MeowClientFucker_triage[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
MeowClientFucker_triage.zip
Size 6.7MB
Sample260804-twmx2sak8x
SHA256 c8175afc2f71b25df4ad96a1362514304641b36923b922edab75f164de07a81d
MD5 0e79f38fc6e1613f17ac6c538f851820
SHA1 6c102ce12095dad38c32aa853a076ca47bc5c640
SHA512 b1c35d064f3d004f06fca57cbeb38790f2169786ff3c2ee9e131c705008937c3e063574646ca6848d7a7e7410ffdf5749cd54e617a12853063249b184334d95b
SSDEEP 196608:oa4UEN0gumZZe6Ps8ihLkOXDf8Ewbk/WG3q:PNgua46snLT0zbk/U
TLSH
T1CF66338BF9378A12273364DE6AC6795D8950B7C16E550E23933DC0B1F090725BEE2E6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MeowClientFucker.exe

File Explorer

MeowClientFucker_triage.zip

.zip 6.7MB
MeowClientFucker.exe

.exe 11.4MB
procdump64.exe

.exe 723KB
run.cmd

206B

MeowClientFucker_triage.zip

SHA256 c8175afc2f71b25df4ad96a1362514304641b36923b922edab75f164de07a81d
MD5 0e79f38fc6e1613f17ac6c538f851820
SHA1 6c102ce12095dad38c32aa853a076ca47bc5c640
SHA512 b1c35d064f3d004f06fca57cbeb38790f2169786ff3c2ee9e131c705008937c3e063574646ca6848d7a7e7410ffdf5749cd54e617a12853063249b184334d95b
SSDEEP 196608:oa4UEN0gumZZe6Ps8ihLkOXDf8Ewbk/WG3q:PNgua46snLT0zbk/U
TLSH
T1CF66338BF9378A12273364DE6AC6795D8950B7C16E550E23933DC0B1F090725BEE2E6C
MD5 SHA1 SHA512 SSDEEP TLSH

MeowClientFucker.exe

IMPHASH 25f4444e0f8d2a8ae40cbacacc252543
SHA256 d8c41906995a2a80724f6ddd2f9294effa2e4e33a9b563cbbbad55ee26fef567
MD5 9cac87ede85c67e03abb95f8fc416a4e
SHA1 279d9a62076fec61992366902d6d6302ddfe0b0e
SHA512 43bbd7e71757f385c8e457cf6afe086106fe19f3237f95c44f63ebb84fb55f2822f20c5f266aa978d6b3c84526c7899377b95acd4cc5a89fef0fa56a96eeb336
SSDEEP 196608:o+azUtnV951h0XCfQbG2i6XTQeWOO+eliO:omHNzQa2iyUez5a
TLSH
T130C6BF56E2FD00E8D5BAC0B8C6975527EBB13455173497EB52A08A692F33FE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6041648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\coreclr\windows.x64.Release\Corehost.Static\singlefilehost.pdb

