Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
explorer.exe
Resource
win10-20230703-en
Target
explorer.exe
Size
4.8MB
MD5
5c7805894b39ba7aaa9c53d013ae92c2
SHA1
b4f089ec1627b1333078df2bafb3b4e9c77dcf88
SHA256
e89840322edaf4a7855ab296bc298add055c6d6910edc6c93ac866eb264e74a3
SHA512
af153689b6215e8646775aef6833939efc2dd48d55aacce35a9ed0bcedd0b8c24c32dc454d97b8e1141de5ab375f3576083f3da4520ca32326ad035006bf98ed
SSDEEP
49152:HAPwTykBQUso1RiXF/a8R/2LjWpeEdgZf0QrffUnjA0ASePAIm3Zq+d4pfhyhqsl:gS8OIuO/TNZengEObw8a0snPk
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
_Cnd_wait
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?id@?$collate@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Thrd_yield
?width@ios_base@std@@QEAA_J_J@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Thrd_detach
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_unlock
_Thrd_join
_Thrd_id
_Mtx_lock
?_Xlength_error@std@@YAXPEBD@Z
_Cnd_do_broadcast_at_thread_exit
_c_exit
_initterm_e
_initterm
_set_error_mode
_register_thread_local_exe_atexit_callback
wcscspn
strncmp
wcscmp
memset
wcsncmp
_time64
_o_exit
_o_floor
_o_floorf
_o_fmod
_o_free
_o_iswspace
_o_lround
_o_lroundf
_o_malloc
_o_memcpy_s
_o_pow
_o_realloc
_o_sqrt
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_o__wcsnicmp
_o__wcslwr_s
_o__wcsicmp
memmove
_o__set_new_mode
_o__set_fmode
_o__set_errno
_o__set_app_type
_o__seh_filter_exe
_o_abort
_o__register_onexit_function
_o__recalloc
_o__purecall
_o__mktime64
_o__wtoi
_o_ceilf
_o_ceil
_o__ltow_s
_o__localtime64
_o__itow_s
_o__itoa_s
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
_o__get_errno
_o__exit
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcschr
wcsrchr
wcsstr
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy
PicFreeFileInfo
PicRetrieveFileInfo
ord9
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
OpenJobObjectW
QueryInformationJobObject
RegisterApplicationRestart
UrlUnescapeW
HashData
PathIsURLW
WerUnregisterCustomMetadata
WerRegisterCustomMetadata
CheckElevation
CheckElevationEnabled
SHRegGetUSValueW
SHRegGetBoolUSValueW
CoRevokeInitializeSpy
CoRegisterMessageFilter
CoRegisterInitializeSpy
GlobalGetAtomNameW
CreateActCtxW
ReleaseActCtx
ActivateActCtx
DeactivateActCtx
NtSetInformationProcess
WinSqmIsOptedIn
RtlGetVersion
ZwQuerySystemInformation
ZwQueryValueKey
ZwOpenKey
ZwClose
RtlReAllocateHeap
ZwEnumerateValueKey
ZwCreateFile
NtQueryInformationFile
RtlAppendUnicodeToString
RtlAnsiStringToUnicodeString
RtlImageDirectoryEntryToData
ZwUnmapViewOfSection
RtlNtPathNameToDosPathName
RtlUpcaseUnicodeChar
ZwCreateSection
RtlxAnsiStringToUnicodeSize
ZwQueryInformationProcess
RtlpEnsureBufferSize
RtlGetNativeSystemInformation
RtlVerifyVersionInfo
ZwQueryDirectoryFile
ZwSetInformationProcess
RtlInitUnicodeStringEx
ZwMapViewOfSection
RtlFormatCurrentUserKeyPath
ZwEnumerateKey
RtlInitString
ZwOpenFile
ZwQueryInformationFile
LdrResSearchResource
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtQueryInformationProcess
NtQueryWnfStateData
RtlInitUnicodeString
NtOpenFile
NtDeviceIoControlFile
RtlCaptureContext
NtClose
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlFlushHeaps
NtSetSystemInformation
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlVirtualUnwind
strchr
memmove_s
