Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
explorer.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
explorer.exe
Resource
win10v2004-20231215-en
Target
explorer.exe
Size
5.0MB
MD5
f797eaf92a57128071e4a95fb2b2c27d
SHA1
a2bd0aaa11603f8d0e28a3cdfc0552b1df37c3c9
SHA256
9d22623cdcb0d78219f21b7beb29931378376724acbac9153aa3dae960c18c05
SHA512
4ab9a82c0c214acc1a11981f0f337a0d2ed5b44c12c085b81f58f350b1389bcd9b52ffd7fad9864208f2841d678998df0588f103e9b7a1784282e1e1ff61560e
SSDEEP
49152:UdBY/K/8ws8yK6s9nsbr8VvnKaXVIHW5GAh2JINMx7NYdN+hGsurnxUL/7mULMJY:UFtAJS3XZoEnMcbw8a0sp
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
explorer.pdb
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
_Cnd_wait
?_Xinvalid_argument@std@@YAXPEBD@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?tolower@?$ctype@G@std@@QEBAGG@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?id@?$collate@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QEBA_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?width@ios_base@std@@QEBA_JXZ
?flags@ios_base@std@@QEBAHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?width@ios_base@std@@QEAA_J_J@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Thrd_yield
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Thrd_detach
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Mtx_unlock
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
_Mtx_lock
?_Xlength_error@std@@YAXPEBD@Z
_register_thread_local_exe_atexit_callback
_set_error_mode
_initterm
_c_exit
_initterm_e
wcscspn
wcsncmp
memset
wcscmp
strncmp
_time64
_o_floor
_o_floorf
_o_fmod
_o_free
_o_iswspace
_o_lround
_o_lroundf
_o_malloc
_o_memcpy_s
_o_pow
_o_realloc
_o_sqrt
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoll
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_o__register_onexit_function
_o__recalloc
_o_ceil
_o__purecall
_o__mktime64
_o__wtoi
memmove
_o_exit
_o__wcsnicmp
_o__wcslwr_s
_o__wcsicmp
_o__ltow_s
_o__localtime64
_o__itow_s
_o_abort
_o__itoa_s
_o__set_new_mode
_o__set_fmode
_o__set_errno
_o__set_app_type
_o__seh_filter_exe
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
_o__get_errno
_o__exit
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcsrchr
wcsstr
__std_terminate
__CxxFrameHandler4
_o_ceilf
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy
PicFreeFileInfo
PicRetrieveFileInfo
ord9
QueryInformationJobObject
OpenJobObjectW
AssignProcessToJobObject
CreateJobObjectW
SetInformationJobObject
RegisterApplicationRestart
HashData
PathIsURLW
UrlUnescapeW
WerUnregisterCustomMetadata
WerRegisterCustomMetadata
CheckElevation
CheckElevationEnabled
SHRegGetBoolUSValueW
SHRegGetUSValueW
CoRevokeInitializeSpy
CoRegisterMessageFilter
CoRegisterInitializeSpy
GlobalGetAtomNameW
CreateActCtxW
DeactivateActCtx
ReleaseActCtx
ActivateActCtx
NtQueryInformationProcess
NtQueryWnfStateData
WinSqmAddToStream
RtlGetVersion
ZwQuerySystemInformation
ZwQueryValueKey
ZwOpenKey
ZwClose
RtlReAllocateHeap
ZwEnumerateValueKey
ZwCreateFile
NtQueryInformationFile
RtlAppendUnicodeToString
RtlAnsiStringToUnicodeString
RtlImageDirectoryEntryToData
ZwUnmapViewOfSection
RtlNtPathNameToDosPathName
RtlUpcaseUnicodeChar
ZwCreateSection
RtlxAnsiStringToUnicodeSize
ZwQueryInformationProcess
RtlpEnsureBufferSize
RtlGetNativeSystemInformation
NtSetInformationProcess
ZwQueryDirectoryFile
ZwSetInformationProcess
RtlInitUnicodeStringEx
ZwMapViewOfSection
RtlFormatCurrentUserKeyPath
ZwEnumerateKey
