Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
explorer.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
explorer.exe
Resource
win10v2004-20230703-en
Target
explorer.exe
Size
4.9MB
MD5
ce8416c5f87a2ddb3bad27b379aace8f
SHA1
131e2d41a679e57e2da7ad83e96b252a86e74dda
SHA256
97a60dfab3b2dec8ce736befdee7efbc22e21de1a5614b719e0b52af99ddb090
SHA512
2bb848b6fb5297e3ed0dcf83bc4c613ead7ff0aa314c93d3c94a1df11c1c909f0ad5c0da57bd2b3375e8625c38b922c345142acd8b89d82cfaa8ef382e11471e
SSDEEP
49152:hiu1Hxs4FD98qaVRAXPkT03bPxkRNjZFpkjse1ITOk+CuqoURKmnnN5XAWpPWXwE:hZG3IXdqF/tN4FnlZBbw8a0sC5
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
_Cnd_wait
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?id@?$collate@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Thrd_yield
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?width@ios_base@std@@QEAA_J_J@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Thrd_detach
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Thrd_id
_Mtx_unlock
_Cnd_do_broadcast_at_thread_exit
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
_Mtx_lock
?_Xlength_error@std@@YAXPEBD@Z
_set_error_mode
_register_thread_local_exe_atexit_callback
_c_exit
_initterm
_initterm_e
memset
wcscmp
wcscspn
wcsncmp
strncmp
_time64
_o_floor
_o_floorf
_o_fmod
_o_free
_o_iswspace
_o_lround
_o_lroundf
_o_malloc
_o_memcpy_s
_o_pow
_o_realloc
_o_sqrt
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_o_abort
_o__set_new_mode
_o__set_fmode
_o__set_errno
_o__wtoi
memmove
_o__set_app_type
_o__register_onexit_function
_o__recalloc
_o__purecall
_o__mktime64
_o__wcsnicmp
_o__wcslwr_s
_o__wcsicmp
_o__ltow_s
_o__localtime64
_o_exit
_o_ceilf
_o_ceil
_o__itow_s
_o__itoa_s
_o__seh_filter_exe
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
_o__get_errno
_o__exit
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcsrchr
wcsstr
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy
PicFreeFileInfo
PicRetrieveFileInfo
ord9
QueryInformationJobObject
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
OpenJobObjectW
RegisterApplicationRestart
PathIsURLW
UrlUnescapeW
HashData
WerRegisterCustomMetadata
WerUnregisterCustomMetadata
CheckElevationEnabled
CheckElevation
SHRegGetBoolUSValueW
SHRegGetUSValueW
CoRevokeInitializeSpy
CoRegisterMessageFilter
CoRegisterInitializeSpy
GlobalGetAtomNameW
CreateActCtxW
ReleaseActCtx
DeactivateActCtx
ActivateActCtx
NtQueryInformationProcess
NtQueryWnfStateData
WinSqmAddToStream
RtlGetVersion
ZwQuerySystemInformation
ZwQueryValueKey
ZwOpenKey
ZwClose
RtlReAllocateHeap
ZwEnumerateValueKey
ZwCreateFile
NtQueryInformationFile
RtlAppendUnicodeToString
RtlAnsiStringToUnicodeString
RtlImageDirectoryEntryToData
ZwUnmapViewOfSection
RtlNtPathNameToDosPathName
RtlUpcaseUnicodeChar
ZwCreateSection
RtlxAnsiStringToUnicodeSize
ZwQueryInformationProcess
RtlpEnsureBufferSize
RtlGetNativeSystemInformation
NtSetInformationProcess
ZwQueryDirectoryFile
ZwSetInformationProcess
RtlInitUnicodeStringEx
ZwMapViewOfSection
RtlFormatCurrentUserKeyPath
ZwEnumerateKey
RtlInitString
ZwOpenFile
ZwQueryInformationFile
LdrResSearchResource
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlVerifyVersionInfo
RtlInitUnicodeString
NtOpenFile
NtDeviceIoControlFile
RtlCaptureContext
NtClose
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlFlushHeaps
NtSetSystemInformation