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeUnicodeString
RtlAllocateHeap
RtlFreeHeap
RtlGetNtSystemRoot
RtlCompareUnicodeString
NtOpenProcessToken
NtQueryInformationToken
RtlAppendUnicodeStringToString
NtOpenThreadToken
wcsspn
RtlRunOnceExecuteOnce
RtlCopyUnicodeString
RtlUpcaseUnicodeString
RtlNtStatusToDosErrorNoTeb
NtSetThreadExecutionState
NtPowerInformation
VerSetConditionMask
RtlQueryResourcePolicy
RtlQueryUnbiasedInterruptTime
NtQuerySystemInformation
WinSqmAddToStream
GetModuleHandleA
FindStringOrdinal
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
FreeLibrary
FindResourceExW
LoadResource
LockResource
LoadLibraryExW
GetModuleHandleExW
LoadStringW
GetModuleFileNameW
SizeofResource
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
Sleep
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
CreateMutexW
ReleaseSRWLockExclusive
WaitForMultipleObjectsEx
ReleaseMutex
InitializeSRWLock
WaitForSingleObject
CreateEventW
InitializeCriticalSectionEx
OpenEventW
LeaveCriticalSection
CreateEventExW
InitializeCriticalSectionAndSpinCount
ResetEvent
OpenMutexW
SleepEx
ReleaseSemaphore
TryEnterCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
SetEvent
CreateMutexExW
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
UnhandledExceptionFilter
SetErrorMode
SetUnhandledExceptionFilter
RaiseException
GetLastError
DeleteFileW
GetFileAttributesW
CreateFileW
FindFirstFileW
FindClose
WriteFile
FindNextFileW
GetLongPathNameW
EventWrite
EventUnregister
EventSetInformation
EventRegister
EventActivityIdControl
EventWriteTransfer
EventEnabled
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
SetThreadpoolTimer
CloseThreadpoolWait
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWait
SetThreadpoolWait
TrySubmitThreadpoolCallback
OpenThread
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentProcess
GetProcessId
TlsFree
GetExitCodeProcess
SetProcessShutdownParameters
GetThreadPriority
SetThreadPriorityBoost
ResumeThread
GetCurrentThreadId
SetThreadPriority
ProcessIdToSessionId
ExitProcess
GetPriorityClass
TerminateProcess
SetPriorityClass
CreateThread
GetStartupInfoW
DeleteProcThreadAttributeList
TlsAlloc
UpdateProcThreadAttribute
CreateProcessW
QueueUserAPC
InitializeProcThreadAttributeList
TlsSetValue
GetCurrentProcessId
TlsGetValue
FormatMessageW
GetLocaleInfoEx
GetCalendarInfoW
GetLocaleInfoW
GetThreadUILanguage
DebugBreak
IsDebuggerPresent
OutputDebugStringW
DuplicateHandle
CloseHandle
SysStringLen
SysAllocString
VariantClear
SafeArrayDestroy
VariantInit
SafeArrayAccessData
SafeArrayCreate
SafeArrayUnaccessData
VarUI4FromStr
SysAllocStringByteLen
SysFreeString
SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask
SetCurrentProcessExplicitAppUserModelID
IsOS
CoTaskMemFree
CoSetProxyBlanket
StringFromCLSID
CoTaskMemAlloc
CoUninitialize
CoInitializeSecurity
CoWaitForMultipleHandles
CoGetApartmentType
CoGetStdMarshalEx
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoFreeUnusedLibraries
CoGetObjectContext
CoInitializeEx
CoRegisterClassObject
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
PropVariantClear
CreateStreamOnHGlobal
CoGetCallContext
StringFromGUID2
StringFromIID
CoCreateGuid
CLSIDFromString
CoEnableCallCancellation
CoDisableCallCancellation
CoCancelCall
CoGetMalloc
IIDFromString
CoReleaseMarshalData
