Static task
static1
Behavioral task
behavioral1
Sample
shell32.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Target
shell32.dll
Size
7.3MB
MD5
521917d09b8cb502c36d11278feafffa
SHA1
80d6b654528e29047d803db21b18a0c93698ec78
SHA256
8de17914fe3d3af4e550ad92ee46ba8a7f1175f8743bc2fdcc1a348d49e93693
SHA512
212a90471483a91190f476309e6830ca68ff51b3b09ca0cf4afc2704e975dca218a4e18f25e849ff97b79d51f3708b03db9c546f8f65835882f38c33cb8c6540
SSDEEP
49152:6PMMo7DNYBxN3XCnrNtDmXsDhc6goC+prwYOtF804uwEVk1cNaA1yH0s6CPJ23PS:mo7XNddktOe5fw6zmSYIebmqbv5ke
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?width@ios_base@std@@QEBA_JXZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?flags@ios_base@std@@QEBAHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?_Xbad_function_call@std@@YAXXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?width@ios_base@std@@QEAA_J_J@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?_Xlength_error@std@@YAXPEBD@Z
?tellp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
memset
wcsspn
wcspbrk
wcscmp
wcscspn
wcsncmp
_initterm_e
_initterm
_o_pow
_o_qsort
_o_rand
_o_realloc
_o_sqrt
_o_srand
_o_strncpy_s
_o_terminate
_o_toupper
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstol
_o_wcstoul
strchr
wcsrchr
__CxxFrameHandler3
_o_malloc
memmove
_o__ui64tow_s
_o_log
_o_iswspace
_o__strnicmp
_o_isdigit
_o_isalpha
_o__set_errno
_o__seh_filter_dll
_o__resetstkoflw
_o__register_onexit_function
_o_free
_o_floor
_o__purecall
_o_ceil
_o_calloc
_o_bsearch
_o__wtoi
_o__wcsupr
_o__wcstoui64
_o__wcsnicmp
_o__wcsicmp
_o__itow
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__get_errno
_o__execute_onexit_table
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
wcschr
wcsstr
__C_specific_handler
_CxxThrowException
memcmp
memcpy
LocalFree
GlobalAlloc
LocalReAlloc
GlobalFree
LocalAlloc
RegGetValueW
RegDeleteValueW
RegQueryInfoKeyA
RegEnumKeyExW
RegEnumValueW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegNotifyChangeKeyValue
RegDeleteKeyExW
RegGetKeySecurity
RegDeleteTreeW
RegCreateKeyExW
RegOpenCurrentUser
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegCloseKey
LoadResource
EnumResourceNamesExW
FindResourceExW
FreeLibrary
LoadStringW
FindStringOrdinal
LoadLibraryExA
LoadStringA
GetModuleFileNameA
GetModuleHandleW
SizeofResource
GetModuleFileNameW
LoadLibraryExW
FreeResource
GetModuleHandleExW
GetProcAddress
DisableThreadLibraryCalls
LockResource
GetVersionExW
GetTickCount
GetSystemWindowsDirectoryW
GetWindowsDirectoryW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GlobalMemoryStatusEx
GetTickCount64
GetComputerNameExW
GetLocalTime
GetSystemTime
VirtualQuery
VirtualProtect
ReadProcessMemory
OpenFileMappingW
VirtualFree
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
VirtualAlloc
WriteProcessMemory
FindFirstFileW
FileTimeToLocalFileTime
GetFileAttributesExW
CompareFileTime
SetFileTime
GetVolumeInformationW
GetFinalPathNameByHandleW
GetLogicalDrives
CreateDirectoryW
SetFilePointer
GetDiskFreeSpaceW
GetDriveTypeW
GetDiskFreeSpaceExW
GetVolumePathNameW
ReadFile
GetFileSize
GetLongPathNameW
GetShortPathNameW
GetTempFileNameW
GetFullPathNameW
FindFirstFileExW
GetFileInformationByHandle
DefineDosDeviceW
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
WriteFile
SetFilePointerEx
FlushFileBuffers
SetFileInformationByHandle
RemoveDirectoryW
SetFileAttributesW
DeleteFileW
GetFileAttributesW
QueryDosDeviceW
LocalFileTimeToFileTime
SetEndOfFile
FindNextFileW
GetFileSizeEx
CreateFileW
FindClose
CloseHandle
DuplicateHandle
LoadLibraryW
FindResourceW
GetStringTypeExW
CompareStringOrdinal
CompareStringEx
CompareStringW
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
TryAcquireSRWLockShared
CreateMutexW
