shell32[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

shell32.dll
Size

8.5MB
MD5

92148669c29d9f909c3ee28b7d83a1de
SHA1

24cf72c7d44e77c8959c26c9372f1cdade612118
SHA256

b45955e7d5c9d7806e1718a300a76435fa76fd35bebd4404101d3b6af46959fb
SHA512

dc15b361365b768fe8b2e4429f06124b788339f5ed75546cab975a2787fbe24e604816003855256584a2078d7be4732a5827c52d35a249a67baf7eb5e2362f9e
SSDEEP

98304:SdO4MyDOX7JO+F9U4gyS23LnxCheuAwDTDAqLX6elt:SdO4t8JO+Ppj7gheuAwDTDVLX6er

Score

1^/10

Malware Config

Signatures

Files

shell32.dll
.dll regsvr32 windows:10 windows x64 arch:x64

20ef7206ba7177d53738a37d38827ca5

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

91:60:a8:65:b6:f0:61:1e:55:37:f3:20:46:8e:54:cc:8e:95:a0:08:ec:0c:3f:2e:54:36:38:9d:02:3b:35:a6
Signer

Actual PE Digest

91:60:a8:65:b6:f0:61:1e:55:37:f3:20:46:8e:54:cc:8e:95:a0:08:ec:0c:3f:2e:54:36:38:9d:02:3b:35:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

shell32.pdb

Imports

msvcp_win

?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAPEAV12@PEAG_J@Z
?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAAXAEBVlocale@2@@Z
?epptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGXZ
?setg@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG00@Z
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?tellp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?width@ios_base@std@@QEAA_J_J@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?pptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?gptr@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?eback@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?setp@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXPEAG0@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEBAPEAGXZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAPEAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?uncaught_exception@std@@YA_NXZ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Xbad_function_call@std@@YAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Thrd_yield
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAAXXZ
?width@ios_base@std@@QEBA_JXZ
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ

api-ms-win-crt-string-l1-1-0

wcspbrk
wcsncmp
wcscspn
memset
strncmp
wcscmp
wcsspn

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o_isalpha
_o_isdigit
_o_iswspace
_o_log
_o_logf
_o_malloc
_o_pow
_o_qsort
_o_rand
_o_realloc
_o_sqrt
_o_sqrtf
_o_srand
_o_strncpy_s
_o_strtol
_o_terminate
_o_towlower
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstok_s
_o_wcstol
_o_wcstoul
memmove
strchr
wcsrchr
__CxxFrameHandler3
__current_exception
__current_exception_context
_o_ceilf
_o_ceil
_o_calloc
_o_abort
_o__wtoi
_o__wcstoui64
_o__wcsnicmp
_o__wcsicmp
_o__ui64tow_s
_o_free
_o__strnicmp
_o__set_errno
_o__seh_filter_dll
_o__resetstkoflw
_o__register_onexit_function
_o__purecall
_o__itow
_o_floorf
_o_floor
_o_expf
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_onexit_table
_o__initialize_narrow_environment
_o__get_errno
_o__execute_onexit_table
_o__errno
_o__difftime64
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
__std_terminate
__CxxFrameHandler4
wcschr
wcsstr
__C_specific_handler
_o_powf
_CxxThrowException
memcmp
memcpy

api-ms-win-core-heap-l2-1-0

GlobalAlloc
LocalReAlloc
GlobalFree
LocalFree
LocalAlloc

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey
RegNotifyChangeKeyValue
RegDeleteKeyExW
RegGetValueW
RegDeleteValueW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteTreeW
RegCreateKeyExW
RegQueryInfoKeyA
RegOpenCurrentUser
RegQueryValueExA
RegQueryValueExW
RegOpenKeyExA
RegGetKeySecurity
RegEnumKeyExW

api-ms-win-core-libraryloader-l1-2-0

FreeResource
FindStringOrdinal
LoadLibraryExA
LoadStringA
GetModuleHandleW
GetModuleFileNameW
LoadStringW
LoadLibraryExW
DisableThreadLibraryCalls
FindResourceExW
LockResource
GetProcAddress
GetModuleFileNameA
SizeofResource
EnumResourceNamesExW
GetModuleHandleExW
LoadResource
GetModuleHandleExA
FreeLibrary

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetVersionExW
GetLocalTime
GetSystemInfo
GetWindowsDirectoryW
GetSystemTime
GlobalMemoryStatusEx
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount
GetSystemWindowsDirectoryW
GetComputerNameExW

api-ms-win-core-memory-l1-1-0

ReadProcessMemory
CreateFileMappingW
VirtualAlloc
UnmapViewOfFile
VirtualProtect
VirtualQuery
MapViewOfFile
OpenFileMappingW
VirtualFree
WriteProcessMemory

api-ms-win-core-file-l1-1-0

GetFileSize
ReadFile
SetFilePointer
GetVolumePathNameW
GetFinalPathNameByHandleW
SetFileInformationByHandle
GetTempFileNameW
GetDiskFreeSpaceW
SetFileTime
CompareFileTime
SetFilePointerEx
QueryDosDeviceW
GetShortPathNameW
FlushFileBuffers
GetFullPathNameW
GetDiskFreeSpaceExW
FindFirstVolumeW
CreateFileW
GetDriveTypeW
FindNextVolumeW
LocalFileTimeToFileTime
FindVolumeClose
GetLongPathNameW
FindFirstFileExW
FindClose
CreateDirectoryW
SetEndOfFile
GetLogicalDrives
GetVolumeInformationW
WriteFile
GetFileAttributesExW
FileTimeToLocalFileTime
RemoveDirectoryW
GetFileSizeEx
SetFileAttributesW
DeleteFileW
DefineDosDeviceW
FindFirstFileW
FindNextFileW
GetFileInformationByHandle
GetFileAttributesW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW
FindResourceW

api-ms-win-core-string-l1-1-0

CompareStringW
WideCharToMultiByte
GetStringTypeW
GetStringTypeExW
CompareStringOrdinal
MultiByteToWideChar
CompareStringEx

