Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
explorer.exe
Resource
win10-20231020-en
Behavioral task
behavioral2
Sample
explorer.exe
Resource
win10v2004-20231025-en
Target
explorer.exe
Size
4.8MB
MD5
390286bdebdb7f2347c9d17c89566f90
SHA1
5c6b4610ee539698cc1ec3f877381b67add8a822
SHA256
82bac4c586713def95a862bdd2c7e9300cbb54d7fb4553fb118d0824499cc044
SHA512
d8c87e32884737ab372bfea8e4ba999288e7733a9fc8bf377aa673a5f19ec7254c58a205544d33f8f1ebbef408c6cd857161243883b6d737c500a380c944e10d
SSDEEP
49152:ewzquQf8wIWjulew7IG/LBg4YWaG9q97T3BA56GlDiDEmERaDvhHlSS+9ow+96Ny:eRQCfvsEKfIbw8a0sY
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
_Cnd_wait
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?id@?$collate@G@std@@2V0locale@2@A
_Thrd_yield
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?width@ios_base@std@@QEAA_J_J@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
_Mtx_unlock
_Mtx_lock
?_Xout_of_range@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Thrd_detach
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
_set_error_mode
_register_thread_local_exe_atexit_callback
_initterm
_c_exit
_initterm_e
_time64
strncmp
memset
wcsncmp
wcscmp
wcscspn
_o_exit
_o_floor
_o_floorf
_o_fmod
_o_free
_o_iswspace
_o_lround
_o_lroundf
_o_malloc
_o_memcpy_s
_o_pow
_o_realloc
_o_sqrt
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_o__wtoi
_o__invalid_parameter_noinfo_noreturn
_o__wcsnicmp
_o__wcslwr_s
_o__wcsicmp
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o_ceilf
_o__set_new_mode
_o__set_fmode
_o__set_errno
_o__set_app_type
_o__seh_filter_exe
_o__register_onexit_function
_o__recalloc
_o_ceil
_o__purecall
_o__mktime64
_o_abort
_o__ltow_s
_o__get_wide_winmain_command_line
_o__get_errno
_o__localtime64
_o__exit
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o__itow_s
_o__itoa_s
_o___p__commode
wcschr
wcsrchr
wcsstr
__std_terminate
__CxxFrameHandler4
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy
memmove
PicRetrieveFileInfo
PicFreeFileInfo
ord9
OpenJobObjectW
QueryInformationJobObject
AssignProcessToJobObject
SetInformationJobObject
CreateJobObjectW
RegisterApplicationRestart
UrlUnescapeW
PathIsURLW
HashData
WerRegisterCustomMetadata
WerUnregisterCustomMetadata
CheckElevation
CheckElevationEnabled
SHRegGetBoolUSValueW
SHRegGetUSValueW
CoRegisterMessageFilter
CoRevokeInitializeSpy
CoRegisterInitializeSpy
GlobalGetAtomNameW
DeactivateActCtx
ReleaseActCtx
ActivateActCtx
CreateActCtxW
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
NtClose
RtlCaptureContext
NtDeviceIoControlFile
NtOpenFile
RtlAnsiStringToUnicodeString
RtlImageDirectoryEntryToData
ZwUnmapViewOfSection
RtlNtPathNameToDosPathName
RtlUpcaseUnicodeChar
ZwCreateSection
RtlxAnsiStringToUnicodeSize
ZwQueryInformationProcess
RtlpEnsureBufferSize
RtlGetNativeSystemInformation
RtlVerifyVersionInfo
ZwQueryDirectoryFile
ZwSetInformationProcess
RtlInitUnicodeStringEx
ZwMapViewOfSection
RtlFormatCurrentUserKeyPath
ZwEnumerateKey
RtlInitString
ZwOpenFile
ZwQueryInformationFile
LdrResSearchResource
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlInitUnicodeString
NtQueryWnfStateData
NtSetInformationProcess
NtQueryInformationProcess
RtlFlushHeaps
NtSetSystemInformation
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlAppendUnicodeToString
strchr
memmove_s