WaitForSingleObject
WaitForMultipleObjectsEx
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
InitializeSRWLock
ReleaseSemaphore
LeaveCriticalSection
CreateMutexExW
ReleaseMutex
OpenEventW
OpenMutexW
TryEnterCriticalSection
ReleaseSRWLockExclusive
OpenSemaphoreW
CreateEventW
ReleaseSRWLockShared
SetEvent
InitializeCriticalSectionEx
SetWaitableTimer
CreateWaitableTimerExW
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
ResetEvent
AcquireSRWLockShared
CreateEventExW
CreateSemaphoreExW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetErrorMode
SetLastError
GetLastError
ResumeThread
GetThreadId
GetExitCodeThread
SetPriorityClass
OpenProcessToken
GetExitCodeProcess
CreateProcessAsUserW
GetCurrentThreadId
CreateProcessW
GetCurrentProcessId
OpenThread
GetThreadPriority
SetThreadPriority
CreateThread
TlsGetValue
TlsSetValue
TlsFree
GetCurrentProcess
TlsAlloc
SetThreadToken
OpenThreadToken
GetCurrentThread
ProcessIdToSessionId
ExitProcess
GetProcessId
TerminateProcess
CharLowerBuffW
IsCharAlphaW
CharNextW
CharPrevW
CharLowerW
CharUpperW
CharUpperBuffW
CreateHardLinkW
MoveFileExW
CopyFile2
ReadDirectoryChangesW
ReplaceFileW
GetFileInformationByHandleEx
SearchPathW
SetEnvironmentVariableW
GetEnvironmentVariableW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetCommandLineW
ExpandEnvironmentStringsW
ExpandEnvironmentStringsA
FreeSid
AllocateAndInitializeSid
AddAccessDeniedAceEx
DeleteAce
AddAccessAllowedAceEx
AddAce
GetAce
GetAclInformation
CopySid
GetLengthSid
IsValidSid
AdjustTokenPrivileges
DuplicateTokenEx
GetSecurityDescriptorOwner
ImpersonateSelf
RevertToSelf
IsWellKnownSid
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSidIdentifierAuthority
SetSecurityDescriptorOwner
SetTokenInformation
SetFileSecurityW
AccessCheck
GetSecurityDescriptorControl
GetSidSubAuthority
GetTokenInformation
EqualSid
CreateWellKnownSid
CheckTokenMembership
GetFileSecurityW
InitializeSid
GetSidLengthRequired
InitializeAcl
DuplicateToken
GetSidSubAuthorityCount
Sleep
InitOnceComplete
InitOnceBeginInitialize
InitOnceExecuteOnce
HeapReAlloc
HeapFree
HeapDestroy
HeapAlloc
GetProcessHeap
EncodePointer
DecodePointer
SubmitThreadpoolWork
CreateThreadpoolWork
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolWait
CloseThreadpoolWork
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
CreateThreadpoolWait
SetThreadpoolTimer
GetUserDefaultLCID
FormatMessageW
GetCPInfo
GetThreadUILanguage
FindNLSString
LCMapStringW
LocaleNameToLCID
IsDBCSLeadByte
VerLanguageNameW
GetUserDefaultLangID
LCMapStringEx
GetUserPreferredUILanguages
IsValidLocaleName
GetACP
GetLocaleInfoW
GetThreadLocale
GetSystemPreferredUILanguages
GetSystemDefaultLCID
GetSystemDefaultLangID
FindNLSStringEx
ResolveLocaleName
IsDebuggerPresent
DebugBreak
OutputDebugStringW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformationForYear
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
IsProcessorFeaturePresent
FlushInstructionCache
OpenProcess
QueryFullProcessImageNameW
K32GetProcessImageFileNameW
PathCchAddExtension
PathCchSkipRoot
PathCchRemoveBackslash
PathCchCombineEx
PathCchAddBackslashEx
PathCchAddBackslash
PathCchAppend
PathCchAppendEx
PathCchCanonicalize
PathCchStripToRoot
PathCchCombine
PathCchRemoveFileSpec
PathIsUNCEx
PathCchRemoveExtension
PathCchRenameExtension
PathCchStripPrefix
PathAllocCanonicalize
PathAllocCombine
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
GetTempPathW
GetQueuedCompletionStatus
GetOverlappedResult
CreateIoCompletionPort
CancelIoEx
DeviceIoControl
GetDateFormatW
QueryPerformanceFrequency
QueryPerformanceCounter
RegDeleteKeyValueW
RegSetKeyValueW
SHLoadIndirectString
GetProductInfo
CopyFileW
GetCompressedFileSizeW
Wow64SetThreadDefaultGuestMachine