RtlInitString
ZwOpenFile
ZwQueryInformationFile
LdrResSearchResource
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlVerifyVersionInfo
RtlInitUnicodeString
NtOpenFile
NtDeviceIoControlFile
RtlCaptureContext
NtClose
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlFlushHeaps
NtSetSystemInformation
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosError
RtlLookupFunctionEntry
RtlVirtualUnwind
strchr
memmove_s
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeUnicodeString
wcschr
RtlAllocateHeap
RtlFreeHeap
RtlCompareUnicodeString
WinSqmIsOptedIn
NtOpenProcessToken
NtQueryInformationToken
NtOpenThreadToken
RtlAppendUnicodeStringToString
wcsspn
RtlRunOnceExecuteOnce
RtlCopyUnicodeString
RtlUpcaseUnicodeString
RtlNtStatusToDosErrorNoTeb
NtSetThreadExecutionState
NtPowerInformation
VerSetConditionMask
RtlQueryResourcePolicy
RtlQueryUnbiasedInterruptTime
NtQuerySystemInformation
RtlGetNtSystemRoot
SizeofResource
FindStringOrdinal
GetModuleFileNameA
FindResourceExW
LoadLibraryExW
LoadResource
LockResource
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadStringW
GetModuleHandleExW
GetModuleFileNameW
GetModuleHandleW
Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce
InitOnceComplete
OpenMutexW
ReleaseSemaphore
LeaveCriticalSection
ResetEvent
CreateMutexW
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
CreateEventExW
WaitForSingleObject
TryEnterCriticalSection
EnterCriticalSection
ReleaseMutex
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
OpenEventW
WaitForSingleObjectEx
WaitForMultipleObjectsEx
OpenSemaphoreW
SetEvent
CreateEventW
InitializeSRWLock
ReleaseSRWLockShared
CreateMutexExW
InitializeCriticalSection
SleepEx
AcquireSRWLockShared
DeleteCriticalSection
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
GetLastError
SetErrorMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
WriteFile
GetFileAttributesW
CreateFileW
GetLongPathNameW
DeleteFileW
FindClose
FindNextFileW
CompareFileTime
FindFirstFileW
EventRegister
EventWriteTransfer
EventUnregister
EventActivityIdControl
EventEnabled
EventWrite
EventSetInformation
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpoolWork
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
SubmitThreadpoolWork
TrySubmitThreadpoolCallback
SetThreadPriorityBoost
SetProcessShutdownParameters
ExitProcess
InitializeProcThreadAttributeList
CreateThread
OpenThread
SetPriorityClass
OpenProcessToken
SetThreadPriority
GetPriorityClass
ResumeThread
ProcessIdToSessionId
UpdateProcThreadAttribute
GetProcessId
TlsFree
TlsGetValue
TlsAlloc
CreateProcessW
GetCurrentProcess
TlsSetValue
QueueUserAPC
GetStartupInfoW
TerminateProcess
GetExitCodeProcess
OpenThreadToken
GetCurrentProcessId
GetThreadPriority
DeleteProcThreadAttributeList
GetCurrentThreadId
GetCurrentThread
GetGeoInfoW
FormatMessageW
GetLocaleInfoEx
GetCalendarInfoW
GetLocaleInfoW
GetThreadUILanguage
DebugBreak
IsDebuggerPresent
OutputDebugStringW
CloseHandle
DuplicateHandle
VariantClear
SafeArrayAccessData
SysStringLen
VarUI4FromStr
SafeArrayCreate
SysFreeString
SysAllocString
SafeArrayUnaccessData
SafeArrayDestroy
SysAllocStringByteLen
VariantInit
SHTaskPoolQueueTask
SHTaskPoolGetUniqueContext
SetCurrentProcessExplicitAppUserModelID
IsOS
CoCreateInstance
CoRegisterClassObject
CoUninitialize
CoGetCallContext
StringFromCLSID
CoTaskMemFree
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoGetMalloc
CoRevokeClassObject
IIDFromString
CoTaskMemAlloc
