Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
explorer.exe
Resource
win7-20230220-ja
Target
explorer.exe
Size
4.8MB
MD5
6d2674dffd5aab48a3990c423ffb3f70
SHA1
4d5fd6e97f11a816b7f8b369438c76647369625a
SHA256
0047b22273e358f138ca1839404327778368329f042091f935034c146309c798
SHA512
d3da8b437357f92813cc8b5312f7862e52e117015b3e6f1624bed90442cf3435a94a73e87136e5fc41627272ee75a6d0eb6ac29a773b615262fa423f43aeb970
SSDEEP
49152:A09w7U5J8ck84abcS4wjzkj1Q88s22xg7OcWD3/nDN4cMFwok8wNMsX/3n2BnujM:XY2c+BuYvwUNUpQ9jyxELbw8a0ss
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
_Cnd_wait
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?id@?$collate@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Xout_of_range@std@@YAXPEBD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Mtx_unlock
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Mtx_lock
_Thrd_yield
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Thrd_detach
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
_c_exit
_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
_set_error_mode
_time64
strncmp
wcscspn
memset
memmove_s
wcsncmp
wcscmp
_o_exit
_o_floor
_o_floorf
_o_fmod
_o_free
_o_iswspace
_o_lround
_o_lroundf
_o_malloc
_o_memcpy_s
_o_pow
_o_realloc
_o_sqrt
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_o__wcsnicmp
_o__wcslwr_s
_o__wcsicmp
memmove
_o_toupper
_o__set_new_mode
_o__set_fmode
_o__set_errno
_o__set_app_type
_o__seh_filter_exe
_o__register_onexit_function
_o__recalloc
_o_abort
_o__purecall
_o__mktime64
_o__wtoi
_o_ceilf
_o_ceil
_o__ltow_s
_o__localtime64
_o__itow_s
_o__itoa_s
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
_o__get_errno
_o__exit
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcschr
wcsrchr
wcsstr
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy
PicFreeFileInfo
PicRetrieveFileInfo
ord9
CreateJobObjectW
OpenJobObjectW
SetInformationJobObject
QueryInformationJobObject
AssignProcessToJobObject
RegisterApplicationRestart
UrlUnescapeW
HashData
PathIsURLW
WerUnregisterCustomMetadata
WerRegisterCustomMetadata
CheckElevationEnabled
CheckElevation
SHRegGetBoolUSValueW
SHRegGetUSValueW
CoRegisterMessageFilter
CoRegisterInitializeSpy
CoRevokeInitializeSpy
GlobalGetAtomNameW
DeactivateActCtx
CreateActCtxW
ReleaseActCtx
ActivateActCtx
ZwQuerySystemInformation
ZwQueryValueKey
ZwOpenKey
ZwClose
RtlReAllocateHeap
RtlVerifyVersionInfo
ZwEnumerateValueKey
ZwCreateFile
RtlAnsiStringToUnicodeString
RtlImageDirectoryEntryToData
ZwUnmapViewOfSection
RtlNtPathNameToDosPathName
RtlUpcaseUnicodeChar
ZwCreateSection
RtlxAnsiStringToUnicodeSize
ZwQueryInformationProcess
RtlpEnsureBufferSize
RtlGetNativeSystemInformation
ZwQueryDirectoryFile
ZwSetInformationProcess
RtlInitUnicodeStringEx
ZwMapViewOfSection
RtlFormatCurrentUserKeyPath
ZwEnumerateKey
RtlInitString
ZwOpenFile
ZwQueryInformationFile
LdrResSearchResource
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtQueryInformationFile
RtlAppendUnicodeToString
RtlGetVersion
WinSqmAddToStream
NtQueryInformationProcess
NtSetInformationProcess
NtQueryWnfStateData
WinSqmIsOptedIn
RtlInitUnicodeString
NtOpenFile
NtDeviceIoControlFile
RtlCaptureContext
NtClose
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlFlushHeaps
NtSetSystemInformation
