XZ, ?arg@QString@@QBE? AV1@GHHVQChar@@@Z, ?staticMetaObject@QProcess@@2UQMetaObject@@B, ? convertFromAscii@QAbstractConcatenable@@KAXPBDHAAPAVQChar@@@Z, ? toHex@QByteArray@@QBE?AV1@XZ, ?append@QByteArray@@QAEAAV1@ABV1@@Z, ?currentCpuArchitecture@QSysInfo@@SA?AVQString@@XZ, ? replace@QString@@QAEAAV1@VQChar@@0W4CaseSensitivity@Qt@@@Z, ? replace@QString@@QAEAAV1@ABV1@0W4CaseSensitivity@Qt@@@Z, ? resize@QString@@QAEXH@Z, ??0QString@@QAE@HW4Initialization@Qt@@@Z, ? quit@QEventLoop@@QAEXXZ, ?exec@QEventLoop@@QAEHV? $QFlags@W4ProcessEventsFlag@QEventLoop@@@@@Z, ??1QEventLoop@@UAE@XZ, ?write@QIODevice@@QAE_JABVQByteArray@@@Z, ? freeData@QMapDataBase@@SAXPAU1@@Z, ? createData@QMapDataBase@@SAPAU1@XZ, ? freeTree@QMapDataBase@@QAEXPAUQMapNodeBase@@H@Z, ? createNode@QMapDataBase@@QAEPAUQMapNodeBase@@HHPAU2@_N@Z, ? recalcMostLeftNode@QMapDataBase@@QAEXXZ, ? freeNodeAndRebalance@QMapDataBase@@QAEXPAUQMapNodeBase@@@Z, ? entryList@QDir@@QBE?AVQStringList@@V?$QFlags@W4Filter@QDir@@@@V? $QFlags@W4SortFlag@QDir@@@@@Z, ? setNameFilters@QDir@@QAEXABVQStringList@@@Z, ? toNativeSeparators@QDir@@SA?AVQString@@ABV2@@Z, ? absoluteFilePath@QDir@@QBE?AVQString@@ABV2@@Z, ??1QDir@@QAE@XZ, ?? 0QDir@@QAE@ABVQString@@@Z, ? finished@QProcess@@QAEXHW4ExitStatus@1@@Z, ? start@QProcess@@QAEXABVQString@@ABVQStringList@@V? $QFlags@W4OpenModeFlag@QIODevice@@@@@Z, ??1QProcess@@UAE@XZ, ?? 0QProcess@@QAE@PAVQObject@@@Z, ?hash@QCryptographicHash@@SA? AVQByteArray@@ABV2@W4Algorithm@1@@Z, ?fileName@QFileInfo@@QBE? AVQString@@XZ, ?secsTo@QDateTime@@QBE_JABV1@@Z, ? qunsetenv@@YA_NPBD@Z, ?instance@QPluginLoader@@QAEPAVQObject@@XZ, ?? 1QPluginLoader@@UAE@XZ, ?? 0QPluginLoader@@QAE@ABVQString@@PAVQObject@@@Z, ? shared_null@QMapDataBase@@2U1@B, ?readLine@QTextStream@@QAE? AVQString@@_J@Z, ?setCodec@QTextStream@@QAEXPBD@Z, ?? 