kernel32

RaiseException FreeLibrary SetErrorMode RaiseFailFastException GetExitCodeProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter AddVectoredExceptionHandler MultiByteToWideChar GetTickCount FlushInstructionCache QueryPerformanceFrequency QueryPerformanceCounter RtlLookupFunctionEntry LocateXStateFeature RtlDeleteFunctionTable InterlockedPushEntrySList InterlockedFlushSList InitializeSListHead GetTickCount64 DuplicateHandle QueueUserAPC WaitForSingleObjectEx SetThreadPriority GetThreadPriority GetCurrentThreadId TlsAlloc GetCurrentThread GetCurrentProcessId CreateThread GetModuleHandleW WaitForMultipleObjectsEx SignalObjectAndWait RtlCaptureContext SetThreadStackGuarantee VirtualQuery WriteFile GetStdHandle GetConsoleOutputCP MapViewOfFileEx UnmapViewOfFile GetStringTypeExW InterlockedPopEntrySList ExitProcess Sleep CreateMemoryResourceNotification VirtualAlloc VirtualFree VirtualProtect SleepEx SwitchToThread SuspendThread ResumeThread InitializeContext SetXStateFeaturesMask RtlRestoreContext CloseThreadpoolTimer CreateThreadpoolTimer SetThreadpoolTimer ReadFile GetFileSize GetEnvironmentVariableW SetEnvironmentVariableW CreateEventW SetEvent ResetEvent GetThreadContext SetThreadContext GetEnabledXStateFeatures CopyContext WerRegisterRuntimeExceptionModule RtlInstallFunctionTableCallback GetSystemDefaultLCID GetUserDefaultLCID RtlUnwind HeapAlloc HeapFree GetProcessHeap HeapCreate HeapDestroy GetEnvironmentStringsW FreeEnvironmentStringsW FormatMessageW CreateSemaphoreExW ReleaseSemaphore GetACP LCMapStringEx LocalFree VerSetConditionMask VerifyVersionInfoW QueryThreadCycleTime GetLogicalProcessorInformationEx SetThreadGroupAffinity GetThreadGroupAffinity GetProcessGroupAffinity GetCurrentProcessorNumberEx GetProcessAffinityMask QueryInformationJobObject CloseHandle GetSystemTimeAsFileTime GetModuleFileNameW CreateProcessW GetCPInfo LoadLibraryExW CreateFileW GetFileAttributesExW GetFullPathNameW LoadLibraryExA OutputDebugStringA OpenEventW ReleaseMutex ExitThread CreateMutexW HeapReAlloc CreateNamedPipeA WaitForMultipleObjects DisconnectNamedPipe CreateFileA CancelIoEx GetOverlappedResult ConnectNamedPipe FlushFileBuffers SetFilePointer MapViewOfFile GetActiveProcessorGroupCount GetSystemTime SetConsoleCtrlHandler GetLocaleInfoEx GetUserDefaultLocaleName RtlAddFunctionTable LoadLibraryW CreateDirectoryW RemoveDirectoryW CreateActCtxW ActivateActCtx FindResourceW GetWindowsDirectoryW GetFileSizeEx FindFirstFileExW FindNextFileW GetTempPathW FindClose LoadLibraryA GetCurrentDirectoryW IsWow64Process EncodePointer DecodePointer CreateFileMappingA TlsSetValue TlsGetValue GetSystemInfo GetCurrentProcess OutputDebugStringW IsDebuggerPresent LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte GetCommandLineW GetProcAddress GetModuleHandleExW SetThreadErrorMode FlushProcessWriteBuffers SetLastError DebugBreak WaitForSingleObject GetNumaHighestNodeNumber SetThreadAffinityMask SetThreadIdealProcessorEx GetThreadIdealProcessorEx VirtualAllocExNuma GetNumaProcessorNodeEx VirtualUnlock GetLargePageMinimum IsProcessInJob K32GetProcessMemoryInfo GetLogicalProcessorInformation GlobalMemoryStatusEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlVirtualUnwind IsProcessorFeaturePresent RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsFree RtlPcToFileHeader TryAcquireSRWLockExclusive GetExitCodeThread GetStringTypeW InitializeCriticalSectionEx GetLastError CreateFileMappingW

advapi32

ReportEventW AdjustTokenPrivileges RegGetValueW SetKernelObjectSecurity GetSidSubAuthorityCount GetSidSubAuthority GetTokenInformation OpenProcessToken DeregisterEventSource RegisterEventSourceW RegQueryValueExW RegOpenKeyExW RegCloseKey EventRegister SetThreadToken RevertToSelf OpenThreadToken EventWriteTransfer EventWrite LookupPrivilegeValueW

