Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
eXplorer.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eXplorer.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
eXplorer.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
eXplorer.exe
Resource
win11-20240419-en
Target
eXplorer.exe
Size
4.6MB
MD5
6fc1abfbb1156ae27d955930c1924492
SHA1
fb139e04ed99a5d6202eabdd243871529d57514c
SHA256
3ae77d6e6700d1f601d50b233a3e93450e053961352a9929d1df17173c5aafc9
SHA512
e5203e5ed849cf7a631d7f89f984336b0cd8ed8c6d0dc9ed50ef40a770c7d06eaf61aeda531d0fcbf55db757f83eb54c46e43a359d83ec9e50d8b5019309850f
SSDEEP
98304:bo6A3G749/X5i1uxq09CSNk+zl7ALJEsT9Mi+F3UGbQ78Rw6sbi2yBfo9pRvZvXN:U6A3G749/X5i1uxq0gSNk+zl7W9T9Mip
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
explorer.pdb
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
_Cnd_wait
?_Xinvalid_argument@std@@YAXPBD@Z
??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IAE@XZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG00@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXPAG0@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAE_JPBG_J@Z
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ
?tolower@?$ctype@G@std@@QBEPBGPAGPBG@Z
?tolower@?$ctype@G@std@@QBEGG@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
?id@?$collate@G@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?id@?$ctype@G@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
??0_Lockit@std@@QAE@H@Z
??0_Locinfo@std@@QAE@PBD@Z
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??1_Lockit@std@@QAE@XZ
??1_Locinfo@std@@QAE@XZ
?is@?$ctype@G@std@@QBE_NFG@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@UAEXXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IBEPAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Thrd_yield
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrCreate@@YAXPAX@Z
?width@ios_base@std@@QAE_J_J@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
_Thrd_detach
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Thrd_id
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
_Cnd_do_broadcast_at_thread_exit
_Mtx_unlock
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
_Mtx_lock
_c_exit
_initterm_e
_initterm
_set_error_mode
_register_thread_local_exe_atexit_callback
memset
strncmp
wcsncmp
wcscspn
_time32
_o_ceil
_o_exit
_o_floor
_o_free
_o_iswspace
_o_lround
_o_lroundf
_o_malloc
_o_memcpy_s
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
_o_wcstoll
__current_exception
__current_exception_context
_except_handler4_common
_o__wcsnicmp
_o__wcslwr_s
_o__wcsicmp
_CxxThrowException
_o__set_new_mode
_o__set_fmode
_o__set_errno
_o__set_app_type
_o__seh_filter_exe
_o__register_onexit_function
_o__recalloc
_o__purecall
_o__mktime32
_o__wtoi
_o__ltow_s
_o__localtime32
_o__itow_s
_o__itoa_s
_o_abort
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_wide_winmain_command_line
_o__get_errno
_o__exit
_o__errno
_o__difftime32
_o__crt_atexit
_o__controlfp_s
_o__configure_wide_argv
_o__configthreadlocale
_o__CIsqrt
_o__CIpow
_o__CIfmod
_o__cexit
_o__beginthreadex
