d56838bb2bac2cf907a70917be644890_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
d56838bb2bac2cf907a70917be644890_NeikiAnalytics.exe
Size 2.6MB
Sample240608-sffclacg2v
SHA256 f305b635893faec025ed84dcf33e164c4a3f89fac09d47c66ba4042f2da8686c
MD5 d56838bb2bac2cf907a70917be644890
SHA1 8b1f31fbe6b8eb1432ac9900569ded68ad297fc7
SHA512 7e8ef5ac30c152bd639ee9bc9313a049d4c09e1f430eea069933afec5188e5a75ea70e450c11afa63f3add539db36a8e93e7dee4790e8a342fedcb4e94610cc1
SSDEEP 49152:ZnMXcBY3GXZ872qxAaYa3Y8sISnlivyrSHoLj0eZi9oXioa+mCc0ztq262iyzhiJ:jS1CtwJ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

d56838bb2bac2cf907a70917be644890_NeikiAnalytics.exe

.dll 2.6MB

d56838bb2bac2cf907a70917be644890_NeikiAnalytics.exe

IMPHASH 5d2ed4ef05a3981746482173e187e650
SHA256 f305b635893faec025ed84dcf33e164c4a3f89fac09d47c66ba4042f2da8686c
MD5 d56838bb2bac2cf907a70917be644890
SHA1 8b1f31fbe6b8eb1432ac9900569ded68ad297fc7
SHA512 7e8ef5ac30c152bd639ee9bc9313a049d4c09e1f430eea069933afec5188e5a75ea70e450c11afa63f3add539db36a8e93e7dee4790e8a342fedcb4e94610cc1
SSDEEP 49152:ZnMXcBY3GXZ872qxAaYa3Y8sISnlivyrSHoLj0eZi9oXioa+mCc0ztq262iyzhiJ:jS1CtwJ
MD5 SHA1 SHA512 SSDEEP

Digest

cc:34:8b:63:1d:40:95:73:39:b7:59:72:6b:ac:85:14:5d:00:bc:75:b8:23:a0:08:f0:5c:c3:ba:6b:ab:6c:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 7, 2024

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

413680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

twinapi.appcore.pdb

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment _o__initialize_onexit_table _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__purecall _o__register_onexit_function _o__seh_filter_dll _o__set_errno _o__ui64tow_s _o__wcsicmp memmove _o_abort _o_free _o_iswspace _o_malloc _o_realloc _o_strncpy_s _o_strtol _o_terminate _o_wcscat_s _o_wcscpy_s _o_wcstol __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context _CxxThrowException __std_type_info_compare _o__crt_atexit _o__configure_narrow_argv _o__cexit _o__callnewh _o___stdio_common_vswprintf _o___stdio_common_vsprintf_s _o___stdio_common_vsnwprintf_s _o___stdio_common_vsnprintf_s _o___std_type_info_destroy_list _o___std_exception_destroy _o___std_exception_copy _o__execute_onexit_table _o__errno __std_terminate __CxxFrameHandler4 memcmp memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

DisableThreadLibraryCalls GetModuleHandleExW GetModuleFileNameA GetProcAddress GetModuleHandleW GetModuleFileNameW LoadLibraryExW LoadStringW FreeLibrary GetModuleHandleExA

api-ms-win-core-synch-l1-2-0

InitializeConditionVariable WakeConditionVariable InitOnceBeginInitialize InitOnceExecuteOnce WakeAllConditionVariable SleepConditionVariableSRW Sleep InitOnceInitialize WakeByAddressAll InitOnceComplete WaitOnAddress WakeByAddressSingle

api-ms-win-core-synch-l1-1-0

CreateEventExW ReleaseSRWLockShared WaitForSingleObjectEx CreateSemaphoreExW CreateMutexExW AcquireSRWLockShared EnterCriticalSection DeleteCriticalSection InitializeSRWLock AcquireSRWLockExclusive SetWaitableTimerEx ReleaseSRWLockExclusive InitializeCriticalSection ReleaseMutex WaitForSingleObject TryAcquireSRWLockExclusive SetEvent InitializeCriticalSectionEx WaitForMultipleObjectsEx CreateEventW CreateWaitableTimerExW OpenEventW ReleaseSemaphore LeaveCriticalSection ResetEvent OpenSemaphoreW

api-ms-win-core-heap-l1-1-0

HeapFree HeapAlloc GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

GetLastError SetUnhandledExceptionFilter RaiseException SetLastError UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl EventUnregister EventWriteTransfer EventRegister EventSetInformation