RtlDosPathNameToNtPathName_U_WithStatus
NtQueryInformationFile
ZwCreateFile
RtlAppendUnicodeStringToString
RtlFreeUnicodeString
ZwEnumerateValueKey
RtlReAllocateHeap
RtlAllocateHeap
RtlFreeHeap
RtlCompareUnicodeString
NtOpenProcessToken
ZwClose
WinSqmAddToStream
WinSqmIsOptedIn
NtQueryInformationToken
NtOpenThreadToken
wcsspn
ZwOpenKey
RtlRunOnceExecuteOnce
ZwQueryValueKey
ZwQuerySystemInformation
RtlCopyUnicodeString
RtlUpcaseUnicodeString
RtlGetVersion
RtlQueryResourcePolicy
RtlNtStatusToDosErrorNoTeb
NtSetThreadExecutionState
NtPowerInformation
VerSetConditionMask
RtlNtStatusToDosError
LoadStringW
LoadResource
GetModuleHandleA
LoadLibraryExW
FreeLibrary
GetModuleFileNameA
GetModuleHandleExW
FindResourceExW
GetModuleHandleW
GetModuleFileNameW
SizeofResource
FindStringOrdinal
GetProcAddress
LockResource
InitOnceBeginInitialize
InitOnceComplete
Sleep
InitOnceExecuteOnce
InitializeCriticalSection
CreateSemaphoreExW
OpenMutexW
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
CreateMutexW
InitializeSRWLock
WaitForMultipleObjectsEx
ReleaseSRWLockShared
ResetEvent
CreateEventExW
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateEventW
SleepEx
EnterCriticalSection
ReleaseSRWLockExclusive
TryEnterCriticalSection
SetEvent
ReleaseMutex
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
OpenEventW
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
HeapAlloc
HeapFree
GetProcessHeap
RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
SetErrorMode
SetUnhandledExceptionFilter
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
CreateFileW
DeleteFileW
GetLongPathNameW
WriteFile
EventRegister
EventActivityIdControl
EventWriteTransfer
EventUnregister
EventEnabled
EventWrite
EventSetInformation
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
SetThreadpoolWait
CreateThreadpoolWork
WaitForThreadpoolWaitCallbacks
SubmitThreadpoolWork
TrySubmitThreadpoolCallback
CloseThreadpoolWait
GetCurrentProcessId
GetCurrentThread
OpenProcessToken
QueueUserAPC
TlsSetValue
TerminateProcess
GetCurrentThreadId
DeleteProcThreadAttributeList
GetCurrentProcess
UpdateProcThreadAttribute
ProcessIdToSessionId
GetThreadPriority
CreateProcessW
SetThreadPriority
InitializeProcThreadAttributeList
TlsAlloc
TlsGetValue
OpenThread
TlsFree
GetProcessId
ResumeThread
GetPriorityClass
SetThreadPriorityBoost
SetPriorityClass
GetStartupInfoW
ExitProcess
OpenThreadToken
GetExitCodeProcess
SetProcessShutdownParameters
CreateThread
GetCalendarInfoW
FormatMessageW
GetLocaleInfoEx
GetThreadUILanguage
GetLocaleInfoW
IsDebuggerPresent
OutputDebugStringW
DebugBreak
CloseHandle
DuplicateHandle
SafeArrayUnaccessData
SafeArrayDestroy
VariantInit
SafeArrayCreate
SysAllocString
SysStringLen
VariantClear
SafeArrayAccessData
VarUI4FromStr
SysAllocStringByteLen
SysFreeString
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
SetCurrentProcessExplicitAppUserModelID
IsOS
CoFreeUnusedLibraries
CoCreateFreeThreadedMarshaler
CoUninitialize
CoGetApartmentType
CoCancelCall
CoDisableCallCancellation
CoEnableCallCancellation
CoWaitForMultipleHandles
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoGetCallContext
CoSetProxyBlanket
StringFromCLSID
CLSIDFromString
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateGuid
CoRegisterClassObject
IIDFromString
StringFromIID
CoRevokeClassObject
