9a8a4d847009072cea4b86932eed9940_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

9a8a4d847009072cea4b86932eed9940_NeikiAnalytics.exe
Size

760KB
MD5

9a8a4d847009072cea4b86932eed9940
SHA1

50f90782b361b8de0de169ca0ca7f59ba9fc2996
SHA256

ab904c66db8dc2256b5309f14a32b9255bebf6a831d0f70c68514fcd2be8ff94
SHA512

69a494020c842761aff819123d2f9014d7514e9f475ea4479c8498b4191872e78080f1518e08a46bd2aad44fa2007bf36a036da858e756c6f9abee52472f32a6
SSDEEP

6144:rnWOguXTv6JBUeAlrHmviShsJ2+/SaZiuw:rnWOBmQeQrHYjsX/Sak

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a8a4d847009072cea4b86932eed9940_NeikiAnalytics.exe

Files

9a8a4d847009072cea4b86932eed9940_NeikiAnalytics.exe
.dll windows:10 windows x64 arch:x64

d4db3fb69e1eaf44e96269f1a467dcb9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlInstallFunctionTableCallback
RtlCompareMemory
RtlDeleteFunctionTable
RtlVirtualUnwind
RtlUnwindEx
RtlRaiseException
RtlAddFunctionTable
RtlCaptureStackBackTrace
RtlRestoreContext
RtlUnwind
RtlPcToFileHeader