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
OpenSemaphoreW
CreateSemaphoreExW
SetEvent
CreateEventW
OpenEventW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
ResetEvent
InitializeCriticalSection
CreateEventExW
TryEnterCriticalSection
DeleteCriticalSection
CreateMutexW
TryAcquireSRWLockShared
ReleaseSRWLockShared
WaitForMultipleObjectsEx
ReleaseMutex
OpenMutexW
AcquireSRWLockExclusive
InitializeSRWLock
WaitForSingleObject
CreateMutexExW
AcquireSRWLockShared
WaitForSingleObjectEx

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError
GetLastError
SetErrorMode

api-ms-win-core-processthreads-l1-1-0

DeleteProcThreadAttributeList
OpenProcessToken
SetThreadToken
CreateProcessW
OpenThread
SetThreadPriority
GetCurrentProcess
ExitProcess
GetCurrentProcessId
UpdateProcThreadAttribute
ProcessIdToSessionId
GetCurrentThreadId
TlsFree
ResumeThread
SetPriorityClass
CreateThread
GetThreadPriority
TlsAlloc
GetProcessId
GetThreadId
GetCurrentThread
GetExitCodeThread
CreateProcessAsUserW
OpenThreadToken
TlsGetValue
TlsSetValue
InitializeProcThreadAttributeList
GetExitCodeProcess
TerminateProcess

api-ms-win-core-string-l2-1-0

CharUpperBuffW
CharNextW
CharLowerBuffW
CharUpperW
IsCharAlphaW
CharPrevW
CharLowerW

api-ms-win-core-file-l2-1-0

CopyFile2
MoveFileExW
CreateHardLinkW
ReplaceFileW
GetFileInformationByHandleEx

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
SetEnvironmentVariableW
SetCurrentDirectoryW
GetEnvironmentVariableW
GetCurrentDirectoryW
SearchPathW

api-ms-win-security-base-l1-1-0

DuplicateTokenEx
GetSecurityDescriptorOwner
ImpersonateSelf
RevertToSelf
DeleteAce
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSidSubAuthorityCount
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
GetSecurityDescriptorControl
DuplicateToken
FreeSid
AllocateAndInitializeSid
AddAccessDeniedAceEx
InitializeAcl
SetFileSecurityW
SetSecurityDescriptorOwner
AddAccessAllowedAceEx
AddAce
GetAce
GetAclInformation
CopySid
GetLengthSid
IsValidSid
AccessCheck
GetFileSecurityW
CheckTokenMembership
CreateWellKnownSid
EqualSid
IsWellKnownSid
GetTokenInformation
SetTokenInformation
AdjustTokenPrivileges
GetSidIdentifierAuthority

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
Sleep
InitOnceExecuteOnce
InitOnceComplete

api-ms-win-core-heap-l1-1-0

HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
HeapDestroy

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolWait
CloseThreadpoolWork
CloseThreadpoolTimer
SetThreadpoolWait
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolWaitCallbacks
CreateThreadpoolWork
SubmitThreadpoolWork
TrySubmitThreadpoolCallback
CloseThreadpoolWait

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
GetCPInfo
IsDBCSLeadByte
GetThreadLocale
LCMapStringEx
FindNLSString
IsValidLocaleName
LCMapStringW
GetSystemDefaultLangID
GetACP
FormatMessageW
GetUserDefaultLangID
VerLanguageNameW
GetSystemDefaultLCID
GetUserDefaultLCID
ResolveLocaleName
FindNLSStringEx
GetUserPreferredUILanguages
GetSystemPreferredUILanguages
GetLocaleInfoW
LocaleNameToLCID
GetThreadUILanguage

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformationForYear
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW
K32GetModuleFileNameExW
K32GetProcessImageFileNameW

api-ms-win-core-path-l1-1-0

PathCchRemoveBackslash
PathCchSkipRoot
PathCchRemoveExtension
PathCchAddBackslash
PathAllocCombine
PathCchRenameExtension
PathIsUNCEx
PathCchStripPrefix
PathCchAddBackslashEx
PathCchCombineEx
PathCchAppend
PathCchAppendEx
PathCchCanonicalize
PathCchStripToRoot
PathCchAddExtension
PathCchCombine
PathCchRemoveFileSpec
PathAllocCanonicalize

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
GetTempPathW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl
GetQueuedCompletionStatus
CreateIoCompletionPort
CancelIoEx

api-ms-win-core-datetime-l1-1-0

GetDateFormatW

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo
GetProductInfo
GetSystemTimePreciseAsFileTime
VerSetConditionMask

api-ms-win-core-string-l2-1-1

SHLoadIndirectString

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-file-l1-2-1

GetCompressedFileSizeW

api-ms-win-core-file-l1-2-4

GetTempPath2W

api-ms-win-core-wow64-l1-1-0

Wow64RevertWow64FsRedirection
Wow64DisableWow64FsRedirection

api-ms-win-core-wow64-l1-1-1

Wow64SetThreadDefaultGuestMachine
IsWow64Process2
GetSystemWow64DirectoryW

api-ms-win-core-localization-l1-2-2

LCIDToLocaleName

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache
OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-realtime-l1-1-0

QueryUnbiasedInterruptTime

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx

api-ms-win-core-io-l1-1-1

CancelSynchronousIo

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-core-sysinfo-l1-2-3

GetIntegratedDisplaySize

api-ms-win-core-memory-l1-1-1

PrefetchVirtualMemory

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventActivityIdControl
EventUnregister
EventRegister
EventSetInformation