GetSystemWow64DirectoryW
IsWow64Process2
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
LCIDToLocaleName
WaitForMultipleObjects
QueryUnbiasedInterruptTime
GetNumberFormatEx
CancelSynchronousIo
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
GetIntegratedDisplaySize
PrefetchVirtualMemory
EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
EventProviderEnabled
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceEnableFlags
InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSListHead
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
StrPBrkW
StrCmpNCW
StrCpyNXW
StrCSpnW
StrCmpLogicalW
StrChrA
StrCmpNICW
StrCmpW
StrDupA
StrTrimW
StrDupW
StrToIntA
StrCmpIW
StrCmpICA
QISearch
StrChrIA
StrSpnW
StrChrIW
StrChrW
StrCmpNA
StrCmpCW
StrToIntW
StrCmpNIA
StrCmpICW
StrStrW
StrStrIW
StrStrIA
StrStrA
StrRStrIW
StrRStrIA
StrRChrW
StrRChrIW
StrRChrIA
StrRChrA
StrCmpNW
StrCmpNIW
StrToIntExW
lstrlenW
lstrcmpA
lstrcmpW
lstrcmpiW
lstrlenA
lstrcmpiA
CharNextA
CharPrevA
GlobalLock
LocalSize
GlobalSize
GlobalFlags
GlobalReAlloc
GlobalUnlock
GetNumberFormatW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
EnumUILanguagesW
GetPrivateProfileStringW
GetPrivateProfileSectionW
GetProfileSectionW
WritePrivateProfileStringW
GetAtomNameW
GlobalGetAtomNameW
FindAtomW
GlobalAddAtomW
GlobalDeleteAtom
PathIsRootA
PathRemoveFileSpecA
PathRemoveBackslashW
PathGetCharTypeW
PathIsFileSpecW
PathIsValidCharW
PathStripPathW
PathGetArgsW
PathRemoveBlanksW
PathMatchSpecExW
PathCommonPrefixW
PathIsPrefixW
PathFindNextComponentW
PathIsRelativeW
PathIsRootW
PathStripToRootW
PathMatchSpecW
PathRemoveFileSpecW
PathFileExistsW
PathSkipRootW
PathGetDriveNumberW
PathAppendW
PathIsUNCW
PathQuoteSpacesW
PathFindFileNameW
PathRemoveExtensionW
PathParseIconLocationW
PathUnExpandEnvStringsW
PathUnquoteSpacesW
PathIsUNCServerShareW
PathIsUNCServerW
PathFindExtensionW
SHExpandEnvironmentStringsW
SHExpandEnvironmentStringsA
IsCharSpaceW
PathAppendA
PathAddBackslashW
PathCombineW
PathIsSameRootW
GetSystemPowerStatus
SetVolumeLabelW
MulDiv
GetShortPathNameA
UnregisterWait
WTSGetActiveConsoleSessionId
RegisterWaitForSingleObject
GetComputerNameW
PowerSetRequest
PowerClearRequest
PowerCreateRequest
UnregisterWaitEx
DeleteTimerQueueTimer
CreateTimerQueueTimer
QueueUserWorkItem
GetBinaryTypeW
HashData
UrlGetPartW
PathCreateFromUrlAlloc
UrlUnescapeA
UrlEscapeW
UrlFixupW
UrlCanonicalizeW
UrlUnescapeW
UrlCreateFromPathW
ParseURLW
PathCreateFromUrlW
UrlIsW
PathIsURLW
UrlApplySchemeW
UrlCompareW
SHRegOpenUSKeyW
SHRegQueryUSValueW
SHRegGetBoolUSValueW
SHRegOpenUSKeyA
SHRegGetUSValueW
SHRegEnumUSKeyW
SHRegCloseUSKey
CheckElevationEnabled
CheckElevation
ApiSetQueryApiSetPresence
ReleaseActCtx
DeactivateActCtx
CreateActCtxW
QueryActCtxW
ActivateActCtx
SHCoCreateInstance
GetPackageFullName
GetPackagesByPackageFamily
GetCurrentPackageInfo
OpenStateExplicit
GetStateFolder
CloseState
ExtensionProgIdExists
GetExtensionProgIds
ParseApplicationUserModelId
PackageNameAndPublisherIdFromFamilyName
GetEffectivePackageStatusForUser
NotifyRedirectedStringChange
GetStagedPackagePathByFullName2
IsMrtResourceRedirectionEnabled
OpenPackageInfoByFullName
GetPackageInfo
ClosePackageInfo
GetSystemAppDataKey
OpenState
GetMenuInfo
IsWinEventHookInstalled
UnhookWinEvent
SetWinEventHook
SetShellWindow
SystemParametersInfoForDpi
DisplayConfigGetDeviceInfo
SetSysColors
wsprintfW
UnpackDDElParam
DdeInitializeW
DdeUninitialize
DdeNameService
DdeDisconnect
DdeQueryStringW
DdeFreeStringHandle
DdeCreateStringHandleW
DdeCreateDataHandle
DdeGetLastError
DdeGetData
DdeQueryConvInfo
WaitMessage
LockWindowUpdate
ord2707
EnumDisplaySettingsW
GetClassLongPtrW
SetShellWindowEx
EnumDisplayMonitors
CreateAcceleratorTableW
GetMessageTime