ntdll

_wcslwr
RtlGetUILanguageInfo
EtwEventEnabled
RtlpConvertLCIDsToCultureNames
NtEnumerateKey
RtlIntegerToUnicodeString
RtlTimeToTimeFields
RtlTimeFieldsToTime
RtlUnhandledExceptionFilter
NtTerminateProcess
wcsncmp
wcsncpy
LdrFindResourceEx_U
RtlReadThreadProfilingData
RtlQueryThreadProfiling
RtlDisableThreadProfiling
RtlNtStatusToDosErrorNoTeb
RtlEnableThreadProfiling
NtMapUserPhysicalPagesScatter
RtlUnicodeStringToInteger
bsearch
RtlComputeImportTableHash
RtlFindActivationContextSectionGuid
RtlQueryActivationContextApplicationSettings
RtlSubAuthorityCountSid
LdrResFindResourceDirectory
RtlQueryInformationActivationContext
TpQueryPoolStackInformation
TpAllocPool
TpSetPoolMinThreads
TpSetPoolStackInformation
TpAllocWait
NtDeleteValueKey
NtSetValueKey
towlower
RtlPublishWnfStateData
NtQueryLicenseValue
_wtol
memmove_s
RtlLCIDToCultureName
RtlSizeHeap
RtlpConvertCultureNamesToLCIDs
NtQueryInstallUILanguage
EtwEventUnregister
EtwEventWrite
EtwEventRegister
RtlGUIDFromString
sin
RtlDecodeSystemPointer
RtlSetThreadPreferredUILanguages
RtlMultiAppendUnicodeStringBuffer
swprintf_s
RtlImageNtHeaderEx
NtMapViewOfSection
NtCreateSection
RtlDosPathNameToNtPathName_U_WithStatus
RtlGetActiveActivationContext
RtlDeactivateActivationContext
RtlActivateActivationContext
RtlZombifyActivationContext
RtlReleaseActivationContext
RtlAddRefActivationContext
RtlCreateActivationContext
RtlGetLengthWithoutLastFullDosOrNtPathElement
RtlpApplyLengthFunction
RtlGetFullPathName_U
RtlDoesFileExists_U
RtlDetermineDosPathNameType_U
RtlpEnsureBufferSize
DbgPrintEx
NtUnmapViewOfSection
RtlQueryPackageClaims
tolower
atol
toupper
isdigit
NtQueryInformationThread
RtlEnterUmsSchedulingMode
RtlCreateUmsThreadContext
RtlDeleteUmsThreadContext
TpAllocTimer
RtlQueryUmsThreadInformation
RtlGetNextUmsListItem
RtlGetCurrentUmsThread
RtlDeleteUmsCompletionList
RtlUmsThreadYield
RtlExecuteUmsThread
RtlGetUmsCompletionListEvent
RtlDequeueUmsCompletionListItems
RtlSetLastWin32ErrorAndNtStatusFromNtStatus
RtlCreateUmsCompletionList
RtlDestroyEnvironment
RtlCreateEnvironmentEx
RtlCreateEnvironment
NtQueryEvent
RtlCreateUnicodeString
NtRaiseHardError
RtlFreeAnsiString
RtlFreeOemString
RtlGetCurrentDirectory_U
wcsrchr
_wcsnicmp
RtlUnicodeStringToOemString
NtQueryVolumeInformationFile
CsrFreeCaptureBuffer
CsrAllocateMessagePointer
CsrAllocateCaptureBuffer
RtlEqualUnicodeString
RtlUnicodeStringToAnsiString
RtlExitUserThread
RtlAddIntegrityLabelToBoundaryDescriptor
RtlQueryProtectedPolicy
NtReplacePartitionUnit
RtlCompareUnicodeString
RtlExitUserProcess
RtlInitUnicodeStringEx
RtlQueryPackageIdentity
EtwEventWriteNoRegistration
RtlWow64LogMessageInEventLogger
LdrUnloadDll
LdrGetProcedureAddress
LdrLoadDll
RtlAppendUnicodeToString
RtlAppendUnicodeStringToString
RtlFormatCurrentUserKeyPath
NtQueryValueKey
RtlEqualSid
RtlSubAuthoritySid
RtlInitializeSid
NtQueryInformationToken
NtOpenProcessToken
NtSetInformationThread
NtOpenThreadToken
RtlReleaseSRWLockExclusive
RtlQueryRegistryValuesEx
NtOpenKey
RtlAcquireSRWLockExclusive
RtlAnsiStringToUnicodeString
RtlxAnsiStringToUnicodeSize
RtlInitAnsiStringEx
NtIsSystemResumeAutomatic
NtInitiatePowerAction
RtlIsNameLegalDOS8Dot3
RtlGetCurrentProcessorNumberEx
NtWaitForSingleObject
NtCreateEvent
RtlSetSearchPathMode
LdrGetDllDirectory
RtlUnlockHeap
RtlGetUserInfoHeap
RtlLockHeap
RtlDeregisterSecureMemoryCacheCallback
RtlRegisterSecureMemoryCacheCallback
RtlCompactHeap
NtFsControlFile
NtOpenFile
NtClose
LdrAddRefDll
NtQueryInformationFile
NtSetInformationFile
wcscpy_s
RtlGetActiveConsoleId
RtlDeactivateActivationContextUnsafeFast
RtlActivateActivationContextUnsafeFast
RtlNtStatusToDosError
RtlFreeUnicodeString
RtlWow64GetThreadSelectorEntry
NtSetInformationDebugObject
DbgUiGetThreadDebugObject
DbgUiIssueRemoteBreakin
NtSetSystemInformation
NtQueryInformationProcess
RtlSetCurrentTransaction
RtlGetCurrentTransaction
RtlSetLastWin32Error
CsrClientCallServer
LdrDisableThreadCalloutsForDll
RtlExpandEnvironmentStrings_U
TpAllocIoCompletion
TpAllocWork
TpCallbackMayRunLong
TpAllocCleanupGroup
RtlSetUmsThreadInformation
TpSimpleTryPost
CsrVerifyRegion
RtlCharToInteger
RtlInitAnsiString
RtlUpcaseUnicodeChar
RtlUnicodeToMultiByteSize
RtlDestroyAtomTable
NtFindAtom
NtQueryInformationAtom
RtlAddAtomToAtomTable
NtAddAtomEx
NtDeleteAtom
RtlCreateAtomTable
RtlDeleteAtomFromAtomTable
RtlLookupAtomInAtomTable
RtlQueryAtomInAtomTable
RtlDnsHostNameToComputerName
RtlPrefixString
NtFlushKey
_memicmp
RtlxUnicodeStringToAnsiSize
RtlEnterCriticalSection
wcschr
wcsstr
RtlLeaveCriticalSection
NtCreateKey
NtCreateFile
RtlCreateUnicodeStringFromAsciiz
wcsncpy_s
wcscspn
NtCreateJobSet
RtlReleasePrivilege
NtSetInformationJobObject
NtQueryInformationJobObject
NtCreateJobObject
RtlAcquirePrivilege
NtAssignProcessToJobObject
NtTerminateJobObject
NtOpenJobObject
RtlLengthSecurityDescriptor
NtSetEaFile
NtSetSecurityObject
NtQueryEaFile
NtQuerySecurityObject
LdrQueryImageFileKeyOption
LdrOpenImageFileOptionsKey
RtlQueryElevationFlags
NtSetInformationProcess
RtlRaiseStatus
NtQuerySection
NtFreeVirtualMemory
NtWriteFile
NtEnumerateValueKey
RtlEqualString
RtlUnicodeToMultiByteN
strncpy_s
NtUnlockFile
RtlDosPathNameToNtPathName_U
NtReadFile
NtLockFile
RtlCopyUnicodeString
CsrCaptureMessageString
RtlIsTextUnicode
NtAllocateVirtualMemory
RtlGetLongestNtPathLength
RtlPrefixUnicodeString
RtlMultiByteToUnicodeN
RtlMultiByteToUnicodeSize
RtlDosPathNameToRelativeNtPathName_U
RtlReleaseRelativeName
RtlSetIoCompletionCallback
RtlDeregisterWait
RtlRegisterWait
RtlImageDirectoryEntryToData
NtQueryVirtualMemory
RtlCreateBoundaryDescriptor
NtProtectVirtualMemory
RtlGetThreadErrorMode
NtCreateMailslotFile
RtlDestroyQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlCreateQueryDebugBuffer
NtQueryDirectoryFile
strcpy_s
RtlFindActivationContextSectionString
LdrSetDllDirectory
LdrFindResource_U
RtlSwitchedVVI
NtQueryWnfStateData
NtPowerInformation
NtGetDevicePowerState
NtSetThreadExecutionState
NtSetSystemEnvironmentValueEx
NtQuerySystemEnvironmentValueEx
RtlInitString
NtSetVolumeInformationFile
NtDeviceIoControlFile
RtlIsValidHandle
RtlAllocateHandle
RtlReAllocateHeap
RtlFreeHandle
RtlSetUserValueHeap
RtlUnsubscribeWnfStateChangeNotification
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
strchr
RtlSetEnvironmentStrings
RtlOemStringToUnicodeString
wcscat_s
RtlAllocateAndInitializeSid
RtlQueryEnvironmentVariable_U
NtQueryAttributesFile
RtlFreeSid
strrchr
NtQueryFullAttributesFile
TpCaptureCaller
RtlWow64EnableFsRedirection
_stricmp
NtSetTimerResolution
NtQueryTimerResolution
RtlGetAppContainerSidType
RtlConvertSidToUnicodeString
RtlSetEnvironmentVariable
RtlGetAppContainerParent
RtlQueryEnvironmentVariable
CsrCaptureMessageMultiUnicodeStringsInPlace
wcsnlen
strcat_s
strnlen
NlsMbCodePageTag
RtlRunOnceExecuteOnce
RtlInitializeCriticalSection
RtlGetThreadPreferredUILanguages
NtReadVirtualMemory
LdrResSearchResource
_strnicmp
strncmp
RtlTryAcquirePebLock
RtlReleasePebLock
RtlEncodeSystemPointer
RtlGetNtSystemRoot
NtWaitForMultipleObjects
NtClearEvent
RtlWerpReportException
DbgPrint
RtlGetDeviceFamilyInfoEnum
RtlHashUnicodeString
NtApphelpCacheControl
RtlGetFullPathName_UEx
ZwClose
ZwOpenFile
ZwOpenKey
ZwEnumerateKey
ZwQueryValueKey
ZwCreateFile
ZwQueryInformationFile
ZwCreateSection
ZwQueryDirectoryFile
RtlNtPathNameToDosPathName
RtlGetNativeSystemInformation
ZwQuerySystemInformation
ZwUnmapViewOfSection
ZwMapViewOfSection
VerSetConditionMask
RtlVerifyVersionInfo
RtlGetVersion
RtlGetCurrentServiceSessionId
RtlGetSuiteMask
LdrQueryImageFileExecutionOptions
RtlInitUnicodeString
_vsnwprintf
RtlSetProtectedPolicy
LdrSetDllManifestProber
RtlSetThreadPoolStartFunc
RtlImageNtHeader
NtQuerySystemInformation
RtlFreeHeap
RtlSetDaclSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlAllocateHeap
_wcsicmp
__C_specific_handler
memmove
RtlGetPersistedStateLocation
_local_unwind
cos
floor
memcmp
memcpy
memset
wcscmp

