Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
explorer.exe
Resource
win10v2004-20240419-en
Target
explorer.exe
Size
4.6MB
MD5
004695c197499eba4679ed11075157c8
SHA1
b1ea12aa727461c0a8262ccc28a38ed1c2165203
SHA256
17eddbedb74401fc26864771e301353d92dec32a6b7ecb90507b96148e8f61e8
SHA512
8e5dd0c6426acb2a5d9f97ec10c2799a272dd35269aa143bc013c6c474e24474012c863faaf4e811e2701ed74e8d90619e823db236c8d8acc8611fa1fcf5c619
SSDEEP
98304:oOLONJafu9scLTSnmrO2d5sVLRud+oIP+03Co2wdUOnFixxbEZNCRlzb+0Y9mVLJ:oOLONJafu9scLTSnmC2d5sVLYDIP+03g
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
explorer.pdb
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
_Cnd_wait
?_Xinvalid_argument@std@@YAXPBD@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?tolower@?$ctype@G@std@@QBEGG@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?id@?$collate@G@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
??0_Lockit@std@@QAE@H@Z
??0_Locinfo@std@@QAE@PBD@Z
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??1_Lockit@std@@QAE@XZ
??1_Locinfo@std@@QAE@XZ
?is@?$ctype@G@std@@QBE_NFG@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?width@ios_base@std@@QAE_J_J@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Thrd_yield
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
_Mtx_unlock
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
_Thrd_detach
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Mtx_lock
_Thrd_join
_Thrd_id
?_Xlength_error@std@@YAXPBD@Z
_Cnd_do_broadcast_at_thread_exit
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_set_error_mode
wcsncmp
strncmp
wcscspn
memset
_time32
_o_ceil
_o_exit
_o_floor
_o_free
_o_iswspace
_o_lround
_o_lroundf
_o_malloc
_o_memcpy_s
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoll
__current_exception
__current_exception_context
_except_handler4_common
_o__wtoi
_o__wcsnicmp
_o__wcslwr_s
_o__wcsicmp
memmove
_o__set_new_mode
_o__set_fmode
_o__set_errno
_o__set_app_type
_o_abort
_o__seh_filter_exe
_o__register_onexit_function
_o__recalloc
_o__purecall
_o__mktime32
_o__ltow_s
_o__localtime32
_o__itow_s
_o__itoa_s
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
_o__get_errno
_o__exit
_o__errno
_o__difftime32
_o__crt_atexit
_o__controlfp_s
_o__configure_wide_argv
_o__configthreadlocale
_o__CIsqrt
_o__CIpow
_o__CIfmod
_o__cexit
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcsrchr
wcsstr
__std_terminate
__CxxFrameHandler3
_CxxThrowException
memcmp
memcpy
PicFreeFileInfo
PicRetrieveFileInfo
ord9
OpenJobObjectW
CreateJobObjectW
QueryInformationJobObject
AssignProcessToJobObject
SetInformationJobObject
RegisterApplicationRestart
HashData
PathIsURLW
UrlUnescapeW
WerUnregisterCustomMetadata
WerRegisterCustomMetadata
CheckElevationEnabled
CheckElevation
SHRegGetUSValueW
SHRegGetBoolUSValueW
CoRegisterMessageFilter
CoRegisterInitializeSpy
CoRevokeInitializeSpy
GlobalGetAtomNameW
CreateActCtxW
ReleaseActCtx
DeactivateActCtx
ActivateActCtx
WinSqmAddToStream
RtlGetVersion
ZwQuerySystemInformation
ZwQueryValueKey
ZwOpenKey
ZwClose
RtlReAllocateHeap
ZwEnumerateValueKey
ZwCreateFile
NtQueryInformationFile
RtlAppendUnicodeToString
RtlAnsiStringToUnicodeString
RtlImageDirectoryEntryToData
ZwUnmapViewOfSection
RtlNtPathNameToDosPathName
RtlUpcaseUnicodeChar
ZwCreateSection
RtlxAnsiStringToUnicodeSize
ZwQueryInformationProcess
RtlpEnsureBufferSize
RtlGetNativeSystemInformation
RtlVerifyVersionInfo
ZwQueryDirectoryFile
ZwSetInformationProcess
RtlInitUnicodeStringEx
ZwMapViewOfSection
RtlFormatCurrentUserKeyPath