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlVirtualUnwind
strchr
memmove_s
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeUnicodeString
wcschr
RtlAllocateHeap
RtlFreeHeap
RtlCompareUnicodeString
WinSqmIsOptedIn
NtOpenProcessToken
NtQueryInformationToken
NtOpenThreadToken
RtlAppendUnicodeStringToString
wcsspn
RtlRunOnceExecuteOnce
RtlCopyUnicodeString
RtlUpcaseUnicodeString
RtlNtStatusToDosErrorNoTeb
NtSetThreadExecutionState
NtPowerInformation
VerSetConditionMask
RtlQueryResourcePolicy
RtlQueryUnbiasedInterruptTime
NtQuerySystemInformation
RtlGetNtSystemRoot
GetModuleHandleA
FindResourceExW
LoadStringW
GetModuleHandleW
LockResource
SizeofResource
GetProcAddress
LoadLibraryExW
GetModuleFileNameA
GetModuleHandleExW
FreeLibrary
FindStringOrdinal
GetModuleFileNameW
LoadResource
Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
OpenEventW
CreateSemaphoreExW
SetEvent
CreateEventW
EnterCriticalSection
ReleaseSemaphore
CreateMutexW
SleepEx
WaitForSingleObject
ReleaseMutex
DeleteCriticalSection
InitializeSRWLock
InitializeCriticalSectionEx
LeaveCriticalSection
InitializeCriticalSection
WaitForMultipleObjectsEx
TryEnterCriticalSection
WaitForSingleObjectEx
OpenMutexW
ResetEvent
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
CreateEventExW
AcquireSRWLockExclusive
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
SetErrorMode
RaiseException
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter
GetLongPathNameW
DeleteFileW
CompareFileTime
WriteFile
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
CreateFileW
EventWriteTransfer
EventSetInformation
EventActivityIdControl
EventRegister
EventWrite
EventUnregister
EventEnabled
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
CloseThreadpoolTimer
SubmitThreadpoolWork
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolTimer
SetThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolWait
TrySubmitThreadpoolCallback
CreateProcessW
TlsFree
InitializeProcThreadAttributeList
TlsAlloc
UpdateProcThreadAttribute
TlsSetValue
QueueUserAPC
GetStartupInfoW
DeleteProcThreadAttributeList
ExitProcess
SetProcessShutdownParameters
ProcessIdToSessionId
GetExitCodeProcess
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentThreadId
GetCurrentProcess
CreateThread
SetPriorityClass
GetPriorityClass
ResumeThread
GetProcessId
SetThreadPriorityBoost
TerminateProcess
TlsGetValue
GetThreadPriority
OpenThread
SetThreadPriority
GetCurrentProcessId
GetLocaleInfoW
GetThreadUILanguage
GetCalendarInfoW
FormatMessageW
GetLocaleInfoEx
DebugBreak
OutputDebugStringW
IsDebuggerPresent
CloseHandle
DuplicateHandle
VariantInit
SysStringLen
SysAllocString
SysFreeString
SafeArrayAccessData
VariantClear
SafeArrayCreate
SafeArrayUnaccessData
VarUI4FromStr
SysAllocStringByteLen
SafeArrayDestroy
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
SetCurrentProcessExplicitAppUserModelID
IsOS
CoGetInterfaceAndReleaseStream
CLSIDFromString
CoRegisterClassObject
CoRevokeClassObject
CoGetObjectContext
CoFreeUnusedLibraries
CoReleaseMarshalData
CoCreateInstance
CoTaskMemFree
PropVariantClear
CoSetProxyBlanket
CoTaskMemRealloc
CoTaskMemAlloc
CoGetMalloc
CoInitializeEx
CoUninitialize
CoGetStdMarshalEx
CoCreateGuid
CoMarshalInterThreadInterfaceInStream
CoEnableCallCancellation
CoGetCallContext
StringFromIID
IIDFromString
CreateStreamOnHGlobal
StringFromCLSID