kernelbase

NotifyMountMgr
BaseFormatObjectAttributes
GetVolumeNameForVolumeMountPointW
lstrcmpW
lstrcmpiW
GetRegistryExtensionFlags
KernelBaseGetGlobalData
GlobalFree
LoadStringBaseExW
GetUnicodeStringToEightBitStringRoutine
GetUnicodeStringToEightBitSizeRoutine
CompareStringA
GetNamedPipeAttribute
AppXPreCreationExtension
AppXPostSuccessExtension
AppXReleaseAppXContext
AreFileApisANSI
CreateProcessInternalA
CreateProcessInternalW
CreateProcessAsUserW
CreateProcessAsUserA
EnumLanguageGroupLocalesW
AppContainerLookupMoniker
EnumSystemLanguageGroupsW
EnumSystemLocalesEx
PackageIdFromFullName
GetPackageFullName
GetCurrentPackageFullName
CheckIsMSIXPackage
ClosePackageInfo
AppXGetOSMaxVersionTested
GetPackageTargetPlatformProperty
GetTargetPlatformContext
OpenPackageInfoByFullNameForUser
AppContainerFreeMemory
BasepNotifyTrackingService
MoveFileWithProgressTransactedW
BasepAdjustObjectAttributesForPrivateNamespace
GetEightBitStringToUnicodeStringRoutine
GetStringTableEntry
CheckGroupPolicyEnabled
OpenRegKey
InternalLcidToName
NlsIsUserDefaultLocale
GetPtrCalDataArray
GetUserOverrideString
GetPtrCalData
Internal_EnumCalendarInfo
Internal_EnumLanguageGroupLocales
Internal_EnumSystemCodePages
Internal_EnumDateFormats
Internal_EnumUILanguages
Internal_EnumSystemLanguageGroups
NlsValidateLocale
Internal_EnumTimeFormats
GetNamedLocaleHashNode
GetUserOverrideWord
GetLocaleInfoHelper
GetCalendar
BaseDllFreeResourceId
BaseDllMapResourceIdW
CheckAllowDecryptedRemoteDestinationPolicy
PrivCopyFileExW
EnumUILanguagesW
LCIDToLocaleName
GetUserDefaultLocaleName
GetSystemDefaultLocaleName
GetEraNameCountedString
FatalAppExitW
FatalAppExitA
lstrlenW
lstrlenA
lstrcpynW
lstrcpynA
Sleep
SetFileApisToOEM
SetFileApisToANSI
PulseEvent
MapViewOfFileExNuma
LocalUnlock
LocalReAlloc
LocalLock
LocalAlloc
HeapSummary
GlobalAlloc
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetStringTypeA
GetProcAddressForCaller
BaseGetNamedObjectDirectory

api-ms-win-core-processthreads-l1-1-0

CreateProcessW
ProcessIdToSessionId
OpenThread
GetProcessVersion
GetExitCodeThread
GetPriorityClass
TlsAlloc
GetProcessIdOfThread
GetProcessId
GetProcessTimes
GetStartupInfoW
SetThreadPriority
SetProcessShutdownParameters
GetThreadId
SetPriorityClass
CreateProcessA
GetThreadPriority
GetThreadPriorityBoost
SetProcessAffinityUpdateMode
GetExitCodeProcess
SetThreadPriorityBoost
SetThreadStackGuarantee
SuspendThread
OpenProcessToken
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
CreateRemoteThread
SwitchToThread
TerminateProcess
TerminateThread
TlsSetValue
QueueUserAPC
TlsFree
ResumeThread
GetCurrentProcessId
GetCurrentProcess
CreateRemoteThreadEx
QueryProcessAffinityUpdateMode

api-ms-win-core-processthreads-l1-1-3

GetProcessShutdownParameters
SetProcessInformation
GetProcessInformation
SetThreadIdealProcessor

api-ms-win-core-processthreads-l1-1-2

GetThreadIOPendingFlag
GetThreadInformation
SetThreadInformation
SetProcessPriorityBoost
GetProcessPriorityBoost
GetSystemTimes

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent
GetThreadTimes
GetThreadIdealProcessorEx
GetThreadContext
SetThreadIdealProcessorEx
FlushInstructionCache
SetProcessMitigationPolicy
GetProcessMitigationPolicy
SetThreadContext
GetProcessHandleCount

api-ms-win-core-registry-l1-1-0

RegDeleteTreeW
RegDeleteValueA
RegDeleteValueW
RegDisablePredefinedCacheEx
RegEnumKeyExA
RegEnumKeyExW
RegEnumValueA
RegEnumValueW
RegFlushKey
RegGetKeySecurity
RegGetValueA
RegLoadKeyA
RegGetValueW
RegLoadMUIStringA
RegLoadMUIStringW
RegNotifyChangeKeyValue
RegDeleteKeyExW
RegOpenKeyExA
RegOpenUserClassesRoot
RegQueryInfoKeyA
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegRestoreKeyA
RegRestoreKeyW
RegSaveKeyExA
RegSaveKeyExW
RegSetKeySecurity
RegSetValueExA
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyExA
RegLoadAppKeyW
RegUnLoadKeyW
RegUnLoadKeyA
RegDeleteTreeA
RegCreateKeyExW
RegCreateKeyExA
RegCopyTreeW
RegOpenCurrentUser
RegCloseKey
RegLoadKeyW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapReAlloc
GetProcessHeaps
HeapCompact
HeapCreate
HeapDestroy
HeapWalk
HeapValidate
HeapUnlock
HeapSetInformation
HeapQueryInformation
HeapLock
HeapAlloc

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-memory-l1-1-1

CreateFileMappingNumaW
CreateMemoryResourceNotification
ResetWriteWatch
GetWriteWatch
VirtualUnlock
VirtualLock
GetLargePageMinimum
SetSystemFileCacheSize
SetProcessWorkingSetSizeEx
QueryMemoryResourceNotification
GetSystemFileCacheSize
GetProcessWorkingSetSizeEx

api-ms-win-core-memory-l1-1-0

VirtualQueryEx
VirtualQuery
VirtualProtectEx
VirtualProtect
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
UnmapViewOfFile
ReadProcessMemory
OpenFileMappingW
MapViewOfFileEx
MapViewOfFile
FlushViewOfFile
CreateFileMappingW
WriteProcessMemory

api-ms-win-core-memory-l1-1-2

AllocateUserPhysicalPagesNuma
AllocateUserPhysicalPages
VirtualAllocExNuma
GetMemoryErrorHandlingCapabilities
UnregisterBadMemoryNotification
RegisterBadMemoryNotification
MapUserPhysicalPages
FreeUserPhysicalPages

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle
SetHandleInformation
GetHandleInformation