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
RegisterTraceGuidsW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrToIntA
StrPBrkW
StrCmpNCW
StrDupA
StrCmpW
StrCSpnW
StrTrimW
StrCmpLogicalW
StrDupW
StrCmpNICW
StrToIntExW
StrCmpIW
StrCmpICA
QISearch
StrToIntW
StrCmpICW
StrStrW
StrStrIW
StrStrIA
StrStrA
StrRStrIW
StrRStrIA
StrRChrW
StrRChrIW
StrRChrIA
StrRChrA
StrCmpNW
StrCmpNIW
StrCmpNIA
StrCmpNA
StrChrW
StrChrIW
StrChrIA
StrChrA
StrSpnW
StrCmpCW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW
lstrcmpA
lstrcmpiA
lstrlenW
lstrlenA

api-ms-win-core-stringansi-l1-1-0

CharPrevA
CharNextA

api-ms-win-core-heap-obsolete-l1-1-0

GlobalReAlloc
LocalSize
GlobalFlags
GlobalUnlock
GlobalSize
GlobalLock

api-ms-win-core-localization-obsolete-l1-2-0

EnumUILanguagesW
GetNumberFormatW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileSectionW
GetPrivateProfileStringW
GetProfileSectionW
WritePrivateProfileStringW

api-ms-win-core-atoms-l1-1-0

FindAtomW
GlobalDeleteAtom
GetAtomNameW
GlobalGetAtomNameW
GlobalAddAtomW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsRootA
SHExpandEnvironmentStringsA
PathAppendA
PathIsUNCW
PathQuoteSpacesW
PathAppendW
PathStripPathW
PathGetDriveNumberW
PathUnExpandEnvStringsW
PathGetArgsW
PathRemoveExtensionW
PathUnquoteSpacesW
PathAddBackslashW
PathFileExistsW
IsCharSpaceW
PathIsPrefixW
PathIsSameRootW
PathRemoveBlanksW
PathParseIconLocationW
PathMatchSpecExW
PathCommonPrefixW
PathRemoveFileSpecW
PathSkipRootW
PathIsUNCServerShareW
PathIsUNCServerW
PathFindNextComponentW
PathIsFileSpecW
PathIsRelativeW
PathFindExtensionW
PathIsValidCharW
PathGetCharTypeW
PathIsRootW
PathRemoveBackslashW
PathRemoveFileSpecA
SHExpandEnvironmentStringsW
PathMatchSpecW
PathStripToRootW
PathCombineW
PathFindFileNameW

api-ms-win-core-kernel32-legacy-l1-1-0

GetShortPathNameA
GetComputerNameW
UnregisterWait
RegisterWaitForSingleObject
MulDiv
GetSystemPowerStatus
SetVolumeLabelW
WTSGetActiveConsoleSessionId

api-ms-win-core-kernel32-legacy-l1-1-1

PowerClearRequest
PowerCreateRequest
PowerSetRequest
VerifyVersionInfoW

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx
DeleteTimerQueueTimer
CreateTimerQueueTimer
QueueUserWorkItem

api-ms-win-core-kernel32-legacy-l1-1-2

GetBinaryTypeW

api-ms-win-core-url-l1-1-0

PathIsURLW
UrlIsW
PathCreateFromUrlW
ParseURLW
UrlApplySchemeW
HashData
UrlFixupW
UrlCanonicalizeW
UrlCreateFromPathW
UrlCompareW
UrlEscapeW
UrlGetPartW
PathCreateFromUrlAlloc
UrlUnescapeW
UrlUnescapeA

api-ms-win-core-registryuserspecific-l1-1-0

SHRegCloseUSKey
SHRegOpenUSKeyW
SHRegGetBoolUSValueW
SHRegGetUSValueW
SHRegEnumUSKeyW
SHRegOpenUSKeyA
SHRegQueryUSValueW

api-ms-win-core-kernel32-private-l1-1-0

CheckElevationEnabled
CheckElevation

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-sidebyside-l1-1-0

ReleaseActCtx
ActivateActCtx
QueryActCtxW
CreateActCtxW
DeactivateActCtx

api-ms-win-shell-shellcom-l1-1-0

SHCoCreateInstance

kernelbase

GetPackagesByPackageFamily
GetCurrentPackageInfo
SHLoadIndirectStringInternal
OpenState
OpenStateExplicit
GetStateFolder
CloseState
ParseApplicationUserModelId
PackageNameAndPublisherIdFromFamilyName
GetEffectivePackageStatusForUser
NotifyRedirectedStringChange
GetStagedPackagePathByFullName2
IsMrtResourceRedirectionEnabled
OpenPackageInfoByFullName
GetPackageInfo
ClosePackageInfo
GetSystemAppDataKey
GetPackageFullName