ZwEnumerateKey
RtlInitString
ZwOpenFile
ZwQueryInformationFile
LdrResSearchResource
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
NtQueryInformationProcess
WinSqmIsOptedIn
NtQueryWnfStateData
RtlInitUnicodeString
NtOpenFile
NtDeviceIoControlFile
NtClose
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlFlushHeaps
NtSetSystemInformation
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosError
strchr
memmove_s
RtlAppendUnicodeStringToString
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeUnicodeString
wcschr
RtlAllocateHeap
RtlFreeHeap
RtlCompareUnicodeString
NtOpenProcessToken
NtQueryInformationToken
NtOpenThreadToken
RtlRunOnceExecuteOnce
wcsspn
RtlGetNtSystemRoot
RtlCopyUnicodeString
RtlUpcaseUnicodeString
RtlNtStatusToDosErrorNoTeb
NtSetThreadExecutionState
NtPowerInformation
VerSetConditionMask
RtlQueryResourcePolicy
RtlQueryUnbiasedInterruptTime
NtQuerySystemInformation
NtSetInformationProcess
SizeofResource
LoadLibraryExW
GetModuleHandleW
LoadStringW
FreeLibrary
FindStringOrdinal
GetModuleFileNameW
GetModuleFileNameA
LockResource
LoadResource
GetProcAddress
GetModuleHandleExW
GetModuleHandleA
FindResourceExW
InitOnceExecuteOnce
Sleep
InitOnceComplete
InitOnceBeginInitialize
AcquireSRWLockShared
ReleaseSRWLockExclusive
ReleaseMutex
WaitForSingleObject
SleepEx
CreateMutexExW
TryEnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
ResetEvent
InitializeCriticalSectionAndSpinCount
OpenMutexW
WaitForMultipleObjectsEx
CreateEventExW
InitializeCriticalSection
OpenSemaphoreW
InitializeSRWLock
WaitForSingleObjectEx
AcquireSRWLockExclusive
CreateEventW
EnterCriticalSection
SetEvent
DeleteCriticalSection
OpenEventW
CreateSemaphoreExW
CreateMutexW
ReleaseSRWLockShared
HeapSetInformation
GetProcessHeap
HeapAlloc
HeapFree
RaiseException
SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetErrorMode
SetLastError
CreateFileW
FindFirstFileW
GetLongPathNameW
CompareFileTime
FindNextFileW
DeleteFileW
WriteFile
FindClose
GetFileAttributesW
EventWrite
EventUnregister
EventRegister
EventEnabled
EventWriteTransfer
EventSetInformation
EventActivityIdControl
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CloseThreadpoolWait
TrySubmitThreadpoolCallback
CreateThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
SubmitThreadpoolWork
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
GetPriorityClass
OpenThread
GetCurrentThreadId
OpenProcessToken
GetCurrentThread
OpenThreadToken
GetCurrentProcess
SetPriorityClass
SetThreadPriority
ResumeThread
CreateThread
TlsSetValue
QueueUserAPC
ProcessIdToSessionId
GetProcessId
GetThreadPriority
SetThreadPriorityBoost
CreateProcessW
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
TlsFree
InitializeProcThreadAttributeList
GetExitCodeProcess
GetCurrentProcessId
TlsAlloc
SetProcessShutdownParameters
TlsGetValue
ExitProcess
GetStartupInfoW
TerminateProcess
FormatMessageW
GetCalendarInfoW
GetLocaleInfoEx
GetThreadUILanguage
GetGeoInfoW
GetLocaleInfoW
IsDebuggerPresent
DebugBreak
OutputDebugStringW
DuplicateHandle
CloseHandle
SafeArrayAccessData
SysStringLen
SafeArrayCreate
SysAllocStringByteLen
SafeArrayUnaccessData
SysFreeString
SafeArrayDestroy
SysAllocString
VariantInit
VariantClear
VarUI4FromStr
SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask
IsOS
SetCurrentProcessExplicitAppUserModelID
CoReleaseMarshalData
CoGetCallContext
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
StringFromCLSID
CoGetObjectContext
CoGetApartmentType
CoInitializeSecurity