LoadBitmapW
CheckRadioButton
GetDlgItemInt
SetDlgItemInt
ClientToScreen
IsRectEmpty
SetParent
WindowFromPoint
GetSystemMenu
PostThreadMessageW
SetDialogDpiChangeBehavior
IsDialogMessageW
SetCapture
ReleaseCapture
GetCapture
TrackPopupMenuEx
MonitorFromRect
GetClassInfoExW
SetMenuInfo
SetCoalescableTimer
CallNextHookEx
CallWindowProcW
SetScrollPos
ord2705
ShowScrollBar
SetScrollInfo
SetWindowRgn
SetWindowsHookExW
UnhookWindowsHookEx
GetDialogBaseUnits
GetLastInputInfo
SystemParametersInfoA
WinHelpW
CreateWindowExW
FindWindowExW
RegisterWindowMessageA
DrawTextExW
ActivateKeyboardLayout
AdjustWindowRectExForDpi
SubtractRect
CreateWindowIndirect
SetLayeredWindowAttributes
GetWindowDC
GetPointerDevices
SetRectEmpty
DialogBoxParamW
GetDpiForWindow
BroadcastSystemMessageW
SetThreadDpiAwarenessContext
EnumChildWindows
CloseClipboard
SetClipboardData
GetClipboardData
OpenClipboard
EnumPropsExW
RedrawWindow
IsWindowEnabled
CloseDesktop
OpenInputDesktop
CreateWindowInBand
GetDpiForSystem
GetSystemMetricsForDpi
EndDeferWindowPos
BeginDeferWindowPos
AdjustWindowRect
GetDlgCtrlID
SetDlgItemTextA
SetShellChangeNotifyWindow
GetShellChangeNotifyWindow
GetShellWindow
RegisterDeviceNotificationW
RegisterPowerSettingNotification
SendMessageCallbackW
MessageBoxW
DeferWindowPos
CopyAcceleratorTableW
MoveWindow
AttachThreadInput
DefWindowProcA
IsWindowUnicode
RegisterShellHookWindow
DeregisterShellHookWindow
SetTaskmanWindow
GetTaskmanWindow
GetClassInfoW
GetWindowTextLengthW
CopyImage
MapDialogRect
SetActiveWindow
GetWindowBand
DrawIconEx
IsProcessDPIAware
GetProcessDefaultLayout
AllowSetForegroundWindow
IsSETEnabled
EqualRect
IntersectRect
MonitorFromWindow
GetAsyncKeyState
ord2521
UpdateLayeredWindow
IsChild
UnionRect
EnumDisplayDevicesW
SetWindowCompositionAttribute
RegisterClassExW
GetScrollInfo
GetDisplayConfigBufferSizes
IsIconic
CopyIcon
GetPropW
RemovePropW
SetPropW
DrawTextW
IsMenu
ModifyMenuW
GetMenuState
CountClipboardFormats
IsHungAppWindow
GetClipboardOwner
GetWindowPlacement
MsgWaitForMultipleObjects
ExitWindowsEx
LoadImageW
SetRect
CopyRect
GetMonitorInfoW
MonitorFromPoint
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
ChangeWindowMessageFilterEx
RegisterWindowMessageW
GetMessagePos
GetKeyboardLayout
OffsetRect
SetClipboardViewer
TranslateAcceleratorW
CreateMenu
InsertMenuW
EndMenu
DestroyAcceleratorTable
GetMessageExtraInfo
SetGestureConfig
CloseGestureInfoHandle
GetGestureInfo
ChangeClipboardChain
MapWindowPoints
GetMenuItemID
EnableMenuItem
InsertMenuItemW
GetFocus
CheckMenuItem
CheckMenuRadioItem
AppendMenuW
GetDoubleClickTime
MessageBeep
TrackPopupMenu
SetMessageExtraInfo
SetMenuDefaultItem
SetMenuItemInfoW
LoadAcceleratorsW
PtInRect
GetMenuStringW
GetDesktopWindow
GetForegroundWindow
ReleaseDC
GetDC
NotifyWinEvent
SendNotifyMessageW
SystemParametersInfoW
GetMenuItemInfoW
GetMenuItemCount
EnumWindows
IsWindow
WaitForInputIdle
GetWindowThreadProcessId
GetMenuDefaultItem
GetLastActivePopup
SwitchToThisWindow
GetCursorPos
RegisterClipboardFormatW
GetWindow
FindWindowW
GetClassNameW
GetAncestor
EnableWindow
MsgWaitForMultipleObjectsEx
PeekMessageW
PostQuitMessage
SetForegroundWindow
ShutdownBlockReasonDestroy
ShutdownBlockReasonCreate
LoadMenuW
GetSubMenu
RemoveMenu
GetParent
IsDlgButtonChecked
CheckDlgButton
DeleteMenu
DestroyMenu
CreatePopupMenu
PostMessageW
SetProcessDPIAware
DispatchMessageW
TranslateMessage
GetMessageW
SetFocus
IsWindowVisible
DrawEdge
GetSysColorBrush
FillRect
EndPaint
BeginPaint
GetUpdateRect
TrackMouseEvent
UpdateWindow
GetWindowRect
DefWindowProcW
RegisterClassW
KillTimer
SetTimer
GetKeyState
InflateRect
AdjustWindowRectEx
DestroyWindow
SetWindowLongW
GetWindowLongW
DrawFocusRect
DrawIcon
GetSysColor
EndDialog
GetWindowLongPtrW