1QTextStream@@UAE@XZ, ??0QTextStream@@QAE@PAVQIODevice@@@Z, ? fileName@QUrl@@QBE?AVQString@@V? $QFlags@W4ComponentFormattingOption@QUrl@@@@@Z, ? setParent@QMapNodeBase@@QAEXPAU1@@Z, ? setColor@QMapNodeBase@@QAEXW4Color@1@@Z, ?color@QMapNodeBase@@QBE? AW4Color@1@XZ, ?tr@QObject@@SA?AVQString@@PBD0H@Z, ? reserve@QString@@QAEXH@Z, ?constData@QString@@QBEPBVQChar@@XZ, ? data@QString@@QAEPAVQChar@@XZ, ??0QString@@QAE@ABVQByteArray@@@Z, ??YQString@@QAEAAV0@VQChar@@@Z, ? prepend@QString@@QAEAAV1@VQChar@@@Z, ?toLower@QString@@QGBE? AV1@XZ, ??4QByteArray@@QAEAAV0@$$QAV0@@Z, ?fromLatin1@QChar@@SA? AV1@D@Z, ??0QChar@@QAE@_W@Z, ??0QChar@@QAE@G@Z, ? qstrcmp@@YAHABVQByteArray@@0@Z, ?destroyed@QObject@@QAEXPAV1@@Z, ? singleShotImpl@QTimer@@CAXHW4TimerType@Qt@@PBVQObject@@PAVQSlotObject Base@QtPrivate@@@Z, ?typeFlags@QMetaType@@SA?AV? $QFlags@W4TypeFlag@QMetaType@@@@H@Z, ? cast@QMetaObject@@QBEPAVQObject@@PAV2@@Z, ? constData@QVariant@@QBEPBXXZ, ?convert@QVariant@@QBE_NHPAX@Z, ? userType@QVariant@@QBEHXZ, ??0QVariant@@QAE@HPBXI@Z, ? nextNode@QMapNodeBase@@QBEPBU1@XZ, ?defaultTypeFor@QTimer@@CA? AW4TimerType@Qt@@H@Z, ?type@QJsonValue@@QBE?AW4Type@1@XZ, ? toVariant@QJsonValue@@QBE?AVQVariant@@XZ, ?fromVariant@QJsonValue@@SA? AV1@ABVQVariant@@@Z, ??0QJsonValue@@QAE@W4Type@0@@Z, ? insert@QJsonObject@@QAE?AViterator@1@ABVQString@@ABVQJsonValue@@@Z, ? contains@QJsonObject@@QBE_NABVQString@@@Z, ??AQJsonObject@@QBE? AVQJsonValue@@ABVQString@@@Z, ??4QJsonObject@@QAEAAV0@ABV0@@Z, ?? 0QJsonObject@@QAE@XZ, ??0QJsonObject@@QAE@ABV0@@Z, ? isObject@QJsonDocument@@QBE_NXZ, ?toJson@QJsonDocument@@QBE? AVQByteArray@@XZ, ??0QJsonDocument@@QAE@XZ, ?? 0QJsonDocument@@QAE@ABVQJsonObject@@@Z, ?? 4QJsonObject@@QAEAAV0@$$QAV0@@Z, ??0QJsonObject@@QAE@$$QAV0@@Z, ?? 4QJsonDocument@@QAEAAV0@$$QAV0@@Z, ?isObject@QJsonValue@@QBE_NXZ, ?? 4QJsonValue@@QAEAAV0@$$QAV0@@Z, ?fromUtf8@QString@@SA? AV1@ABVQByteArray@@@Z, ?toUtf8@QString@@QHAE?AVQByteArray@@XZ, ? timeout@QTimer@@QAEXUQPrivateSignal@1@@Z, ?stop@QTimer@@QAEXXZ, ? start@QTimer@@QAEXXZ, ?setInterval@QTimer@@QAEXH@Z, ?? 0QTimer@@QAE@PAVQObject@@@Z, ??8QDateTime@@QBE_NABV0@@Z, ? staticMetaObject@QTimer@@2UQMetaObject@@B, ? remove@QSettings@@QAEXABVQString@@@Z, ? setValue@QSettings@@QAEXABVQString@@ABVQVariant@@@Z, ? sync@QSettings@@QAEXXZ, ?isActive@QTimer@@QBE_NXZ, ?