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlVirtualUnwind
strchr
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeUnicodeString
RtlAllocateHeap
RtlFreeHeap
RtlAppendUnicodeStringToString
RtlCompareUnicodeString
NtOpenProcessToken
RtlRunOnceExecuteOnce
RtlCopyUnicodeString
RtlUpcaseUnicodeString
NtQueryInformationToken
NtOpenThreadToken
wcsspn
RtlQueryResourcePolicy
RtlNtStatusToDosErrorNoTeb
NtSetThreadExecutionState
NtPowerInformation
GetModuleFileNameW
GetModuleHandleA
FindStringOrdinal
LoadResource
LockResource
GetModuleFileNameA
FreeLibrary
GetModuleHandleW
GetModuleHandleExW
FindResourceExW
SizeofResource
LoadStringW
GetProcAddress
LoadLibraryExW
InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
Sleep
ReleaseMutex
CreateSemaphoreExW
ReleaseSRWLockExclusive
CreateMutexW
ResetEvent
AcquireSRWLockExclusive
WaitForSingleObject
OpenSemaphoreW
ReleaseSRWLockShared
InitializeCriticalSectionEx
WaitForMultipleObjectsEx
CreateMutexExW
LeaveCriticalSection
DeleteCriticalSection
OpenMutexW
SleepEx
OpenEventW
ReleaseSemaphore
InitializeSRWLock
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
EnterCriticalSection
WaitForSingleObjectEx
SetEvent
CreateEventW
InitializeCriticalSection
CreateEventExW
AcquireSRWLockShared
HeapAlloc
HeapFree
GetProcessHeap
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter
RaiseException
SetErrorMode
GetLastError
GetFileAttributesW
CreateFileW
WriteFile
FindNextFileW
DeleteFileW
FindFirstFileW
GetLongPathNameW
FindClose
EventSetInformation
EventActivityIdControl
EventUnregister
EventWrite
EventWriteTransfer
EventRegister
EventEnabled
CreateThreadpoolTimer
CloseThreadpoolTimer
SubmitThreadpoolWork
CreateThreadpoolWork
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
TrySubmitThreadpoolCallback
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
TlsFree
GetCurrentProcess
TlsGetValue
GetCurrentThread
OpenProcessToken
SetThreadPriorityBoost
TlsAlloc
TlsSetValue
InitializeProcThreadAttributeList
GetExitCodeProcess
UpdateProcThreadAttribute
CreateProcessW
QueueUserAPC
GetCurrentThreadId
ProcessIdToSessionId
OpenThreadToken
TerminateProcess
DeleteProcThreadAttributeList
GetStartupInfoW
ExitProcess
SetProcessShutdownParameters
GetThreadPriority
OpenThread
GetCurrentProcessId
GetProcessId
ResumeThread
GetPriorityClass
SetPriorityClass
CreateThread
SetThreadPriority
GetThreadUILanguage
FormatMessageW
GetLocaleInfoEx
GetCalendarInfoW
GetLocaleInfoW
DebugBreak
OutputDebugStringW
IsDebuggerPresent
DuplicateHandle
CloseHandle
VariantClear
VarUI4FromStr
SysAllocStringByteLen
SysFreeString
SysAllocString
SafeArrayCreate
SafeArrayUnaccessData
SafeArrayDestroy
SysStringLen
VariantInit
SafeArrayAccessData
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
SetCurrentProcessExplicitAppUserModelID
IsOS
CoCreateGuid
CoGetInterfaceAndReleaseStream
StringFromIID
StringFromGUID2
CreateStreamOnHGlobal
CoReleaseMarshalData
CoGetStdMarshalEx
CoGetCallContext
PropVariantClear
StringFromCLSID
CoInitializeSecurity
CoCreateInstance
CLSIDFromString
CoUninitialize
CoGetObjectContext
CoInitializeEx
CoSetProxyBlanket
CoGetMalloc
CoTaskMemAlloc
CoFreeUnusedLibraries
CoTaskMemRealloc
CoEnableCallCancellation
CoDisableCallCancellation
CoWaitForMultipleHandles
CoGetApartmentType
CoRegisterClassObject
CoRevokeClassObject