CoReleaseMarshalData
CoGetStdMarshalEx
StringFromGUID2
CoGetMalloc
PropVariantClear
CoGetObjectContext
CoTaskMemRealloc
CoTaskMemAlloc
CreateStreamOnHGlobal
StrChrIW
StrCmpNIW
StrToIntW
StrCmpW
QISearch
StrCmpNICW
StrCmpIW
StrCmpICA
StrChrW
StrCmpICW
SHStrDupW
RegLoadMUIStringW
RegDeleteTreeW
RegEnumKeyExW
RegDeleteKeyExW
RegQueryValueExW
RegCreateKeyExW
RegOpenCurrentUser
RegSetValueExW
RegGetValueW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
IUnknown_QueryService
IUnknown_GetSite
IUnknown_SetSite
IUnknown_Set
LocalAlloc
LocalFree
GlobalFree
LocalReAlloc
GlobalAlloc
GetProcessMitigationPolicy
OpenProcess
IsProcessorFeaturePresent
GetDateFormatW
GetTickCount
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
GetWindowsDirectoryW
GetTickCount64
GetVersionExW
GetDateFormatEx
GetTimeFormatEx
SearchPathW
GetCommandLineW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
PathFindExtensionW
PathGetDriveNumberW
PathFileExistsW
PathQuoteSpacesW
PathGetArgsW
PathFindFileNameW
PathRemoveBlanksW
PathCommonPrefixW
SHExpandEnvironmentStringsW
PathCombineW
PathIsFileSpecW
PathRemoveFileSpecW
PathParseIconLocationW
SHDeleteValueW
SHRegGetValueW
SHDeleteKeyW
SHGetValueW
SHSetValueW
SHEnumKeyExW
SHQueryInfoKeyW
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
WindowsCompareStringOrdinal
WindowsSubstringWithSpecifiedLength
WindowsCreateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsDuplicateString
SHGetThreadRef
SetProcessReference
SHSetThreadRef
SHCreateThread
SHCreateThreadRef
LoadLibraryW
FindResourceW
SetKernelObjectSecurity
EqualSid
GetAce
DeleteAce
InitializeAcl
AddAce
FreeSid
AllocateAndInitializeSid
CreateWellKnownSid
CheckTokenMembership
DuplicateToken
MakeAbsoluteSD
GetTokenInformation
CopySid
GetLengthSid
IsValidSid
GetAclInformation
GetSecurityDescriptorDacl
K32GetModuleFileNameExW
K32EnumProcessModules
QueryFullProcessImageNameW
K32EnumProcesses
K32GetModuleBaseNameW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage
UnregisterTraceGuids
GetUserDefaultUILanguage
SHLoadIndirectString
SetThreadDescription
SetProcessInformation
RegSetKeyValueW
RoUninitialize
RoInitialize
RoActivateInstance
RoGetActivationFactory
RoGetAgileReference
RoOriginateError
SetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
PathCchRemoveFileSpec
PathCchCombine
PathCchAppend
PathCchAddExtension
PathAllocCombine
SHAnsiToUnicode
GlobalLock
GlobalUnlock
lstrcmpiW
lstrlenW
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
VirtualFree
VirtualProtect
VirtualAlloc
OpenFileMappingW
CommandLineToArgvW
MulDiv
IStream_Reset
SHOpenRegStream2W
IStream_Write
SHCreateMemStream
SHCreateStreamOnFileEx
SHCreateStreamOnFileW
IStream_Read
GetTempPathW
ord170
CreateTimerQueueTimer
UnregisterWaitEx
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetProductInfo
GetUserDefaultGeoName
DeriveAppContainerSidFromAppContainerName
GetProfileType
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetTimeZoneInformation
GetDynamicTimeZoneInformation
SystemTimeToFileTime
RegisterWaitForSingleObject
GetComputerNameW
GetSystemPowerStatus
QueryPerformanceCounter
InitializeSListHead
InterlockedPushEntrySList
GetPersistedRegistryLocationW
LookupAccountNameW
CharNextW
CharLowerBuffW
NotifyServiceStatusChangeW
QueryServiceConfigW
CreateIoCompletionPort
GetQueuedCompletionStatus