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateEventW
WaitForSingleObject
SetWaitableTimer
SetEvent
CreateMutexExA
ResetEvent
ReleaseSemaphore
ReleaseMutex
SleepEx
CreateEventExW
CreateEventExA
CreateEventA
CancelWaitableTimer
OpenWaitableTimerW
OpenSemaphoreW
OpenMutexW
OpenEventW
OpenEventA
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
CreateWaitableTimerExW
CreateMutexA
CreateSemaphoreExW
CreateMutexW
CreateMutexExW
InitializeCriticalSection
WaitForMultipleObjectsEx

api-ms-win-core-synch-l1-2-1

CreateSemaphoreW
WaitForMultipleObjects

api-ms-win-core-synch-l1-2-0

InitializeSynchronizationBarrier
EnterSynchronizationBarrier
DeleteSynchronizationBarrier
SignalObjectAndWait
InitOnceExecuteOnce

api-ms-win-core-file-l1-1-0

GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetFileAttributesA
GetFileAttributesExA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileTime
GetDiskFreeSpaceExW
GetFileType
FlushFileBuffers
GetDiskFreeSpaceExA
GetFinalPathNameByHandleA
DeleteFileW
FindFirstFileExA
FindFirstFileExW
FindFirstFileW
FindFirstVolumeW
DeleteFileA
DefineDosDeviceW
CreateFileW
CreateFileA
GetLogicalDriveStringsW
CreateDirectoryW
GetVolumeInformationByHandleW
GetVolumeInformationW
GetVolumePathNameW
LocalFileTimeToFileTime
LockFile
LockFileEx
QueryDosDeviceW
ReadFile
ReadFileEx
ReadFileScatter
RemoveDirectoryA
RemoveDirectoryW
SetEndOfFile
SetFileAttributesA
SetFileAttributesW
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetFileValidData
UnlockFile
UnlockFileEx
WriteFile
WriteFileEx
WriteFileGather
FindNextChangeNotification
FindNextFileA
GetFullPathNameW
GetFullPathNameA
GetDiskFreeSpaceA
GetFinalPathNameByHandleW
GetTempFileNameW
DeleteVolumeMountPointW
CreateDirectoryA
FindNextFileW
FindNextVolumeW
FindVolumeClose
CompareFileTime
FileTimeToLocalFileTime
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
CreateFile2
GetTempPathW

api-ms-win-core-file-l1-2-2

GetTempPathA
GetTempFileNameA
FindFirstStreamW
FindFirstFileNameW
FindNextFileNameW
GetVolumeInformationA

api-ms-win-core-file-l1-2-1

GetCompressedFileSizeW
SetFileIoOverlappedRange
GetCompressedFileSizeA

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-io-l1-1-0

GetQueuedCompletionStatusEx
CancelIoEx
DeviceIoControl
GetQueuedCompletionStatus
GetOverlappedResult
CreateIoCompletionPort
PostQueuedCompletionStatus

api-ms-win-core-io-l1-1-1

CancelSynchronousIo
CancelIo

api-ms-win-core-job-l1-1-0

IsProcessInJob

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
CreateTimerQueue
UnregisterWaitEx
QueueUserWorkItem
ChangeTimerQueueTimer
DeleteTimerQueueTimer
DeleteTimerQueueEx

api-ms-win-core-threadpool-private-l1-1-0

RegisterWaitForSingleObjectEx

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-libraryloader-l1-2-2

EnumResourceNamesW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetModuleHandleExA
EnumResourceTypesExW
GetModuleFileNameW
GetModuleFileNameA
FreeResource
FreeLibraryAndExitThread
GetModuleHandleExW
EnumResourceLanguagesExW
EnumResourceTypesExA
GetModuleHandleA
EnumResourceNamesExA
FreeLibrary
LoadLibraryExW
EnumResourceLanguagesExA
DisableThreadLibraryCalls
EnumResourceNamesExW
FindResourceExW
FindStringOrdinal
GetProcAddress
LoadLibraryExA
SizeofResource
LockResource
LoadResource

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW
FindResourceW

api-ms-win-core-libraryloader-l2-1-0

LoadPackagedLibrary

api-ms-win-core-namedpipe-l1-2-2

CallNamedPipeW

api-ms-win-core-namedpipe-l1-1-0

CreateNamedPipeW
ConnectNamedPipe
CreatePipe
DisconnectNamedPipe
GetNamedPipeClientComputerNameW
PeekNamedPipe
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW

api-ms-win-core-namedpipe-l1-2-1

GetNamedPipeHandleStateW

api-ms-win-core-datetime-l1-1-0

GetDateFormatA
GetTimeFormatA
GetTimeFormatW
GetDateFormatW

api-ms-win-core-datetime-l1-1-1

GetTimeFormatEx
GetDateFormatEx

api-ms-win-core-datetime-l1-1-2

GetDurationFormatEx

api-ms-win-core-sysinfo-l1-2-0

SetSystemTime
EnumSystemFirmwareTables
GetSystemFirmwareTable
GetNativeSystemInfo
GetSystemTimePreciseAsFileTime
SetComputerNameExW
GetProductInfo

api-ms-win-core-sysinfo-l1-1-0

GlobalMemoryStatusEx
GetWindowsDirectoryW
GetWindowsDirectoryA
GetVersionExW
GetVersionExA
GetVersion
SetLocalTime
GetSystemTimeAdjustment
GetSystemTime
GetSystemInfo
GetLocalTime
GetComputerNameExW
GetComputerNameExA
GetLogicalProcessorInformationEx
GetSystemTimeAsFileTime
GetTickCount
GetLogicalProcessorInformation

api-ms-win-core-sysinfo-l1-2-3

SetComputerNameA
SetComputerNameW
SetComputerNameExA

api-ms-win-core-sysinfo-l1-2-1

DnsHostnameToComputerNameExW
SetComputerNameEx2W
GetPhysicallyInstalledSystemMemory

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetDynamicTimeZoneInformation
SetDynamicTimeZoneInformation
GetTimeZoneInformationForYear
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
SetTimeZoneInformation

api-ms-win-core-localization-l1-2-0

FindNLSStringEx
GetThreadUILanguage
SetProcessPreferredUILanguages
GetFileMUIInfo
GetCPInfo
GetCPInfoExW
GetNLSVersion
IsValidNLSVersion
SetThreadPreferredUILanguages
SetThreadUILanguage
GetLocaleInfoA
GetLocaleInfoW
GetOEMCP
GetSystemPreferredUILanguages
GetACP
GetFileMUIPath
IdnToAscii
FormatMessageW
GetProcessPreferredUILanguages
GetCalendarInfoEx
GetSystemDefaultLCID
GetThreadLocale
GetUserDefaultLangID
GetUserDefaultLCID
IsDBCSLeadByte
IsDBCSLeadByteEx
IsNLSDefinedString
IsValidCodePage
IsValidLanguageGroup
IsValidLocale
LCMapStringA
GetLocaleInfoEx
LCMapStringW
SetCalendarInfoW
SetLocaleInfoW
GetUserPreferredUILanguages
FormatMessageA
FindNLSString
IdnToUnicode
EnumSystemLocalesA
SetThreadLocale
ResolveLocaleName
LocaleNameToLCID
LCMapStringEx
IsValidLocaleName
GetNLSVersionEx
GetSystemDefaultLangID
GetThreadPreferredUILanguages
GetUILanguageInfo
ConvertDefaultLocale
VerLanguageNameW
GetCalendarInfoW
VerLanguageNameA
EnumSystemLocalesW

api-ms-win-core-processsnapshot-l1-1-0

PssFreeSnapshot
PssQuerySnapshot
PssWalkSnapshot
PssWalkMarkerSeekToBeginning
PssWalkMarkerSetPosition
PssWalkMarkerGetPosition
PssWalkMarkerFree
PssWalkMarkerCreate
PssCaptureSnapshot
PssDuplicateSnapshot