ole32

CoCreateFreeThreadedMarshaler CreateStreamOnHGlobal CoRevokeInitializeSpy CoGetContextToken CoGetObjectContext CoUnmarshalInterface CoMarshalInterface CoGetMarshalSizeMax CLSIDFromProgID CoReleaseMarshalData CoTaskMemFree CoTaskMemAlloc CoCreateGuid CoInitializeEx CoRegisterInitializeSpy CoWaitForMultipleHandles CoUninitialize CoGetClassObject

oleaut32

CreateErrorInfo SysFreeString GetErrorInfo SetErrorInfo SysStringLen SysAllocString SysAllocStringLen SafeArrayGetDim SafeArrayGetLBound SafeArrayDestroy QueryPathOfRegTypeLi LoadTypeLibEx SafeArrayGetVartype VariantChangeType VariantChangeTypeEx VariantClear VariantInit VarCyFromDec SafeArrayAllocDescriptorEx GetRecordInfoFromTypeInfo SafeArraySetRecordInfo SafeArrayAllocData SafeArrayGetElemsize SysStringByteLen SysAllocStringByteLen SafeArrayCreateVector SafeArrayPutElement LoadRegTypeLi

user32

LoadStringW MessageBoxW

shell32

ShellExecuteW

api-ms-win-crt-string-l1-1-0

strncat_s wcsncat_s _wcsicmp wcsnlen wcscat_s towupper iswascii _strdup strncpy strnlen wcstok_s isdigit isupper isalpha towlower _wcsdup iswspace isspace islower strtok_s strcmp strcspn __strncnt _wcsnicmp strlen wcscpy_s toupper wcsncpy_s strcpy_s strcat_s strncpy_s _strnicmp tolower wcsncmp iswupper strncmp _stricmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf fflush __acrt_iob_func __stdio_common_vfprintf __stdio_common_vswprintf __stdio_common_vfwprintf fputws fputwc _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc fgetpos fgets fgetc fputc _wfsopen _wfopen __p__commode _set_fmode __stdio_common_vsnprintf_s setvbuf _setmode _dup _fileno ftell fseek fputs __stdio_common_vsnwprintf_s __stdio_common_vsprintf_s fwrite _flushall fopen fclose

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _register_onexit_function _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e _exit _invoke_watson __p___argc __p___wargv _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _beginthreadex terminate _controlfp_s _wcserror_s _invalid_parameter_noinfo _errno exit abort

api-ms-win-crt-convert-l1-1-0

_atoi64 _ltow_s _wtoi strtoul _wcstoui64 atol _itow_s strtoull wcstoul

api-ms-win-crt-heap-l1-1-0

free _set_new_mode calloc malloc realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

asinhf atanhf cbrtf acoshf cosh cbrt coshf exp expf acosh atanh floor floorf fma fmaf cosf _fdopen cos ceilf _copysignf _isnanf trunc truncf ilogb ilogbf tanhf ceil fmod fmodf atanf frexp atan2f atan2 log log10 log10f atan asinf log2 log2f logf pow powf sin sinf asin sinh sinhf sqrt sqrtf tan tanf tanh acosf _copysign asinh _isnan _finite modf modff _dclass _ldclass acos __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64_s wcsftime

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_unlock_locales setlocale __pctype_func ___lc_locale_name_func _lock_locales ___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv

api-ms-win-crt-filesystem-l1-1-0

_wrename _unlock_file _wremove _lock_file

Name

.text

Size

6.1MB

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.CLR_UEF

Size

512B

Virtual Size

221B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Section

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

procdump64.exe

IMPHASH 2c81cb4630df5497dc2a5050263610e9
SHA256 d1fc99ae304bd1d2bf28abeb62531da959e2431916194981b88c958fd713a8e6
MD5 3c026011a9f2f583d708e7e9737ee976
SHA1 d8e96599c34d1f6716126cc5a6f48cff708c6a2a
SHA512 2aa85cd0224e068a660d692be527ed26034ae3dc87b3633db1f688788927bb8130417b8696dadb980e0a80d8e4078a76c7db28d93035cdccfd4ac7f82d38081e
SSDEEP 12288:6nkGp0V/l61xMp4PedPPVow4BQVzIvZQZDtQS8:6nkGyyPbPedPPuw4y2N
TLSH
T145F45C3167E801E8E1BB963ACD664511FBB37C061B70DBCF029445AA1F77AD48E39722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