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage UnregisterTraceGuids GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer CloseThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolTimer SetThreadpoolWait CloseThreadpoolWork CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolTimerCallbacks WaitForThreadpoolWorkCallbacks DisassociateCurrentThreadFromCallback CreateThreadpoolWait TrySubmitThreadpoolCallback SetThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

TerminateProcess GetProcessId GetCurrentProcess GetCurrentThreadId GetCurrentProcessId ExitProcess GetCurrentThread OpenThread GetProcessTimes OpenProcessToken OpenThreadToken ProcessIdToSessionId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle DuplicateHandle GetHandleInformation

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlCaptureStackBackTrace RtlVirtualUnwind RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetTickCount GetVersionExW GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList

api-ms-win-core-registry-l1-1-0

RegCloseKey RegOpenCurrentUser RegGetValueW RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW

api-ms-win-core-quirks-l1-1-0

QuirkIsEnabled

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW GetCommandLineW

api-ms-win-core-heap-l2-1-0

LocalAlloc GlobalAlloc LocalReAlloc LocalFree GlobalFree

api-ms-win-security-base-l1-1-0

GetLengthSid CreateWellKnownSid GetTokenInformation DuplicateTokenEx FreeSid CopySid

api-ms-win-core-processthreads-l1-1-3

SetThreadDescription

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar CompareStringOrdinal

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime GetProductInfo

api-ms-win-core-localization-l1-2-3

GetUserDefaultGeoName

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-memory-l1-1-0

MapViewOfFile OpenFileMappingW UnmapViewOfFile VirtualQueryEx MapViewOfFileEx CreateFileMappingW FlushViewOfFile

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer DeleteTimerQueueTimer QueueUserWorkItem

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW RegisterWaitForSingleObject

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrCmpNIW

api-ms-win-core-psm-key-l1-1-0

PsmGetKeyFromToken PsmGetKeyFromProcess PsmGetPackageFullNameFromKey

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-apiquery-l2-1-0

IsApiSetImplemented

combase

ord122 ord90 ord157 ord69 ord95 ord168 ord120

ntdll

RtlRunOnceExecuteOnce RtlFlushHeaps RtlQueryPackageIdentity TpTrimPools RtlUpcaseUnicodeChar NtOpenProcessTokenEx RtlUnsubscribeWnfStateChangeNotification NtWaitForSingleObject NtDelayExecution RtlAllocateWnfSerializationGroup RtlUnsubscribeWnfNotificationWithCompletionCallback NtIsProcessInJob NtQueryInformationJobObject RtlRaiseStatus RtlInitializeConditionVariable RtlWakeAllConditionVariable NtResetEvent RtlExpandEnvironmentStrings RtlCompareUnicodeStrings RtlReleaseSRWLockShared RtlAcquireSRWLockShared RtlAcquireSRWLockExclusive RtlReleaseSRWLockExclusive RtlSleepConditionVariableSRW RtlInitializeSRWLock NtClose RtlQueryUnbiasedInterruptTime RtlFreeHeap wcschr NtQueryInformationToken RtlEqualSid RtlDeriveCapabilitySidsFromName RtlInitUnicodeString RtlSubscribeWnfStateChangeNotification NtQueryWnfStateData RtlUnsubscribeWnfNotificationWaitForCompletion RtlGetDeviceFamilyInfoEnum RtlWaitOnAddress NtQueryInformationProcess RtlWakeAddressAll RtlNtStatusToDosError RtlQueryPackageClaims RtlLoadString RtlAllocateHeap RtlNtStatusToDosErrorNoTeb RtlCompareUnicodeString wcsrchr wcscspn RtlFreeUnicodeString RtlGetTokenNamedObjectPath strncmp RtlLengthSid RtlConvertDeviceFamilyInfoToString strchr RtlGUIDFromString RtlQueryWnfStateData RtlFindLeastSignificantBit TpSetWait TpAllocWait TpReleaseWait TpWaitForWait RtlRunOnceBeginInitialize RtlIsMultiSessionSku

msvcp_win

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?uncaught_exception@std@@YA_NXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Thrd_yield ?__ExceptionPtrCreate@@YAXPEAX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrRethrow@@YAXPEBX@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