CoGetStdMarshalEx
CoCancelCall
CoDisableCallCancellation
CoEnableCallCancellation
CLSIDFromString
CoInitializeSecurity
CoTaskMemRealloc
CoWaitForMultipleHandles
CoCreateGuid
CoGetApartmentType
StringFromIID
StringFromGUID2
CreateStreamOnHGlobal
CoCreateFreeThreadedMarshaler
CoReleaseMarshalData
PropVariantClear
CoSetProxyBlanket
CoFreeUnusedLibraries
CoGetObjectContext
StrCmpW
StrCmpNICW
StrToIntW
StrChrIW
StrCmpICA
StrCmpIW
QISearch
StrCmpNIW
StrCmpICW
StrChrW
SHStrDupW
RegDeleteTreeW
RegOpenCurrentUser
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegGetValueW
RegOpenKeyExW
RegLoadMUIStringW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegDeleteKeyExW
RegSetValueExW
RegCloseKey
IUnknown_SetSite
IUnknown_QueryService
IUnknown_GetSite
IUnknown_Set
LocalReAlloc
GlobalAlloc
GlobalFree
LocalAlloc
LocalFree
GetProcessMitigationPolicy
OpenProcess
IsProcessorFeaturePresent
GetDateFormatW
GetSystemDirectoryW
GetVersionExW
GetWindowsDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
GetSystemTime
GetDateFormatEx
GetTimeFormatEx
SearchPathW
GetCurrentDirectoryW
GetCommandLineW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
PathCommonPrefixW
PathQuoteSpacesW
PathRemoveFileSpecW
PathFileExistsW
PathFindFileNameW
PathFindExtensionW
SHExpandEnvironmentStringsW
PathParseIconLocationW
PathCombineW
PathRemoveBlanksW
PathIsFileSpecW
PathGetDriveNumberW
PathGetArgsW
SHQueryInfoKeyW
SHRegGetValueW
SHDeleteValueW
SHEnumKeyExW
SHSetValueW
SHGetValueW
SHDeleteKeyW
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
WindowsCompareStringOrdinal
WindowsPromoteStringBuffer
WindowsCreateString
WindowsDeleteStringBuffer
WindowsSubstringWithSpecifiedLength
WindowsPreallocateStringBuffer
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsDuplicateString
SHSetThreadRef
SHGetThreadRef
SHCreateThreadRef
SetProcessReference
SHCreateThread
FindResourceW
LoadLibraryW
DeleteAce
GetAce
CreateWellKnownSid
GetAclInformation
InitializeAcl
MakeAbsoluteSD
DuplicateToken
EqualSid
FreeSid
AllocateAndInitializeSid
AddAce
SetKernelObjectSecurity
GetSecurityDescriptorDacl
IsValidSid
GetLengthSid
CheckTokenMembership
GetTokenInformation
CopySid
K32EnumProcesses
QueryFullProcessImageNameW
K32EnumProcessModules
K32GetModuleFileNameExW
K32GetModuleBaseNameW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
TraceMessage
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW
GetTraceEnableFlags
GetUserDefaultUILanguage
SHLoadIndirectString
SetProcessInformation
SetThreadDescription
RegSetKeyValueW
RoActivateInstance
RoInitialize
RoUninitialize
RoGetActivationFactory
RoGetAgileReference
RoOriginateError
RoTransformError
SetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
PathCchAddExtension
PathCchAppend
PathCchCombine
PathAllocCombine
PathCchRemoveFileSpec
SHAnsiToUnicode
GlobalLock
GlobalUnlock
lstrlenW
lstrcmpiW
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
CreateFileMappingW
VirtualProtect
OpenFileMappingW
CommandLineToArgvW
MulDiv
SHCreateMemStream
SHCreateStreamOnFileEx
IStream_Read
SHOpenRegStream2W
SHCreateStreamOnFileW
IStream_Write
IStream_Reset
GetTempPathW
ord170
CreateTimerQueueTimer
UnregisterWaitEx
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetNativeSystemInfo
GetProductInfo
GetUserDefaultGeoName
GetProfileType
DeriveAppContainerSidFromAppContainerName
FileTimeToSystemTime
GetTimeZoneInformation
GetDynamicTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetComputerNameW
GetSystemPowerStatus
RegisterWaitForSingleObject
QueryPerformanceCounter
InterlockedPushEntrySList
InitializeSListHead
GetPersistedRegistryLocationW
LookupAccountNameW
CharLowerBuffW
CharNextW
NotifyServiceStatusChangeW
QueryServiceConfigW
DeviceIoControl
CreateIoCompletionPort
GetQueuedCompletionStatus
SHRegGetValueFromHKCUHKLM
GetDpiForMonitor
ord244
RaiseFailFastException
CharNextA
GetPwrCapabilities
CallNtPowerInformation
ApiSetQueryApiSetPresence
ord544
ord292
ord635
ord165
ord509
ShellMessageBoxW
StrRetToBufW
StrRetToStrW
SHIsChildOrSelf
ord279
SHPinDllOfCLSID
ord481
ord479
IUnknown_GetWindow
AssocQueryStringW
ord197
PathRemoveArgsW
ord478
SHCreateWorkerWindowW
EnumDisplayMonitors
GetMonitorInfoW
QueryDisplayConfig
SystemParametersInfoW
GetSystemMetrics
EnumDisplayDevicesW
GetDisplayConfigBufferSizes
PtInRect
CopyRect
UnionRect
SetRect
InflateRect
EqualRect
SubtractRect
OffsetRect
IntersectRect
SetRectEmpty
IsRectEmpty
SetWinEventHook
NotifyWinEvent
UnhookWinEvent
ILFindLastID
ILIsParent
ILGetSize
ILCloneFirst
ILCombine
ILFree
ILIsEqual
SHGetNameFromIDList
SHGetIDListFromObject
SHBindToParent
SHBindToObject
ILRemoveLastID
ILClone
SHParseDisplayName
SHCreateItemFromParsingName
SHCreateItemFromIDList
SHBindToFolderIDListParent
DXGIDeclareAdapterRemovalSupport
EnableMouseInPointer
GetPointerType
GetPointerDevices
GetCurrentInputMessageSource
GetPointerInfo
SetThreadFlags
GetThreadFlags
SHGetKnownFolderIDList
SHGetFolderPathEx
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
GetPackageFullName
GetPackagesByPackageFamily
SetWindowFeedbackSetting
RegisterClipboardFormatW
DragQueryFileW
CreateWindowInBand
GetWindowBand
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
SHChangeNotifyDeregister
SHChangeNotification_Unlock
SHChangeNotification_Lock
SHChangeNotifyRegisterThread
SHHandleUpdateImage
SHChangeNotifyRegister
PSGetPropertyFromPropertyStorage
PropVariantToBoolean
PSPropertyBag_WriteStr
PropVariantToUInt32
PSPropertyBag_WriteDWORD
InitVariantFromResource
InitVariantFromGUIDAsString
PropVariantToStringAlloc
PSCreateMemoryPropertyStore
SHChangeNotify
SHCreateDataObject
ParseApplicationUserModelId
FindPackagesByPackageFamily
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
CreateCompatibleDC
SelectObject
GetClipBox
GetCurrentObject
DeleteDC
SelectClipRgn
GetClipRgn
GetOutlineTextMetricsW
GetObjectW
DeleteObject
CombineRgn
GetGlyphOutlineW
CreateRectRgnIndirect
Rectangle
SetStretchBltMode
ExcludeClipRect
StretchBlt
OffsetRgn
GetDeviceCaps
GetStockObject
CreateRectRgn
SetRectRgn
GetTextExtentPoint32W
ExtTextOutW
GetTextMetricsW
SetTextAlign
SetTextColor
CreateFontIndirectW
IsBadWritePtr
RtlCompareMemory
HeapSize
HeapReAlloc
GetModuleHandleExA
HeapDestroy
InternetCrackUrlW
ord192
ord210
ord1
ord183
ord213
ord126
ord109
ord174
ord121
ord190
ord123
ord162
SHUnicodeToAnsi
ord187
ord191
ord141
ord142
ord200
ord184
ord186
ord743
ord907
ord43
Shell_GetCachedImageIndexW
ord790
ord792
ord727
ord162
SHAppBarMessage
ord894
ord906
ord181
ord895
SHGetLocalizedName
SHGetPropertyStoreForWindow
ord866
SHEvaluateSystemCommandTemplate
ord244
ExtractIconExW
ord132
ord137
Shell_NotifyIconW
Shell_NotifyIconGetRect
ord6
SHGetStockIconInfo
DuplicateIcon
ShellExecuteW
ord91
ord254
ord54
SHEnableServiceObject
ord61
ord896
SHAddToRecentDocs
ord60
SHUpdateRecycleBinIcon
ord711
SHFileOperationW
SHGetPathFromIDListW
ord753
ord733
ord67
SHCreateItemInKnownFolder
ord206
ord201
ord188