SetWindowLongPtrW
GetWindowTextW
SetWindowPos
GetClientRect
ShowWindow
SetWindowTextW
GetDlgItem
InvalidateRect
LoadCursorW
SetCursor
SetDlgItemTextW
GetDlgItemTextW
SendDlgItemMessageW
ScreenToClient
SendMessageW
LookupIconIdFromDirectory
CreateIconIndirect
GetIconInfo
DestroyIcon
PrivateExtractIconsW
LoadIconW
GetSystemMetrics
EmptyClipboard
QueryDisplayConfig
GetClassLongW
CreateDialogParamW
ChildWindowFromPoint
SetMenu
LockSetForegroundWindow
ShowCaret
HideCaret
GetCursor
AnimateWindow
SendMessageTimeoutW
UnregisterPowerSettingNotification
GetCurrentInputMessageSource
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
UnregisterDeviceNotification
RtlAreLongPathsEnabled
RtlQueryResourcePolicy
EtwEventWriteTransfer
RtlInitUnicodeString
RtlPrefixString
NtQueryInformationFile
RtlNtStatusToDosError
NtCreateFile
NtClose
NtFsControlFile
RtlUnicodeStringToOemString
NtSetInformationFile
NtOpenFile
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeHeap
NtQueryVolumeInformationFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
RtlReleaseRelativeName
RtlFreeUnicodeString
RtlGetLastNtStatus
RtlInitializeResource
RtlAcquireResourceExclusive
RtlReleaseResource
RtlDeleteResource
RtlInitUnicodeStringEx
RtlQueryEnvironmentVariable_U
RtlSetEnvironmentVariable
RtlExpandEnvironmentStrings_U
RtlCreateEnvironment
RtlSetCurrentEnvironment
RtlDestroyEnvironment
EtwEventUnregister
EtwEventRegister
EtwEventSetInformation
EtwEventActivityIdControl
EtwEventEnabled
EtwEventWrite
EtwTraceMessage
WinSqmAddToStream
WinSqmIncrementDWORD
WinSqmSetDWORD
RtlMapGenericMask
NtGetCachedSigningLevel
NtCompareSigningLevels
NtSetCachedSigningLevel
WinSqmAddToStreamEx
RtlGetDeviceFamilyInfoEnum
RtlDllShutdownInProgress
NtQueryInformationToken
NtOpenProcessToken
RtlDosPathNameToRelativeNtPathName_U
NtQueryAttributesFile
NtQueryInformationProcess
NtPowerInformation
EtwGetTraceLoggerHandle
RtlFlushHeaps
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
RtlGetNtProductType
RtlLengthRequiredSid
RtlCreateServiceSid
NtQueryWnfStateData
RtlPublishWnfStateData
RtlCreateUnicodeString
RtlRandomEx
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
ZwQueryWnfStateData
ShipAssert
NtOpenThreadToken
EtwLogTraceEvent
NtQuerySystemInformationEx
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
NtQueryInformationThread
RtlAllocateHeap
NtSetInformationToken
RtlQueryWnfStateData
RtlGetNtSystemRoot
RtlQueryRegistryValuesEx
RtlCheckRegistryKey
NtQuerySystemInformation
NtQueryObject
RtlIsPartialPlaceholder
NtQueryKey
NtSetSecurityObject
NtQuerySecurityObject
RtlDosPathNameToNtPathName_U
RtlIsNonEmptyDirectoryReparsePointAllowed
DeleteObject
SetBkColor
GetLayout
SetLayout
GetStockObject
SetBkMode
SelectObject
SetTextColor
GetDeviceCaps
ExcludeClipRect
ExtTextOutW
SetDIBits
GetWindowOrgEx
GetRegionData
GetObjectType
GetDIBColorTable
GetRgnBox
CombineRgn
SaveDC
RestoreDC
CreateRectRgnIndirect
SetDCBrushColor
PlgBlt
ExtSelectClipRgn
GetViewportOrgEx
DeleteMetaFile
PlayMetaFile
SetMetaFileBitsEx
LPtoDP
SelectClipRgn
IntersectClipRect
GetClipRgn
CreateRectRgn
GetClipBox
StretchDIBits
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetMapMode
GetTextAlign
TextOutA
GetTextExtentPoint32A
CreateFontW
GetPixel
CreateSolidBrush
OffsetWindowOrgEx
SetWindowOrgEx
GetObjectW
GetTextExtentPointW
CreateDIBSection
CreateCompatibleDC
DeleteDC
CreateDCW
GdiAlphaBlend
BitBlt
CreateCompatibleBitmap
CreateBitmap
GetDIBits
StretchBlt
GdiTransparentBlt
GetTextColor
GetCurrentObject
CreateFontIndirectW
CreatePen
Rectangle
GetTextMetricsW
GetTextExtentPoint32W
SetTextAlign
SetStretchBltMode
PatBlt
MoveToEx
LineTo
CreatePolygonRgn
GetPersistedRegistryLocationW
AssignProcessToJobObject
SetInformationJobObject
