Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
explorer.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
explorer.exe
Resource
win10v2004-20231020-en
Target
explorer.exe
Size
4.5MB
MD5
8ddda1b3ddd83942e8b8624f9487ec0d
SHA1
7d811b6c688c52735bc819c5e348396d676f6e6e
SHA256
abc4dc9fb57311a16668bf8a6f7d1bcac162b172690762715e2559c3a0837307
SHA512
f2ad71f43e0f7f94dc087646652b51bf61093e0fe764e61110060f2bb32a241cb56cc0c33d6b6d5333221c2d18eb8e762d92c34643a9fa51eb541650112f80c9
SSDEEP
98304:rvSG5pxVLCJl31FonIv/moRRHCd6iEMfMBDLW7J9+h+sA4/Cxx1zkSmUtjt0I9rK:rvSG5pxVLCJl31FonS/moRRHziEMfQSs
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
_Cnd_wait
?_Xinvalid_argument@std@@YAXPBD@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?tolower@?$ctype@G@std@@QBEGG@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?id@?$collate@G@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
??0_Lockit@std@@QAE@H@Z
??0_Locinfo@std@@QAE@PBD@Z
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??1_Lockit@std@@QAE@XZ
??1_Locinfo@std@@QAE@XZ
?is@?$ctype@G@std@@QBE_NFG@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?width@ios_base@std@@QAE_J_J@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Thrd_yield
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
_Mtx_unlock
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
_Thrd_detach
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Thrd_join
_Thrd_id
?_Xlength_error@std@@YAXPBD@Z
_Cnd_do_broadcast_at_thread_exit
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
_c_exit
_initterm_e
_initterm
_set_error_mode
_register_thread_local_exe_atexit_callback
strncmp
memset
wcsncmp
wcscspn
_time32
_o_ceil
_o_exit
_o_floor
_o_free
_o_iswspace
_o_lround
_o_lroundf
_o_malloc
_o_memcpy_s
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoll
__current_exception
__current_exception_context
_except_handler4_common
_o__wtoi
_o__wcsnicmp
_o__wcslwr_s
_o__wcsicmp
memmove
_o_abort
_o__set_new_mode
_o__set_fmode
_o__set_errno
_o__set_app_type
_o__seh_filter_exe
_o__register_onexit_function
_o__recalloc
_o__purecall
_o__mktime32
_o__ltow_s
_o__localtime32
_o__itow_s
_o__itoa_s
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
_o__get_errno
_o__exit
_o__errno
_o__difftime32
_o__crt_atexit
_o__controlfp_s
_o__configure_wide_argv
_o__configthreadlocale
_o__CIsqrt
_o__CIpow
_o__CIfmod
_o__cexit
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcsrchr
wcsstr
__std_terminate
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy
PicRetrieveFileInfo
PicFreeFileInfo
ord9
QueryInformationJobObject
AssignProcessToJobObject
OpenJobObjectW
CreateJobObjectW
SetInformationJobObject
RegisterApplicationRestart
HashData
PathIsURLW
UrlUnescapeW
WerUnregisterCustomMetadata
WerRegisterCustomMetadata
CheckElevation
CheckElevationEnabled
SHRegGetBoolUSValueW
SHRegGetUSValueW
CoRegisterInitializeSpy
CoRevokeInitializeSpy
CoRegisterMessageFilter
GlobalGetAtomNameW
ActivateActCtx
ReleaseActCtx
DeactivateActCtx
CreateActCtxW
WinSqmAddToStream
RtlGetVersion
ZwQuerySystemInformation
ZwQueryValueKey
ZwOpenKey
ZwClose
RtlReAllocateHeap
ZwEnumerateValueKey
ZwCreateFile
NtQueryInformationFile
RtlAppendUnicodeToString
RtlAnsiStringToUnicodeString
RtlImageDirectoryEntryToData
ZwUnmapViewOfSection
RtlNtPathNameToDosPathName
RtlUpcaseUnicodeChar
ZwCreateSection
RtlxAnsiStringToUnicodeSize
ZwQueryInformationProcess
RtlpEnsureBufferSize
RtlGetNativeSystemInformation
RtlVerifyVersionInfo
ZwQueryDirectoryFile