Copyright Joe Security LLC 2019 Page 30 of 34 DLL IsmtaptiocMrtetaObject@QAbstractListModel@@2UQMetaObject@@B, ? qt_metacall@QAbstractListModel@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QAbstractListModel@@UAEPAXPBD@Z, ?? 4QVariant@@QAEAAV0@$$QAV0@@Z, ?locate@QStandardPaths@@SA? AVQString@@W4StandardLocation@1@ABV2@V? $QFlags@W4LocateOption@QStandardPaths@@@@@Z, ? current@QOperatingSystemVersion@@SA?AV1@XZ, ?exists@QDir@@QBE_NXZ, ? readAllStandardOutput@QProcess@@QAE?AVQByteArray@@XZ, ? waitForFinished@QProcess@@QAE_NH@Z, ? setArguments@QProcess@@QAEXABVQStringList@@@Z, ? setProgram@QProcess@@QAEXABVQString@@@Z, ? startDetached@QProcess@@QAE_NPA_J@Z, ?start@QProcess@@QAEXV? $QFlags@W4OpenModeFlag@QIODevice@@@@@Z, ??6QDebug@@QAEAAV0@K@Z, ? fromStdWString@QString@@SA?AV1@ABV?$basic_string@_WU? $char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z, ? fromLocal8Bit@QString@@SA?AV1@ABVQByteArray@@@Z, ? blockSignals@QObject@@QAE_N_N@Z, ? setData@QAbstractItemModel@@UAE_NABVQModelIndex@@ABVQVariant@@H@Z, ? column@QModelIndex@@QBEHXZ, ?toLower@QString@@QHAE?AV1@XZ, ? QStringList_contains@QtPrivate@@YA_NPBVQStringList@@ABVQString@@W4CaseSensi tivity@Qt@@@Z, ?machineHostName@QSysInfo@@SA?AVQString@@XZ, ?? 0QJsonValue@@QAE@H@Z, ?number@QString@@SA?AV1@HH@Z, ? toDouble@QString@@QBENPA_N@Z, ?toVariant@QJsonValueRef@@QBE? AVQVariant@@XZ, ?fromString@QDate@@SA?AV1@ABVQString@@0@Z, ? currentDate@QDate@@SA?AV1@XZ, ?addDays@QDate@@QBE?AV1@_J@Z, ? toString@QDate@@QBE?AVQString@@W4DateFormat@Qt@@@Z, ? fromString@QDateTime@@SA?AV1@ABVQString@@0@Z, ? addMSecs@QDateTime@@QBE?AV1@_J@Z, ?addSecs@QDateTime@@QBE? AV1@_J@Z, ?isValid@QDateTime@@QBE_NXZ, ?toDate@QVariant@@QBE? AVQDate@@XZ, ?type@QVariant@@QBE?AW4Type@1@XZ, ?? 0QVariant@@QAE@ABV?$QHash@VQString@@VQVariant@@@@@Z, ? isNull@QJsonDocument@@QBE_NXZ, ??PQDateTime@@QBE_NABV0@@Z, ?? NQDateTime@@QBE_NABV0@@Z, ??NQDate@@QBE_NABV0@@Z, ? nextNode@QMapNodeBase@@QAEPAU1@XZ, ?? 6QJsonArray@@QAEAAV0@ABVQJsonValue@@@Z, ? toInt@QJsonValueRef@@QBEHXZ, ?detach@QSharedMemory@@QAE_NXZ, ? isAttached@QSharedMemory@@QBE_NXZ, ? attach@QSharedMemory@@QAE_NW4AccessMode@1@@Z, ? create@QSharedMemory@@QAE_NHW4AccessMode@1@@Z, ?? 1QSharedMemory@@UAE@XZ, ?? 0QSharedMemory@@QAE@ABVQString@@PAVQObject@@@Z, ? readLine@QIODevice@@QAE?AVQByteArray@@_J@Z, ? release@QSystemSemaphore@@QAE_NH@Z, ? acquire@QSystemSemaphore@@QAE_NXZ, ??1QSystemSemaphore@@QAE@XZ, ?? 0QSystemSemaphore@@QAE@ABVQString@@HW4AccessMode@0@@Z, ? type@QEvent@@QBE?AW4Type@1@XZ, ?y@QPointF@@QBENXZ, ? x@QPointF@@QBENXZ, ?arg@QString@@QBE?AV1@KHHVQChar@@@Z, ?? 4QByteArray@@QAEAAV0@PBD@Z, ? columnCount@QAbstractListModel@@EBEHABVQModelIndex@@@Z, ? setDefault@QLocale@@SAXABV1@@Z, ??0QLocale@@QAE@ABVQString@@@Z, ? removeTranslator@QCoreApplication@@SA_NPAVQTranslator@@@Z, ? installTranslator@QCoreApplication@@SA_NPAVQTranslator@@@Z, ? load@QTranslator@@QAE_NABVQString@@000@Z, ? isEmpty@QTranslator@@UBE_NXZ, ?translate@QTranslator@@UBE? AVQString@@PBD00H@Z, ??1QTranslator@@UAE@XZ, ?? 