CoRevokeClassObject
CoTaskMemRealloc
StrCmpICA
QISearch
StrCmpNIW
StrCmpIW
StrCmpNICW
StrChrW
StrToIntW
StrCmpICW
StrChrIW
StrCmpW
SHStrDupW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegEnumValueW
RegDeleteValueW
RegQueryValueExW
RegDeleteTreeW
RegQueryInfoKeyW
RegOpenCurrentUser
RegGetValueW
RegLoadMUIStringW
IUnknown_SetSite
IUnknown_QueryService
IUnknown_Set
IUnknown_GetSite
GlobalFree
GlobalAlloc
LocalAlloc
LocalFree
LocalReAlloc
IsProcessorFeaturePresent
OpenProcess
GetProcessMitigationPolicy
GetDateFormatW
GetVersionExW
GetSystemTimeAsFileTime
GetTickCount
GetSystemTime
GetLocalTime
GetTickCount64
GetWindowsDirectoryW
GetSystemDirectoryW
GetDateFormatEx
GetTimeFormatEx
ExpandEnvironmentStringsW
GetCurrentDirectoryW
GetCommandLineW
SearchPathW
PathFindExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathIsFileSpecW
PathCombineW
PathQuoteSpacesW
PathCommonPrefixW
PathGetDriveNumberW
PathParseIconLocationW
PathFileExistsW
PathRemoveBlanksW
PathGetArgsW
SHExpandEnvironmentStringsW
SHEnumKeyExW
SHSetValueW
SHQueryInfoKeyW
SHRegGetValueW
SHGetValueW
SHDeleteValueW
SHDeleteKeyW
WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar
CompareStringW
WindowsCreateString
WindowsCompareStringOrdinal
WindowsSubstringWithSpecifiedLength
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsDuplicateString
SHCreateThread
SHGetThreadRef
SHSetThreadRef
SHCreateThreadRef
SetProcessReference
FindResourceW
LoadLibraryW
DeleteAce
InitializeAcl
DuplicateToken
GetAce
CheckTokenMembership
MakeAbsoluteSD
IsValidSid
SetKernelObjectSecurity
FreeSid
CreateWellKnownSid
AllocateAndInitializeSid
AddAce
GetLengthSid
CopySid
EqualSid
GetAclInformation
GetTokenInformation
GetSecurityDescriptorDacl
K32EnumProcessModules
K32EnumProcesses
QueryFullProcessImageNameW
K32GetModuleFileNameExW
K32GetModuleBaseNameW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
RegisterTraceGuidsW
UnregisterTraceGuids
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
TraceMessage
GetUserDefaultUILanguage
SHLoadIndirectString
SetThreadDescription
SetProcessInformation
RegSetKeyValueW
RoUninitialize
RoInitialize
RoActivateInstance
RoGetActivationFactory
RoGetAgileReference
SetRestrictedErrorInfo
RoOriginateError
RoGetMatchingRestrictedErrorInfo
PathCchAddExtension
PathCchCombine
PathAllocCombine
PathCchAppend
PathCchRemoveFileSpec
SHAnsiToUnicode
GlobalUnlock
GlobalLock
lstrcmpiW
lstrlenW
VirtualProtect
UnmapViewOfFile
OpenFileMappingW
CreateFileMappingW
VirtualFree
VirtualAlloc
MapViewOfFile
CommandLineToArgvW
MulDiv
IStream_Reset
SHCreateStreamOnFileEx
IStream_Read
SHCreateMemStream
SHCreateStreamOnFileW
IStream_Write
SHOpenRegStream2W
GetTempPathW
ord170
UnregisterWaitEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetNativeSystemInfo
GetProductInfo
GetUserDefaultGeoName
GetProfileType
DeriveAppContainerSidFromAppContainerName
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SystemTimeToFileTime
GetDynamicTimeZoneInformation
GetSystemPowerStatus
GetComputerNameW
RegisterWaitForSingleObject
QueryPerformanceCounter
InitializeSListHead
InterlockedPushEntrySList
GetPersistedRegistryLocationW
LookupAccountNameW
CharNextW
CharLowerBuffW
QueryServiceConfigW
NotifyServiceStatusChangeW
DeviceIoControl
CreateIoCompletionPort