SHRegGetValueFromHKCUHKLM
GetDpiForMonitor
ord244
RaiseFailFastException
CharNextA
CallNtPowerInformation
GetPwrCapabilities
ApiSetQueryApiSetPresence
StrRetToBufW
SHIsChildOrSelf
ord197
ord479
ord292
SHPinDllOfCLSID
ord279
ord165
IUnknown_GetWindow
StrRetToStrW
ord544
PathRemoveArgsW
AssocQueryStringW
ord478
ShellMessageBoxW
ord509
ord635
SHCreateWorkerWindowW
ord481
EnumDisplayMonitors
QueryDisplayConfig
GetSystemMetrics
GetDisplayConfigBufferSizes
SystemParametersInfoW
GetMonitorInfoW
EnumDisplayDevicesW
IntersectRect
InflateRect
OffsetRect
IsRectEmpty
EqualRect
UnionRect
SubtractRect
SetRectEmpty
PtInRect
SetRect
CopyRect
SetWinEventHook
NotifyWinEvent
UnhookWinEvent
SHBindToParent
SHParseDisplayName
SHGetNameFromIDList
SHGetIDListFromObject
ILCloneFirst
ILCombine
ILGetSize
SHCreateItemFromIDList
SHBindToFolderIDListParent
ILIsParent
SHCreateItemFromParsingName
ILRemoveLastID
ILIsEqual
SHBindToObject
ILFindLastID
ILClone
ILFree
DXGIDeclareAdapterRemovalSupport
EnableMouseInPointer
GetPointerType
GetCurrentInputMessageSource
GetPointerDevices
GetPointerInfo
SHGetKnownFolderIDList
SHGetFolderPathEx
GetThreadFlags
SetThreadFlags
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
GetPackageFullName
GetPackagesByPackageFamily
SetWindowFeedbackSetting
RegisterClipboardFormatW
DragQueryFileW
GetWindowBand
CreateWindowInBand
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
SHChangeNotifyRegister
SHHandleUpdateImage
SHChangeNotifyDeregister
SHChangeNotifyRegisterThread
SHChangeNotification_Unlock
SHChangeNotification_Lock
PropVariantToBoolean
PSCreateMemoryPropertyStore
PSGetPropertyFromPropertyStorage
InitVariantFromGUIDAsString
InitVariantFromResource
PSPropertyBag_WriteStr
PropVariantToStringAlloc
PropVariantToUInt32
PSPropertyBag_WriteDWORD
SHChangeNotify
SHCreateDataObject
ParseApplicationUserModelId
FindPackagesByPackageFamily
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
SetTextAlign
GetTextMetricsW
ExtTextOutW
GetTextExtentPoint32W
CreateRectRgnIndirect
GetGlyphOutlineW
GetOutlineTextMetricsW
GetClipRgn
SelectClipRgn
CreateFontIndirectW
SelectObject
CreateCompatibleDC
DeleteDC
GetObjectW
DeleteObject
CombineRgn
OffsetRgn
SetRectRgn
CreateRectRgn
GetStockObject
GetDeviceCaps
SetTextColor
GetCurrentObject
GetClipBox
Rectangle
SetStretchBltMode
ExcludeClipRect
StretchBlt
HeapDestroy
HeapReAlloc
HeapSize
GetModuleHandleExA
IsBadWritePtr
RtlCompareMemory
InternetCrackUrlW
ord142
ord200
ord184
ord186
ord187
ord123
ord190
ord191
ord121
ord174
ord109
ord126
ord213
ord183
ord210
ord192
ord1
SHUnicodeToAnsi
ord141
ord162
ord60
SHUpdateRecycleBinIcon
ord711
SHFileOperationW
SHGetPathFromIDListW
ord753
ord733
ord67
SHCreateItemInKnownFolder
ord206
ord201
ord188
ord896
ShellExecuteExW
ord245
ord61
ord89
ord190
ord85
ord100
SHAddToRecentDocs
SHEnableServiceObject
ord54
ord254
DuplicateIcon
SHGetStockIconInfo
ord6
Shell_NotifyIconGetRect
Shell_NotifyIconW
ord137
ord132
ord244
SHEvaluateSystemCommandTemplate
ord866
ord764
SHGetPropertyStoreForWindow
SHGetLocalizedName
ShellExecuteW
ord895
ord906
ord894
SHAppBarMessage
ord162
ord727
ord792
ord790
Shell_GetCachedImageIndexW
ord899
ord43
ord134
ord172
ord680
ord723
ord22
ord907
ord885
ord95
ord850
ord743
ord200
ord91
ExtractIconExW
ord181
AssocCreate
ord164
PathIsDirectoryW
ord413
ord548
ord163
ord467