0QTranslator@@QAE@PAVQObject@@@Z, ? qt_metacall@QTranslator@@UAEHW4Call@QMetaObject@@HPAPAX@Z, ? qt_metacast@QTranslator@@UAEPAXPBD@Z, ? metaObject@QTranslator@@UBEPBUQMetaObject@@XZ, ? toByteArray@QVariant@@QBE?AVQByteArray@@XZ, ?? 0QVariant@@QAE@ABVQByteArray@@@Z, ?? 0QVariant@@QAE@ABVQModelIndex@@@Z, ? clearSelection@QItemSelectionModel@@QAEXXZ, ? isSelected@QItemSelectionModel@@QBE_NABVQModelIndex@@@Z, ? flags@QAbstractItemModel@@UBE?AV? $QFlags@W4ItemFlag@Qt@@@@ABVQModelIndex@@@Z, ? dropMimeData@QAbstractItemModel@@UAE_NPBVQMimeData@@W4DropAction@Qt@ @HHABVQModelIndex@@@Z, ? hasChildren@QAbstractItemModel@@UBE_NABVQModelIndex@@@Z, ? sibling@QAbstractItemModel@@UBE?AVQModelIndex@@HHABV2@@Z, ? hasIndex@QAbstractItemModel@@QBE_NHHABVQModelIndex@@@Z, ?? 1QAbstractItemModel@@UAE@XZ, ?? 0QAbstractItemModel@@QAE@PAVQObject@@@Z, ? merge@QItemSelection@@QAEXABV1@V? $QFlags@W4SelectionFlag@QItemSelectionModel@@@@@Z, ? indexes@QItemSelection@@QBE?AV?$QList@VQModelIndex@@@@XZ, ? select@QItemSelection@@QAEXABVQModelIndex@@0@Z, ?? 0QItemSelection@@QAE@$$QAV0@@Z, ??1QItemSelection@@QAE@XZ, ?? 6QDebug@@QAEAAV0@_N@Z, ??0QItemSelection@@QAE@XZ, ? child@QModelIndex@@QBE?AV1@HH@Z, ?createIndex@QAbstractItemModel@@IBE? AVQModelIndex@@HHPAX@Z, ?? 0QModelIndex@@AAE@HHPAXPBVQAbstractItemModel@@@Z, ? model@QModelIndex@@QBEPBVQAbstractItemModel@@XZ, ? internalPointer@QModelIndex@@QBEPAXXZ, ?length@QString@@QBEHXZ, ? trimmed@QString@@QGBE?AV1@XZ, ?fromBase64@QByteArray@@SA? AV1@ABV1@@Z, ?toBase64@QByteArray@@QBE?AV1@V? $QFlags@W4Base64Option@QByteArray@@@@@Z, ? contains@QString@@QBE_NABV1@W4CaseSensitivity@Qt@@@Z, ? fromStdString@QByteArray@@SA?AV1@ABV?$basic_string@DU? $char_traits@D@std@@V?$allocator@D@2@@std@@@Z, ? toStdString@QByteArray@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V? Copyright Joe Security LLC 2019 Page 31 of 34 DLL I$malploocrattor@D@2@@std@@XZ, ?qstrcmp@@YAHABVQByteArray@@PBD@Z, ? hex@@YAAAVQTextStream@@AAV1@@Z, ?qustrlen@QtPrivate@@YAHPBG@Z, ? compareStrings@QtPrivate@@YAHVQStringView@@0W4CaseSensitivity@Qt@@@Z, ?? 1QAbstractNativeEventFilter@@UAE@XZ, ??0QAbstractNativeEventFilter@@QAE@XZ, ?? 6QDebug@@QAEAAV0@P6AAAVQTextStream@@AAV1@@Z@Z, ?? 6QDebug@@QAEAAV0@ABVQByteArray@@@Z, ??6QDebug@@QAEAAV0@I@Z, ? data@QString@@QBEPBVQChar@@XZ, ?isNull@QString@@QBE_NXZ, ? startsWith@QString@@QBE_NVQChar@@W4CaseSensitivity@Qt@@@Z, ? cleanPath@QDir@@SA?AVQString@@ABV2@@Z, ? qRegisterResourceData@@YA_NHPBE00@Z, ?path@QUrl@@QBE?AVQString@@V? $QFlags@W4ComponentFormattingOption@QUrl@@@@@Z, ?scheme@QUrl@@QBE? AVQString@@XZ, ??9QString@@QBE_NVQLatin1String@@@Z, ? moveToThread@QObject@@QAEXPAVQThread@@@Z, ?run@QThread@@MAEXXZ, ? finished@QThread@@QAEXUQPrivateSignal@1@@Z, ? started@QThread@@QAEXUQPrivateSignal@1@@Z, ?quit@QThread@@QAEXXZ, ? metaObject@QThread@@UBEPBUQMetaObject@@XZ, ?? 