68:d2:f1:fb:eb:fd:cf:f2:11:1b:81:ca:2e:02:ae:22:36:15:25:30:a9:24:bc:49:e7:95:5b:b1:33:6b:08:c7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 9, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1c:09:55:15:d7:c3:59:07:d1:00:01:00:00:02:1c

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

266592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\__w\1\s\x64\Release\procdump64.pdb

api-ms-win-core-path-l1-1-0

PathCchStripToRoot

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

shlwapi

StrStrIW

kernel32

WaitForMultipleObjects GetCurrentProcessId CreateThread OpenProcess GetSystemInfo GetTickCount GetModuleHandleW GetProcAddress LoadLibraryW LocalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessImageFileNameW ExpandEnvironmentStringsW FormatMessageW MultiByteToWideChar GetStdHandle GetFileType LocalAlloc GetVersionExW GetModuleFileNameW GetDiskFreeSpaceExW GetFileSizeEx SetFilePointerEx ReleaseSemaphore CreateSemaphoreW GetCurrentProcess ExitProcess TerminateProcess GetExitCodeProcess OpenThread GetProcessId GetThreadContext ReadProcessMemory FreeLibrary GetDateFormatW OpenEventW GetCommandLineW GetFileAttributesA GetSystemTimeAsFileTime DeleteFileW ContinueDebugEvent WaitForDebugEvent DebugActiveProcess DebugActiveProcessStop ResumeThread CreateProcessW LoadResource LockResource SizeofResource FindResourceW GetCurrentThreadId GetTempPathA LoadLibraryExW VirtualQueryEx DeleteCriticalSection K32EnumProcessModules K32GetModuleBaseNameW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc CreateDirectoryW ReadFile GetTimeZoneInformation ReadConsoleW ReadConsoleInputW SetConsoleMode GetConsoleMode CreateEventW WaitForSingleObject DebugBreak IsDebuggerPresent GetFullPathNameW GetCurrentDirectoryW GetFileAttributesW GetTimeFormatW GetEnvironmentVariableA SystemTimeToTzSpecificLocalTime GetSystemTime LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeviceIoControl SetLastError GetLastError CreateFileW CloseHandle SetEvent RtlUnwind Sleep SetConsoleCtrlHandler GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize SetEndOfFile WriteConsoleW GetCurrentThread GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree WideCharToMultiByte GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetConsoleCP SetStdHandle WriteFile GetCommandLineA HeapAlloc

user32

SetWindowTextW GetDlgItem wsprintfW LoadStringA SendMessageW EndDialog InflateRect SetCursor DialogBoxIndirectParamW GetWindowThreadProcessId EnumWindows IsWindowVisible IsHungAppWindow LoadCursorW GetSysColorBrush

gdi32

StartPage EndDoc StartDocW SetMapMode GetDeviceCaps EndPage

comdlg32

PrintDlgW

advapi32

RegDeleteValueW CloseTrace ProcessTrace OpenTraceW EnableTraceEx2 ControlTraceW StartTraceW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegCreateKeyW RegCloseKey OpenSCManagerW EnumServicesStatusExW CloseServiceHandle

shell32

CommandLineToArgvW

ole32

CoInitializeEx CoCreateInstance CLSIDFromString CoAllowSetForegroundWindow CoUninitialize

pdh

PdhCollectQueryData PdhGetFormattedCounterValue PdhAddCounterW PdhOpenQueryW

MeowClientFucker_triage.zip

MeowClientFucker.exe

kernel32

advapi32

ole32

oleaut32

user32

shell32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic

procdump64.exe

api-ms-win-core-path-l1-1-0

version

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

pdh

generic

run.cmd