CreateJobObjectW
_time64
ResolveDelayLoadedAPI
DelayLoadFailureHook
ceilf
logf
expf
floorf
sqrtf
AppCompat_RunDLLW
AssocCreateForClasses
AssocElemCreateForKey
AssocGetDetailsOfPropKey
CDefFolderMenu_Create2
CIDLData_CreateFromIDArray
CStorageItem_GetValidatedStorageItemObject
CallFileCopyHook
CheckEscapesW
CommandLineToArgvW
Control_RunDLL
Control_RunDLLA
Control_RunDLLAsUserW
Control_RunDLLW
CreateStorageItemFromPath_FullTrustCaller
CreateStorageItemFromPath_FullTrustCaller_ForPackage
CreateStorageItemFromPath_PartialTrustCaller
CreateStorageItemFromShellItem_FullTrustCaller
CreateStorageItemFromShellItem_FullTrustCaller_ForPackage
CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandle
CreateStorageItemFromShellItem_FullTrustCaller_UseImplicitFlagsAndPackage
DAD_AutoScroll
DAD_DragEnterEx
DAD_DragEnterEx2
DAD_DragLeave
DAD_DragMove
DAD_SetDragImage
DAD_ShowDragImage
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllGetVersion
DllInstall
DllRegisterServer
DllUnregisterServer
DoEnvironmentSubstA
DoEnvironmentSubstW
DragAcceptFiles
DragFinish
DragQueryFile
DragQueryFileA
DragQueryFileAorW
DragQueryFileW
DragQueryPoint
DriveType
DuplicateIcon
ExtractAssociatedIconA
ExtractAssociatedIconExA
ExtractAssociatedIconExW
ExtractAssociatedIconW
ExtractIconA
ExtractIconEx
ExtractIconExA
ExtractIconExW
ExtractIconW
FindExecutableA
FindExecutableW
FreeIconList
GetCurrentProcessExplicitAppUserModelID
GetFileNameFromBrowse
GetSystemPersistedStorageItemList
ILAppendID
ILClone
ILCloneFirst
ILCombine
ILCreateFromPath
ILCreateFromPathA
ILCreateFromPathW
ILFindChild
ILFindLastID
ILFree
ILGetNext
ILGetSize
ILIsEqual
ILIsParent
ILLoadFromStreamEx
ILRemoveLastID
ILSaveToStream
InitNetworkAddressControl
InternalExtractIconListA
InternalExtractIconListW
IsDesktopExplorerProcess
IsLFNDrive
IsLFNDriveA
IsLFNDriveW
IsNetDrive
IsProcessAnExplorer
IsUserAnAdmin
LaunchMSHelp_RunDLLW
OpenAs_RunDLL
OpenAs_RunDLLA
OpenAs_RunDLLW
OpenRegStream
Options_RunDLL
Options_RunDLLA
Options_RunDLLW
PathCleanupSpec
PathGetShortPath
PathIsExe
PathIsSlowA
PathIsSlowW
PathMakeUniqueName
PathQualify
PathResolve
PathYetAnotherMakeUniqueName
PickIconDlg
PifMgr_CloseProperties
PifMgr_GetProperties
PifMgr_OpenProperties
PifMgr_SetProperties
PrepareDiscForBurnRunDllW
PrintersGetCommand_RunDLL
PrintersGetCommand_RunDLLA
PrintersGetCommand_RunDLLW
ReadCabinetState
RealDriveType
RealShellExecuteA
RealShellExecuteExA
RealShellExecuteExW
RealShellExecuteW
RegenerateUserEnvironment
RestartDialog
RestartDialogEx
RunAsNewUser_RunDLLW
SHAddDefaultPropertiesByExt
SHAddFromPropSheetExtArray
SHAddToRecentDocs
SHAlloc
SHAppBarMessage
SHAssocEnumHandlers
SHAssocEnumHandlersForProtocolByApplication
SHBindToFolderIDListParent
SHBindToFolderIDListParentEx
SHBindToObject
SHBindToParent
SHBrowseForFolder
SHBrowseForFolderA
SHBrowseForFolderW
SHCLSIDFromString
SHChangeNotification_Lock
SHChangeNotification_Unlock
SHChangeNotify
SHChangeNotifyDeregister
SHChangeNotifyRegister
SHChangeNotifyRegisterThread
SHChangeNotifySuspendResume
SHCloneSpecialIDList
SHCoCreateInstance
SHCoCreateInstanceWorker
SHCreateAssociationRegistration
SHCreateCategoryEnum
SHCreateDataObject
SHCreateDefaultContextMenu
SHCreateDefaultExtractIcon
SHCreateDefaultPropertiesOp
SHCreateDirectory
SHCreateDirectoryExA
SHCreateDirectoryExW
SHCreateDrvExtIcon
SHCreateFileExtractIconW
SHCreateItemFromIDList
SHCreateItemFromParsingName
SHCreateItemFromRelativeName
SHCreateItemInKnownFolder
SHCreateItemWithParent
SHCreateLocalServerRunDll
SHCreateProcessAsUserW
SHCreatePropSheetExtArray
SHCreateQueryCancelAutoPlayMoniker
SHCreateShellFolderView
SHCreateShellFolderViewEx
SHCreateShellItem
SHCreateShellItemArray
SHCreateShellItemArrayFromDataObject