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
wcsrchr
wcsstr
__std_terminate
__CxxFrameHandler3
PicFreeFileInfo
PicRetrieveFileInfo
ord9
AssignProcessToJobObject
OpenJobObjectW
CreateJobObjectW
QueryInformationJobObject
SetInformationJobObject
RegisterApplicationRestart
PathIsURLW
HashData
UrlUnescapeW
WerRegisterCustomMetadata
WerUnregisterCustomMetadata
CheckElevation
CheckElevationEnabled
SHRegGetUSValueW
SHRegGetBoolUSValueW
CoRegisterMessageFilter
CoRevokeInitializeSpy
CoRegisterInitializeSpy
GlobalGetAtomNameW
CreateActCtxW
ReleaseActCtx
DeactivateActCtx
ActivateActCtx
NtQueryWnfStateData
NtSetInformationProcess
NtQueryInformationProcess
NtOpenFile
NtDeviceIoControlFile
RtlGetVersion
ZwQuerySystemInformation
ZwQueryValueKey
ZwOpenKey
ZwClose
RtlReAllocateHeap
ZwEnumerateValueKey
ZwCreateFile
NtQueryInformationFile
RtlAppendUnicodeToString
RtlAnsiStringToUnicodeString
RtlImageDirectoryEntryToData
ZwUnmapViewOfSection
RtlNtPathNameToDosPathName
RtlUpcaseUnicodeChar
ZwCreateSection
RtlxAnsiStringToUnicodeSize
ZwQueryInformationProcess
RtlpEnsureBufferSize
RtlGetNativeSystemInformation
RtlVerifyVersionInfo
ZwQueryDirectoryFile
ZwSetInformationProcess
RtlInitUnicodeStringEx
ZwMapViewOfSection
RtlFormatCurrentUserKeyPath
ZwEnumerateKey
RtlInitString
ZwOpenFile
ZwQueryInformationFile
LdrResSearchResource
RtlReleaseSRWLockShared
RtlAcquireSRWLockShared
RtlReleaseSRWLockExclusive
RtlAcquireSRWLockExclusive
RtlInitUnicodeString
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
RtlFlushHeaps
NtSetSystemInformation
RtlPublishWnfStateData
RtlGetDeviceFamilyInfoEnum
RtlNtStatusToDosError
strchr
memmove_s
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeUnicodeString
wcschr
RtlAllocateHeap
RtlFreeHeap
RtlCompareUnicodeString
RtlAppendUnicodeStringToString
NtOpenProcessToken
NtQueryInformationToken
NtOpenThreadToken
wcsspn
memcpy
memmove
memcmp
RtlNtStatusToDosErrorNoTeb
NtSetThreadExecutionState
RtlRunOnceExecuteOnce
NtPowerInformation
VerSetConditionMask
RtlQueryResourcePolicy
RtlCopyUnicodeString
RtlUpcaseUnicodeString
RtlQueryUnbiasedInterruptTime
NtQuerySystemInformation
RtlGetNtSystemRoot
WinSqmIsOptedIn
NtClose
WinSqmAddToStream
LoadStringW
FindResourceExW
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
FindStringOrdinal
GetModuleFileNameA
GetModuleHandleW
LoadResource
FreeLibrary
LockResource
GetProcAddress
SizeofResource
GetModuleHandleA
InitOnceComplete
Sleep
InitOnceBeginInitialize
InitOnceExecuteOnce
SleepEx
CreateMutexExW
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TryEnterCriticalSection
OpenSemaphoreW
ResetEvent
InitializeCriticalSectionAndSpinCount
TryAcquireSRWLockShared
WaitForSingleObject
OpenMutexW
InitializeCriticalSectionEx
CreateMutexW
LeaveCriticalSection
ReleaseMutex
ReleaseSemaphore
EnterCriticalSection
CreateSemaphoreExW
WaitForMultipleObjectsEx
InitializeCriticalSection
InitializeSRWLock
OpenEventW
WaitForSingleObjectEx
DeleteCriticalSection
CreateEventExW
SetEvent
CreateEventW
ReleaseSRWLockShared
HeapSetInformation
HeapFree
GetProcessHeap
HeapAlloc
RaiseException
SetLastError
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode
GetFileAttributesW
FindClose
FindFirstFileW
DeleteFileW
CreateFileW
CompareFileTime
WriteFile
FindNextFileW
GetLongPathNameW
EventEnabled
EventSetInformation
EventUnregister
EventRegister
EventWriteTransfer
EventActivityIdControl
EventWrite
WaitForThreadpoolTimerCallbacks
SubmitThreadpoolWork
TrySubmitThreadpoolCallback
CloseThreadpoolTimer
CreateThreadpoolTimer
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
WaitForThreadpoolIoCallbacks
CloseThreadpoolIo
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWork
SetThreadpoolTimer
SetThreadpoolWait
CreateThreadpoolWait
GetCurrentThread
OpenThreadToken
GetCurrentProcess
GetPriorityClass
ResumeThread
OpenThread
SetPriorityClass
GetExitCodeProcess
CreateThread
SetThreadPriority
OpenProcessToken
TerminateProcess
QueueUserAPC
DeleteProcThreadAttributeList
ProcessIdToSessionId
GetCurrentThreadId
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
TlsAlloc
TlsSetValue
CreateProcessW
TlsGetValue
TlsFree
SetThreadPriorityBoost
GetStartupInfoW
ExitProcess
GetThreadPriority
SetProcessShutdownParameters
GetCurrentProcessId
GetProcessId
GetLocaleInfoEx
GetCalendarInfoW
GetGeoInfoW
FormatMessageW
GetLocaleInfoW
GetThreadUILanguage
IsDebuggerPresent
DebugBreak
OutputDebugStringW
DuplicateHandle
CloseHandle
SafeArrayAccessData
SysAllocString
SafeArrayDestroy
SysStringLen
VariantInit
SysFreeString
SafeArrayUnaccessData
VariantClear
VarUI4FromStr
SysAllocStringByteLen
SafeArrayCreate
SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask
SetCurrentProcessExplicitAppUserModelID
IsOS
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
IIDFromString
CoGetCallContext
CoGetMalloc
CoInitializeEx
CoCancelCall
CoDisableCallCancellation
CoEnableCallCancellation
CoGetStdMarshalEx
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoSetProxyBlanket
StringFromGUID2
CoGetApartmentType
CoGetObjectContext
CoReleaseMarshalData
StringFromIID
CoCreateGuid
CoUninitialize
CoWaitForMultipleHandles
CoRegisterClassObject
CLSIDFromString
CoRevokeClassObject
CoInitializeSecurity
CoFreeUnusedLibraries
CoGetInterfaceAndReleaseStream
CoTaskMemRealloc
PropVariantClear
CoMarshalInterThreadInterfaceInStream
StringFromCLSID
QISearch
StrCmpW
StrCmpIW
StrChrW
StrChrIW
StrToIntW
StrCmpNICW
StrCmpICA
StrCmpICW
StrCmpNIW
SHStrDupW
RegCreateKeyExW
RegGetValueW
RegEnumValueW
RegQueryValueExW
RegNotifyChangeKeyValue
RegDeleteTreeW
RegDeleteKeyExW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegLoadMUIStringW
RegOpenCurrentUser
RegCloseKey
IUnknown_QueryService
IUnknown_GetSite
IUnknown_Set
IUnknown_SetSite
GlobalFree
LocalAlloc
GlobalAlloc
LocalReAlloc
LocalFree
GetProcessMitigationPolicy
IsProcessorFeaturePresent
OpenProcess
GetDateFormatW
GetTickCount64
GetSystemDirectoryW
GetWindowsDirectoryW
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
GetLocalTime
GetVersionExW
GetDateFormatEx
GetTimeFormatEx
GetCurrentDirectoryW
ExpandEnvironmentStringsW
SearchPathW
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCommandLineW
PathParseIconLocationW
PathFindExtensionW
PathQuoteSpacesW
PathGetDriveNumberW