8QUuid@@QBE_NABU_GUID@@@Z, ??8QUuid@@QBE_NABV0@@Z, ? toWCharArray@QString@@QBEHPA_W@Z, ?count@QString@@QBEHXZ, ? open@QFile@@UAE_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z, ? exists@QFile@@SA_NABVQString@@@Z, ??1QFile@@UAE@XZ, ?? GDI32.dll C0QreFaitle@Re@ctQRAgnE,@ CAomBVbQinSeRtrignng,@ Se@le@ctZO,b ?jecclot,s eC@reQatFeiCleoDmepvaicteib@le@DCU,A DEeXleXteZD, ?C, DeleteObject, GreeatdDAellv@iceQCIOapDsevice@@QAE?AVQByteArray@@XZ, ?fromLatin1@QString@@SA? AV1@PBDH@Z USER32.dll GetKeyState, GetMenuItemInfoW, GetMessagePos, PostMessageW, UnregisterClassW, GetWindowLongW, GetForegroundWindow, AllowSetForegroundWindow, GetWindowThreadProcessId, GetSystemMetrics, GetDC, ReleaseDC, EnableWindow, GetParent, GetClientRect, GetMenuItemCount, EnumWindows, SetParent, IsWindowEnabled, SendMessageW, SetWindowLongW KERNEL32.dll HeapDestroy, GetProcessHeap, GetCurrentProcess, CloseHandle, QueryPerformanceCounter, GetVolumeInformationW, SetLastError, K32GetModuleFileNameExW, OpenProcess, GetCurrentThread, K32EnumProcesses, FormatMessageW, LocalFree, CreateMutexW, WaitForSingleObject, ReleaseMutex, GetSystemDirectoryW, LoadLibraryW, GetProcAddress, IsBadWritePtr, GetLocaleInfoW, DeleteAtom, GlobalAlloc, GlobalFree, GlobalLock, FindAtomW, AddAtomW, GlobalUnlock, OutputDebugStringW, HeapReAlloc, HeapSize, HeapFree, WaitNamedPipeW, CallNamedPipeW, SetThreadErrorMode, GetCurrentProcessId, Sleep, ProcessIdToSessionId, GetModuleFileNameA, DeleteCriticalSection, DecodePointer, RaiseException, GetLastError, InitializeCriticalSectionEx, HeapAlloc, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, SetEvent, ResetEvent, IsDebuggerPresent, WaitForSingleObjectEx, CreateEventW, GetModuleHandleW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, GetCommandLineW, WideCharToMultiByte ADVAPI32.dll AdjustTokenPrivileges, OpenSCManagerW, CloseServiceHandle, QueryServiceStatus, LsaClose, LsaOpenPolicy, LsaQueryInformationPolicy, OpenProcessToken, GetUserNameW, OpenThreadToken, GetTokenInformation, LookupPrivilegeValueW, InitiateSystemShutdownW, LsaFreeMemory, OpenServiceW SHELL32.dll SHGetFolderPathW, SHQueryUserNotificationState, CommandLineToArgvW ole32.dll CLSIDFromProgID, StgCreateDocfileOnILockBytes, CreateILockBytesOnHGlobal, CoFreeUnusedLibraries, OleCreateFromFile, CoGetInterfaceAndReleaseStream, CoMarshalInterThreadInterfaceInStream, CoGetClassObject, CoTaskMemFree, CreateStreamOnHGlobal, OleRun, OleLockRunning, StgOpenStorageOnILockBytes, CoDisconnectObject, CoUninitialize, OleSetMenuDescriptor, CoTaskMemAlloc, CoInitialize, CoCreateInstance OLEAUT32.dll SysFreeString, SafeArrayGetLBound, SafeArrayGetElement, SafeArrayGetUBound, SafeArrayDestroy, SafeArrayCreate, SafeArrayLock, SafeArrayUnlock, SafeArrayRedim, SysAllocString, VariantClear, SysAllocStringLen, GetErrorInfo, VariantChangeType, SetErrorInfo, CreateErrorInfo, GetActiveObject, LoadTypeLib, VariantInit, SafeArrayAccessData, SafeArrayCreateVector, SafeArrayUnaccessData, OleCreatePictureIndirect, SafeArrayPutElement, SafeArrayGetVartype, OleCreateFontIndirect, SafeArrayGetDim, SystemTimeToVariantTime, VariantTimeToSystemTime