SHCreateShellItemArrayFromIDLists
SHCreateShellItemArrayFromShellItem
SHCreateStdEnumFmtEtc
SHDefExtractIconA
SHDefExtractIconW
SHDestroyPropSheetExtArray
SHDoDragDrop
SHELL32_AddToBackIconTable
SHELL32_AddToFrontIconTable
SHELL32_AreAllItemsAvailable
SHELL32_CCommonPlacesFolder_CreateInstance
SHELL32_CDBurn_CloseSession
SHELL32_CDBurn_DriveSupportedForDataBurn
SHELL32_CDBurn_Erase
SHELL32_CDBurn_GetCDInfo
SHELL32_CDBurn_GetLiveFSDiscInfo
SHELL32_CDBurn_GetStagingPathOrNormalPath
SHELL32_CDBurn_GetTaskInfo
SHELL32_CDBurn_IsBlankDisc
SHELL32_CDBurn_IsBlankDisc2
SHELL32_CDBurn_IsLiveFS
SHELL32_CDBurn_OnDeviceChange
SHELL32_CDBurn_OnEject
SHELL32_CDBurn_OnMediaChange
SHELL32_CDefFolderMenu_Create2
SHELL32_CDefFolderMenu_Create2Ex
SHELL32_CDefFolderMenu_MergeMenu
SHELL32_CDrivesContextMenu_Create
SHELL32_CDrivesDropTarget_Create
SHELL32_CDrives_CreateSFVCB
SHELL32_CFSDropTarget_CreateInstance
SHELL32_CFSFolderCallback_Create
SHELL32_CFillPropertiesTask_CreateInstance
SHELL32_CLibraryDropTarget_CreateInstance
SHELL32_CLocationContextMenu_Create
SHELL32_CLocationFolderUI_CreateInstance
SHELL32_CMountPoint_DoAutorun
SHELL32_CMountPoint_DoAutorunPrompt
SHELL32_CMountPoint_IsAutoRunDriveAndEnabledByPolicy
SHELL32_CMountPoint_ProcessAutoRunFile
SHELL32_CMountPoint_WantAutorunUI
SHELL32_CMountPoint_WantAutorunUIGetReady
SHELL32_CNetFolderUI_CreateInstance
SHELL32_CPL_CategoryIdArrayFromVariant
SHELL32_CPL_IsLegacyCanonicalNameListedUnderKey
SHELL32_CPL_ModifyWowDisplayName
SHELL32_CRecentDocsContextMenu_CreateInstance
SHELL32_CTransferConfirmation_CreateInstance
SHELL32_CallFileCopyHooks
SHELL32_CanDisplayWin8CopyDialog
SHELL32_CloseAutoplayPrompt
SHELL32_CommandLineFromMsiDescriptor
SHELL32_CopySecondaryTiles
SHELL32_CreateConfirmationInterrupt
SHELL32_CreateConflictInterrupt
SHELL32_CreateDefaultOperationDataProvider
SHELL32_CreateFileFolderContextMenu
SHELL32_CreateLinkInfoW
SHELL32_CreateQosRecorder
SHELL32_CreateSharePointView
SHELL32_Create_IEnumUICommand
SHELL32_DestroyLinkInfo
SHELL32_EncryptDirectory
SHELL32_EncryptedFileKeyInfo
SHELL32_EnumCommonTasks
SHELL32_FreeEncryptedFileKeyInfo
SHELL32_GenerateAppID
SHELL32_GetAppIDRoot
SHELL32_GetCommandProviderForFolderType
SHELL32_GetDPIAdjustedLogicalSize
SHELL32_GetDiskCleanupPath
SHELL32_GetFileNameFromBrowse
SHELL32_GetIconOverlayManager
SHELL32_GetLinkInfoData
SHELL32_GetRatingBucket
SHELL32_GetSqmableFileName
SHELL32_GetThumbnailAdornerFromFactory
SHELL32_GetThumbnailAdornerFromFactory2
SHELL32_HandleUnrecognizedFileSystem
SHELL32_IconCacheCreate
SHELL32_IconCacheDestroy
SHELL32_IconCacheHandleAssociationChanged
SHELL32_IconCacheRestore
SHELL32_IconCache_AboutToExtractIcons
SHELL32_IconCache_DoneExtractingIcons
SHELL32_IconCache_ExpandEnvAndSearchPath
SHELL32_IconCache_RememberRecentlyExtractedIconsW
SHELL32_IconOverlayManagerInit
SHELL32_IsGetKeyboardLayoutPresent
SHELL32_IsSystemUpgradeInProgress
SHELL32_IsValidLinkInfo
SHELL32_LegacyEnumSpecialTasksByType
SHELL32_LegacyEnumTasks
SHELL32_LookupBackIconIndex
SHELL32_LookupFrontIconIndex
SHELL32_NormalizeRating
SHELL32_NotifyLinkTrackingServiceOfMove
SHELL32_PifMgr_CloseProperties
SHELL32_PifMgr_GetProperties
SHELL32_PifMgr_OpenProperties
SHELL32_PifMgr_SetProperties
SHELL32_Printers_CreateBindInfo
SHELL32_Printjob_GetPidl
SHELL32_PurgeSystemIcon
SHELL32_RefreshOverlayImages
SHELL32_ResolveLinkInfoW
SHELL32_SHAddSparseIcon
SHELL32_SHCreateByValueOperationInterrupt
SHELL32_SHCreateDefaultContextMenu
SHELL32_SHCreateLocalServer
SHELL32_SHCreateShellFolderView
SHELL32_SHDuplicateEncryptionInfoFile
SHELL32_SHEncryptFile
SHELL32_SHFormatDriveAsync
SHELL32_SHGetThreadUndoManager
SHELL32_SHGetUserNameW
SHELL32_SHIsVirtualDevice
SHELL32_SHLaunchPropSheet
