whaTARE YIOUYASD[.]zip

Resubmissions

08/06/2024, 15:16

240608-snmrmsdf837

08/06/2024, 15:15

240608-sm889acg7w3

08/06/2024, 15:14

240608-smthssdf753

08/06/2024, 15:13

240608-sl169acg6v3

Sharing

Copy URL Twitter E-mail

General

Target
whaTARE YIOUYASD.zip
Size 1002KB
Sample240608-snmrmsdf83
SHA256 8c5805bfc8cd8bf691cfbf49b0c1eeb2b92b3cc32b1b23370ca969f6655b9714
MD5 66763bed573aa4f67d097e9ecdd0d318
SHA1 d8763d225a284059c7b82a840e571afa16a57cd0
SHA512 ecf6294a4f8ba0815a85f37f3c736f4dfd79d226c27326df0223de4bdcbb5611880e372a331e16c957534de568a4687af9a86ad044b2cf8855013778202f2f8c
SSDEEP 24576:vvjZcuQiKuolRTJF14GKaMhulAoTFhldkntqZbGl:vv1JhkLdF17KilA0hld1ZS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/rblx.exe

File Explorer

whaTARE YIOUYASD.zip

.zip 1002KB
dxwebsetup.exe

.exe 288KB
rblx.exe

.exe 1.5MB

whaTARE YIOUYASD.zip

SHA256 8c5805bfc8cd8bf691cfbf49b0c1eeb2b92b3cc32b1b23370ca969f6655b9714
MD5 66763bed573aa4f67d097e9ecdd0d318
SHA1 d8763d225a284059c7b82a840e571afa16a57cd0
SHA512 ecf6294a4f8ba0815a85f37f3c736f4dfd79d226c27326df0223de4bdcbb5611880e372a331e16c957534de568a4687af9a86ad044b2cf8855013778202f2f8c
SSDEEP 24576:vvjZcuQiKuolRTJF14GKaMhulAoTFhldkntqZbGl:vv1JhkLdF17KilA0hld1ZS
MD5 SHA1 SHA512 SSDEEP

dxwebsetup.exe

IMPHASH 1494de9b53e05fc1f40cb92afbdd6ce4
SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
MD5 2cbd6ad183914a0c554f0739069e77d7
SHA1 7bf35f2afca666078db35ca95130beb2e3782212
SHA512 ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
SSDEEP 6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

27:76:a5:a9:c5:b9:5a:43:1b:2c:30:b6:5e:2d:45:20:bf:45:97:ec:05:e8:52:14:50:01:2c:09:4d:ce:b4:84

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 7, 2024

Minor OS version

Major OS version

Entry point

23134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

FreeSid AllocateAndInitializeSid EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCloseKey RegDeleteValueA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegCreateKeyExA RegQueryInfoKeyA

kernel32

LocalFree LocalAlloc GetLastError GetCurrentProcess GetModuleFileNameA lstrlenA GetSystemDirectoryA RemoveDirectoryA FindClose FindNextFileA DeleteFileA SetFileAttributesA lstrcmpA FindFirstFileA lstrcatA lstrcpyA _lclose _llseek _lopen WritePrivateProfileStringA GetWindowsDirectoryA CreateDirectoryA GetFileAttributesA ExpandEnvironmentStringsA IsDBCSLeadByte GetShortPathNameA GetPrivateProfileStringA GetPrivateProfileIntA lstrcmpiA GetProcAddress GlobalUnlock GlobalLock GlobalAlloc FreeResource CloseHandle LoadResource SizeofResource FindResourceA ReadFile WriteFile SetFilePointer SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetCurrentDirectoryA GetTempFileNameA ExitProcess CreateFileA LoadLibraryExA lstrcpynA GetVolumeInformationA FormatMessageA GetCurrentDirectoryA GetVersionExA GetExitCodeProcess WaitForSingleObject CreateProcessA GetTempPathA GetSystemInfo CreateMutexA SetEvent CreateEventA CreateThread ResetEvent TerminateThread GetDriveTypeA GetModuleHandleA GetStartupInfoA GetCommandLineA LockResource LoadLibraryA GetDiskFreeSpaceA MulDiv EnumResourceLanguagesA FreeLibrary GlobalFree