CoMarshalInterThreadInterfaceInStream
CoCancelCall
CoTaskMemFree
CoCreateFreeThreadedMarshaler
IIDFromString
StrCmpW
StrChrW
StrCmpNICW
StrToIntW
StrCmpICW
StrCmpIW
StrCmpICA
StrStrIW
QISearch
StrChrIW
StrCmpNIW
SHStrDupW
RegCreateKeyExW
RegEnumValueW
RegGetValueW
RegLoadMUIStringW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegDeleteTreeW
RegEnumKeyExW
RegOpenCurrentUser
RegDeleteValueW
RegDeleteKeyExW
RegQueryInfoKeyW
RegCloseKey
IUnknown_QueryService
IUnknown_Set
IUnknown_SetSite
IUnknown_GetSite
GlobalAlloc
LocalFree
LocalAlloc
LocalReAlloc
GlobalFree
OpenProcess
GetProcessMitigationPolicy
IsProcessorFeaturePresent
GetDateFormatW
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GetSystemTime
GetTickCount64
GetLocalTime
GetSystemDirectoryW
GetWindowsDirectoryW
GetDateFormatEx
GetTimeFormatEx
GetCurrentDirectoryW
SearchPathW
ExpandEnvironmentStringsW
GetCommandLineW
PathGetArgsW
PathFindFileNameW
PathCommonPrefixW
SHExpandEnvironmentStringsW
PathFileExistsW
PathGetDriveNumberW
PathParseIconLocationW
PathRemoveBlanksW
PathCombineW
PathRemoveFileSpecW
PathQuoteSpacesW
PathFindExtensionW
PathIsFileSpecW
SHQueryInfoKeyW
SHDeleteKeyW
SHEnumKeyExW
SHRegGetValueW
SHSetValueW
SHGetValueW
SHDeleteValueW
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
CompareStringOrdinal
WindowsCreateString
WindowsSubstringWithSpecifiedLength
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsDuplicateString
SHSetThreadRef
SHCreateThread
SHGetThreadRef
SetProcessReference
SHCreateThreadRef
LoadLibraryW
FindResourceW
IsValidSid
GetLengthSid
CopySid
GetTokenInformation
GetAclInformation
GetSecurityDescriptorDacl
GetAce
DeleteAce
InitializeAcl
AddAce
AllocateAndInitializeSid
FreeSid
SetKernelObjectSecurity
EqualSid
CreateWellKnownSid
CheckTokenMembership
DuplicateToken
MakeAbsoluteSD
QueryFullProcessImageNameW
K32GetModuleFileNameExW
K32GetModuleBaseNameW
K32EnumProcessModules
K32EnumProcesses
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceLoggerHandle
GetTraceEnableLevel
TraceMessage
GetUserDefaultUILanguage
SHLoadIndirectString
SetThreadDescription
SetProcessInformation
RegSetKeyValueW
RoInitialize
RoActivateInstance
RoUninitialize
RoGetActivationFactory
RoGetAgileReference
SetRestrictedErrorInfo
RoOriginateError
RoGetMatchingRestrictedErrorInfo
PathCchAppend
PathCchRemoveFileSpec
PathCchCombine
PathAllocCombine
PathCchAddExtension
SHAnsiToUnicode
GlobalUnlock
GlobalLock
lstrlenW
lstrcmpiW
UnmapViewOfFile
VirtualAlloc
MapViewOfFile
VirtualProtect
VirtualFree
CreateFileMappingW
OpenFileMappingW
CommandLineToArgvW
MulDiv
IStream_Write
SHCreateStreamOnFileW
IStream_Read
SHCreateMemStream
IStream_Reset
SHCreateStreamOnFileEx
SHOpenRegStream2W
GetTempPathW
ord170
UnregisterWaitEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetProductInfo
GetUserDefaultGeoName
DeriveAppContainerSidFromAppContainerName
GetProfileType
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToFileTime
GetDynamicTimeZoneInformation
GetComputerNameW
RegisterWaitForSingleObject
GetSystemPowerStatus
QueryPerformanceCounter
InterlockedPushEntrySList
InitializeSListHead
GetPersistedRegistryLocationW
LookupAccountNameW
CharLowerBuffW
CharNextW
NotifyServiceStatusChangeW
QueryServiceConfigW
CreateIoCompletionPort
GetQueuedCompletionStatus