GetQueuedCompletionStatus
SHRegGetValueFromHKCUHKLM
GetDpiForMonitor
ord244
RaiseFailFastException
CharNextA
CallNtPowerInformation
GetPwrCapabilities
ApiSetQueryApiSetPresence
ord509
SHPinDllOfCLSID
AssocQueryStringW
ord197
SHIsChildOrSelf
ord478
StrRetToBufW
ord479
ord481
ord165
StrRetToStrW
ord544
PathRemoveArgsW
ord292
IUnknown_GetWindow
SHCreateWorkerWindowW
ord279
ShellMessageBoxW
ord635
GetDisplayConfigBufferSizes
SystemParametersInfoW
QueryDisplayConfig
GetMonitorInfoW
GetSystemMetrics
EnumDisplayMonitors
EnumDisplayDevicesW
SetRect
SetRectEmpty
IntersectRect
CopyRect
OffsetRect
PtInRect
IsRectEmpty
InflateRect
SubtractRect
EqualRect
UnionRect
NotifyWinEvent
UnhookWinEvent
SetWinEventHook
SHBindToObject
ILCombine
SHCreateItemFromIDList
ILClone
ILIsEqual
SHGetIDListFromObject
SHCreateItemFromParsingName
ILIsParent
ILFree
ILFindLastID
ILGetSize
ILCloneFirst
ILRemoveLastID
SHBindToParent
SHParseDisplayName
SHBindToFolderIDListParent
SHGetNameFromIDList
DXGIDeclareAdapterRemovalSupport
GetPointerType
GetPointerInfo
GetPointerDevices
GetCurrentInputMessageSource
EnableMouseInPointer
SHGetFolderPathEx
GetThreadFlags
SetThreadFlags
SHGetKnownFolderIDList
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
GetPackageFullName
GetPackagesByPackageFamily
SetWindowFeedbackSetting
RegisterClipboardFormatW
DragQueryFileW
GetWindowBand
CreateWindowInBand
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
SHChangeNotifyDeregister
SHChangeNotification_Lock
SHHandleUpdateImage
SHChangeNotifyRegister
SHChangeNotifyRegisterThread
SHChangeNotification_Unlock
PropVariantToStringAlloc
PSPropertyBag_WriteDWORD
PropVariantToUInt32
PSPropertyBag_WriteStr
PropVariantToBoolean
PSCreateMemoryPropertyStore
PSGetPropertyFromPropertyStorage
InitVariantFromResource
InitVariantFromGUIDAsString
SHChangeNotify
SHCreateDataObject
FindPackagesByPackageFamily
ParseApplicationUserModelId
WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
ExtTextOutW
GetTextExtentPoint32W
CreateRectRgnIndirect
SetTextAlign
SetTextColor
StretchBlt
ExcludeClipRect
GetTextMetricsW
CreateFontIndirectW
GetClipBox
GetCurrentObject
SelectObject
CreateCompatibleDC
DeleteDC
GetObjectW
DeleteObject
CombineRgn
GetDeviceCaps
GetStockObject
CreateRectRgn
SetRectRgn
SetStretchBltMode
Rectangle
OffsetRgn
SelectClipRgn
GetGlyphOutlineW
GetOutlineTextMetricsW
GetClipRgn
HeapSize
GetModuleHandleExA
HeapReAlloc
IsBadWritePtr
RtlCompareMemory
HeapDestroy
InternetCrackUrlW
ord1
SHUnicodeToAnsi
ord192
ord210
ord183
ord213
ord126
ord109
ord174
ord121
ord162
ord190
ord123
ord191
ord187
ord141
ord142
ord200
ord184
ord186
ord743
ord907
ord43
Shell_GetCachedImageIndexW
ord790
ord792
ord727
ord162
SHAppBarMessage
ord894
ord906
ord181
ord895
SHGetLocalizedName
SHGetPropertyStoreForWindow
ord764
ord866
SHEvaluateSystemCommandTemplate
ord244
ExtractIconExW
ord132
ord137
Shell_NotifyIconW
Shell_NotifyIconGetRect
ord6
SHGetStockIconInfo
DuplicateIcon
ord91
ord254
ord54
SHEnableServiceObject
ord61
ord896
SHAddToRecentDocs
ord60
SHUpdateRecycleBinIcon
ord711
SHFileOperationW
SHGetPathFromIDListW
ord753
ord733
ord67
SHCreateItemInKnownFolder
ord206
ord201
ord188
ord899
ShellExecuteExW
ord245
ord200
ord89
ord190
ord85
ord100
ord134
ord22
ord850
ord95
ord885
ord723
ord680
ord172
ShellExecuteW
ord164
PathIsDirectoryW