gdi32

GetDeviceCaps

user32

ExitWindowsEx wsprintfA CharNextA CharUpperA CharPrevA SetWindowLongA GetWindowLongA CallWindowProcA DispatchMessageA MsgWaitForMultipleObjects PeekMessageA SendMessageA SetWindowPos ReleaseDC GetDC GetWindowRect SendDlgItemMessageA GetDlgItem SetForegroundWindow SetWindowTextA MessageBoxA DialogBoxIndirectParamA ShowWindow EnableWindow GetDlgItemTextA EndDialog GetDesktopWindow MessageBeep SetDlgItemTextA LoadStringA GetSystemMetrics

comctl32

ord17

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

rblx.exe

IMPHASH a936ba347805991172a869f8ae2ce6ea
SHA256 863558a986730d1d3e906b1a6a6d6551f8bbcdd32b2a0928d8e449265f9a8252
MD5 90fbc0c73bf12342d5270516a422ba92
SHA1 4074a2b6193603a540e81f65df4644e97b398802
SHA512 e34ef82265a3510d077dd4586a55495332d6f6fbac41468a0f6c3350d229aeeb80e042a197bded691547936ae824ff319068aaef73dc5de8def924b6aee59534
SSDEEP 24576:Ivzkt0225NBFLPhQJ9UrnC3FbevhpREesudVv0inJ48hb5OPdwDGMnyUK5r:MzktfMNB4J9FOhnRdFrN5OGDGMne
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1182628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hgh50\Downloads\stuff i need and want\yukilol\output\build\rblx.pdb

kernel32

PeekNamedPipe WaitForMultipleObjects GetFileSizeEx LoadLibraryExA OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI GetTempPathW SetFileInformationByHandle GetFullPathNameW GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx GetFileType VerifyVersionInfoA GetSystemDirectoryA SleepEx LeaveCriticalSection EnterCriticalSection LocalFree QueryFullProcessImageNameW GetModuleHandleW UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect CreateThread DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy QueryPerformanceCounter VerSetConditionMask QueryPerformanceFrequency GetLocaleInfoA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar lstrcmpiA Process32Next CreateFileA CreateToolhelp32Snapshot CreateFileW Process32First GetCurrentProcess SetLastError CloseHandle GetLastError GetProcAddress FreeLibrary ReadFile GetStdHandle GetEnvironmentVariableA WaitForSingleObjectEx GetTickCount FormatMessageA SetConsoleTitleA Sleep GetConsoleWindow VirtualFree MoveFileExA DeviceIoControl VirtualAlloc GetModuleHandleA GetCurrentProcessId LoadLibraryA GetModuleFileNameA

user32

DispatchMessageA GetWindowRect DestroyWindow GetSystemMetrics ShowWindow SetWindowDisplayAffinity GetMonitorInfoA MoveWindow DefWindowProcA CreateWindowExA TranslateMessage LoadIconA PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow GetKeyState GetMessageExtraInfo LoadCursorA MonitorFromWindow GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout SetCapture SetCursor GetClientRect SetProcessDPIAware IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData MessageBoxA ScreenToClient GetAsyncKeyState GetForegroundWindow GetCursorPos SendInput FindWindowA SetWindowLongA GetWindowLongA SetLayeredWindowAttributes

gdi32

CreateSolidBrush

advapi32

CryptEncrypt RegOpenKeyExA RegQueryValueExA RegCloseKey OpenProcessToken RegSetValueExA RegDeleteKeyA RegOpenKeyA AdjustTokenPrivileges LookupPrivilegeValueW RegCreateKeyA AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextA CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext

shell32

ShellExecuteA SHGetFolderPathW

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join _Query_perf_frequency _Query_perf_counter _Thrd_detach ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setf@ios_base@std@@QEAAHHH@Z _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Xtime_get_ticks ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Syserror_map@std@@YAPEBDH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

ntdll

RtlInitAnsiString RtlVirtualUnwind RtlLookupFunctionEntry RtlInitUnicodeString NtQuerySystemInformation RtlCaptureContext RtlAnsiStringToUnicodeString

dbghelp

ImageRvaToVa ImageNtHeader ImageDirectoryEntryToData

d3d11

D3D11CreateDeviceAndSwapChain

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp longjmp strrchr __C_specific_handler _CxxThrowException __std_terminate strchr memchr memcmp memcpy __std_exception_copy memmove memset __std_exception_destroy __current_exception _purecall __current_exception_context strstr

api-ms-win-crt-heap-l1-1-0

realloc malloc _callnewh free _set_new_mode calloc

api-ms-win-crt-math-l1-1-0

acos acosf asin ldexp atan2 sin ceilf cos sinf cosf exp llround sqrt sqrtf frexp _dsign ceil log10 __setusermatherr floor fmod fmodf pow roundf _dclass log tan

api-ms-win-crt-string-l1-1-0

islower ispunct iscntrl isalpha tolower isupper isgraph strspn strcoll isalnum strncpy toupper isxdigit strcmp strcspn strpbrk _strdup isdigit strncmp isspace isblank _stricmp

api-ms-win-crt-runtime-l1-1-0

_resetstkoflw perror _beginthreadex _getpid terminate _invalid_parameter_noinfo system _configure_narrow_argv exit _initialize_narrow_environment _initialize_onexit_table _invalid_parameter_noinfo_noreturn _register_onexit_function _crt_atexit _cexit abort _seh_filter_exe _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc strerror _set_app_type _exit _initterm_e _errno _initterm _get_initial_narrow_environment __sys_nerr

api-ms-win-crt-stdio-l1-1-0

ungetc freopen ferror fopen __acrt_iob_func fflush fclose getc __stdio_common_vfprintf _ftelli64 feof _fseeki64 tmpnam fread _open _close _write _read setvbuf __p__commode _set_fmode __stdio_common_vsprintf _lseeki64 tmpfile fputs _pclose __stdio_common_vsscanf _wfopen clearerr fgets fseek ftell fwrite fputc _get_stream_buffer_pointers fsetpos fgetpos fgetc _popen

api-ms-win-crt-locale-l1-1-0

setlocale localeconv _configthreadlocale ___lc_codepage_func

api-ms-win-crt-time-l1-1-0

clock _mktime64 strftime _gmtime64 _difftime64 _time64 _localtime64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-convert-l1-1-0

atof strtoull strtod strtoul atoi strtol strtoll

api-ms-win-crt-filesystem-l1-1-0

_fstat64 rename remove _unlock_file _unlink _access _stat64 _lock_file

api-ms-win-crt-utility-l1-1-0

rand qsort

ws2_32

ioctlsocket socket ntohl WSASetLastError ntohs WSAIoctl __WSAFDIsSet gethostname sendto select recvfrom freeaddrinfo htons getsockopt getsockname getpeername connect bind WSAGetLastError send setsockopt WSAStartup WSACleanup accept htonl getaddrinfo closesocket recv listen

normaliz

IdnToAscii

crypt32

CertFreeCertificateChain CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA

wldap32

ord301 ord22 ord200 ord30 ord79 ord35 ord33 ord32 ord26 ord143 ord217 ord46 ord211 ord60 ord45 ord50 ord41 ord27

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

whaTARE YIOUYASD.zip

dxwebsetup.exe

PE Signature issue

advapi32

kernel32

gdi32

user32

comctl32

version

generic

rblx.exe

kernel32

user32

gdi32

advapi32

shell32

msvcp140

ntdll

dbghelp

d3d11

imm32

d3dcompiler_43

dwmapi

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

ws2_32

normaliz

crypt32

wldap32

generic