PathFileExistsW
PathGetArgsW
PathCombineW
SHExpandEnvironmentStringsW
PathIsFileSpecW
PathCommonPrefixW
PathRemoveBlanksW
PathFindFileNameW
PathRemoveFileSpecW
SHRegGetValueW
SHEnumKeyExW
SHSetValueW
SHGetValueW
SHDeleteKeyW
SHQueryInfoKeyW
SHDeleteValueW
CompareStringW
WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal
WindowsDeleteStringBuffer
WindowsCompareStringOrdinal
WindowsCreateString
WindowsPreallocateStringBuffer
WindowsPromoteStringBuffer
WindowsSubstringWithSpecifiedLength
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference
WindowsDuplicateString
SHSetThreadRef
SHGetThreadRef
SetProcessReference
SHCreateThreadRef
SHCreateThread
FindResourceW
LoadLibraryW
MakeAbsoluteSD
CopySid
AllocateAndInitializeSid
GetLengthSid
GetAce
DeleteAce
EqualSid
InitializeAcl
DuplicateToken
CheckTokenMembership
CreateWellKnownSid
AddAce
FreeSid
IsValidSid
GetSecurityDescriptorDacl
SetKernelObjectSecurity
GetTokenInformation
GetAclInformation
K32GetModuleFileNameExW
QueryFullProcessImageNameW
K32EnumProcessModules
K32GetModuleBaseNameW
K32EnumProcesses
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
UnregisterTraceGuids
TraceMessage
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
GetTraceEnableFlags
GetUserDefaultUILanguage
SHLoadIndirectString
SetThreadDescription
SetProcessInformation
RegSetKeyValueW
RoGetActivationFactory
RoUninitialize
RoInitialize
RoActivateInstance
RoGetAgileReference
RoTransformError
RoOriginateError
SetRestrictedErrorInfo
RoGetMatchingRestrictedErrorInfo
PathCchSkipRoot
PathCchCombine
PathCchRemoveFileSpec
PathCchAddExtension
PathAllocCombine
PathCchAppend
SHAnsiToUnicode
GlobalUnlock
GlobalLock
lstrcmpiW
lstrlenW
OpenFileMappingW
VirtualFree
MapViewOfFile
VirtualAlloc
VirtualProtect
CreateFileMappingW
UnmapViewOfFile
CommandLineToArgvW
MulDiv
GetDpiForMonitor
ord244
IStream_Reset
SHCreateStreamOnFileW
IStream_Read
IStream_Write
SHCreateStreamOnFileEx
SHOpenRegStream2W
SHCreateMemStream
GetTempPathW
ord170
UnregisterWaitEx
DeleteTimerQueueTimer
CreateTimerQueueTimer
ChangeTimerQueueTimer
GetProductInfo
GetNativeSystemInfo
GetSystemTimePreciseAsFileTime
GetUserDefaultGeoName
GetProfileType
DeriveAppContainerSidFromAppContainerName
SystemTimeToFileTime
GetDynamicTimeZoneInformation
GetTimeZoneInformation
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
CreateIoCompletionPort
CancelIoEx
GetQueuedCompletionStatus
DeviceIoControl
ReadDirectoryChangesW
GetComputerNameW
GetSystemPowerStatus
RegisterWaitForSingleObject
QueryPerformanceCounter
InterlockedPushEntrySList
InitializeSListHead
GetPersistedRegistryLocationW
LookupAccountNameW
CharLowerBuffW
CharNextW
QueryServiceConfigW
NotifyServiceStatusChangeW
SHRegGetValueFromHKCUHKLM
RaiseFailFastException
CharNextA
CallNtPowerInformation
GetPwrCapabilities
ApiSetQueryApiSetPresence
StrRetToStrW
SHIsChildOrSelf
ord478
ord481
StrRetToBufW
AssocQueryStringW
ord544
SHPinDllOfCLSID
ord165
ord292
ord479
PathRemoveArgsW
SHCreateWorkerWindowW
ord279
ord635
ShellMessageBoxW
IUnknown_GetWindow
ord197
ord509
GetDisplayConfigBufferSizes
QueryDisplayConfig
EnumDisplayMonitors