user32

wsprintfW
UnpackDDElParam
DdeInitializeW
DdeUninitialize
DdeNameService
DdeDisconnect
DdeQueryStringW
DdeFreeStringHandle
DdeCreateStringHandleW
DdeCreateDataHandle
DdeGetLastError
DdeGetData
DdeQueryConvInfo
WaitMessage
LockWindowUpdate
EnumDisplaySettingsW
GetClassLongPtrW
SetShellWindowEx
EnumDisplayMonitors
ord2707
CreateAcceleratorTableW
GetMessageTime
CheckRadioButton
GetDlgItemInt
SetDlgItemInt
ClientToScreen
IsRectEmpty
SetParent
WindowFromPoint
GetSystemMenu
PostThreadMessageW
SetDialogDpiChangeBehavior
IsDialogMessageW
SetCapture
ReleaseCapture
GetCapture
TrackPopupMenuEx
GetClassInfoExW
SetMenuInfo
SetCoalescableTimer
CallNextHookEx
CallWindowProcW
SetScrollPos
ord2705
ShowScrollBar
SetScrollInfo
SetWindowRgn
SetWindowsHookExW
UnhookWindowsHookEx
GetDialogBaseUnits
SystemParametersInfoForDpi
GetLastInputInfo
SystemParametersInfoA
WinHelpW
CreateWindowExW
FindWindowExW
RegisterWindowMessageA
DrawTextExW
ActivateKeyboardLayout
AdjustWindowRectExForDpi
SubtractRect
CreateWindowIndirect
SetLayeredWindowAttributes
GetWindowDC
GetPointerDevices
SetRectEmpty
DialogBoxParamW
GetDpiForWindow
BroadcastSystemMessageW
GetShellWindow
GetWindowPlacement
MsgWaitForMultipleObjects
EnumChildWindows
CloseClipboard
SetClipboardData
GetClipboardData
OpenClipboard
RedrawWindow
IsWindowEnabled
SetClipboardViewer
TranslateAcceleratorW
CreateMenu
EndMenu
GetMessageExtraInfo
SetGestureConfig
CloseGestureInfoHandle
GetGestureInfo
ChangeClipboardChain
CheckMenuItem
CheckMenuRadioItem
AppendMenuW
SetMessageExtraInfo
NotifyWinEvent
CloseDesktop
OpenInputDesktop
CreateWindowInBand
GetDpiForSystem
GetSystemMetricsForDpi
EndDeferWindowPos
BeginDeferWindowPos
AdjustWindowRect
GetDlgCtrlID
SetDlgItemTextA
MessageBoxW
DeferWindowPos
DestroyAcceleratorTable
CopyAcceleratorTableW
LoadAcceleratorsW
MoveWindow
GetWindowDpiAwarenessContext
SetThreadDpiAwarenessContext
AttachThreadInput
DefWindowProcA
IsWindowUnicode
RegisterShellHookWindow
DeregisterShellHookWindow
SetTaskmanWindow
GetTaskmanWindow
GetClassInfoW
GetWindowTextLengthW
CopyImage
MapDialogRect
GetComboBoxInfo
SetActiveWindow
DrawIconEx
IsProcessDPIAware
GetProcessDefaultLayout
MonitorFromRect
EnumPropsExW
GetWindowBand
SystemParametersInfoW
IsSETEnabled
EqualRect
IntersectRect
MonitorFromWindow
GetAsyncKeyState
ord2521
UpdateLayeredWindow
GetDoubleClickTime
SetShellWindow
UnionRect
EnumDisplayDevicesW
SetWindowCompositionAttribute
RegisterClassExW
GetScrollInfo
GetDesktopWindow
ReleaseDC
GetDC
SendNotifyMessageW
IsIconic
CopyIcon
EnumWindows
GetPropW
RemovePropW
SetPropW
PtInRect
DrawTextW
SetMenuItemInfoW
IsMenu
MessageBeep
GetMenuItemID
SetMenuDefaultItem
ModifyMenuW
GetMenuState
CountClipboardFormats
IsHungAppWindow
GetClipboardOwner
EnableMenuItem
GetMenuStringW
ExitWindowsEx
GetFocus
LoadImageW
SetRect
CopyRect
GetMonitorInfoW
MonitorFromPoint
GetUserObjectInformationW
GetThreadDesktop
GetProcessWindowStation
ChangeWindowMessageFilterEx
RegisterWindowMessageW
TrackPopupMenu
InsertMenuItemW
InsertMenuW
GetMessagePos
GetMenuItemInfoW
GetMenuItemCount
GetForegroundWindow
GetKeyboardLayout
MapWindowPoints
OffsetRect
IsWindow
WaitForInputIdle
SendMessageTimeoutW
AllowSetForegroundWindow
GetWindowThreadProcessId
GetMenuDefaultItem
GetLastActivePopup
SwitchToThisWindow
GetCursorPos
RegisterClipboardFormatW
GetWindow
FindWindowW
GetClassNameW
GetAncestor
EnableWindow
MsgWaitForMultipleObjectsEx
PeekMessageW
PostQuitMessage
SetForegroundWindow
ShutdownBlockReasonDestroy
ShutdownBlockReasonCreate
LoadMenuW
GetSubMenu
RemoveMenu
GetParent
IsDlgButtonChecked
CheckDlgButton
DeleteMenu
DestroyMenu
CreatePopupMenu
PostMessageW
SetProcessDPIAware
DispatchMessageW
TranslateMessage
GetMessageW
SetFocus
IsWindowVisible
DrawEdge
GetSysColorBrush
FillRect
EndPaint
BeginPaint
GetUpdateRect
TrackMouseEvent
UpdateWindow
GetWindowRect
DefWindowProcW
RegisterClassW
KillTimer
SetTimer
GetKeyState
InflateRect
AdjustWindowRectEx
DestroyWindow
SetWindowLongW
GetWindowLongW
DrawFocusRect
DrawIcon
GetSysColor
EndDialog
GetWindowLongPtrW
SetWindowLongPtrW
GetWindowTextW
SetWindowPos
GetClientRect
ShowWindow
SetWindowTextW
GetDlgItem
InvalidateRect
LoadCursorW
SetCursor
SetDlgItemTextW
GetDlgItemTextW
SendDlgItemMessageW
ScreenToClient
SendMessageW
LookupIconIdFromDirectory
CreateIconIndirect
GetIconInfo
DestroyIcon
PrivateExtractIconsW
LoadIconW
GetSystemMetrics
DisplayConfigGetDeviceInfo
SetSysColors
SetWinEventHook
UnhookWinEvent
IsWinEventHookInstalled
GetMenuInfo
HideCaret
ShowCaret
LockSetForegroundWindow
SetMenu
ChildWindowFromPoint
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
GetClassLongW
QueryDisplayConfig
AreDpiAwarenessContextsEqual
WindowFromDC
GetCursor
GetCurrentInputMessageSource
AnimateWindow
EmptyClipboard
GetDisplayConfigBufferSizes
DialogBoxIndirectParamW
CreateDialogParamW
IsChild