CoCancelCall
CoDisableCallCancellation
IIDFromString
CoSetProxyBlanket
CoEnableCallCancellation
CLSIDFromString
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoGetMalloc
CoTaskMemAlloc
PropVariantClear
CoGetStdMarshalEx
CoTaskMemRealloc
CoRevokeClassObject
CoRegisterClassObject
CoMarshalInterThreadInterfaceInStream
CoCreateGuid
CreateStreamOnHGlobal
StringFromIID
CoCreateInstance
CoTaskMemFree
StringFromGUID2
CoFreeUnusedLibraries
StrCmpNIW
StrChrIW
StrCmpICA
StrChrW
StrCmpW
QISearch
StrCmpIW
StrCmpICW
StrCmpNICW
StrToIntW
SHStrDupW
RegDeleteKeyExW
RegGetValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegDeleteTreeW
RegEnumValueW
RegOpenKeyExW
RegOpenCurrentUser
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
RegLoadMUIStringW
IUnknown_Set
IUnknown_SetSite
IUnknown_GetSite
IUnknown_QueryService
LocalAlloc
LocalReAlloc
LocalFree
GlobalFree
GlobalAlloc
OpenProcess
GetProcessMitigationPolicy
IsProcessorFeaturePresent
GetDateFormatW
GetTickCount
GetWindowsDirectoryW
GetTickCount64
GetSystemTime
GetSystemDirectoryW
GetLocalTime
GetVersionExW
GetSystemTimeAsFileTime
GetTimeFormatEx
GetDateFormatEx
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCommandLineW
SearchPathW
GetCurrentDirectoryW
PathParseIconLocationW
PathIsFileSpecW
PathGetArgsW
PathCommonPrefixW
PathCombineW
PathQuoteSpacesW
PathFileExistsW
SHExpandEnvironmentStringsW
PathFindExtensionW
PathFindFileNameW
PathRemoveBlanksW
PathRemoveFileSpecW
PathGetDriveNumberW
SHQueryInfoKeyW
SHRegGetValueW
SHEnumKeyExW
SHDeleteKeyW
SHDeleteValueW
SHSetValueW
SHGetValueW
WideCharToMultiByte
CompareStringW
CompareStringOrdinal
MultiByteToWideChar
WindowsPromoteStringBuffer
WindowsCompareStringOrdinal
WindowsCreateString
WindowsDeleteStringBuffer
WindowsSubstringWithSpecifiedLength
WindowsPreallocateStringBuffer
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsDuplicateString
SHSetThreadRef
SHCreateThreadRef
SHCreateThread
SetProcessReference
SHGetThreadRef
FindResourceW
LoadLibraryW
EqualSid
IsValidSid
GetSecurityDescriptorDacl
GetLengthSid
CopySid
GetTokenInformation
CreateWellKnownSid
CheckTokenMembership
DuplicateToken
AllocateAndInitializeSid
GetAclInformation
DeleteAce
InitializeAcl
FreeSid
AddAce
SetKernelObjectSecurity
MakeAbsoluteSD
GetAce
K32EnumProcesses
K32GetModuleBaseNameW
K32EnumProcessModules
K32GetModuleFileNameExW
QueryFullProcessImageNameW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW
TraceMessage
RegisterTraceGuidsW
GetTraceEnableFlags
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableLevel
GetUserDefaultUILanguage
SHLoadIndirectString
SetProcessInformation
SetThreadDescription
RegSetKeyValueW
RoUninitialize
RoActivateInstance
RoInitialize
RoGetActivationFactory
RoGetAgileReference
RoOriginateError
RoTransformError
SetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
PathCchRemoveFileSpec
PathAllocCombine
PathCchAppend
PathCchAddExtension
PathCchCombine
SHAnsiToUnicode
GlobalLock
GlobalUnlock
lstrlenW
lstrcmpiW
VirtualFree
VirtualProtect
CreateFileMappingW
UnmapViewOfFile
VirtualAlloc
MapViewOfFile
OpenFileMappingW
CommandLineToArgvW
MulDiv
ord244
GetDpiForMonitor
SHOpenRegStream2W
SHCreateStreamOnFileEx
IStream_Read
IStream_Write
SHCreateMemStream
IStream_Reset
SHCreateStreamOnFileW
GetTempPathW
ord170
CreateTimerQueueTimer
UnregisterWaitEx
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetNativeSystemInfo
GetProductInfo
GetSystemTimePreciseAsFileTime
GetUserDefaultGeoName
DeriveAppContainerSidFromAppContainerName
GetProfileType