GetSystemMetrics
GetMonitorInfoW
EnumDisplayDevicesW
SystemParametersInfoW
IntersectRect
IsRectEmpty
CopyRect
SubtractRect
UnionRect
PtInRect
OffsetRect
SetRectEmpty
EqualRect
SetRect
InflateRect
NotifyWinEvent
UnhookWinEvent
SetWinEventHook
ILIsParent
ILCombine
ILIsEqual
SHGetNameFromIDList
ILClone
ILGetSize
ILFree
ILFindLastID
SHBindToParent
SHGetIDListFromObject
SHBindToObject
ILCloneFirst
ILRemoveLastID
SHBindToFolderIDListParent
SHParseDisplayName
SHCreateItemFromIDList
SHCreateItemFromParsingName
DXGIDeclareAdapterRemovalSupport
EnableMouseInPointer
GetPointerInfo
GetPointerDevices
GetCurrentInputMessageSource
GetPointerType
GetThreadFlags
SHGetKnownFolderIDList
SetThreadFlags
SHGetFolderPathEx
MsgWaitForMultipleObjects
MsgWaitForMultipleObjectsEx
GetPackagesByPackageFamily
GetPackageFullName
SetWindowFeedbackSetting
RegisterClipboardFormatW
DragQueryFileW
GetWindowBand
CreateWindowInBand
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
SHChangeNotification_Unlock
SHHandleUpdateImage
SHChangeNotifyRegister
SHChangeNotifyDeregister
SHChangeNotification_Lock
SHChangeNotifyRegisterThread
PSPropertyBag_WriteStr
PropVariantToBoolean
PSCreateMemoryPropertyStore
PropVariantToUInt32
PSGetPropertyFromPropertyStorage
InitVariantFromResource
InitVariantFromGUIDAsString
PSPropertyBag_WriteDWORD
PropVariantToStringAlloc
SHChangeNotify
SHCreateDataObject
ParseApplicationUserModelId
FindPackagesByPackageFamily
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
CreateRectRgnIndirect
StretchBlt
DeleteDC
CreateCompatibleDC
SelectObject
GetClipBox
GetCurrentObject
ExcludeClipRect
GetGlyphOutlineW
SetStretchBltMode
GetTextExtentPoint32W
GetDeviceCaps
GetStockObject
CreateRectRgn
SetRectRgn
OffsetRgn
CombineRgn
DeleteObject
SelectClipRgn
GetObjectW
GetClipRgn
GetOutlineTextMetricsW
ExtTextOutW
GetTextMetricsW
SetTextAlign
SetTextColor
CreateFontIndirectW
Rectangle
SetProcessDEPPolicy
IsBadWritePtr
GetModuleHandleExA
HeapDestroy
HeapReAlloc
HeapSize
RtlCompareMemory
InternetCrackUrlW
ord187
ord186
ord162
ord123
ord191
ord190
ord121
ord174
ord109
ord126
ord183
ord192
ord1
SHUnicodeToAnsi
ord141
ord142
ord200
ord184
ord907
ord43
ord723
Shell_GetCachedImageIndexW
ord790
ord792
ord727
ord162
SHAppBarMessage
ord894
ord906
ord181
ord895
SHGetLocalizedName
SHGetPropertyStoreForWindow
ord764
ord866
ord244
ExtractIconExW
ord132
ord137
Shell_NotifyIconW
Shell_NotifyIconGetRect
ord6
SHGetStockIconInfo
DuplicateIcon
ShellExecuteW
ord91
ord254
ord54
SHEnableServiceObject
ord61
ord896
SHAddToRecentDocs
ord60
SHUpdateRecycleBinIcon
ord711
SHFileOperationW
SHGetPathFromIDListW
ord753
ord733
ord67
SHCreateItemInKnownFolder
ord206
ord201
ord188
ord899
ShellExecuteExW
ord245
ord200
ord89
ord190
ord85
ord100
ord743
ord134
ord22
ord850
ord95
ord885
ord680
ord172
SHEvaluateSystemCommandTemplate
ord164
PathIsDirectoryW
ord413
ord548
ord163
ord467
AssocQueryKeyW
ChrCmpIW
AssocCreate
PathIsRelativeW
EndBufferedPaint
BufferedPaintUnInit
GetWindowTheme
SetWindowTheme
GetThemeMetric
BeginBufferedPaint
DrawThemeParentBackground
GetThemeColor
DrawThemeBackground
GetThemeInt