ntdll

RtlAreLongPathsEnabled
RtlQueryResourcePolicy
EtwEventWriteTransfer
RtlInitUnicodeString
RtlPrefixString
NtQueryInformationFile
RtlNtStatusToDosError
NtCreateFile
NtFsControlFile
NtOpenThreadToken
EtwLogTraceEvent
NtQuerySystemInformationEx
RtlCompareUnicodeString
RtlNtStatusToDosErrorNoTeb
RtlAllocateHeap
NtSetInformationToken
NtUnmapViewOfSection
RtlImageNtHeaderEx
NtMapViewOfSection
RtlQueryWnfStateData
RtlGetNtSystemRoot
RtlQueryRegistryValuesEx
RtlInitializeResource
RtlAcquireResourceExclusive
RtlReleaseResource
RtlDeleteResource
RtlCheckRegistryKey
NtQuerySystemInformation
NtQueryObject
RtlIsPartialPlaceholder
NtQueryKey
NtSetSecurityObject
NtQuerySecurityObject
RtlDosPathNameToNtPathName_U
ShipAssert
RtlIsNonEmptyDirectoryReparsePointAllowed
ZwQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlRandomEx
RtlCreateUnicodeString
RtlIsThreadWithinLoaderCallout
RtlCreateServiceSid
RtlLengthRequiredSid
RtlGetNtProductType
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
NtPowerInformation
WinSqmSetDWORD
NtQueryInformationProcess
NtQueryAttributesFile
RtlDosPathNameToRelativeNtPathName_U
RtlPublishWnfStateData
NtQueryWnfStateData
NtOpenProcessToken
NtQueryInformationToken
RtlDllShutdownInProgress
WinSqmAddToStreamEx
WinSqmAddToStream
NtSetCachedSigningLevel
NtCompareSigningLevels
NtGetCachedSigningLevel
RtlMapGenericMask
WinSqmIncrementDWORD
EtwTraceMessage
EtwEventWrite
EtwEventEnabled
EtwEventActivityIdControl
EtwEventRegister
EtwEventUnregister
EtwEventSetInformation
RtlDestroyEnvironment
RtlSetCurrentEnvironment
RtlCreateEnvironment
RtlExpandEnvironmentStrings_U
RtlSetEnvironmentVariable
RtlQueryEnvironmentVariable_U
RtlInitUnicodeStringEx
RtlGetLastNtStatus
NtQueryInformationThread
RtlFreeUnicodeString
RtlReleaseRelativeName
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtQueryVolumeInformationFile
RtlFreeHeap
RtlDosPathNameToNtPathName_U_WithStatus
NtOpenFile
NtSetInformationFile
RtlUnicodeStringToOemString
NtClose

gdi32

DeleteObject
GetLayout
SetLayout
GetStockObject
ExcludeClipRect
SetBkMode
SelectObject
SetTextColor
OffsetWindowOrgEx
SetWindowOrgEx
GetObjectW
GetTextExtentPointW
GetDeviceCaps
CreateDIBSection
CreateCompatibleDC
DeleteDC
CreateDCW
GdiAlphaBlend
BitBlt
CreateFontIndirectW
CreateCompatibleBitmap
CreateBitmap
CreateSolidBrush
GetDIBits
StretchBlt
GdiTransparentBlt
GetTextColor
GetCurrentObject
CreatePen
Rectangle
GetTextMetricsW
GetTextExtentPoint32W
SetTextAlign
SetStretchBltMode
PatBlt
MoveToEx
LineTo
CreatePolygonRgn
GetTextAlign
SetMapMode
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
StretchDIBits
GetClipBox
CreateRectRgn
GetClipRgn
IntersectClipRect
SelectClipRgn
LPtoDP
SetMetaFileBitsEx
PlayMetaFile
DeleteMetaFile
SetBkColor
GetViewportOrgEx
ExtSelectClipRgn
SetDCBrushColor
CreateRectRgnIndirect
RestoreDC
SaveDC
CombineRgn
GetRgnBox
GetRegionData
GetWindowOrgEx
GetObjectType
ExtTextOutW
GetDIBColorTable
GetPixel
CreateFontW
GetTextExtentPoint32A
TextOutA