Copyright Joe Security LLC 2019 Page 32 of 34 DLL Import MSVCP140.dll ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV? $basic_streambuf@DU?$char_traits@D@std@@@2@XZ, ?fill@?$basic_ios@DU? $char_traits@D@std@@@std@@QBEDXZ, ?setstate@?$basic_ios@DU? $char_traits@D@std@@@std@@QAEXH_N@Z, ?sputc@?$basic_streambuf@DU? $char_traits@D@std@@@std@@QAEHD@Z, ?__ExceptionPtrRethrow@@YAXPBX@Z, ? __ExceptionPtrCurrentException@@YAXPAX@Z, ?__ExceptionPtrDestroy@@YAXPAX@Z, ?__ExceptionPtrToBool@@YA_NPBX@Z, ?_XGetLastError@std@@YAXXZ, ? __ExceptionPtrCopy@@YAXPAXPBX@Z, ?__ExceptionPtrCreate@@YAXPAX@Z, ? __ExceptionPtrAssign@@YAXPAXPBX@Z, ??0?$basic_streambuf@DU? $char_traits@D@std@@@std@@IAE@XZ, ?pbase@?$basic_streambuf@DU? $char_traits@D@std@@@std@@IBEPADXZ, ?setp@?$basic_streambuf@DU? $char_traits@D@std@@@std@@IAEXPAD0@Z, ??0?$basic_ios@DU? $char_traits@D@std@@@std@@IAE@XZ, ?_Osfx@?$basic_ostream@DU? $char_traits@D@std@@@std@@QAEXXZ, ?tie@?$basic_ios@DU? $char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU? $char_traits@D@std@@@2@XZ, _Cnd_destroy_in_situ, _Cnd_broadcast, _Mtx_unlock, _Cnd_wait, _Mtx_init_in_situ, _Mtx_lock, ??_7?$basic_iostream@DU? $char_traits@D@std@@@std@@6B@, _Mtx_destroy_in_situ, ??_7?$basic_istream@DU? $char_traits@D@std@@@std@@6B@, ?_Syserror_map@std@@YAPBDH@Z, ? _Throw_C_error@std@@YAXH@Z, ? _Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z, _Cnd_init_in_situ, ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@, ? _Xlength_error@std@@YAXPBD@Z, ?_Xout_of_range@std@@YAXPBD@Z, ?flush@? $basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ, ? uncaught_exception@std@@YA_NXZ, ?eback@?$basic_streambuf@DU? $char_traits@D@std@@@std@@IBEPADXZ, ?gptr@?$basic_streambuf@DU? $char_traits@D@std@@@std@@IBEPADXZ, ?pptr@?$basic_streambuf@DU? $char_traits@D@std@@@std@@IBEPADXZ, ?egptr@?$basic_streambuf@DU? $char_traits@D@std@@@std@@IBEPADXZ, ?gbump@?$basic_streambuf@DU? $char_traits@D@std@@@std@@IAEXH@Z, ?setg@?$basic_streambuf@DU? $char_traits@D@std@@@std@@IAEXPAD00@Z, ?epptr@?$basic_streambuf@DU? $char_traits@D@std@@@std@@IBEPADXZ, ?setp@?$basic_streambuf@DU? $char_traits@D@std@@@std@@IAEXPAD00@Z, ?_Pninc@?$basic_streambuf@DU? $char_traits@D@std@@@std@@IAEPADXZ, ??0?$basic_iostream@DU? $char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU? $char_traits@D@std@@@1@@Z, ??1?$basic_ios@DU? $char_traits@D@std@@@std@@UAE@XZ, ??1?$basic_streambuf@DU? $char_traits@D@std@@@std@@UAE@XZ, ?_Lock@?$basic_streambuf@DU? $char_traits@D@std@@@std@@UAEXXZ, ?_Xbad_function_call@std@@YAXXZ, ? rdstate@ios_base@std@@QBEHXZ, ?good@ios_base@std@@QBE_NXZ, ? flags@ios_base@std@@QBEHXZ, ?width@ios_base@std@@QBE_JXZ, ? width@ios_base@std@@QAE_J_J@Z, ??1?$basic_iostream@DU? $char_traits@D@std@@@std@@UAE@XZ, ??1?$basic_ostream@DU? $char_traits@D@std@@@std@@UAE@XZ, ??1?