CoDisableCallCancellation
CoCancelCall
CoInitializeSecurity
StringFromGUID2
CoWaitForMultipleHandles
CoGetApartmentType
CoCreateFreeThreadedMarshaler
StrCmpIW
StrCmpNIW
StrCmpW
StrCmpNICW
StrChrW
StrToIntW
StrCmpICA
StrCmpICW
QISearch
StrChrIW
SHStrDupW
RegSetValueExW
RegDeleteValueW
RegGetValueW
RegQueryInfoKeyW
RegOpenKeyExW
RegDeleteKeyExW
RegEnumKeyExW
RegOpenCurrentUser
RegCloseKey
RegEnumValueW
RegLoadMUIStringW
RegCreateKeyExW
RegDeleteTreeW
RegQueryValueExW
IUnknown_SetSite
IUnknown_QueryService
IUnknown_Set
IUnknown_GetSite
LocalFree
LocalReAlloc
GlobalAlloc
GlobalFree
LocalAlloc
IsProcessorFeaturePresent
GetProcessMitigationPolicy
OpenProcess
GetDateFormatW
GetTickCount
GetSystemTimeAsFileTime
GetWindowsDirectoryW
GetSystemDirectoryW
GetVersionExW
GetSystemTime
GetLocalTime
GetTickCount64
GetDateFormatEx
GetTimeFormatEx
GetCommandLineW
GetCurrentDirectoryW
SearchPathW
ExpandEnvironmentStringsW
PathIsFileSpecW
PathCombineW
PathRemoveBlanksW
SHExpandEnvironmentStringsW
PathQuoteSpacesW
PathParseIconLocationW
PathGetArgsW
PathFindExtensionW
PathRemoveFileSpecW
PathGetDriveNumberW
PathFileExistsW
PathFindFileNameW
PathCommonPrefixW
SHQueryInfoKeyW
SHDeleteValueW
SHDeleteKeyW
SHRegGetValueW
SHSetValueW
SHEnumKeyExW
SHGetValueW
MultiByteToWideChar
CompareStringOrdinal
CompareStringW
WideCharToMultiByte
WindowsDeleteStringBuffer
WindowsCompareStringOrdinal
WindowsCreateString
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsSubstringWithSpecifiedLength
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsDuplicateString
SHSetThreadRef
SetProcessReference
SHCreateThread
SHGetThreadRef
SHCreateThreadRef
FindResourceW
LoadLibraryW
GetLengthSid
GetSecurityDescriptorDacl
IsValidSid
GetTokenInformation
AllocateAndInitializeSid
EqualSid
SetKernelObjectSecurity
FreeSid
GetAclInformation
GetAce
DeleteAce
InitializeAcl
AddAce
CreateWellKnownSid
CheckTokenMembership
CopySid
DuplicateToken
MakeAbsoluteSD
K32GetModuleBaseNameW
K32EnumProcesses
K32EnumProcessModules
K32GetModuleFileNameExW
QueryFullProcessImageNameW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
GetTraceEnableLevel
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags
TraceMessage
GetTraceLoggerHandle
GetUserDefaultUILanguage
SHLoadIndirectString
SetThreadDescription
SetProcessInformation
RegSetKeyValueW
RoGetActivationFactory
RoUninitialize
RoInitialize
RoActivateInstance
RoGetAgileReference
SetRestrictedErrorInfo
RoOriginateError
RoGetMatchingRestrictedErrorInfo
PathCchAppend
PathCchRemoveFileSpec
PathAllocCombine
PathCchAddExtension
PathCchCombine
SHAnsiToUnicode
GlobalLock
GlobalUnlock
lstrlenW
lstrcmpiW
VirtualFree
VirtualAlloc
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
VirtualProtect
OpenFileMappingW
CommandLineToArgvW
MulDiv
SHOpenRegStream2W
IStream_Read
SHCreateStreamOnFileW
SHCreateStreamOnFileEx
IStream_Write
SHCreateMemStream
IStream_Reset
GetTempPathW
ord170
DeleteTimerQueueTimer
UnregisterWaitEx
CreateTimerQueueTimer
ChangeTimerQueueTimer
GetProductInfo
GetNativeSystemInfo
GetUserDefaultGeoName
GetProfileType
DeriveAppContainerSidFromAppContainerName
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
GetDynamicTimeZoneInformation
GetComputerNameW
RegisterWaitForSingleObject
GetSystemPowerStatus
QueryPerformanceCounter
InterlockedPushEntrySList
InitializeSListHead
GetPersistedRegistryLocationW