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-job-l2-1-0

SetInformationJobObject
CreateJobObjectW
AssignProcessToJobObject

api-ms-win-crt-time-l1-1-0

_time64

Exports

Exports

AppCompat_RunDLLW
AssocCreateForClasses
AssocElemCreateForKey
AssocGetDetailsOfPropKey
CDefFolderMenu_Create2
CIDLData_CreateFromIDArray
CStorageItem_GetValidatedStorageItemObject
CallFileCopyHook
CheckEscapesW
CommandLineToArgvW
Control_RunDLL
Control_RunDLLA
Control_RunDLLAsUserW
Control_RunDLLW
CreateStorageItemFromPath_FullTrustCaller
CreateStorageItemFromPath_FullTrustCaller_ForPackage
CreateStorageItemFromPath_PartialTrustCaller
CreateStorageItemFromShellItem_FullTrustCaller
CreateStorageItemFromShellItem_FullTrustCaller_ForPackage
CreateStorageItemFromShellItem_FullTrustCaller_ForPackage_WithProcessHandle
CreateStorageItemFromShellItem_FullTrustCaller_UseImplicitFlagsAndPackage
DAD_AutoScroll
DAD_DragEnterEx
DAD_DragEnterEx2
DAD_DragLeave
DAD_DragMove
DAD_SetDragImage
DAD_ShowDragImage
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
DllGetVersion
DllInstall
DllRegisterServer
DllUnregisterServer
DoEnvironmentSubstA
DoEnvironmentSubstW
DragAcceptFiles
DragFinish
DragQueryFile
DragQueryFileA
DragQueryFileAorW
DragQueryFileW
DragQueryPoint
DriveType
DuplicateIcon
ExtractAssociatedIconA
ExtractAssociatedIconExA
ExtractAssociatedIconExW
ExtractAssociatedIconW
ExtractIconA
ExtractIconEx
ExtractIconExA
ExtractIconExW
ExtractIconW
FindExecutableA
FindExecutableW
FreeIconList
GetCurrentProcessExplicitAppUserModelID
GetFileNameFromBrowse
GetSystemPersistedStorageItemList
ILAppendID
ILClone
ILCloneFirst
ILCombine
ILCreateFromPath
ILCreateFromPathA
ILCreateFromPathW
ILFindChild
ILFindLastID
ILFree
ILGetNext
ILGetSize
ILIsEqual
ILIsParent
ILLoadFromStreamEx
ILRemoveLastID
ILSaveToStream
InitNetworkAddressControl
InternalExtractIconListA
InternalExtractIconListW
IsDesktopExplorerProcess
IsLFNDrive
IsLFNDriveA
IsLFNDriveW
IsNetDrive
IsProcessAnExplorer
IsUserAnAdmin
LaunchMSHelp_RunDLLW
OpenAs_RunDLL
OpenAs_RunDLLA
OpenAs_RunDLLW
OpenRegStream
Options_RunDLL
Options_RunDLLA
Options_RunDLLW
PathCleanupSpec
PathGetShortPath
PathIsExe
PathIsSlowA
PathIsSlowW
PathMakeUniqueName
PathQualify
PathResolve
PathYetAnotherMakeUniqueName
PickIconDlg
PifMgr_CloseProperties
PifMgr_GetProperties
PifMgr_OpenProperties
PifMgr_SetProperties
PrepareDiscForBurnRunDllW
PrintersGetCommand_RunDLL
PrintersGetCommand_RunDLLA
PrintersGetCommand_RunDLLW
ReadCabinetState
RealDriveType
RealShellExecuteA
RealShellExecuteExA
RealShellExecuteExW
RealShellExecuteW
RegenerateUserEnvironment
RestartDialog
RestartDialogEx
RunAsNewUser_RunDLLW
SHAddDefaultPropertiesByExt
SHAddFromPropSheetExtArray
SHAddToRecentDocs
SHAlloc
SHAppBarMessage
SHAssocEnumHandlers
SHAssocEnumHandlersForProtocolByApplication
SHBindToFolderIDListParent
SHBindToFolderIDListParentEx
SHBindToObject
SHBindToParent
SHBrowseForFolder
SHBrowseForFolderA
SHBrowseForFolderW
SHCLSIDFromString
SHChangeNotification_Lock
SHChangeNotification_Unlock
SHChangeNotify
SHChangeNotifyDeregister
SHChangeNotifyRegister
SHChangeNotifyRegisterThread
SHChangeNotifySuspendResume
SHCloneSpecialIDList
SHCoCreateInstance
SHCoCreateInstanceWorker
SHCreateAssociationRegistration
SHCreateCategoryEnum
SHCreateDataObject
SHCreateDefaultContextMenu
SHCreateDefaultExtractIcon
SHCreateDefaultPropertiesOp
SHCreateDirectory
SHCreateDirectoryExA
SHCreateDirectoryExW
SHCreateDrvExtIcon
SHCreateFileExtractIconW
SHCreateItemFromIDList
SHCreateItemFromParsingName
SHCreateItemFromRelativeName
SHCreateItemInKnownFolder
SHCreateItemWithParent
SHCreateLocalServerRunDll
SHCreateProcessAsUserW
SHCreatePropSheetExtArray
SHCreateQueryCancelAutoPlayMoniker
SHCreateShellFolderView
SHCreateShellFolderViewEx
SHCreateShellItem
SHCreateShellItemArray
SHCreateShellItemArrayFromDataObject
SHCreateShellItemArrayFromIDLists
SHCreateShellItemArrayFromShellItem
SHCreateStdEnumFmtEtc
SHDefExtractIconA
SHDefExtractIconW
SHDestroyPropSheetExtArray
SHDoDragDrop
SHELL32_AddToBackIconTable
SHELL32_AddToFrontIconTable
SHELL32_AreAllItemsAvailable
SHELL32_CCommonPlacesFolder_CreateInstance
SHELL32_CDBurn_CloseSession
SHELL32_CDBurn_DriveSupportedForDataBurn
SHELL32_CDBurn_Erase
SHELL32_CDBurn_GetCDInfo
SHELL32_CDBurn_GetLiveFSDiscInfo
SHELL32_CDBurn_GetStagingPathOrNormalPath
SHELL32_CDBurn_GetTaskInfo
SHELL32_CDBurn_IsBlankDisc
SHELL32_CDBurn_IsBlankDisc2
SHELL32_CDBurn_IsLiveFS
SHELL32_CDBurn_OnDeviceChange
SHELL32_CDBurn_OnEject
SHELL32_CDBurn_OnMediaChange
SHELL32_CDefFolderMenu_Create2
SHELL32_CDefFolderMenu_Create2Ex
SHELL32_CDefFolderMenu_MergeMenu
SHELL32_CDrivesContextMenu_Create
SHELL32_CDrivesDropTarget_Create
SHELL32_CDrives_CreateSFVCB
SHELL32_CFSDropTarget_CreateInstance
SHELL32_CFSFolderCallback_Create
SHELL32_CFillPropertiesTask_CreateInstance
SHELL32_CLibraryDropTarget_CreateInstance
SHELL32_CLocationContextMenu_Create
SHELL32_CLocationFolderUI_CreateInstance
SHELL32_CMountPoint_DoAutorun
SHELL32_CMountPoint_DoAutorunPrompt
SHELL32_CMountPoint_IsAutoRunDriveAndEnabledByPolicy
SHELL32_CMountPoint_ProcessAutoRunFile
SHELL32_CMountPoint_WantAutorunUI
SHELL32_CMountPoint_WantAutorunUIGetReady
SHELL32_CNetFolderUI_CreateInstance
SHELL32_CPL_CategoryIdArrayFromVariant
SHELL32_CPL_IsLegacyCanonicalNameListedUnderKey
SHELL32_CPL_ModifyWowDisplayName
SHELL32_CRecentDocsContextMenu_CreateInstance
SHELL32_CTransferConfirmation_CreateInstance
SHELL32_CallFileCopyHooks
SHELL32_CanDisplayWin8CopyDialog
SHELL32_CloseAutoplayPrompt
SHELL32_CommandLineFromMsiDescriptor
SHELL32_CopySecondaryTiles
SHELL32_CreateConfirmationInterrupt
SHELL32_CreateConflictInterrupt