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW
SetStdHandleEx
SetStdHandle
GetEnvironmentVariableA
SetEnvironmentStringsW
SetEnvironmentVariableA
GetEnvironmentStrings
GetEnvironmentVariableW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SearchPathW
GetStdHandle
GetEnvironmentStringsW
GetCurrentDirectoryW
SetEnvironmentVariableW
GetCurrentDirectoryA
SetCurrentDirectoryA

api-ms-win-core-processenvironment-l1-2-0

NeedCurrentDirectoryForExePathA
NeedCurrentDirectoryForExePathW
SearchPathA

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
CompareStringEx
WideCharToMultiByte
GetStringTypeW
GetStringTypeExW
FoldStringW
CompareStringW
MultiByteToWideChar

api-ms-win-core-debug-l1-1-1

ContinueDebugEvent
WaitForDebugEvent
CheckRemoteDebuggerPresent
DebugActiveProcessStop
DebugActiveProcess

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent
OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

GetLastError
GetErrorMode
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
SetErrorMode
RaiseException

api-ms-win-core-errorhandling-l1-1-3

SetThreadErrorMode
GetThreadErrorMode

api-ms-win-core-fibers-l1-1-0

FlsFree
FlsGetValue
FlsSetValue
FlsAlloc

api-ms-win-core-util-l1-1-0

Beep

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-security-base-l1-1-0

GetTokenInformation
CreateWellKnownSid
EqualSid
AccessCheck
AllocateAndInitializeSid
FreeSid
DuplicateToken

api-ms-win-security-base-l1-2-0

AddResourceAttributeAce
SetCachedSigningLevel
GetCachedSigningLevel
GetAppContainerAce
CheckTokenMembershipEx
CheckTokenCapability
AddScopedPolicyIDAce

api-ms-win-security-appcontainer-l1-1-0

GetAppContainerNamedObjectPath

api-ms-win-core-comm-l1-1-0

SetCommBreak
SetCommConfig
GetCommTimeouts
GetCommState
SetCommMask
GetCommModemStatus
GetCommMask
GetCommConfig
EscapeCommFunction
ClearCommError
GetCommProperties
WaitCommEvent
TransmitCommChar
SetupComm
SetCommTimeouts
SetCommState
PurgeComm
ClearCommBreak

api-ms-win-core-realtime-l1-1-0

QueryThreadCycleTime
QueryUnbiasedInterruptTime
QueryProcessCycleTime
QueryIdleProcessorCycleTimeEx
QueryIdleProcessorCycleTime

api-ms-win-core-wow64-l1-1-1

GetSystemWow64DirectoryA
GetSystemWow64Directory2W
IsWow64Process2
GetSystemWow64DirectoryW

api-ms-win-core-wow64-l1-1-0

Wow64DisableWow64FsRedirection
IsWow64Process
Wow64RevertWow64FsRedirection

api-ms-win-core-wow64-l1-1-3

Wow64GetThreadContext
Wow64SetThreadContext
Wow64SuspendThread

api-ms-win-core-systemtopology-l1-1-1

GetNumaProximityNodeEx

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber
GetNumaNodeProcessorMaskEx

api-ms-win-core-processtopology-l1-1-0

SetThreadGroupAffinity
GetThreadGroupAffinity
GetProcessGroupAffinity

api-ms-win-core-namespace-l1-1-0

DeleteBoundaryDescriptor
ClosePrivateNamespace
AddSIDToBoundaryDescriptor
CreateBoundaryDescriptorW
OpenPrivateNamespaceW
CreatePrivateNamespaceW

api-ms-win-core-file-l2-1-2

CopyFileW
CreateHardLinkA

api-ms-win-core-file-l2-1-0

ReplaceFileW
CopyFile2
CopyFileExW
ReadDirectoryChangesW
ReOpenFile
CreateSymbolicLinkW
CreateHardLinkW
GetFileInformationByHandleEx
CreateDirectoryExW
MoveFileWithProgressW
MoveFileExW

api-ms-win-core-file-l2-1-3

ReadDirectoryChangesExW

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-xstate-l2-1-0

GetXStateFeaturesMask
SetXStateFeaturesMask
InitializeContext
LocateXStateFeature
CopyContext
GetEnabledXStateFeatures

api-ms-win-core-xstate-l2-1-1

InitializeContext2

api-ms-win-core-localization-l2-1-0

EnumCalendarInfoExEx
EnumDateFormatsExEx
EnumTimeFormatsEx
GetCurrencyFormatEx
EnumTimeFormatsW
EnumSystemCodePagesW
EnumDateFormatsW
EnumDateFormatsExW
EnumCalendarInfoW
EnumCalendarInfoExW
GetNumberFormatEx

api-ms-win-core-normalization-l1-1-0

IdnToNameprepUnicode
GetStringScripts
IsNormalizedString
NormalizeString
VerifyScripts

api-ms-win-core-fibers-l2-1-0

SwitchToFiber
CreateFiber
ConvertFiberToThread
DeleteFiber
ConvertThreadToFiber

api-ms-win-core-fibers-l2-1-1

CreateFiberEx
ConvertThreadToFiberEx

api-ms-win-core-localization-private-l1-1-0

NlsCheckPolicy
NlsGetCacheUpdateCount
NlsUpdateSystemLocale
NlsUpdateLocale

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx
ActivateActCtx
AddRefActCtx
ZombifyActCtx
CreateActCtxW
DeactivateActCtx
FindActCtxSectionGuid
FindActCtxSectionStringW
GetCurrentActCtx
QueryActCtxW
QueryActCtxSettingsW

api-ms-win-core-appcompat-l1-1-0

BaseUpdateAppcompatCache
BaseFlushAppcompatCache
BaseDumpAppcompatCache
BaseInitAppcompatCacheSupport
BaseCleanupAppcompatCacheSupport
BaseCheckAppcompatCacheEx
BaseCheckAppcompatCache

api-ms-win-core-windowserrorreporting-l1-1-0

WerUnregisterMemoryBlock
WerRegisterMemoryBlock
GetApplicationRestartSettings
WerRegisterFile
WerUnregisterFile
WerRegisterRuntimeExceptionModule
WerUnregisterRuntimeExceptionModule
GetApplicationRecoveryCallback