LookupAccountNameW
CharNextW
CharLowerBuffW
QueryServiceConfigW
NotifyServiceStatusChangeW
CreateIoCompletionPort
DeviceIoControl
GetQueuedCompletionStatus
SHRegGetValueFromHKCUHKLM
ord244
GetDpiForMonitor
RaiseFailFastException
CharNextA
GetPwrCapabilities
CallNtPowerInformation
ApiSetQueryApiSetPresence
ord165
ord197
StrRetToStrW
ord509
IUnknown_GetWindow
SHIsChildOrSelf
StrRetToBufW
ord292
ShellMessageBoxW
ord279
ord478
SHCreateWorkerWindowW
ord635
ord479
SHPinDllOfCLSID
PathRemoveArgsW
ord544
ord481
AssocQueryStringW
GetSystemMetrics
EnumDisplayDevicesW
SystemParametersInfoW
EnumDisplayMonitors
GetMonitorInfoW
QueryDisplayConfig
GetDisplayConfigBufferSizes
SubtractRect
OffsetRect
CopyRect
IntersectRect
EqualRect
UnionRect
SetRectEmpty
PtInRect
InflateRect
IsRectEmpty
SetRect
UnhookWinEvent
SetWinEventHook
NotifyWinEvent
ILCloneFirst
ILCombine
ILIsEqual
SHGetNameFromIDList
SHBindToParent
SHBindToObject
SHGetIDListFromObject
ILClone
ILRemoveLastID
ILGetSize
SHBindToFolderIDListParent
SHCreateItemFromIDList
SHParseDisplayName
ILFree
ILFindLastID
SHCreateItemFromParsingName
ILIsParent
DXGIDeclareAdapterRemovalSupport
GetPointerDevices
GetPointerInfo
GetCurrentInputMessageSource
EnableMouseInPointer
GetPointerType
SetThreadFlags
GetThreadFlags
SHGetFolderPathEx
SHGetKnownFolderIDList
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
GetPackageFullName
GetPackagesByPackageFamily
SetWindowFeedbackSetting
RegisterClipboardFormatW
DragQueryFileW
CreateWindowInBand
GetWindowBand
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
SHHandleUpdateImage
SHChangeNotifyRegisterThread
SHChangeNotifyRegister
SHChangeNotifyDeregister
SHChangeNotification_Lock
SHChangeNotification_Unlock
PropVariantToStringAlloc
PSPropertyBag_WriteDWORD
PropVariantToUInt32
PSPropertyBag_WriteStr
PropVariantToBoolean
PSCreateMemoryPropertyStore
PSGetPropertyFromPropertyStorage
InitVariantFromResource
InitVariantFromGUIDAsString
SHChangeNotify
SHCreateDataObject
FindPackagesByPackageFamily
ParseApplicationUserModelId
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
ExtTextOutW
CreateRectRgnIndirect
GetGlyphOutlineW
GetTextMetricsW
SetTextAlign
StretchBlt
ExcludeClipRect
GetTextExtentPoint32W
SetStretchBltMode
SetTextColor
CreateFontIndirectW
Rectangle
GetClipBox
SelectObject
CreateCompatibleDC
DeleteDC
GetObjectW
DeleteObject
GetDeviceCaps
GetStockObject
CreateRectRgn
GetOutlineTextMetricsW
GetClipRgn
SetRectRgn
GetCurrentObject
CombineRgn
OffsetRgn
SelectClipRgn
GetModuleHandleExA
HeapSize
IsBadWritePtr
RtlCompareMemory
HeapReAlloc
HeapDestroy
InternetCrackUrlW
ord1
SHUnicodeToAnsi
ord192
ord210
ord183
ord213
ord126
ord109
ord174
ord121
ord162
ord190
ord123
ord191
ord187
ord141
ord142
ord200
ord184
ord186
ord743
ord907
ord43
Shell_GetCachedImageIndexW
ord790
ord792
ord727
ord162
SHAppBarMessage
ord894
ord906
ord181
ord895
SHGetLocalizedName
SHGetPropertyStoreForWindow
ord764
ord866
SHEvaluateSystemCommandTemplate
ord244
ExtractIconExW
ord132
ord137
Shell_NotifyIconW
Shell_NotifyIconGetRect
ord6
SHGetStockIconInfo
DuplicateIcon
ord91
ord254
ord54
SHEnableServiceObject
ord61
ord896
SHAddToRecentDocs
ord60
SHUpdateRecycleBinIcon
ord711
SHFileOperationW
SHGetPathFromIDListW
ord753
ord733
ord67
SHCreateItemInKnownFolder
ord206
ord201
ord188
ord899
ShellExecuteExW
ord245
ord200
ord89
ord190
ord85
ord100
ord134
ord22