AssocQueryKeyW
ChrCmpIW
PathIsRelativeW
IsAppThemed
IsCompositionActive
DrawThemeTextEx
IsThemePartDefined
GetThemeFont
GetThemeBackgroundExtent
GetThemeBool
OpenThemeData
OpenThemeDataForDpi
GetThemeMargins
ord138
BufferedPaintSetAlpha
ord126
GetThemePartSize
IsThemeActive
GetBufferedPaintBits
GetThemeInt
GetThemeColor
GetThemeMetric
SetWindowTheme
GetWindowTheme
BufferedPaintUnInit
EndBufferedPaint
BeginBufferedPaint
BufferedPaintInit
CloseThemeData
DrawThemeParentBackground
DrawThemeBackground
ord86
ord114
ord113
DwmRegisterThumbnail
DwmSetWindowAttribute
ord139
ord138
ord141
ord140
DwmGetWindowAttribute
ord159
DwmQueryThumbnailSourceSize
ord124
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
DwmEnableBlurBehindWindow
DwmIsCompositionEnabled
SetScrollInfo
GetMenuState
IsTopLevelWindow
EndTask
GhostWindowFromHungWindow
ord2573
BringWindowToTop
InsertMenuW
ShowWindowAsync
GetCursorInfo
SetScrollPos
GetMenuStringW
InternalGetWindowText
GetLayeredWindowAttributes
GetPhysicalCursorPos
GetClassLongW
DrawTextExW
IsProcessDPIAware
SetThreadDpiAwarenessContext
GetWindowCompositionAttribute
GetWindowProcessHandle
GetClassLongPtrW
UpdateLayeredWindow
ord2521
UnregisterClassW
ord2522
GetClassWord
WindowFromDC
GetMenuInfo
SetMenuInfo
GetDpiForSystem
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
CharLowerW
IsCharAlphaNumericW
GetIconInfo
GetLastActivePopup
GetIconInfoExW
SetLayeredWindowAttributes
GetSysColorBrush
GetSystemMenu
GetAsyncKeyState
UnregisterHotKey
RegisterHotKey
SendDlgItemMessageW
EndDialog
ReplyMessage
MonitorFromPoint
GetMenuItemInfoW
GetMenuItemCount
ExitWindowsEx
CreateIconIndirect
GetSubMenu
LoadMenuW
GetKeyState
DrawTextW
FillRect
DeleteMenu
TrackPopupMenuEx
SetMenuDefaultItem
RemoveMenu
EnableMenuItem
CheckMenuItem
LoadImageW
SetGestureConfig
AdjustWindowRectEx
GetDC
ReleaseDC
CreatePopupMenu
IsIconic
LoadIconW
GetSystemMetricsForDpi
ord2005
HungWindowFromGhostWindow
CascadeWindows
TileWindows
LockWorkStation
InjectMouseInput
MapVirtualKeyExW
TrackMouseEvent
SetCapture
GetCapture
InjectKeyboardInput
GetCaretBlinkTime
ReleaseCapture
GetSysColor
CopyImage
GetDoubleClickTime
CalculatePopupWindowPosition
CopyIcon
GetLastInputInfo
GetCursorFrameInfo
AdjustWindowRect
GetMenuDefaultItem
DestroyMenu
SendInput
SetDesktopColorTransform
UnregisterClassA
LoadCursorW
SetCursor
SetMenuItemInfoW
MonitorFromWindow
DefWindowProcA
IsWindowUnicode
LoadAcceleratorsW
ChangeWindowMessageFilterEx
TranslateAcceleratorW
ord2611
GetDpiForWindow
MonitorFromRect
GetGuiResources
GetScrollInfo
ord2574
IsHungAppWindow
ModifyMenuW
SetWindowCompositionAttribute
DestroyIcon
DrawIconEx
SwitchToThisWindow
GetUserNameExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
LCIDToLocaleName
VerifyVersionInfoW
PowerSetRequest
PowerCreateRequest
OOBEComplete
CopyFileW
SetTermsrvAppInstallMode
ord292
EnableTraceEx2
StopTraceW
StartTraceW
IsProcessInJob
RpcBindingFree
NdrClientCall3
RpcStringFreeW
RpcBindingSetAuthInfoExW
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcBindingFromStringBindingW
GetStagedPackagePathByFullName2
BiPtQueryWorkItem
BiPtEnumerateWorkItemsForPackageName
BiPtFreeMemory
BiPtAssociateApplicationEntryPoint
GetShellWindow
RoCreatePropertySetSerializer
GetErrorInfo
SetErrorInfo
g_trayTriageBlock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