SHRegGetValueFromHKCUHKLM
GetDpiForMonitor
ord244
RaiseFailFastException
CharNextA
GetPwrCapabilities
CallNtPowerInformation
ApiSetQueryApiSetPresence
AssocQueryStringW
ord165
ord197
StrRetToBufW
StrRetToStrW
SHPinDllOfCLSID
SHIsChildOrSelf
ord509
ord292
PathRemoveArgsW
SHCreateWorkerWindowW
ord481
ord635
IUnknown_GetWindow
ord478
ShellMessageBoxW
ord279
ord479
ord544
EnumDisplayMonitors
SystemParametersInfoW
GetDisplayConfigBufferSizes
QueryDisplayConfig
GetMonitorInfoW
EnumDisplayDevicesW
GetSystemMetrics
InflateRect
SetRectEmpty
EqualRect
IntersectRect
OffsetRect
SubtractRect
IsRectEmpty
CopyRect
UnionRect
SetRect
PtInRect
NotifyWinEvent
SetWinEventHook
UnhookWinEvent
ILFree
ILGetSize
ILCloneFirst
SHParseDisplayName
ILRemoveLastID
SHGetNameFromIDList
ILFindLastID
SHGetIDListFromObject
SHBindToParent
ILCombine
SHBindToObject
SHBindToFolderIDListParent
SHCreateItemFromIDList
SHCreateItemFromParsingName
ILIsEqual
ILClone
ILIsParent
DXGIDeclareAdapterRemovalSupport
GetPointerInfo
EnableMouseInPointer
GetCurrentInputMessageSource
GetPointerDevices
GetPointerType
GetThreadFlags
SHGetKnownFolderIDList
SHGetFolderPathEx
SetThreadFlags
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
GetPackageFullName
GetPackagesByPackageFamily
SetWindowFeedbackSetting
RegisterClipboardFormatW
DragQueryFileW
CreateWindowInBand
GetWindowBand
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
SHChangeNotification_Lock
SHChangeNotifyDeregister
SHChangeNotifyRegisterThread
SHChangeNotifyRegister
SHChangeNotification_Unlock
SHHandleUpdateImage
PropVariantToBoolean
PSPropertyBag_WriteStr
PSGetPropertyFromPropertyStorage
PropVariantToUInt32
PSPropertyBag_WriteDWORD
InitVariantFromResource
InitVariantFromGUIDAsString
PropVariantToStringAlloc
PSCreateMemoryPropertyStore
SHChangeNotify
SHCreateDataObject
ParseApplicationUserModelId
FindPackagesByPackageFamily
WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
GetCurrentObject
SelectObject
DeleteDC
GetObjectW
SelectClipRgn
GetClipRgn
GetOutlineTextMetricsW
DeleteObject
CreateCompatibleDC
GetGlyphOutlineW
CreateRectRgnIndirect
GetTextExtentPoint32W
Rectangle
SetStretchBltMode
ExcludeClipRect
StretchBlt
CombineRgn
GetDeviceCaps
GetStockObject
CreateRectRgn
SetRectRgn
GetClipBox
CreateFontIndirectW
OffsetRgn
ExtTextOutW
GetTextMetricsW
SetTextAlign
SetTextColor
IsBadWritePtr
VerSetConditionMask
RtlCompareMemory
HeapSize
GetModuleHandleExA
HeapReAlloc
HeapDestroy
InternetCrackUrlW
ord183
ord213
ord126
ord109
ord174
ord121
ord190
ord123
ord162
ord210
ord192
ord1
ord191
SHUnicodeToAnsi
ord187
ord141
ord142
ord200
ord184
ord186
ord743
ord907
ord43
Shell_GetCachedImageIndexW
ord790
ord792
ord727
ord162
SHAppBarMessage
ord894
ord906
ord181
ord895
ShellExecuteW
SHGetLocalizedName
SHGetPropertyStoreForWindow
ord866
SHEvaluateSystemCommandTemplate
ord244
ExtractIconExW
ord132
ord137
Shell_NotifyIconW
Shell_NotifyIconGetRect
ord6
SHGetStockIconInfo
DuplicateIcon
ord91
ord254
ord54
SHEnableServiceObject
ord61
ord896
SHAddToRecentDocs
ord60
SHUpdateRecycleBinIcon
ord711
SHFileOperationW
SHGetPathFromIDListW
ord753
ord733
ord67
SHCreateItemInKnownFolder
ord206
ord201
ord188
ord899
ShellExecuteExW
ord245
ord200
ord89
ord190
ord85
ord100
ord134
ord22
ord850
ord95
ord885
ord723
ord680
ord172
ord764
ord164
PathIsDirectoryW