ord850
ord95
ord885
ord723
ord680
ord172
ShellExecuteW
ord164
PathIsDirectoryW
ord413
ord548
ord163
ord467
AssocQueryKeyW
ChrCmpIW
PathIsRelativeW
AssocCreate
GetThemeMetric
IsAppThemed
IsCompositionActive
DrawThemeTextEx
GetThemeFont
IsThemePartDefined
ord86
DrawThemeBackground
DrawThemeParentBackground
GetWindowTheme
CloseThemeData
GetBufferedPaintBits
GetThemeBackgroundExtent
GetThemeBool
OpenThemeData
OpenThemeDataForDpi
GetThemeMargins
ord138
BufferedPaintSetAlpha
ord126
GetThemePartSize
IsThemeActive
SetWindowTheme
BufferedPaintInit
BufferedPaintUnInit
EndBufferedPaint
GetThemeColor
BeginBufferedPaint
GetThemeInt
DwmIsCompositionEnabled
DwmEnableBlurBehindWindow
ord113
DwmRegisterThumbnail
ord139
ord138
ord141
ord140
ord114
DwmGetWindowAttribute
ord159
DwmQueryThumbnailSourceSize
ord124
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
DwmSetWindowAttribute
GetCapture
ReleaseCapture
GetDoubleClickTime
CalculatePopupWindowPosition
CopyIcon
GetLastInputInfo
GetCursorFrameInfo
AdjustWindowRect
GetDpiForWindow
SetWindowCompositionAttribute
SetGestureConfig
LoadImageW
CheckMenuItem
EnableMenuItem
RemoveMenu
SetMenuDefaultItem
TrackPopupMenuEx
DestroyIcon
CopyImage
GetSysColor
GetCaretBlinkTime
InjectKeyboardInput
MapVirtualKeyExW
InjectMouseInput
LockWorkStation
TileWindows
CascadeWindows
HungWindowFromGhostWindow
LoadIconW
IsIconic
GetKeyState
ExitWindowsEx
EndDialog
AdjustWindowRectEx
GetDC
ReleaseDC
CreatePopupMenu
GetMenuDefaultItem
DestroyMenu
SetCapture
SetCursor
SetMenuItemInfoW
MonitorFromWindow
DefWindowProcA
IsWindowUnicode
LoadAcceleratorsW
ChangeWindowMessageFilterEx
TranslateAcceleratorW
ord2611
ord2005
SendInput
SetDesktopColorTransform
UnregisterClassA
DeleteMenu
FillRect
DrawTextW
LoadMenuW
MonitorFromRect
GetGuiResources
GetSystemMetricsForDpi
CreateIconIndirect
GetMenuItemCount
GetMenuItemInfoW
MonitorFromPoint
ReplyMessage
IsHungAppWindow
GetAsyncKeyState
ModifyMenuW
GetSystemMenu
GetSysColorBrush
SetLayeredWindowAttributes
GetIconInfoExW
GetIconInfo
GetClassWord
GetClassLongW
LoadCursorW
TrackMouseEvent
GetPhysicalCursorPos
GetCursorInfo
ShowWindowAsync
InsertMenuW
BringWindowToTop
ord2573
GhostWindowFromHungWindow
EndTask
IsTopLevelWindow
GetMenuState
SetScrollInfo
GetScrollInfo
SetScrollPos
GetMenuStringW
InternalGetWindowText
GetLayeredWindowAttributes
DrawTextExW
IsProcessDPIAware
SetThreadDpiAwarenessContext
GetWindowCompositionAttribute
GetWindowProcessHandle
GetClassLongPtrW
UpdateLayeredWindow
ord2521
ord2574
SwitchToThisWindow
UnregisterClassW
ord2522
WindowFromDC
GetMenuInfo
SetMenuInfo
GetDpiForSystem
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
CharLowerW
IsCharAlphaNumericW
GetLastActivePopup
UnregisterHotKey
RegisterHotKey
DrawIconEx
GetSubMenu
SendDlgItemMessageW
GetUserNameExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
LCIDToLocaleName
PowerCreateRequest
PowerSetRequest
VerifyVersionInfoW
OOBEComplete
CopyFileW
SetTermsrvAppInstallMode
ord292
StartTraceW
StopTraceW
EnableTraceEx2
IsProcessInJob
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrClientCall3
GetStagedPackagePathByFullName2
BiPtFreeMemory
BiPtAssociateApplicationEntryPoint
BiPtQueryWorkItem
BiPtEnumerateWorkItemsForPackageName
GetShellWindow
RoCreatePropertySetSerializer
GetErrorInfo
SetErrorInfo
g_trayTriageBlock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