ZwSetInformationProcess
RtlInitUnicodeStringEx
ZwMapViewOfSection
RtlFormatCurrentUserKeyPath
ZwEnumerateKey
RtlInitString
ZwOpenFile
ZwQueryInformationFile
LdrResSearchResource
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtQueryInformationProcess
WinSqmIsOptedIn
NtQueryWnfStateData
RtlInitUnicodeString
NtOpenFile
NtDeviceIoControlFile
NtClose
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlFlushHeaps
NtSetSystemInformation
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosError
strchr
memmove_s
RtlAppendUnicodeStringToString
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeUnicodeString
wcschr
RtlAllocateHeap
RtlFreeHeap
RtlCompareUnicodeString
NtOpenProcessToken
NtQueryInformationToken
NtOpenThreadToken
wcsspn
RtlRunOnceExecuteOnce
RtlGetNtSystemRoot
RtlNtStatusToDosErrorNoTeb
RtlCopyUnicodeString
RtlUpcaseUnicodeString
NtSetThreadExecutionState
NtPowerInformation
VerSetConditionMask
RtlQueryResourcePolicy
RtlQueryUnbiasedInterruptTime
NtQuerySystemInformation
NtSetInformationProcess
FindResourceExW
FreeLibrary
LockResource
GetModuleHandleW
LoadLibraryExW
LoadStringW
GetModuleHandleExW
SizeofResource
GetModuleHandleA
FindStringOrdinal
GetProcAddress
LoadResource
GetModuleFileNameW
GetModuleFileNameA
Sleep
InitOnceComplete
InitOnceExecuteOnce
InitOnceBeginInitialize
CreateSemaphoreExW
CreateMutexW
WaitForSingleObject
InitializeSRWLock
ReleaseMutex
EnterCriticalSection
CreateEventW
SetEvent
InitializeCriticalSectionEx
ReleaseSemaphore
OpenEventW
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSection
ReleaseSRWLockExclusive
CreateEventExW
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForMultipleObjectsEx
AcquireSRWLockExclusive
WaitForSingleObjectEx
OpenSemaphoreW
SleepEx
LeaveCriticalSection
OpenMutexW
ReleaseSRWLockShared
HeapFree
HeapAlloc
HeapSetInformation
GetProcessHeap
GetLastError
SetLastError
SetUnhandledExceptionFilter
SetErrorMode
RaiseException
UnhandledExceptionFilter
GetLongPathNameW
FindNextFileW
FindFirstFileW
GetFileAttributesW
WriteFile
DeleteFileW
FindClose
CreateFileW
CompareFileTime
EventWrite
EventWriteTransfer
EventActivityIdControl
EventRegister
EventEnabled
EventUnregister
EventSetInformation
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks
SubmitThreadpoolWork
SetThreadpoolWait
CreateThreadpoolWait
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWork
TrySubmitThreadpoolCallback
CloseThreadpoolWait
SetThreadpoolTimer
TlsSetValue
UpdateProcThreadAttribute
ExitProcess
SetProcessShutdownParameters
InitializeProcThreadAttributeList
CreateProcessW
QueueUserAPC
TlsGetValue
CreateThread
SetThreadPriorityBoost
GetThreadPriority
TlsFree
SetPriorityClass
GetPriorityClass
ProcessIdToSessionId
ResumeThread
SetThreadPriority
GetCurrentProcessId
GetCurrentThreadId
OpenThread
GetProcessId
TerminateProcess
GetExitCodeProcess
GetStartupInfoW
TlsAlloc
DeleteProcThreadAttributeList
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentProcess
GetGeoInfoW
GetLocaleInfoW
GetLocaleInfoEx
GetCalendarInfoW
GetThreadUILanguage
FormatMessageW
IsDebuggerPresent
OutputDebugStringW
DebugBreak
CloseHandle
DuplicateHandle
SafeArrayCreate
SafeArrayAccessData
VariantClear
SafeArrayUnaccessData
SafeArrayDestroy
VarUI4FromStr
SysFreeString
SysStringLen
SysAllocString
VariantInit
SysAllocStringByteLen
SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask
IsOS
SetCurrentProcessExplicitAppUserModelID
CoTaskMemRealloc
CoSetProxyBlanket