ord413
ord548
ord163
ord467
AssocQueryKeyW
ChrCmpIW
AssocCreate
PathIsRelativeW
GetThemeBackgroundExtent
DrawThemeTextEx
GetThemeFont
ord86
IsThemePartDefined
DrawThemeParentBackground
CloseThemeData
BufferedPaintInit
BeginBufferedPaint
EndBufferedPaint
GetThemeBool
IsAppThemed
DrawThemeBackground
BufferedPaintUnInit
GetWindowTheme
SetWindowTheme
OpenThemeData
OpenThemeDataForDpi
GetThemeMargins
ord138
BufferedPaintSetAlpha
ord126
GetThemePartSize
IsThemeActive
GetBufferedPaintBits
GetThemeInt
GetThemeMetric
GetThemeColor
IsCompositionActive
DwmSetWindowAttribute
DwmIsCompositionEnabled
ord138
DwmEnableBlurBehindWindow
ord113
ord141
DwmRegisterThumbnail
ord140
DwmGetWindowAttribute
ord159
DwmQueryThumbnailSourceSize
ord124
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
ord114
ord139
GetCapture
ReleaseCapture
GetDoubleClickTime
CalculatePopupWindowPosition
CopyIcon
GetLastInputInfo
GetCursorFrameInfo
AdjustWindowRect
GetDpiForWindow
SetWindowCompositionAttribute
SetGestureConfig
LoadImageW
CheckMenuItem
EnableMenuItem
RemoveMenu
GetSystemMetricsForDpi
DrawIconEx
DestroyIcon
GetCaretBlinkTime
InjectKeyboardInput
MapVirtualKeyExW
InjectMouseInput
LockWorkStation
TileWindows
CascadeWindows
HungWindowFromGhostWindow
LoadIconW
IsIconic
GetKeyState
ExitWindowsEx
EndDialog
SendDlgItemMessageW
RegisterHotKey
UnregisterHotKey
AdjustWindowRectEx
GetDC
ReleaseDC
CreatePopupMenu
TrackMouseEvent
DestroyMenu
LoadCursorW
SetCursor
SetMenuItemInfoW
MonitorFromWindow
DefWindowProcA
IsWindowUnicode
CopyImage
SendInput
SetDesktopColorTransform
UnregisterClassA
LoadAcceleratorsW
SetMenuDefaultItem
TrackPopupMenuEx
DeleteMenu
FillRect
ChangeWindowMessageFilterEx
TranslateAcceleratorW
DrawTextW
LoadMenuW
GetSysColor
CreateIconIndirect
GetMenuItemCount
GetMenuItemInfoW
ord2611
MonitorFromPoint
ReplyMessage
GetAsyncKeyState
ModifyMenuW
GetSystemMenu
GetSysColorBrush
SetLayeredWindowAttributes
GetIconInfoExW
GetIconInfo
SetCapture
GetMenuDefaultItem
GetClassWord
GetClassLongW
GetPhysicalCursorPos
GetCursorInfo
ShowWindowAsync
InsertMenuW
BringWindowToTop
ord2573
GhostWindowFromHungWindow
EndTask
IsTopLevelWindow
GetMenuState
SetScrollInfo
GetScrollInfo
SetScrollPos
GetMenuStringW
InternalGetWindowText
GetLayeredWindowAttributes
DrawTextExW
IsProcessDPIAware
SetThreadDpiAwarenessContext
GetWindowCompositionAttribute
GetWindowProcessHandle
GetClassLongPtrW
MonitorFromRect
UpdateLayeredWindow
GetGuiResources
ord2521
UnregisterClassW
ord2522
WindowFromDC
GetMenuInfo
SetMenuInfo
GetDpiForSystem
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
CharLowerW
IsCharAlphaNumericW
IsHungAppWindow
ord2574
GetLastActivePopup
SwitchToThisWindow
ord2005
GetSubMenu
GetUserNameExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
LCIDToLocaleName
VerifyVersionInfoW
PowerSetRequest
PowerCreateRequest
OOBEComplete
CopyFileW
SetTermsrvAppInstallMode
ord292
EnableTraceEx2
StartTraceW
StopTraceW
IsProcessInJob
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrClientCall3
GetStagedPackagePathByFullName2
BiPtFreeMemory
BiPtQueryWorkItem
BiPtAssociateApplicationEntryPoint
BiPtEnumerateWorkItemsForPackageName
GetShellWindow
RoCreatePropertySetSerializer
GetErrorInfo
SetErrorInfo
g_trayTriageBlock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