ord899
ShellExecuteExW
ord245
ord200
ord89
ord190
ord85
ord100
ord134
ord22
ord850
ord95
ord885
ord723
ord680
ord172
ord764
ord164
PathIsDirectoryW
ord413
ord548
ord163
ord467
AssocQueryKeyW
ChrCmpIW
PathIsRelativeW
AssocCreate
IsCompositionActive
DrawThemeTextEx
GetThemeFont
ord86
DrawThemeBackground
GetThemeBackgroundExtent
DrawThemeParentBackground
CloseThemeData
BufferedPaintInit
IsThemePartDefined
GetThemeBool
OpenThemeData
OpenThemeDataForDpi
GetThemeMargins
ord138
BufferedPaintSetAlpha
ord126
GetThemePartSize
IsThemeActive
BeginBufferedPaint
GetBufferedPaintBits
GetThemeInt
EndBufferedPaint
BufferedPaintUnInit
GetWindowTheme
IsAppThemed
SetWindowTheme
GetThemeColor
GetThemeMetric
ord141
ord138
ord139
ord140
DwmSetWindowAttribute
DwmGetWindowAttribute
DwmIsCompositionEnabled
ord159
DwmRegisterThumbnail
DwmQueryThumbnailSourceSize
ord124
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
ord114
DwmEnableBlurBehindWindow
ord113
GetDoubleClickTime
CalculatePopupWindowPosition
CopyIcon
GetLastInputInfo
GetCursorFrameInfo
AdjustWindowRect
GetDpiForWindow
SetWindowCompositionAttribute
SetGestureConfig
LoadImageW
CheckMenuItem
EnableMenuItem
RemoveMenu
SetMenuDefaultItem
TrackPopupMenuEx
SetCapture
TrackMouseEvent
DestroyIcon
CopyImage
GetSysColor
GetCaretBlinkTime
InjectKeyboardInput
MapVirtualKeyExW
ReleaseCapture
LockWorkStation
TileWindows
CascadeWindows
HungWindowFromGhostWindow
LoadIconW
IsIconic
GetKeyState
ExitWindowsEx
EndDialog
AdjustWindowRectEx
GetDC
ReleaseDC
CreatePopupMenu
GetMenuDefaultItem
DestroyMenu
LoadCursorW
SetCursor
SetMenuItemInfoW
MonitorFromWindow
DefWindowProcA
IsWindowUnicode
LoadAcceleratorsW
ChangeWindowMessageFilterEx
ord2005
InjectMouseInput
GetCapture
SendInput
SetDesktopColorTransform
UnregisterClassA
DeleteMenu
FillRect
DrawTextW
LoadMenuW
GetSubMenu
CreateIconIndirect
GetSystemMetricsForDpi
GetMenuItemInfoW
MonitorFromPoint
ReplyMessage
TranslateAcceleratorW
GetAsyncKeyState
ModifyMenuW
GetSystemMenu
GetSysColorBrush
SetLayeredWindowAttributes
GetIconInfoExW
GetIconInfo
GetClassWord
GetClassLongW
ord2611
MonitorFromRect
GetPhysicalCursorPos
GetCursorInfo
ShowWindowAsync
InsertMenuW
BringWindowToTop
ord2573
GhostWindowFromHungWindow
EndTask
IsTopLevelWindow
GetMenuState
SetScrollInfo
GetScrollInfo
SetScrollPos
GetMenuStringW
InternalGetWindowText
GetLayeredWindowAttributes
DrawTextExW
GetGuiResources
IsProcessDPIAware
SetThreadDpiAwarenessContext
GetWindowCompositionAttribute
GetWindowProcessHandle
GetClassLongPtrW
UpdateLayeredWindow
ord2521
IsHungAppWindow
UnregisterClassW
ord2522
WindowFromDC
GetMenuInfo
SetMenuInfo
GetDpiForSystem
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
CharLowerW
IsCharAlphaNumericW
ord2574
SwitchToThisWindow
GetLastActivePopup
DrawIconEx
UnregisterHotKey
RegisterHotKey
GetMenuItemCount
SendDlgItemMessageW
GetUserNameExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
LCIDToLocaleName
VerifyVersionInfoW
PowerCreateRequest
PowerSetRequest
OOBEComplete
CopyFileW
SetTermsrvAppInstallMode
ord292
StopTraceW
StartTraceW
EnableTraceEx2
IsProcessInJob
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrClientCall3
GetStagedPackagePathByFullName2
IsDeveloperModeEnabled
BiPtFreeMemory
BiPtEnumerateWorkItemsForPackageName
BiPtAssociateApplicationEntryPoint
BiPtQueryWorkItem
GetShellWindow
RoCreatePropertySetSerializer
GetErrorInfo
SetErrorInfo
g_trayTriageBlock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