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoRevokeClassObject
CoReleaseMarshalData
PropVariantClear
CoInitializeEx
CoRegisterClassObject
CoCreateFreeThreadedMarshaler
IIDFromString
CreateStreamOnHGlobal
CoGetApartmentType
CoGetCallContext
CoCreateInstance
CoWaitForMultipleHandles
CoCancelCall
CoDisableCallCancellation
CoEnableCallCancellation
StringFromGUID2
CLSIDFromString
CoTaskMemFree
StringFromIID
CoGetObjectContext
CoCreateGuid
StringFromCLSID
CoGetStdMarshalEx
CoInitializeSecurity
CoFreeUnusedLibraries
CoUninitialize
QISearch
StrCmpNICW
StrCmpICW
StrCmpW
StrChrIW
StrToIntW
StrChrW
StrCmpNIW
StrCmpICA
StrCmpIW
SHStrDupW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegOpenKeyExW
RegOpenCurrentUser
RegCloseKey
RegDeleteTreeW
RegDeleteKeyExW
RegQueryValueExW
RegLoadMUIStringW
RegDeleteValueW
RegQueryInfoKeyW
RegGetValueW
IUnknown_GetSite
IUnknown_QueryService
IUnknown_Set
IUnknown_SetSite
LocalFree
LocalAlloc
GlobalFree
GlobalAlloc
LocalReAlloc
IsProcessorFeaturePresent
OpenProcess
GetProcessMitigationPolicy
GetDateFormatW
GetTickCount64
GetTickCount
GetVersionExW
GetSystemTime
GetLocalTime
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetDateFormatEx
GetTimeFormatEx
GetCommandLineW
SearchPathW
GetEnvironmentVariableW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
PathRemoveFileSpecW
PathIsFileSpecW
PathGetDriveNumberW
PathCombineW
PathFileExistsW
PathRemoveBlanksW
PathFindFileNameW
PathGetArgsW
PathParseIconLocationW
SHExpandEnvironmentStringsW
PathQuoteSpacesW
PathFindExtensionW
PathCommonPrefixW
SHQueryInfoKeyW
SHDeleteKeyW
SHGetValueW
SHSetValueW
SHEnumKeyExW
SHDeleteValueW
SHRegGetValueW
MultiByteToWideChar
WideCharToMultiByte
CompareStringOrdinal
CompareStringW
WindowsPromoteStringBuffer
WindowsCompareStringOrdinal
WindowsCreateString
WindowsDeleteStringBuffer
WindowsSubstringWithSpecifiedLength
WindowsPreallocateStringBuffer
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsDuplicateString
SHSetThreadRef
SetProcessReference
SHCreateThreadRef
SHCreateThread
SHGetThreadRef
LoadLibraryW
FindResourceW
GetSecurityDescriptorDacl
AddAce
InitializeAcl
GetTokenInformation
CreateWellKnownSid
CheckTokenMembership
DuplicateToken
DeleteAce
SetKernelObjectSecurity
GetAce
GetAclInformation
EqualSid
AllocateAndInitializeSid
IsValidSid
GetLengthSid
FreeSid
MakeAbsoluteSD
CopySid
K32EnumProcesses
K32EnumProcessModules
K32GetModuleBaseNameW
QueryFullProcessImageNameW
K32GetModuleFileNameExW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceEnableLevel
TraceMessage
GetUserDefaultUILanguage
SHLoadIndirectString
SetProcessInformation
SetThreadDescription
RegSetKeyValueW
RoUninitialize
RoActivateInstance
RoInitialize
RoGetActivationFactory
RoGetAgileReference
RoOriginateError
RoTransformError
SetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
PathCchAddExtension
PathAllocCombine
PathCchRemoveFileSpec
PathCchCombine
PathCchAppend
SHAnsiToUnicode
GlobalUnlock
GlobalLock
lstrcmpiW
lstrlenW
VirtualAlloc
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
VirtualFree
VirtualProtect
CommandLineToArgvW
MulDiv
IStream_Read
SHCreateStreamOnFileEx
IStream_Write
IStream_Reset
SHCreateMemStream
SHCreateStreamOnFileW
SHOpenRegStream2W
GetTempPathW
ord170
CreateTimerQueueTimer
UnregisterWaitEx
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetNativeSystemInfo
GetProductInfo
GetUserDefaultGeoName
DeriveAppContainerSidFromAppContainerName
GetProfileType
FileTimeToSystemTime
GetTimeZoneInformation
GetDynamicTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemPowerStatus
RegisterWaitForSingleObject
GetComputerNameW
QueryPerformanceCounter
InitializeSListHead
InterlockedPushEntrySList
GetPersistedRegistryLocationW
LookupAccountNameW
CharNextW
CharLowerBuffW
NotifyServiceStatusChangeW
QueryServiceConfigW
DeviceIoControl
GetQueuedCompletionStatus
CreateIoCompletionPort
SHRegGetValueFromHKCUHKLM
ord244
GetDpiForMonitor
RaiseFailFastException
CharNextA
CallNtPowerInformation
GetPwrCapabilities
ApiSetQueryApiSetPresence
SHCreateWorkerWindowW
ord635
AssocQueryStringW
SHPinDllOfCLSID
ord544
ShellMessageBoxW
ord197
SHIsChildOrSelf
ord478
StrRetToBufW
ord479
ord481
ord165
StrRetToStrW
IUnknown_GetWindow
ord279
ord509
PathRemoveArgsW
ord292
EnumDisplayMonitors
GetSystemMetrics
SystemParametersInfoW
QueryDisplayConfig
GetMonitorInfoW
GetDisplayConfigBufferSizes
EnumDisplayDevicesW
OffsetRect
SubtractRect
UnionRect
CopyRect
IntersectRect
SetRectEmpty
PtInRect
EqualRect
SetRect
InflateRect
IsRectEmpty
NotifyWinEvent
UnhookWinEvent
SetWinEventHook
SHBindToParent
SHParseDisplayName
ILGetSize
ILCloneFirst
ILCombine
SHCreateItemFromParsingName
ILClone
SHCreateItemFromIDList
SHBindToObject
SHGetIDListFromObject
ILFindLastID
SHGetNameFromIDList
ILIsParent
SHBindToFolderIDListParent
ILIsEqual
ILRemoveLastID
ILFree
DXGIDeclareAdapterRemovalSupport
GetPointerInfo
GetPointerDevices
GetCurrentInputMessageSource
GetPointerType
EnableMouseInPointer
SHGetFolderPathEx
SHGetKnownFolderIDList
GetThreadFlags
SetThreadFlags
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
GetPackagesByPackageFamily
GetPackageFullName
SetWindowFeedbackSetting
RegisterClipboardFormatW
DragQueryFileW
CreateWindowInBand
GetWindowBand
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
SHChangeNotifyRegister
SHHandleUpdateImage
SHChangeNotifyDeregister
SHChangeNotifyRegisterThread
SHChangeNotification_Unlock
SHChangeNotification_Lock
PSCreateMemoryPropertyStore
PropVariantToBoolean
PSPropertyBag_WriteStr
PSGetPropertyFromPropertyStorage
PropVariantToUInt32
InitVariantFromResource
InitVariantFromGUIDAsString
PSPropertyBag_WriteDWORD
PropVariantToStringAlloc
SHChangeNotify
SHCreateDataObject
ParseApplicationUserModelId
FindPackagesByPackageFamily
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
SelectObject
CreateCompatibleDC
DeleteDC
CreateFontIndirectW
SetTextColor
GetCurrentObject
Rectangle
SetStretchBltMode
GetClipBox
ExcludeClipRect
GetStockObject
SetTextAlign
StretchBlt
GetDeviceCaps
GetObjectW
CreateRectRgn
SetRectRgn
OffsetRgn
CombineRgn
SelectClipRgn
DeleteObject
GetClipRgn
GetOutlineTextMetricsW
GetGlyphOutlineW
CreateRectRgnIndirect
GetTextExtentPoint32W
ExtTextOutW
GetTextMetricsW
SetProcessDEPPolicy
IsBadWritePtr
GetModuleHandleExA
HeapSize
HeapDestroy
HeapReAlloc
RtlCompareMemory
InternetCrackUrlW
ord190
ord121
ord123
ord174
SHUnicodeToAnsi
ord1
ord192
ord183
ord126
ord109
ord162
ord191
ord187
ord186
ord184
ord141
ord142
ord200
ord134
ord22
ord743
ord907
ord43
Shell_GetCachedImageIndexW
ord790
ord792
ord727
ord162
SHAppBarMessage
ord894
ord906
ord850
ord895
SHGetLocalizedName
SHGetPropertyStoreForWindow
ord764
ord866
SHEvaluateSystemCommandTemplate
ord244
ExtractIconExW
ord132
ord137
Shell_NotifyIconW
Shell_NotifyIconGetRect
ord6
SHGetStockIconInfo
DuplicateIcon
ShellExecuteW
ord91
ord254
ord54
SHEnableServiceObject
ord61
ord896
SHAddToRecentDocs
ord60
SHUpdateRecycleBinIcon
ord711
SHFileOperationW
SHGetPathFromIDListW
ord753