FileTimeToSystemTime
GetTimeZoneInformation
GetDynamicTimeZoneInformation
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemPowerStatus
GetComputerNameW
RegisterWaitForSingleObject
QueryPerformanceCounter
InterlockedPushEntrySList
InitializeSListHead
GetPersistedRegistryLocationW
LookupAccountNameW
CharNextW
CharLowerBuffW
QueryServiceConfigW
NotifyServiceStatusChangeW
CreateIoCompletionPort
GetQueuedCompletionStatus
DeviceIoControl
SHRegGetValueFromHKCUHKLM
RaiseFailFastException
CharNextA
CallNtPowerInformation
GetPwrCapabilities
ApiSetQueryApiSetPresence
ord197
SHCreateWorkerWindowW
ord635
ord509
SHPinDllOfCLSID
ord544
ord478
ord479
ord481
StrRetToBufW
ord165
StrRetToStrW
AssocQueryStringW
SHIsChildOrSelf
IUnknown_GetWindow
ord279
ord292
PathRemoveArgsW
ShellMessageBoxW
EnumDisplayDevicesW
GetSystemMetrics
GetDisplayConfigBufferSizes
QueryDisplayConfig
SystemParametersInfoW
GetMonitorInfoW
EnumDisplayMonitors
SetRect
InflateRect
PtInRect
IsRectEmpty
UnionRect
SubtractRect
OffsetRect
IntersectRect
SetRectEmpty
EqualRect
CopyRect
NotifyWinEvent
UnhookWinEvent
SetWinEventHook
SHCreateItemFromIDList
ILGetSize
ILCloneFirst
ILCombine
SHBindToObject
SHCreateItemFromParsingName
SHBindToFolderIDListParent
SHBindToParent
SHGetIDListFromObject
ILFindLastID
ILFree
SHParseDisplayName
ILIsParent
ILIsEqual
ILRemoveLastID
ILClone
SHGetNameFromIDList
DXGIDeclareAdapterRemovalSupport
GetCurrentInputMessageSource
EnableMouseInPointer
GetPointerDevices
GetPointerType
GetPointerInfo
GetThreadFlags
SetThreadFlags
SHGetKnownFolderIDList
SHGetFolderPathEx
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
GetPackagesByPackageFamily
GetPackageFullName
SetWindowFeedbackSetting
RegisterClipboardFormatW
DragQueryFileW
GetWindowBand
CreateWindowInBand
RegisterPowerSettingNotification
UnregisterPowerSettingNotification
SHChangeNotifyRegisterThread
SHChangeNotifyDeregister
SHHandleUpdateImage
SHChangeNotification_Lock
SHChangeNotifyRegister
SHChangeNotification_Unlock
PropVariantToBoolean
PSCreateMemoryPropertyStore
PSGetPropertyFromPropertyStorage
PSPropertyBag_WriteStr
InitVariantFromResource
PropVariantToUInt32
InitVariantFromGUIDAsString
PSPropertyBag_WriteDWORD
PropVariantToStringAlloc
SHChangeNotify
SHCreateDataObject
ParseApplicationUserModelId
FindPackagesByPackageFamily
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
CreateFontIndirectW
SetTextColor
GetClipBox
SelectObject
GetCurrentObject
Rectangle
SetStretchBltMode
ExcludeClipRect
CreateCompatibleDC
SetTextAlign
GetStockObject
StretchBlt
GetDeviceCaps
DeleteDC
CreateRectRgn
SetRectRgn
OffsetRgn
CombineRgn
DeleteObject
GetTextMetricsW
SelectClipRgn
GetObjectW
GetClipRgn
GetOutlineTextMetricsW
GetGlyphOutlineW
CreateRectRgnIndirect
GetTextExtentPoint32W
ExtTextOutW
SetProcessDEPPolicy
IsBadWritePtr
GetModuleHandleExA
HeapSize
HeapDestroy
HeapReAlloc
RtlCompareMemory
InternetCrackUrlW
ord121
ord190
SHUnicodeToAnsi
ord1
ord192
ord183
ord126
ord109
ord174
ord162
ord123
ord191
ord187
ord186
ord141
ord142
ord200
ord184
ord134
ord743
ord907
ord43
Shell_GetCachedImageIndexW
ord790
ord792
ord727
ord162
SHAppBarMessage
ord894
ord906
ord181
ord22
SHGetLocalizedName
SHGetPropertyStoreForWindow
ord764
ord866
ord723
SHEvaluateSystemCommandTemplate
ord244
ExtractIconExW
ord132
ord137
Shell_NotifyIconW
Shell_NotifyIconGetRect
ord6
SHGetStockIconInfo
DuplicateIcon
ShellExecuteW
ord91
ord254
ord54
SHEnableServiceObject
ord61
ord896
SHAddToRecentDocs
ord60
SHUpdateRecycleBinIcon
ord711
SHFileOperationW