api-ms-win-core-windowserrorreporting-l1-1-3

RegisterApplicationRestart
UnregisterApplicationRestart

api-ms-win-core-windowserrorreporting-l1-1-1

WerUnregisterExcludedMemoryBlock
WerRegisterAdditionalProcess
WerUnregisterCustomMetadata
WerRegisterCustomMetadata
WerRegisterExcludedMemoryBlock
WerUnregisterAdditionalProcess

api-ms-win-core-windowserrorreporting-l1-1-2

WerRegisterAppLocalDump
WerUnregisterAppLocalDump

api-ms-win-core-console-l1-1-0

GetConsoleMode
GetConsoleOutputCP
GetConsoleCP
WriteConsoleW
GetNumberOfConsoleInputEvents
ReadConsoleA
ReadConsoleInputA
ReadConsoleInputW
ReadConsoleW
SetConsoleCtrlHandler
SetConsoleMode
WriteConsoleA
AllocConsole

api-ms-win-core-console-l1-2-0

PeekConsoleInputA
AttachConsole
FreeConsole
PeekConsoleInputW

api-ms-win-core-console-l1-2-1

CreatePseudoConsole
ClosePseudoConsole
ResizePseudoConsole

api-ms-win-core-console-l2-1-0

WriteConsoleOutputCharacterW
GenerateConsoleCtrlEvent
GetConsoleCursorInfo
GetConsoleScreenBufferInfo
FlushConsoleInputBuffer
ReadConsoleOutputCharacterA
CreateConsoleScreenBuffer
SetConsoleScreenBufferInfoEx
GetLargestConsoleWindowSize
ReadConsoleOutputA
ReadConsoleOutputAttribute
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfoEx
WriteConsoleOutputW
FillConsoleOutputCharacterA
ReadConsoleOutputCharacterW
ReadConsoleOutputW
ScrollConsoleScreenBufferA
ScrollConsoleScreenBufferW
SetConsoleActiveScreenBuffer
SetConsoleCP
SetConsoleCursorInfo
SetConsoleCursorPosition
WriteConsoleOutputCharacterA
WriteConsoleOutputAttribute
WriteConsoleOutputA
WriteConsoleInputW
WriteConsoleInputA
SetConsoleWindowInfo
SetConsoleTextAttribute
SetConsoleScreenBufferSize
SetConsoleOutputCP

api-ms-win-core-console-l2-2-0

GetConsoleOriginalTitleW
GetConsoleTitleA
SetConsoleTitleW
SetConsoleTitleA
GetConsoleTitleW
GetConsoleOriginalTitleA

api-ms-win-core-console-l3-2-0

AddConsoleAliasA
AddConsoleAliasW
ExpungeConsoleCommandHistoryA
ExpungeConsoleCommandHistoryW
GetConsoleAliasA
SetCurrentConsoleFontEx
SetConsoleNumberOfCommandsW
SetConsoleNumberOfCommandsA
SetConsoleHistoryInfo
GetConsoleAliasExesA
GetNumberOfConsoleMouseButtons
GetCurrentConsoleFontEx
GetCurrentConsoleFont
GetConsoleWindow
GetConsoleSelectionInfo
GetConsoleProcessList
GetConsoleHistoryInfo
GetConsoleFontSize
GetConsoleDisplayMode
GetConsoleCommandHistoryW
GetConsoleCommandHistoryLengthW
GetConsoleCommandHistoryLengthA
GetConsoleCommandHistoryA
GetConsoleAliasesW
GetConsoleAliasesLengthW
GetConsoleAliasesLengthA
GetConsoleAliasesA
GetConsoleAliasW
GetConsoleAliasExesW
GetConsoleAliasExesLengthW
GetConsoleAliasExesLengthA
SetConsoleDisplayMode

api-ms-win-core-psapi-l1-1-0

K32EmptyWorkingSet
K32QueryWorkingSet
QueryFullProcessImageNameW
K32GetModuleInformation
K32EnumProcessModulesEx
K32GetModuleBaseNameW
K32EnumProcessModules
K32EnumProcesses
K32QueryWorkingSetEx
K32InitializeProcessForWsWatch
K32GetWsChanges
K32GetWsChangesEx
K32GetMappedFileNameW
K32EnumDeviceDrivers
K32GetDeviceDriverBaseNameW
K32GetDeviceDriverFileNameW
K32GetProcessMemoryInfo
K32GetPerformanceInfo
K32EnumPageFilesW
K32GetProcessImageFileNameW
K32GetModuleFileNameExW

api-ms-win-core-psapi-ansi-l1-1-0

QueryFullProcessImageNameA
K32GetModuleBaseNameA
K32GetMappedFileNameA
K32GetDeviceDriverBaseNameA
K32GetDeviceDriverFileNameA
K32EnumPageFilesA
K32GetProcessImageFileNameA
K32GetModuleFileNameExA

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventWriteTransfer
EventUnregister