BiActivateWorkItemForUser BiChangeApplicationStateForPackageName BiChangeApplicationStateForPackageNameForUser BiChangeApplicationStateForPsmKey BiChangeApplicationStateForPsmKeyForUser BiChangeSessionState BiChangeUserState BiEnumerateWorkItemsForPackageNameAndUser BiGetActiveBackgroundTasksEvent BiGetActiveBackgroundTasksEventForUser BiGetCancellationTimeoutInMs BiIsApplicationTerminateSensitive BiIsApplicationTerminateSensitiveForUser BiNotifyNewSession BiNotifyNewSessionComplete BiNotifyNewUser BiPlmFreeMemory BiPtActivateDeferredWorkItem BiPtActivateInBackground BiPtActivateInBackgroundEx BiPtActivateWorkItem BiPtAssociateActivationProxy BiPtAssociateApplicationEntryPoint BiPtAssociateApplicationExtensionClass BiPtCancelWorkItem BiPtCancelWorkItemEx BiPtCreateEvent BiPtCreateEventForApp BiPtCreateEventForPackageName BiPtDeleteEvent BiPtDisableWorkItem BiPtDisassociateWorkItem BiPtDisassociateWorkItemEx BiPtEnableWorkItem BiPtEnumerateBrokeredEvents BiPtEnumerateBrokeredEventsEx BiPtEnumerateWorkItemsForPackageName BiPtEnumerateWorkItemsForPackageNameEx BiPtFreeMemory BiPtGetStatusStateNameFromBrokerEventId BiPtQueryBrokerEventId BiPtQueryBrokeredEvent BiPtQuerySystemStateBroadcastChannels BiPtQueryWorkItem BiPtQueryWorkItemEx BiPtQueryWorkItemStatusStateName BiPtSignalEvent BiPtSignalEventEx BiPtSignalMultipleEvents BiPtSignalTriggerEvent BiPtSignalTriggerEventEx BiQueryWorkItemForUser BiResetActiveSessionForPackage BiResetActiveUserForPackage BiSetActiveSessionForPackage BiSetActiveUserForPackage BiTerminateApplicationHost BiTerminateApplicationHost2 BiTerminateApplicationHostForUser BiUpdateBackgroundAccessApplicationsForUser BiUpdateLockScreenApplications DllCanUnloadNow DllGetActivationFactory DllGetClassObject PsmApplyTaskCompletion PsmBlockAppStateChangeCompletion PsmDisconnect PsmGetSessionInfo PsmInitializeExtension PsmIsProcessInApplication PsmIsProcessInApplication2 PsmQueryApplicationInformation PsmQueryApplicationInformation2 PsmQueryApplicationInterferenceCount PsmQueryApplicationInterferenceCount2 PsmQueryApplicationList PsmQueryApplicationList2 PsmQueryApplicationProperties PsmQueryApplicationProperties2 PsmQueryApplicationProperties3 PsmQueryApplicationPropertiesByUser PsmQueryApplicationResourceUsage PsmQueryApplicationResourceUsage2 PsmQueryApplicationResourceUsageForTimer PsmQueryCurrentAppState PsmQueryMaxMemoryUsage PsmQueryMaxMemoryUsage2 PsmQueryMemoryUsage PsmQueryMemoryUsage2 PsmQueryMemoryUsageByUser PsmQueryProcessList PsmQueryProcessList2 PsmQuerySharedCommitByUser PsmQueryTaskCompletionInformation PsmQueryTaskCompletionInformation2 PsmRegisterAppPriorityNotification PsmRegisterAppStateChangeNotification PsmRegisterApplicationNotification PsmRegisterApplicationNotification2 PsmRegisterDynamicProcess PsmRegisterKeyNotification PsmRegisterManagerType PsmResetMaxMemoryUsage PsmResetMaxMemoryUsage2 PsmResetMaxMemoryUsageByUser PsmSetApplicationPriority PsmSetApplicationPriority2 PsmSetApplicationProperties PsmSetApplicationProperties2 PsmSetApplicationProperties3 PsmSetApplicationPropertiesByUser PsmSetApplicationState PsmSetApplicationState2 PsmShutdownApplication PsmTimerCleanup PsmTimerElapsedResourceTimeGet PsmTimerInitialize PsmTimerRemainingResourceTimeGet PsmTimerStart PsmUnblockAppStateChangeCompletion PsmUnregisterAppStateChangeNotification PsmWaitForAppResume RegisterAppConstrainedChangeNotification RegisterAppStateChangeNotification UnregisterAppConstrainedChangeNotification UnregisterAppStateChangeNotification ValidateSystemShutdown

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

568KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d56838bb2bac2cf907a70917be644890_NeikiAnalytics.exe

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-quirks-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-3

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-localization-l1-2-3

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-psm-key-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-apiquery-l2-1-0

combase

ntdll

msvcp_win

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

generic