SHELL32_CreateDefaultOperationDataProvider
SHELL32_CreateFileFolderContextMenu
SHELL32_CreateLinkInfoW
SHELL32_CreateQosRecorder
SHELL32_CreateSharePointView
SHELL32_Create_IEnumUICommand
SHELL32_DestroyLinkInfo
SHELL32_EncryptDirectory
SHELL32_EncryptedFileKeyInfo
SHELL32_EnumCommonTasks
SHELL32_FreeEncryptedFileKeyInfo
SHELL32_GenerateAppID
SHELL32_GetAppIDRoot
SHELL32_GetCommandProviderForFolderType
SHELL32_GetDPIAdjustedLogicalSize
SHELL32_GetDiskCleanupPath
SHELL32_GetFileNameFromBrowse
SHELL32_GetIconOverlayManager
SHELL32_GetLinkInfoData
SHELL32_GetRatingBucket
SHELL32_GetSqmableFileName
SHELL32_GetThumbnailAdornerFromFactory
SHELL32_GetThumbnailAdornerFromFactory2
SHELL32_HandleUnrecognizedFileSystem
SHELL32_IconCacheCreate
SHELL32_IconCacheDestroy
SHELL32_IconCacheHandleAssociationChanged
SHELL32_IconCacheRestore
SHELL32_IconCache_AboutToExtractIcons
SHELL32_IconCache_DoneExtractingIcons
SHELL32_IconCache_ExpandEnvAndSearchPath
SHELL32_IconCache_RememberRecentlyExtractedIconsW
SHELL32_IconOverlayManagerInit
SHELL32_IsGetKeyboardLayoutPresent
SHELL32_IsSystemUpgradeInProgress
SHELL32_IsValidLinkInfo
SHELL32_LegacyEnumSpecialTasksByType
SHELL32_LegacyEnumTasks
SHELL32_LookupBackIconIndex
SHELL32_LookupFrontIconIndex
SHELL32_NormalizeRating
SHELL32_NotifyLinkTrackingServiceOfMove
SHELL32_PifMgr_CloseProperties
SHELL32_PifMgr_GetProperties
SHELL32_PifMgr_OpenProperties
SHELL32_PifMgr_SetProperties
SHELL32_Printers_CreateBindInfo
SHELL32_Printjob_GetPidl
SHELL32_PurgeSystemIcon
SHELL32_RefreshOverlayImages
SHELL32_ResolveLinkInfoW
SHELL32_SHAddSparseIcon
SHELL32_SHCreateByValueOperationInterrupt
SHELL32_SHCreateDefaultContextMenu
SHELL32_SHCreateLocalServer
SHELL32_SHCreateShellFolderView
SHELL32_SHDuplicateEncryptionInfoFile
SHELL32_SHEncryptFile
SHELL32_SHFormatDriveAsync
SHELL32_SHGetThreadUndoManager
SHELL32_SHGetUserNameW
SHELL32_SHIsVirtualDevice
SHELL32_SHLaunchPropSheet
SHELL32_SHLogILFromFSIL
SHELL32_SHOpenWithDialog
SHELL32_SHStartNetConnectionDialogW
SHELL32_SHUICommandFromGUID
SHELL32_SendToMenu_InvokeTargetedCommand
SHELL32_SendToMenu_VerifyTargetedCommand
SHELL32_ShowHideIconOnlyOnDesktop
SHELL32_SimpleRatingToFilterCondition
SHELL32_StampIconForFile
SHELL32_SuspendUndo
SHELL32_TryVirtualDiscImageDriveEject
SHELL32_VerifySaferTrust
SHEmptyRecycleBinA
SHEmptyRecycleBinW
SHEnableServiceObject
SHEnumerateUnreadMailAccountsW
SHEvaluateSystemCommandTemplate
SHExecuteErrorMessageBox
SHExtractIconsW
SHFileOperation
SHFileOperationA
SHFileOperationW
SHFindFiles
SHFind_InitMenuPopup
SHFlushSFCache
SHFormatDrive
SHFree
SHFreeNameMappings
SHGetAttributesFromDataObject
SHGetDataFromIDListA
SHGetDataFromIDListW
SHGetDesktopFolder
SHGetDiskFreeSpaceA
SHGetDiskFreeSpaceExA
SHGetDiskFreeSpaceExW
SHGetDriveMedia
SHGetFileInfo
SHGetFileInfoA
SHGetFileInfoW
SHGetFolderLocation
SHGetFolderPathA
SHGetFolderPathAndSubDirA
SHGetFolderPathAndSubDirW
SHGetFolderPathEx
SHGetFolderPathW
SHGetIDListFromObject
SHGetIconOverlayIndexA
SHGetIconOverlayIndexW
SHGetImageList
SHGetInstanceExplorer
SHGetItemFromDataObject
SHGetItemFromObject
SHGetKnownFolderIDList
SHGetKnownFolderItem
SHGetKnownFolderPath
SHGetLocalizedName
SHGetMalloc
SHGetNameFromIDList
SHGetNewLinkInfo
SHGetNewLinkInfoA
SHGetNewLinkInfoW
SHGetPathFromIDList
SHGetPathFromIDListA
SHGetPathFromIDListEx
SHGetPathFromIDListW
SHGetPropertyStoreForWindow
SHGetPropertyStoreFromIDList
SHGetPropertyStoreFromParsingName
SHGetRealIDL
SHGetSetFolderCustomSettings
SHGetSetSettings
SHGetSettings
SHGetSpecialFolderLocation
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
SHGetStockIconInfo
SHGetTemporaryPropertyForItem
SHGetUnreadMailCountW
SHHandleUpdateImage
SHHelpShortcuts_RunDLL
SHHelpShortcuts_RunDLLA
SHHelpShortcuts_RunDLLW
SHILCreateFromPath
SHInvokePrinterCommandA
SHInvokePrinterCommandW
SHIsFileAvailableOffline
SHLimitInputEdit
SHLoadInProc
SHLoadNonloadedIconOverlayIdentifiers
SHMapPIDLToSystemImageListIndex
SHMultiFileProperties
SHObjectProperties
SHOpenFolderAndSelectItems
SHOpenOrGetFolderView
SHOpenPropSheetW
SHOpenWithDialog
SHParseDisplayName
SHPathPrepareForWriteA
SHPathPrepareForWriteW
SHPropStgCreate
SHPropStgReadMultiple
SHPropStgWriteMultiple
SHQueryRecycleBinA
SHQueryRecycleBinW
SHQueryUserNotificationState
SHRemoveLocalizedName
SHReplaceFromPropSheetExtArray
SHResolveLibrary
SHRestricted
SHSetDefaultProperties
SHSetFolderPathA
SHSetFolderPathW
SHSetInstanceExplorer
SHSetKnownFolderPath
SHSetLocalizedName
SHSetTemporaryPropertyForItem
SHSetUnreadMailCountW
SHShellFolderView_Message
SHShowManageLibraryUI
SHSimpleIDListFromPath
SHStartNetConnectionDialogW
SHTestTokenMembership
SHUpdateImageA
SHUpdateImageW
SHUpdateRecycleBinIcon
SHValidateUNC
SetCurrentProcessExplicitAppUserModelID
SheChangeDirA
SheChangeDirExW
SheGetDirA
SheSetCurDrive
ShellAboutA
ShellAboutW
ShellExec_RunDLL
ShellExec_RunDLLA
ShellExec_RunDLLW
ShellExecuteA
ShellExecuteEx
ShellExecuteExA
ShellExecuteExW
ShellExecuteW
ShellHookProc
ShellMessageBoxA
ShellMessageBoxW
Shell_GetCachedImageIndex
Shell_GetCachedImageIndexA
Shell_GetCachedImageIndexW
Shell_GetImageLists
Shell_MergeMenus
Shell_NotifyIcon
Shell_NotifyIconA
Shell_NotifyIconGetRect
Shell_NotifyIconW
SignalFileOpen
StateRepoNewMenuCache_EnsureCacheAsync
StateRepoNewMenuCache_RebuildCacheAsync
StgMakeUniqueName
StrChrA
StrChrIA
StrChrIW
StrChrW
StrCmpNA
StrCmpNIA
StrCmpNIW
StrCmpNW
StrNCmpA
StrNCmpIA
StrNCmpIW
StrNCmpW
StrRChrA
StrRChrIA
StrRChrIW
StrRChrW
StrRStrA
StrRStrIA
StrRStrIW
StrRStrW
StrStrA
StrStrIA
StrStrIW
StrStrW
UsersLibrariesFolderUI_CreateInstance
WOWShellExecute
WaitForExplorerRestartW
Win32DeleteFile
WriteCabinetState