ord413
ord548
ord163
ord467
AssocQueryKeyW
ChrCmpIW
PathIsRelativeW
AssocCreate
IsThemeActive
BufferedPaintInit
BeginBufferedPaint
CloseThemeData
DrawThemeParentBackground
GetThemePartSize
GetBufferedPaintBits
GetThemeInt
GetThemeColor
ord126
BufferedPaintUnInit
DrawThemeBackground
ord86
GetThemeFont
DrawThemeTextEx
IsCompositionActive
GetWindowTheme
IsThemePartDefined
IsAppThemed
SetWindowTheme
EndBufferedPaint
GetThemeBackgroundExtent
ord138
GetThemeMargins
OpenThemeDataForDpi
GetThemeMetric
OpenThemeData
GetThemeBool
BufferedPaintSetAlpha
DwmRegisterThumbnail
ord138
ord139
DwmSetWindowAttribute
ord141
ord140
DwmGetWindowAttribute
DwmIsCompositionEnabled
ord113
ord159
DwmQueryThumbnailSourceSize
ord124
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
DwmEnableBlurBehindWindow
ord114
TrackMouseEvent
SetCapture
GetCapture
ReleaseCapture
GetDoubleClickTime
CalculatePopupWindowPosition
CopyIcon
GetLastInputInfo
GetCursorFrameInfo
AdjustWindowRect
GetDpiForWindow
SetWindowCompositionAttribute
SetGestureConfig
LoadImageW
CheckMenuItem
EnableMenuItem
RemoveMenu
GetSysColor
GetCaretBlinkTime
InjectKeyboardInput
MapVirtualKeyExW
InjectMouseInput
LockWorkStation
TileWindows
CascadeWindows
HungWindowFromGhostWindow
LoadIconW
IsIconic
GetKeyState
ExitWindowsEx
EndDialog
SendDlgItemMessageW
RegisterHotKey
AdjustWindowRectEx
GetDC
ReleaseDC
CreatePopupMenu
GetMenuDefaultItem
GetSystemMetricsForDpi
LoadCursorW
SetCursor
SetMenuItemInfoW
MonitorFromWindow
DefWindowProcA
IsWindowUnicode
LoadAcceleratorsW
ChangeWindowMessageFilterEx
DestroyIcon
SendInput
SetDesktopColorTransform
UnregisterClassA
TranslateAcceleratorW
SetMenuDefaultItem
TrackPopupMenuEx
DeleteMenu
FillRect
ord2611
MonitorFromRect
DrawTextW
CopyImage
GetSubMenu
CreateIconIndirect
GetMenuItemCount
GetMenuItemInfoW
ord2005
MonitorFromPoint
ReplyMessage
GetAsyncKeyState
ModifyMenuW
GetSystemMenu
GetSysColorBrush
SetLayeredWindowAttributes
GetIconInfoExW
GetIconInfo
DestroyMenu
GetClassWord
GetClassLongW
GetPhysicalCursorPos
GetCursorInfo
ShowWindowAsync
InsertMenuW
BringWindowToTop
ord2573
GhostWindowFromHungWindow
EndTask
IsTopLevelWindow
GetMenuState
SetScrollInfo
GetScrollInfo
SetScrollPos
GetGuiResources
GetMenuStringW
InternalGetWindowText
GetLayeredWindowAttributes
DrawTextExW
IsProcessDPIAware
SetThreadDpiAwarenessContext
GetWindowCompositionAttribute
GetWindowProcessHandle
GetClassLongPtrW
IsHungAppWindow
UpdateLayeredWindow
ord2574
ord2521
UnregisterClassW
ord2522
WindowFromDC
GetMenuInfo
SetMenuInfo
GetDpiForSystem
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
CharLowerW
IsCharAlphaNumericW
SwitchToThisWindow
UnregisterHotKey
GetLastActivePopup
DrawIconEx
LoadMenuW
GetUserNameExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
LCIDToLocaleName
PowerCreateRequest
VerifyVersionInfoW
PowerSetRequest
OOBEComplete
CopyFileW
SetTermsrvAppInstallMode
ord292
StopTraceW
StartTraceW
EnableTraceEx2
IsProcessInJob
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrClientCall3
GetStagedPackagePathByFullName2
BiPtAssociateApplicationEntryPoint
BiPtEnumerateWorkItemsForPackageName
BiPtQueryWorkItem
BiPtFreeMemory
GetShellWindow
RoCreatePropertySetSerializer
GetErrorInfo
SetErrorInfo
g_trayTriageBlock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