SHGetPathFromIDListW
ord753
ord733
ord67
SHCreateItemInKnownFolder
ord206
ord201
ord188
ord899
ShellExecuteExW
ord245
ord200
ord89
ord190
ord85
ord100
ord850
ord95
ord885
ord680
ord172
ord895
ord164
PathIsDirectoryW
ord413
ord548
ord163
ord467
AssocQueryKeyW
ChrCmpIW
PathIsRelativeW
AssocCreate
GetThemeMetric
GetThemeColor
BufferedPaintSetAlpha
GetWindowTheme
BufferedPaintUnInit
SetWindowTheme
EndBufferedPaint
GetThemePartSize
BufferedPaintInit
CloseThemeData
DrawThemeParentBackground
DrawThemeBackground
ord86
GetThemeFont
DrawThemeTextEx
IsCompositionActive
IsAppThemed
BeginBufferedPaint
IsThemePartDefined
ord138
GetThemeInt
GetThemeBackgroundExtent
GetThemeBool
IsThemeActive
OpenThemeData
OpenThemeDataForDpi
GetBufferedPaintBits
GetThemeMargins
ord126
ord113
DwmIsCompositionEnabled
ord141
ord139
DwmSetWindowAttribute
ord140
DwmEnableBlurBehindWindow
DwmRegisterThumbnail
DwmGetWindowAttribute
ord159
DwmQueryThumbnailSourceSize
ord124
DwmUpdateThumbnailProperties
DwmUnregisterThumbnail
ord114
ord138
SetCapture
GetCapture
ReleaseCapture
GetDoubleClickTime
CalculatePopupWindowPosition
CopyIcon
GetLastInputInfo
GetCursorFrameInfo
AdjustWindowRect
GetDpiForWindow
SetWindowCompositionAttribute
SetGestureConfig
LoadImageW
CheckMenuItem
EnableMenuItem
RemoveMenu
SetMenuDefaultItem
TrackPopupMenuEx
CopyImage
GetSysColor
GetCaretBlinkTime
InjectKeyboardInput
MapVirtualKeyExW
InjectMouseInput
LockWorkStation
TileWindows
CascadeWindows
HungWindowFromGhostWindow
LoadIconW
IsIconic
GetKeyState
ord2005
EndDialog
AdjustWindowRectEx
GetDC
ReleaseDC
CreatePopupMenu
GetMenuDefaultItem
DestroyMenu
LoadCursorW
SetCursor
SetMenuItemInfoW
MonitorFromWindow
DefWindowProcA
IsWindowUnicode
LoadAcceleratorsW
ChangeWindowMessageFilterEx
TranslateAcceleratorW
ord2611
DrawIconEx
SendInput
SetDesktopColorTransform
UnregisterClassA
MonitorFromRect
GetGuiResources
IsHungAppWindow
TrackMouseEvent
DeleteMenu
FillRect
DestroyIcon
LoadMenuW
ExitWindowsEx
GetSubMenu
CreateIconIndirect
GetMenuItemCount
GetMenuItemInfoW
MonitorFromPoint
ReplyMessage
ord2574
GetAsyncKeyState
ModifyMenuW
GetSystemMenu
GetSysColorBrush
SetLayeredWindowAttributes
GetIconInfoExW
GetIconInfo
GetClassWord
GetClassLongW
SendDlgItemMessageW
SwitchToThisWindow
GetPhysicalCursorPos
GetCursorInfo
ShowWindowAsync
InsertMenuW
BringWindowToTop
ord2573
GhostWindowFromHungWindow
EndTask
IsTopLevelWindow
GetMenuState
SetScrollInfo
GetScrollInfo
SetScrollPos
GetMenuStringW
InternalGetWindowText
GetLayeredWindowAttributes
GetLastActivePopup
DrawTextExW
IsProcessDPIAware
SetThreadDpiAwarenessContext
GetWindowCompositionAttribute
GetWindowProcessHandle
UpdateLayeredWindow
ord2521
UnregisterHotKey
RegisterHotKey
UnregisterClassW
ord2522
WindowFromDC
GetMenuInfo
SetMenuInfo
GetDpiForSystem
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
CharLowerW
IsCharAlphaNumericW
GetSystemMetricsForDpi
DrawTextW
GetUserNameExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
LCIDToLocaleName
PowerSetRequest
VerifyVersionInfoW
PowerCreateRequest
OOBEComplete
CopyFileW
SetTermsrvAppInstallMode
ord292
EnableTraceEx2
StartTraceW
StopTraceW
IsProcessInJob
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrClientCall2
GetStagedPackagePathByFullName2
BiPtQueryWorkItem
BiPtFreeMemory
BiPtAssociateApplicationEntryPoint
BiPtEnumerateWorkItemsForPackageName
IsDeveloperModeEnabled
GetShellWindow
RoCreatePropertySetSerializer
SetErrorInfo
GetErrorInfo
g_trayTriageBlock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