ord86
GetBufferedPaintBits
CloseThemeData
BufferedPaintInit
IsThemeActive
GetThemePartSize
DrawThemeTextEx
ord126
IsCompositionActive
BufferedPaintSetAlpha
ord138
GetThemeMargins
OpenThemeDataForDpi
OpenThemeData
GetThemeBool
GetThemeBackgroundExtent
IsThemePartDefined
IsAppThemed
GetThemeFont
ord124
ord139
DwmEnableBlurBehindWindow
DwmUnregisterThumbnail
ord113
DwmSetWindowAttribute
ord141
DwmUpdateThumbnailProperties
DwmIsCompositionEnabled
DwmQueryThumbnailSourceSize
ord159
DwmGetWindowAttribute
ord114
ord138
DwmRegisterThumbnail
ord140
TrackMouseEvent
SetCapture
GetCapture
ReleaseCapture
GetDoubleClickTime
CalculatePopupWindowPosition
CopyIcon
GetLastInputInfo
GetCursorFrameInfo
AdjustWindowRect
GetDpiForWindow
SetWindowCompositionAttribute
DestroyIcon
CopyImage
GetSysColor
GetCaretBlinkTime
InjectKeyboardInput
LockWorkStation
TileWindows
CascadeWindows
HungWindowFromGhostWindow
LoadIconW
IsIconic
GetKeyState
ExitWindowsEx
EndDialog
SendDlgItemMessageW
RegisterHotKey
GetSystemMetricsForDpi
GetLastActivePopup
SwitchToThisWindow
ord2574
IsHungAppWindow
AdjustWindowRectEx
GetDC
ReleaseDC
CreatePopupMenu
GetMenuDefaultItem
DestroyMenu
LoadCursorW
SetCursor
SetMenuItemInfoW
MonitorFromWindow
MapVirtualKeyExW
SendInput
SetDesktopColorTransform
UnregisterClassA
DefWindowProcA
IsWindowUnicode
LoadAcceleratorsW
ord2005
SetGestureConfig
LoadImageW
CheckMenuItem
EnableMenuItem
UnregisterHotKey
RemoveMenu
SetMenuDefaultItem
InjectMouseInput
DeleteMenu
FillRect
DrawTextW
GetGuiResources
LoadMenuW
GetSubMenu
CreateIconIndirect
GetMenuItemCount
GetMenuItemInfoW
MonitorFromPoint
ReplyMessage
GetAsyncKeyState
ModifyMenuW
ChangeWindowMessageFilterEx
TranslateAcceleratorW
GetSystemMenu
GetSysColorBrush
SetLayeredWindowAttributes
GetIconInfoExW
GetIconInfo
GetClassWord
GetClassLongW
GetPhysicalCursorPos
GetCursorInfo
ShowWindowAsync
InsertMenuW
BringWindowToTop
ord2573
GhostWindowFromHungWindow
EndTask
IsTopLevelWindow
ord2611
GetMenuState
SetScrollInfo
GetScrollInfo
SetScrollPos
GetMenuStringW
InternalGetWindowText
GetLayeredWindowAttributes
DrawTextExW
IsProcessDPIAware
DrawIconEx
SetThreadDpiAwarenessContext
MonitorFromRect
GetWindowCompositionAttribute
GetWindowProcessHandle
UpdateLayeredWindow
ord2521
UnregisterClassW
ord2522
WindowFromDC
GetMenuInfo
SetMenuInfo
GetDpiForSystem
GetWindowDpiAwarenessContext
AreDpiAwarenessContextsEqual
CharLowerW
IsCharAlphaNumericW
TrackPopupMenuEx
GetUserNameExW
ResolveDelayLoadedAPI
DelayLoadFailureHook
LCIDToLocaleName
PowerSetRequest
VerifyVersionInfoW
PowerCreateRequest
OOBEComplete
CopyFileW
SetTermsrvAppInstallMode
ord292
StartTraceW
EnableTraceEx2
StopTraceW
IsProcessInJob
RpcBindingFromStringBindingW
RpcStringBindingComposeW
I_RpcExceptionFilter
RpcBindingSetAuthInfoExW
NdrClientCall2
RpcBindingFree
RpcStringFreeW
GetStagedPackagePathByFullName2
BiPtEnumerateWorkItemsForPackageName
BiPtAssociateApplicationEntryPoint
BiPtFreeMemory
BiPtQueryWorkItem
IsDeveloperModeEnabled
GetShellWindow
RoCreatePropertySetSerializer
SetErrorInfo
GetErrorInfo
g_trayTriageBlock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