ord733
ord67
SHCreateItemInKnownFolder
ord206
ord201
ord188
ord899
ShellExecuteExW
ord245
ord200
ord89
ord190
ord85
ord100
ord95
ord885
ord723
ord680
ord172
ord181
ord164
PathIsDirectoryW
ord413
ord548
ord163
ord467
AssocQueryKeyW
ChrCmpIW
PathIsRelativeW
AssocCreate
ord138
GetThemeInt
IsThemePartDefined
IsThemeActive
GetWindowTheme
BufferedPaintSetAlpha
GetBufferedPaintBits
IsCompositionActive
GetThemeColor
DrawThemeTextEx
ord126
BufferedPaintUnInit
GetThemePartSize
SetWindowTheme
EndBufferedPaint
GetThemeFont
OpenThemeDataForDpi
GetThemeMetric
ord86
IsAppThemed
BeginBufferedPaint
DrawThemeBackground
GetThemeBackgroundExtent
DrawThemeParentBackground
GetThemeBool
GetThemeMargins
CloseThemeData
OpenThemeData
BufferedPaintInit
DwmSetWindowAttribute
ord139
DwmRegisterThumbnail
ord138
ord141
ord140
ord113
DwmEnableBlurBehindWindow
DwmGetWindowAttribute
ord159
DwmQueryThumbnailSourceSize
ord124
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
ord114
DwmIsCompositionEnabled
TrackMouseEvent
SetCapture
GetCapture
ReleaseCapture
GetDoubleClickTime
CalculatePopupWindowPosition
CopyIcon
GetLastInputInfo
GetCursorFrameInfo
AdjustWindowRect
GetDpiForWindow
SetWindowCompositionAttribute
SetGestureConfig
LoadImageW
CheckMenuItem
EnableMenuItem
RemoveMenu
SetMenuDefaultItem
TrackPopupMenuEx
GetSysColor
GetCaretBlinkTime
InjectKeyboardInput
MapVirtualKeyExW
InjectMouseInput
LockWorkStation
TileWindows
CascadeWindows
HungWindowFromGhostWindow
LoadIconW
IsIconic
GetKeyState
ExitWindowsEx
GetSystemMetricsForDpi
AdjustWindowRectEx
GetDC
ReleaseDC
CreatePopupMenu
GetMenuDefaultItem
DestroyMenu
LoadCursorW
SetCursor
SetMenuItemInfoW
MonitorFromWindow
DefWindowProcA
IsWindowUnicode
LoadAcceleratorsW
ChangeWindowMessageFilterEx
TranslateAcceleratorW
ord2611
MonitorFromRect
GetGuiResources
CopyImage
SendInput
SetDesktopColorTransform
UnregisterClassA
IsHungAppWindow
ord2574
SwitchToThisWindow
DeleteMenu
DestroyIcon
DrawTextW
LoadMenuW
ord2005
EndDialog
GetSubMenu
CreateIconIndirect
GetMenuItemCount
GetMenuItemInfoW
MonitorFromPoint
ReplyMessage
SendDlgItemMessageW
GetAsyncKeyState
ModifyMenuW
GetSystemMenu
GetSysColorBrush
SetLayeredWindowAttributes
GetIconInfoExW
GetIconInfo
GetClassWord
GetClassLongW
GetLastActivePopup
GetPhysicalCursorPos
GetCursorInfo
ShowWindowAsync
InsertMenuW
BringWindowToTop
ord2573
GhostWindowFromHungWindow
EndTask
IsTopLevelWindow
GetMenuState
SetScrollInfo
GetScrollInfo
SetScrollPos
GetMenuStringW
InternalGetWindowText
GetLayeredWindowAttributes
DrawTextExW
UnregisterHotKey
IsProcessDPIAware
SetThreadDpiAwarenessContext
GetWindowCompositionAttribute
GetWindowProcessHandle
UpdateLayeredWindow
ord2521
DrawIconEx
RegisterHotKey
UnregisterClassW
ord2522
WindowFromDC
GetMenuInfo
SetMenuInfo
GetDpiForSystem
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
CharLowerW
IsCharAlphaNumericW
FillRect
GetUserNameExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
LCIDToLocaleName
VerifyVersionInfoW
PowerCreateRequest
PowerSetRequest
OOBEComplete
CopyFileW
SetTermsrvAppInstallMode
ord292
StopTraceW
EnableTraceEx2
StartTraceW
IsProcessInJob
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrClientCall2
GetStagedPackagePathByFullName2
IsDeveloperModeEnabled
BiPtEnumerateWorkItemsForPackageName
BiPtQueryWorkItem
BiPtAssociateApplicationEntryPoint
BiPtFreeMemory
GetShellWindow
RoCreatePropertySetSerializer
GetErrorInfo
SetErrorInfo
g_trayTriageBlock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