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-appcompat-l1-1-1

BaseReadAppCompatDataForProcess
BaseFreeAppCompatDataForProcess

Exports

Exports

AcquireSRWLockExclusive
AcquireSRWLockShared
ActivateActCtx
ActivateActCtxWorker
AddAtomA
AddAtomW
AddConsoleAliasA
AddConsoleAliasW
AddDllDirectory
AddIntegrityLabelToBoundaryDescriptor
AddLocalAlternateComputerNameA
AddLocalAlternateComputerNameW
AddRefActCtx
AddRefActCtxWorker
AddResourceAttributeAce
AddSIDToBoundaryDescriptor
AddScopedPolicyIDAce
AddSecureMemoryCacheCallback
AddVectoredContinueHandler
AddVectoredExceptionHandler
AdjustCalendarDate
AllocConsole
AllocateUserPhysicalPages
AllocateUserPhysicalPagesNuma
AppPolicyGetClrCompat
AppPolicyGetCreateFileAccess
AppPolicyGetLifecycleManagement
AppPolicyGetMediaFoundationCodecLoading
AppPolicyGetProcessTerminationMethod
AppPolicyGetShowDeveloperDiagnostic
AppPolicyGetThreadInitializationType
AppPolicyGetWindowingModel
AppXGetOSMaxVersionTested
ApplicationRecoveryFinished
ApplicationRecoveryInProgress
AreFileApisANSI
AssignProcessToJobObject
AttachConsole
BackupRead
BackupSeek
BackupWrite
BaseCheckAppcompatCache
BaseCheckAppcompatCacheEx
BaseCheckAppcompatCacheExWorker
BaseCheckAppcompatCacheWorker
BaseCheckElevation
BaseCleanupAppcompatCacheSupport
BaseCleanupAppcompatCacheSupportWorker
BaseDestroyVDMEnvironment
BaseDllReadWriteIniFile
BaseDumpAppcompatCache
BaseDumpAppcompatCacheWorker
BaseElevationPostProcessing
BaseFlushAppcompatCache
BaseFlushAppcompatCacheWorker
BaseFormatObjectAttributes
BaseFormatTimeOut
BaseFreeAppCompatDataForProcessWorker
BaseGenerateAppCompatData
BaseGetNamedObjectDirectory
BaseInitAppcompatCacheSupport
BaseInitAppcompatCacheSupportWorker
BaseIsAppcompatInfrastructureDisabled
BaseIsAppcompatInfrastructureDisabledWorker
BaseIsDosApplication
BaseQueryModuleData
BaseReadAppCompatDataForProcessWorker
BaseSetLastNTError
BaseThreadInitThunk
BaseUpdateAppcompatCache
BaseUpdateAppcompatCacheWorker
BaseUpdateVDMEntry
BaseVerifyUnicodeString
BaseWriteErrorElevationRequiredEvent
Basep8BitStringToDynamicUnicodeString
BasepAllocateActivationContextActivationBlock
BasepAnsiStringToDynamicUnicodeString
BasepAppContainerEnvironmentExtension
BasepAppXExtension
BasepCheckAppCompat
BasepCheckWebBladeHashes
BasepCheckWinSaferRestrictions
BasepConstructSxsCreateProcessMessage
BasepCopyEncryption
BasepFinishPackageActivationForSxS
BasepFreeActivationContextActivationBlock
BasepFreeAppCompatData
BasepGetAppCompatData
BasepGetComputerNameFromNtPath
BasepGetExeArchType
BasepGetPackageActivationTokenForSxS
BasepInitAppCompatData
BasepIsProcessAllowed
BasepMapModuleHandle
BasepNotifyLoadStringResource
BasepPostSuccessAppXExtension
BasepProcessInvalidImage
BasepQueryAppCompat
BasepQueryModuleChpeSettings
BasepReleaseAppXContext
BasepReleaseSxsCreateProcessUtilityStruct
BasepReportFault
BasepSetFileEncryptionCompression
Beep
BeginUpdateResourceA
BeginUpdateResourceW
BindIoCompletionCallback
BuildCommDCBA
BuildCommDCBAndTimeoutsA
BuildCommDCBAndTimeoutsW
BuildCommDCBW
CallNamedPipeA
CallNamedPipeW
CallbackMayRunLong
CancelDeviceWakeupRequest
CancelIo
CancelIoEx
CancelSynchronousIo
CancelThreadpoolIo
CancelTimerQueueTimer
CancelWaitableTimer
CeipIsOptedIn
ChangeTimerQueueTimer
CheckAllowDecryptedRemoteDestinationPolicy
CheckElevation
CheckElevationEnabled
CheckForReadOnlyResource
CheckForReadOnlyResourceFilter
CheckIsMSIXPackage
CheckNameLegalDOS8Dot3A
CheckNameLegalDOS8Dot3W
CheckRemoteDebuggerPresent
CheckTokenCapability
CheckTokenMembershipEx
ClearCommBreak
ClearCommError
CloseConsoleHandle
CloseHandle
ClosePackageInfo
ClosePrivateNamespace
CloseProfileUserMapping
ClosePseudoConsole
CloseState
CloseThreadpool
CloseThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolIo
CloseThreadpoolTimer
CloseThreadpoolWait
CloseThreadpoolWork
CmdBatNotification
CommConfigDialogA
CommConfigDialogW
CompareCalendarDates
CompareFileTime
CompareStringA
CompareStringEx
CompareStringOrdinal
CompareStringW
ConnectNamedPipe
ConsoleMenuControl
ContinueDebugEvent
ConvertCalDateTimeToSystemTime
ConvertDefaultLocale
ConvertFiberToThread
ConvertNLSDayOfWeekToWin32DayOfWeek
ConvertSystemTimeToCalDateTime
ConvertThreadToFiber
ConvertThreadToFiberEx
CopyContext
CopyFile2
CopyFileA
CopyFileExA
CopyFileExW
CopyFileTransactedA
CopyFileTransactedW
CopyFileW
CopyLZFile
CreateActCtxA
CreateActCtxW
CreateActCtxWWorker
CreateBoundaryDescriptorA
CreateBoundaryDescriptorW
CreateConsoleScreenBuffer
CreateDirectoryA
CreateDirectoryExA
CreateDirectoryExW
CreateDirectoryTransactedA
CreateDirectoryTransactedW
CreateDirectoryW
CreateEnclave
CreateEventA
CreateEventExA
CreateEventExW
CreateEventW
CreateFiber
CreateFiberEx
CreateFile2
CreateFileA
CreateFileMappingA
CreateFileMappingFromApp
CreateFileMappingNumaA
CreateFileMappingNumaW
CreateFileMappingW
CreateFileTransactedA
CreateFileTransactedW
CreateFileW
CreateHardLinkA
CreateHardLinkTransactedA
CreateHardLinkTransactedW
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectA
CreateJobObjectW
CreateJobSet
CreateMailslotA
CreateMailslotW
CreateMemoryResourceNotification
CreateMutexA
CreateMutexExA
CreateMutexExW
CreateMutexW
CreateNamedPipeA
CreateNamedPipeW
CreatePipe
CreatePrivateNamespaceA
CreatePrivateNamespaceW
CreateProcessA
CreateProcessAsUserA
CreateProcessAsUserW
CreateProcessInternalA
CreateProcessInternalW
CreateProcessW
CreatePseudoConsole
CreateRemoteThread
CreateRemoteThreadEx
CreateSemaphoreA
CreateSemaphoreExA
CreateSemaphoreExW
CreateSemaphoreW
CreateSymbolicLinkA
CreateSymbolicLinkTransactedA
CreateSymbolicLinkTransactedW
CreateSymbolicLinkW
CreateTapePartition
CreateThread
CreateThreadpool
CreateThreadpoolCleanupGroup
CreateThreadpoolIo
CreateThreadpoolTimer
CreateThreadpoolWait
CreateThreadpoolWork
CreateTimerQueue
CreateTimerQueueTimer
CreateToolhelp32Snapshot
CreateUmsCompletionList
CreateUmsThreadContext
CreateWaitableTimerA
CreateWaitableTimerExA
CreateWaitableTimerExW
CreateWaitableTimerW
CtrlRoutine
DeactivateActCtx
DeactivateActCtxWorker
DebugActiveProcess
DebugActiveProcessStop
DebugBreak
DebugBreakProcess
DebugSetProcessKillOnExit
DecodePointer
DecodeSystemPointer
DefineDosDeviceA
DefineDosDeviceW
DelayLoadFailureHook