Sections

.text
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 308KB - Virtual size: 305KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

20ef7206ba7177d53738a37d38827ca5

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

91:60:a8:65:b6:f0:61:1e:55:37:f3:20:46:8e:54:cc:8e:95:a0:08:ec:0c:3f:2e:54:36:38:9d:02:3b:35:a6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-string-l2-1-1

api-ms-win-core-registry-l1-1-1

api-ms-win-core-file-l2-1-2

api-ms-win-core-file-l1-2-1

api-ms-win-core-file-l1-2-4

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-wow64-l1-1-1

api-ms-win-core-localization-l1-2-2

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-realtime-l1-1-0

api-ms-win-core-localization-l2-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-core-sysinfo-l1-2-3

api-ms-win-core-memory-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-stringansi-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

91:60:a8:65:b6:f0:61:1e:55:37:f3:20:46:8e:54:cc:8e:95:a0:08:ec:0c:3f:2e:54:36:38:9d:02:3b:35:a6
Signer

.text
Size: 6.6MB - Virtual size: 6.6MB

.rdata
Size: 1.4MB - Virtual size: 1.4MB

.data
Size: 12KB - Virtual size: 40KB

.pdata
Size: 308KB - Virtual size: 305KB

.didat
Size: 16KB - Virtual size: 12KB

.rsrc
Size: 36KB - Virtual size: 33KB

.reloc
Size: 76KB - Virtual size: 75KB