SHELL32_SHLogILFromFSIL
SHELL32_SHOpenWithDialog
SHELL32_SHStartNetConnectionDialogW
SHELL32_SHUICommandFromGUID
SHELL32_SendToMenu_InvokeTargetedCommand
SHELL32_SendToMenu_VerifyTargetedCommand
SHELL32_ShowHideIconOnlyOnDesktop
SHELL32_SimpleRatingToFilterCondition
SHELL32_StampIconForFile
SHELL32_SuspendUndo
SHELL32_TryVirtualDiscImageDriveEject
SHELL32_VerifySaferTrust
SHEmptyRecycleBinA
SHEmptyRecycleBinW
SHEnableServiceObject
SHEnumerateUnreadMailAccountsW
SHEvaluateSystemCommandTemplate
SHExecuteErrorMessageBox
SHExtractIconsW
SHFileOperation
SHFileOperationA
SHFileOperationW
SHFindFiles
SHFind_InitMenuPopup
SHFlushSFCache
SHFormatDrive
SHFree
SHFreeNameMappings
SHGetAttributesFromDataObject
SHGetDataFromIDListA
SHGetDataFromIDListW
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHGetDiskFreeSpaceExA
SHGetDiskFreeSpaceExW
SHGetDriveMedia
SHGetFileInfo
SHGetFileInfoA
SHGetFileInfoW
SHGetFolderLocation
SHGetFolderPathA
SHGetFolderPathAndSubDirA
SHGetFolderPathAndSubDirW
SHGetFolderPathEx
SHGetFolderPathW
SHGetIDListFromObject
SHGetIconOverlayIndexA
SHGetIconOverlayIndexW
SHGetImageList
SHGetInstanceExplorer
SHGetItemFromDataObject
SHGetItemFromObject
SHGetKnownFolderIDList
SHGetKnownFolderItem
SHGetKnownFolderPath
SHGetLocalizedName
SHGetMalloc
SHGetNameFromIDList
SHGetNewLinkInfo
SHGetNewLinkInfoA
SHGetNewLinkInfoW
SHGetPathFromIDList
SHGetPathFromIDListA
SHGetPathFromIDListEx
SHGetPathFromIDListW
SHGetPropertyStoreForWindow
SHGetPropertyStoreFromIDList
SHGetPropertyStoreFromParsingName
SHGetRealIDL
SHGetSetFolderCustomSettings
SHGetSetSettings
SHGetSettings
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
SHGetStockIconInfo
SHGetTemporaryPropertyForItem
SHGetUnreadMailCountW
SHHandleUpdateImage
SHHelpShortcuts_RunDLL
SHHelpShortcuts_RunDLLA
SHHelpShortcuts_RunDLLW
SHILCreateFromPath
SHInvokePrinterCommandA
SHInvokePrinterCommandW
SHIsFileAvailableOffline
SHLimitInputEdit
SHLoadInProc
SHLoadNonloadedIconOverlayIdentifiers
SHMapPIDLToSystemImageListIndex
SHMultiFileProperties
SHObjectProperties
SHOpenFolderAndSelectItems
SHOpenPropSheetW
SHOpenWithDialog
SHParseDisplayName
SHPathPrepareForWriteA
SHPathPrepareForWriteW
SHPropStgCreate
SHPropStgReadMultiple
SHPropStgWriteMultiple
SHQueryRecycleBinA
SHQueryRecycleBinW
SHQueryUserNotificationState
SHRemoveLocalizedName
SHReplaceFromPropSheetExtArray
SHResolveLibrary
SHRestricted
SHSetDefaultProperties
SHSetFolderPathA
SHSetFolderPathW
SHSetInstanceExplorer
SHSetKnownFolderPath
SHSetLocalizedName
SHSetTemporaryPropertyForItem
SHSetUnreadMailCountW
SHShellFolderView_Message
SHShowManageLibraryUI
SHSimpleIDListFromPath
SHStartNetConnectionDialogW
SHTestTokenMembership
SHUpdateImageA
SHUpdateImageW
SHUpdateRecycleBinIcon
SHValidateUNC
SetCurrentProcessExplicitAppUserModelID
SheChangeDirA
SheChangeDirExW
SheGetDirA
SheSetCurDrive
ShellAboutA
ShellAboutW
ShellExec_RunDLL
ShellExec_RunDLLA
ShellExec_RunDLLW
ShellExecuteA
ShellExecuteEx
ShellExecuteExA
ShellExecuteExW
ShellExecuteW
ShellHookProc
ShellMessageBoxA
ShellMessageBoxW
Shell_GetCachedImageIndex
Shell_GetCachedImageIndexA
Shell_GetCachedImageIndexW
Shell_GetImageLists
Shell_MergeMenus
Shell_NotifyIcon
Shell_NotifyIconA
Shell_NotifyIconGetRect
Shell_NotifyIconW
SignalFileOpen
StateRepoNewMenuCache_EnsureCacheAsync
StateRepoNewMenuCache_RebuildCacheAsync
StgMakeUniqueName
StrChrA
StrChrIA
StrChrIW
StrChrW
StrCmpNA
StrCmpNIA
StrCmpNIW
StrCmpNW
StrNCmpA
StrNCmpIA
StrNCmpIW
StrNCmpW
StrRChrA
StrRChrIA
StrRChrIW
StrRChrW
StrRStrA
StrRStrIA
StrRStrIW
StrRStrW
StrStrA
StrStrIA
StrStrIW
StrStrW
UsersLibrariesFolderUI_CreateInstance
WOWShellExecute
WaitForExplorerRestartW
Win32DeleteFile
WriteCabinetState
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