DeleteAtom
DeleteBoundaryDescriptor
DeleteCriticalSection
DeleteFiber
DeleteFileA
DeleteFileTransactedA
DeleteFileTransactedW
DeleteFileW
DeleteProcThreadAttributeList
DeleteSynchronizationBarrier
DeleteTimerQueue
DeleteTimerQueueEx
DeleteTimerQueueTimer
DeleteUmsCompletionList
DeleteUmsThreadContext
DeleteVolumeMountPointA
DeleteVolumeMountPointW
DequeueUmsCompletionListItems
DeviceIoControl
DisableThreadLibraryCalls
DisableThreadProfiling
DisassociateCurrentThreadFromCallback
DiscardVirtualMemory
DisconnectNamedPipe
DnsHostnameToComputerNameA
DnsHostnameToComputerNameExW
DnsHostnameToComputerNameW
DosDateTimeToFileTime
DosPathToSessionPathA
DosPathToSessionPathW
DuplicateConsoleHandle
DuplicateEncryptionInfoFileExt
DuplicateHandle
EnableThreadProfiling
EncodePointer
EncodeSystemPointer
EndUpdateResourceA
EndUpdateResourceW
EnterCriticalSection
EnterSynchronizationBarrier
EnterUmsSchedulingMode
EnumCalendarInfoA
EnumCalendarInfoExA
EnumCalendarInfoExEx
EnumCalendarInfoExW
EnumCalendarInfoW
EnumDateFormatsA
EnumDateFormatsExA
EnumDateFormatsExEx
EnumDateFormatsExW
EnumDateFormatsW
EnumLanguageGroupLocalesA
EnumLanguageGroupLocalesW
EnumResourceLanguagesA
EnumResourceLanguagesExA
EnumResourceLanguagesExW
EnumResourceLanguagesW
EnumResourceNamesA
EnumResourceNamesExA
EnumResourceNamesExW
EnumResourceNamesW
EnumResourceTypesA
EnumResourceTypesExA
EnumResourceTypesExW
EnumResourceTypesW
EnumSystemCodePagesA
EnumSystemCodePagesW
EnumSystemFirmwareTables
EnumSystemGeoID
EnumSystemGeoNames
EnumSystemLanguageGroupsA
EnumSystemLanguageGroupsW
EnumSystemLocalesA
EnumSystemLocalesEx
EnumSystemLocalesW
EnumTimeFormatsA
EnumTimeFormatsEx
EnumTimeFormatsW
EnumUILanguagesA
EnumUILanguagesW
EnumerateLocalComputerNamesA
EnumerateLocalComputerNamesW
EraseTape
EscapeCommFunction
ExecuteUmsThread
ExitProcess
ExitThread
ExitVDM
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
ExpungeConsoleCommandHistoryA
ExpungeConsoleCommandHistoryW
FatalAppExitA
FatalAppExitW
FatalExit
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FillConsoleOutputCharacterW
FindActCtxSectionGuid
FindActCtxSectionGuidWorker
FindActCtxSectionStringA
FindActCtxSectionStringW
FindActCtxSectionStringWWorker
FindAtomA
FindAtomW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindFirstFileA
FindFirstFileExA
FindFirstFileExW
FindFirstFileNameTransactedW
FindFirstFileNameW
FindFirstFileTransactedA
FindFirstFileTransactedW
FindFirstFileW
FindFirstStreamTransactedW
FindFirstStreamW
FindFirstVolumeA
FindFirstVolumeMountPointA
FindFirstVolumeMountPointW
FindFirstVolumeW
FindNLSString
FindNLSStringEx
FindNextChangeNotification
FindNextFileA
FindNextFileNameW
FindNextFileW
FindNextStreamW
FindNextVolumeA
FindNextVolumeMountPointA
FindNextVolumeMountPointW
FindNextVolumeW
FindPackagesByPackageFamily
FindResourceA
FindResourceExA
FindResourceExW
FindResourceW
FindStringOrdinal
FindVolumeClose
FindVolumeMountPointClose
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushConsoleInputBuffer
FlushFileBuffers
FlushInstructionCache
FlushProcessWriteBuffers
FlushViewOfFile
FoldStringA
FoldStringW
FormatApplicationUserModelId
FormatMessageA
FormatMessageW
FreeConsole
FreeEnvironmentStringsA
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
FreeLibraryWhenCallbackReturns
FreeMemoryJobObject
FreeResource
FreeUserPhysicalPages
GenerateConsoleCtrlEvent
GetACP
GetActiveProcessorCount
GetActiveProcessorGroupCount
GetAppContainerAce
GetAppContainerNamedObjectPath
GetApplicationRecoveryCallback
GetApplicationRecoveryCallbackWorker
GetApplicationRestartSettings
GetApplicationRestartSettingsWorker
GetApplicationUserModelId
GetAtomNameA
GetAtomNameW
GetBinaryType
GetBinaryTypeA
GetBinaryTypeW
GetCPInfo
GetCPInfoExA
GetCPInfoExW
GetCachedSigningLevel
GetCalendarDateFormat
GetCalendarDateFormatEx
GetCalendarDaysInMonth
GetCalendarDifferenceInDays
GetCalendarInfoA
GetCalendarInfoEx
GetCalendarInfoW
GetCalendarMonthsInYear
GetCalendarSupportedDateRange
GetCalendarWeekNumber
GetComPlusPackageInstallStatus
GetCommConfig
GetCommMask
GetCommModemStatus
GetCommProperties
GetCommState
GetCommTimeouts
GetCommandLineA
GetCommandLineW
GetCompressedFileSizeA
GetCompressedFileSizeTransactedA
GetCompressedFileSizeTransactedW
GetCompressedFileSizeW
GetComputerNameA
GetComputerNameExA
GetComputerNameExW
GetComputerNameW
GetConsoleAliasA
GetConsoleAliasExesA
GetConsoleAliasExesLengthA
GetConsoleAliasExesLengthW
GetConsoleAliasExesW
GetConsoleAliasW
GetConsoleAliasesA
GetConsoleAliasesLengthA
GetConsoleAliasesLengthW
GetConsoleAliasesW
GetConsoleCP

Sections

.text
Size: 508KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d4db3fb69e1eaf44e96269f1a467dcb9

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-core-rtlsupport-l1-1-0

ntdll

kernelbase

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-3

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l1-2-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-job-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-threadpool-private-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-libraryloader-l1-2-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l2-1-0

api-ms-win-core-namedpipe-l1-2-2

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-namedpipe-l1-2-1

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-datetime-l1-1-1

api-ms-win-core-datetime-l1-1-2

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-3

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processsnapshot-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-debug-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-base-l1-2-0

api-ms-win-security-appcontainer-l1-1-0

api-ms-win-core-comm-l1-1-0

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-wow64-l1-1-3

api-ms-win-core-systemtopology-l1-1-1

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-processtopology-l1-1-0

api-ms-win-core-namespace-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-3

.text
Size: 508KB - Virtual size: 508KB

.rdata
Size: 204KB - Virtual size: 204KB

.data
Size: 8KB - Virtual size: 8KB

.pdata
Size: 24KB - Virtual size: 24KB

.didat
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 4KB