$basic_istream@DU? $char_traits@D@std@@@std@@UAE@XZ, ?imbue@?$basic_streambuf@DU? $char_traits@D@std@@@std@@MAEXABVlocale@2@@Z, ?sync@? $basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ?setbuf@? $basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z, ? xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z, ? xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z, ? uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ, ? showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ, ? _Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ SHLWAPI.dll PathFindFileNameW, PathIsNetworkPathW WININET.dll InternetCloseHandle, InternetSetOptionW, InternetOpenW, InternetQueryOptionW VCRUNTIME140.dll memcpy, __std_type_info_destroy_list, _except_handler4_common, _CxxThrowException, __RTDynamicCast, memset, memmove, __std_exception_copy, __std_exception_destroy, _purecall, __CxxFrameHandler3 api-ms-win-crt-heap-l1-1-0.dll _set_new_mode, _recalloc, _callnewh, free, malloc api-ms-win-crt-runtime-l1-1-0.dll _set_app_type, _exit, _initterm_e, _initterm, _invalid_parameter_noinfo_noreturn, terminate, _set_errno, _errno, exit, _register_thread_local_exe_atexit_callback, _seh_filter_exe, _get_narrow_winmain_command_line, _invalid_parameter_noinfo, _controlfp_s, _c_exit, _seh_filter_dll, _configure_narrow_argv, _initialize_narrow_environment, _initialize_onexit_table, _crt_at_quick_exit, _register_onexit_function, _execute_onexit_table, _crt_atexit, _cexit api-ms-win-crt-convert-l1-1-0.dll strtol api-ms-win-crt-stdio-l1-1-0.dll _set_fmode, __stdio_common_vswscanf, __stdio_common_vswprintf, __p__commode api-ms-win-crt-string-l1-1-0.dll isupper, toupper api-ms-win-crt-math-l1-1-0.dll __setusermatherr, floor, ceil, _except1 api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale mbcut.dll MbVerifyFile

Version Infos

Description Data LegalCopyright Malwarebytes. All rights reserved. InternalName mbam.exe FileVersion 4.0.0.448 CompanyName Malwarebytes LegalTrademarks ProductName Malwarebytes

Copyright Joe Security LLC 2019 Page 33 of 34 Description Data FileDescription Malwarebytes OriginalFilename mbam.exe Translation 0x0409 0x04e4

Possible Origin

Language of compilation system Country where language is spoken Map

English United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

System Behavior

Analysis Process: mbam.exe PID: 708 Parent PID: 4448

General

Start time: 17:41:10 Start date: 01/12/2019 Path: C:\Users\user\Desktop\mbam.exe Wow64 process (32bit): true Commandline: 'C:\Users\user\Desktop\mbam.exe' Imagebase: 0x110000 File size: 16544280 bytes MD5 hash: E14DDE2165D2D297D12C8898435285D1 Has administrator privileges: true Programmed in: C, C++ or other language Reputation: low

Disassembly

Code Analysis

Copyright Joe Security LLC 2019 Page 34 of 34